HIVE-2199: Improve isControlledByMachinePool robustness

[huangmingxia]

Require HiveManagedLabel for prefix-based matching to prevent false positives where MachineSets match the naming prefix but aren't actually managed by Hive. This ensures only MachineSets under Hive management are identified as controlled, preventing unexpected deletion of externally managed resources.

[openshift-ci-robot]

@huangmingxia: This pull request references HIVE-2199 which is a valid jira issue.

Details

In response to this:

Require HiveManagedLabel for prefix-based matching to prevent false positives where MachineSets match the naming prefix but aren't actually managed by Hive. This ensures only MachineSets under Hive management are identified as controlled, preventing unexpected deletion of externally managed resources.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: huangmingxia
Once this PR has been reviewed and has the lgtm label, please assign dlom for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[huangmingxia]

/hold

[openshift-ci]

@huangmingxia: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.40%. Comparing base (b061ef0) to head (9f75647).
⚠️ Report is 6 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2822   +/-   ##
=======================================
  Coverage   50.39%   50.40%           
=======================================
  Files         279      279           
  Lines       34190    34194    +4     
=======================================
+ Hits        17231    17235    +4     
  Misses      15595    15595           
  Partials     1364     1364           

Files with missing lines	Coverage Δ
...g/controller/machinepool/machinepool_controller.go	63.57% <100.00%> (+0.16%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[2uasimojo]

I like it.

[2uasimojo]

I think we should also have a branch that short circuits false if the label exists but doesn't match. That would cover the "prefix scenario" -- where one pool's spec.name is the prefix of another's, like worker and worker2. (I've seen this happen in the field, and I think it was the impetus for the card.)