device-plugin: gate Enabled label on SriovNetworkNodeState sync status

[beccccaboo]

Problem

When a new node joins the cluster, the sriov-device-plugin pod can start before sriov-network-config-daemon finishes configuring VFs. The device plugin scans once at startup, finds 0 VFs, and never picks them up later — leaving the node without SR-IOV resources until the pod is manually restarted.

Solution

The device plugin DaemonSet uses nodeSelector: { sriovnetwork.openshift.io/device-plugin: Enabled } and only schedules on nodes with this label. The operator's SriovNetworkNodePolicyReconciler is exclusively responsible for setting this label.

This PR delays setting the label to Enabled until SriovNetworkNodeState.Status.SyncStatus == "Succeeded", ensuring the device plugin pod cannot start until VFs are fully configured.

A NodeStateSyncStatusPredicate watch on SriovNetworkNodeState triggers reconciliation as soon as the config daemon transitions to Succeeded, so the label is applied promptly.

Behaviour

Scenario	SyncStatus	Current label	Result
New node, first sync	"" / "InProgress"	(none)	→ Disabled; device plugin not scheduled
Config daemon finishes	"Succeeded"	Disabled	Reconciler re-triggers → Enabled; device plugin starts, finds VFs
Node reconfiguring	"InProgress"	Enabled	Label preserved; running device plugin not evicted
Already-configured node	"Succeeded"	Enabled	No change

Changes

• controllers/sriovnetworknodepolicy_controller.go: fetch SriovNetworkNodeState before labeling; only set Enabled when SyncStatus == Succeeded (or already Enabled). Add SriovNetworkNodeState watch with NodeStateSyncStatusPredicate.
• controllers/helper.go: add NodeStateSyncStatusPredicate that fires only when SyncStatus changes.

🤖 Generated with Claude Code

[github-actions]

Thanks for your PR,
To run vendors CIs, Maintainers can use one of:

• /test-all: To run all tests for all vendors.
• /test-e2e-all: To run all E2E tests for all vendors.
• /test-e2e-nvidia-all: To run all E2E tests for NVIDIA vendor.

To skip the vendors CIs, Maintainers can use one of:

• /skip-all: To skip all tests for all vendors.
• /skip-e2e-all: To skip all E2E tests for all vendors.
• /skip-e2e-nvidia-all: To skip all E2E tests for NVIDIA vendor.
  Best regards.

[Yarosh]

Overall this change looks good (see 1 comment I left) - I would:

1. Test it in tcloud staging, with a full test- i.e.: scale down operator, delete sriovnetworknodestate, remove label from a node, scale operator back up and see it reconcile properly. Then roll this out to prod substrates
2. Worth adding tests to this scenario - there are quite a few tests in this repo. Pretty sure there's a test for this device-plugin code that you can tweak

[Yarosh]

could we move the check for currentLabel == constants.SriovDevicePluginLabelEnabled here, and just skip making any changes if already enabled?
You can short-circuit, and spare the etcd lookup for sriovnetworknodestate - saving some load on k8s api-server and etcd.

[beccccaboo]

Good call. Implemented in 3f5b824

[lbogdan-together]

When sriov-network-config-daemon finishes configuring all interfaces, it restarts sriov-device-plugin, so I'm not sure what this PR is supposed to solve.

sriov-network-operator/pkg/daemon/daemon.go

Lines 525 to 530 in 1fb8405

	// restart device plugin pod
	log.Log.Info("nodeStateSyncHandler(): restart device plugin pod")
	if err := dn.restartDevicePluginPod(); err != nil {
	log.Log.Error(err, "nodeStateSyncHandler(): fail to restart device plugin pod")
	return err
	}