refactor: extract shared reconciliation logic into pkg/reconcile

[aslakknutsen]

What type of PR is this?

• Refactor

What this PR does / why we need it:

Move validation, Helm installation, and image digest logic from individual controllers into a shared pkg/reconcile package. This enables code reuse between operator controllers and (future) the install library, ensuring the same code path is used regardless of deployment mode.

Changes:

• Add pkg/reconcile with IstiodReconciler, CNIReconciler, ZTunnelReconciler
• Each reconciler provides ValidateSpec(), Validate(), Install(), Uninstall()
• Export ApplyCNIImageDigests() and ApplyZTunnelImageDigests() for reuse
• Refactor IstioRevision, IstioCNI, ZTunnel controllers to delegate to shared reconcilers
• Update controller tests to use shared reconcilers

Design decisions:

• Two-tier validation: ValidateSpec() for basic checks, Validate() for K8s API checks (supports library usage without K8s client)
• Controller-agnostic error messages (e.g., "version not set" instead of "spec.version not set")

Which issue(s) this PR fixes:

Additional information:

Co-authored-by: Cursor noreply@cursor.com

[istio-testing]

Hi @aslakknutsen. Thanks for your PR.

I'm waiting for a istio-ecosystem or istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

❌ Patch coverage is 84.67742% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.70%. Comparing base (fe94427) to head (c51614a).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/reconcile/cni.go	77.77%	7 Missing and 7 partials ⚠️
pkg/reconcile/ztunnel.go	78.46%	7 Missing and 7 partials ⚠️
pkg/reconcile/istiod.go	85.45%	4 Missing and 4 partials ⚠️
...trollers/istiorevision/istiorevision_controller.go	97.14%	0 Missing and 1 partial ⚠️
controllers/ztunnel/ztunnel_controller.go	92.85%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1572      +/-   ##
==========================================
+ Coverage   71.09%   80.70%   +9.61%     
==========================================
  Files          40       50      +10     
  Lines        2072     2441     +369     
==========================================
+ Hits         1473     1970     +497     
+ Misses        430      347      -83     
+ Partials      169      124      -45     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nrfox]

/ok-to-test

[nrfox]

Do these need to be exported? I don't see them currently used outside this package but maybe it's intended for users of the library to consume these?

[aslakknutsen]

GetChartPath is used across all reconcilers and from the Library install package(downstream), so moved to common.go(types.go).
GetReleaseName is only used in istiod so unexported.

10cdd85