AGENT-1488: Aggregate IRI status from MachineConfigNodes

cmd/machine-config-controller/start.go

@@ -143,6 +143,9 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 				ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigs(),
 				ctrlctx.ConfigInformerFactory.Config().V1().ClusterVersions(),
 				ctrlctx.KubeInformerFactory.Core().V1().Secrets(),
+				ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigNodes(),
+				ctrlctx.KubeInformerFactory.Core().V1().Nodes(),
+				ctrlctx.ConfigInformerFactory.Config().V1().Infrastructures(),
 				ctrlctx.ClientBuilder.KubeClientOrDie("internalreleaseimage-controller"),
 				ctrlctx.ClientBuilder.MachineConfigClientOrDie("internalreleaseimage-controller"))
 

manifests/machineconfigcontroller/internalreleaseimage-deletion-guard-validatingadmissionpolicy.yaml

@@ -18,5 +18,6 @@ spec:
       resources:   ["internalreleaseimages"]
       scope: "*"
   validations:
-    - expression: "!oldObject.status.releases.exists(r, has(r.image) && r.image == params.status.desired.image)"
+    - expression: "!oldObject.status.releases.exists(r, has(r.image) && r.image.split('@')[1] == params.status.desired.image.split('@')[1])"
       message: "Cannot delete InternalReleaseImage while the cluster is using a release bundle from this resource. The current cluster release image matches a release stored in this InternalReleaseImage. Please upgrade or downgrade to a different release before deletion."
+      reason: Invalid

pkg/controller/internalreleaseimage/.claude/skills/iri-controller/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: iri-controller
+description: The InternalReleaseImage controller manages the IRI resource lifecycle, generates MachineConfigs for the IRI registry, updates status by aggregating from MachineConfigNodes, and handles deletion. Use when reviewing controller implementation or validating behaviors.
+disable-model-invocation: true
+allowed-tools: Read Grep
+---
+
+# Verify InternalReleaseImage Controller Implementation
+
+Verify that the InternalReleaseImage (IRI) controller implementation correctly handles all acceptance criteria defined in test scenarios.
+
+## IRI Aggregation Behavior
+
+Verify that the IRI aggregation implementation correctly handles all acceptance criteria defined in the CSV test scenarios.
+
+### Scenarios to Verify
+
+See [testdata/acceptance/README.md](../../testdata/acceptance/README.md) for complete scenario descriptions.
+
+The skill verifies the implementation matches these acceptance criteria by checking code paths, status constants, condition handling, and message formatting.
+
+### Verification Steps
+
+For each scenario:
+
+1. **Read the CSV file** to understand the expected behavior
+2. **Search aggregation.go** for the relevant code paths:
+   - `aggregateMCNIRIStatus()` - main aggregation function
+   - `checkAPIIntRegistryAvailability()` - api-int health check
+   - `processMCNReleases()` - MCN status processing
+   - `buildAggregatedReleases()` - final status construction
+3. **Verify status constants** match CSV expectations:
+   - `IRIStatusAllReleasesAvailable`
+   - `IRIStatusAPIIntNotAvailable`
+   - `IRIStatusSomeNodesNotAvailable`
+   - `IRIStatusSomeRegistriesUnavailable`
+4. **Check condition handling** in `updateDegradedCondition()`
+5. **Verify message formatting** includes node lists in brackets with commas
+
+### Code Locations to Check
+
+Primary implementation:
+- `pkg/controller/internalreleaseimage/aggregation.go`
+- `pkg/controller/internalreleaseimage/internalreleaseimage_controller.go`
+
+Event handlers that trigger aggregation:
+- `updateMachineConfigNode()` - watches for MCN status changes
+- `updateNode()` - watches for node Ready condition changes
+
+### Report Format
+
+For each scenario, report:
+- ✅ **PASS**: Code correctly implements the scenario
+- ⚠️  **PARTIAL**: Code partially implements but missing details
+- ❌ **FAIL**: Code does not match expected behavior
+- 📝 **Notes**: Any observations or edge cases
+
+Include:
+- Which code section handles the scenario
+- How the expected status/reason/message is generated
+- Any gaps or improvements needed
+
+### Example Verification
+
+For "happy-path.csv":
+1. Read the CSV expectations
+2. Verify `IRIStatusAllReleasesAvailable` is returned when:
+   - All MCNs have `InternalReleaseImageDegraded=False`
+   - api-int registry ping succeeds
+   - All nodes are ready
+3. Confirm message: "All the release images are available"
+4. Check that releases use api-int URL format