refactor(janitor): drop the Node watch + field indexer + predicate

The Node watch existed to self-heal during apply (if a Node update
landed mid-apply we'd re-enqueue and try again) and to detect drift on
released nodes. Both reasons are gone:

* The apply path is one-shot under the node-level lock — we either
  succeed and transition Released=True, or the API call propagates an
  error and controller-runtime requeues. There's no "we needed another
  watch fire to make progress" case.

* Post-release, the external system owns the Node's release state.
  ADR-040 is explicit that we do NOT re-take ownership if the external
  system strips the taint, and we no longer treat drift as terminal,
  so re-enqueueing on Node updates is a no-op.

The watch was firing on every Node taint/label change just to land in
the dispatcher's no-op branch. Net negative: pointless reconcile churn,
40 lines of mapper/predicate/indexer plumbing, an extra RBAC scope
implication.

Removed:
* `Watches(&corev1.Node{}, ...)` from SetupWithManager
* `mapNodeToExtRRs`, `nodeReleaseStateChangedPredicate`,
  `indexExtRRByNodeName`, `extrrNodeNameIndexKey`
* The field-indexer registration + `mgr.GetFieldIndexer()` call
* `externalremediationrequest_setup_test.go` (the dedicated test file
  for the indexer/predicate/mapper)
* Unused imports: `builder`, `handler`, `predicate`, `event`

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jtschelling

janitor/pkg/controller/externalremediationrequest_controller.go

@@ -29,12 +29,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/event"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	"github.com/nvidia/nvsentinel/commons/pkg/managed"
 	"github.com/nvidia/nvsentinel/commons/pkg/tracing"
@@ -70,8 +66,6 @@ const (
 	// in the ReleaseTaintRemoved event message.
 	closeReasonExternalRemediationCompleteTrue = "ExternalRemediationCompleteTrue"
 	closeReasonOperatorInitiated               = "OperatorInitiated"
-
-	extrrNodeNameIndexKey = "spec.healthEvent.nodeName"
 )
 
 // ExternalRemediationRequestReconciler implements the ADR-040 state machine.
@@ -613,8 +607,6 @@ func (r *ExternalRemediationRequestReconciler) patchStatusConditions(
 	return true, nil
 }
 
-// SetupWithManager wires the controller, the Node watch that re-enqueues on
-// taint/label drift, and the field indexer on spec.healthEvent.nodeName.
 func (r *ExternalRemediationRequestReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	if r.Recorder == nil {
 		// nolint:staticcheck // SA1019: project-wide events.k8s.io migration pending.
@@ -625,101 +617,8 @@ func (r *ExternalRemediationRequestReconciler) SetupWithManager(mgr ctrl.Manager
 		r.NodeLock = distributedlock.NewNodeLock(mgr.GetClient(), r.LockNamespace)
 	}
 
-	if err := mgr.GetFieldIndexer().IndexField(
-		context.Background(),
-		&nvsentinelv1.ExternalRemediationRequest{},
-		extrrNodeNameIndexKey,
-		indexExtRRByNodeName,
-	); err != nil {
-		return fmt.Errorf("registering ExtRR node-name field indexer: %w", err)
-	}
-
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&nvsentinelv1.ExternalRemediationRequest{}).
-		Watches(
-			&corev1.Node{},
-			handler.EnqueueRequestsFromMapFunc(r.mapNodeToExtRRs),
-			builder.WithPredicates(nodeReleaseStateChangedPredicate()),
-		).
 		Named("externalremediationrequest").
 		Complete(r)
 }
-
-// indexExtRRByNodeName returns nil for malformed ExtRRs so a webhook bypass
-// can't crash the indexer.
-func indexExtRRByNodeName(o client.Object) []string {
-	extrr, ok := o.(*nvsentinelv1.ExternalRemediationRequest)
-	if !ok || extrr.Spec == nil || extrr.Spec.HealthEvent == nil || extrr.Spec.HealthEvent.NodeName == "" {
-		return nil
-	}
-
-	return []string{extrr.Spec.HealthEvent.NodeName}
-}
-
-// nodeReleaseStateChangedPredicate drops Node updates outside the release
-// surface (managed label + release taint), so kubelet heartbeats don't
-// re-enqueue every ExtRR on every sync.
-func nodeReleaseStateChangedPredicate() predicate.Predicate {
-	return predicate.Funcs{
-		CreateFunc:  func(_ event.CreateEvent) bool { return true },
-		DeleteFunc:  func(_ event.DeleteEvent) bool { return true },
-		GenericFunc: func(_ event.GenericEvent) bool { return true },
-		UpdateFunc: func(e event.UpdateEvent) bool {
-			oldNode, ok := e.ObjectOld.(*corev1.Node)
-			if !ok {
-				return false
-			}
-
-			newNode, ok := e.ObjectNew.(*corev1.Node)
-			if !ok {
-				return false
-			}
-
-			if oldNode.Labels[managed.ManagedLabelKey] != newNode.Labels[managed.ManagedLabelKey] {
-				return true
-			}
-
-			oldTaint := findTaintByKey(oldNode.Spec.Taints, ReleaseTaintKey)
-			newTaint := findTaintByKey(newNode.Spec.Taints, ReleaseTaintKey)
-
-			if (oldTaint == nil) != (newTaint == nil) {
-				return true
-			}
-
-			if oldTaint != nil && newTaint != nil && oldTaint.Value != newTaint.Value {
-				return true
-			}
-
-			return false
-		},
-	}
-}
-
-// mapNodeToExtRRs uses the field indexer so each lookup is bounded by the
-// ExtRRs targeting this Node, not the total ExtRR population.
-func (r *ExternalRemediationRequestReconciler) mapNodeToExtRRs(ctx context.Context, obj client.Object) []ctrl.Request {
-	node, ok := obj.(*corev1.Node)
-	if !ok {
-		return nil
-	}
-
-	var extrrs nvsentinelv1.ExternalRemediationRequestList
-	if err := r.List(ctx, &extrrs, client.MatchingFields{extrrNodeNameIndexKey: node.Name}); err != nil {
-		slog.ErrorContext(ctx, "listing ExternalRemediationRequests by node-name index",
-			"node", node.Name, "error", err)
-
-		return nil
-	}
-
-	requests := make([]ctrl.Request, 0, len(extrrs.Items))
-	for i := range extrrs.Items {
-		requests = append(requests, ctrl.Request{
-			NamespacedName: client.ObjectKey{
-				Name:      extrrs.Items[i].Name,
-				Namespace: extrrs.Items[i].Namespace,
-			},
-		})
-	}
-
-	return requests
-}