fix: requeue with a fixed delay on stale ServiceAccount cache

Addresses review feedback on the stale-cache handling: relying on the
`Owns(ServiceAccount)` watch to requeue is not guaranteed, because a
ServiceAccount with the deterministic name that is owned by another
controller will never be mapped back to this Workspace. Requeue with a
small fixed `RequeueAfter` instead: a stale cache is common and is not
write contention, so no exponential backoff is needed.

Assisted-by: Qwen3.8-27B
Signed-off-by: Christian Heusel <christian@heusel.eu>

Author: christian-heusel

workspaces/controller/internal/controller/workspace_controller.go

@@ -63,6 +63,10 @@ const (
 	// pod template constants
 	workspacePodTemplateContainerName = "main"
 
+	// requeue delay when the local cache is known to be stale (fixed delay, since a stale cache
+	// is not write contention, so no exponential backoff is needed)
+	requeueAfterStaleCache = 2 * time.Second
+
 	// lengths for resource names
 	generateNameSuffixLength    = 6
 	nameHashLength              = 8
@@ -292,9 +296,10 @@ func (r *WorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 				existingServiceAccount := &corev1.ServiceAccount{}
 				if getErr := r.Get(ctx, client.ObjectKeyFromObject(serviceAccount), existingServiceAccount); getErr != nil {
 					if apierrors.IsNotFound(getErr) {
-						// the cache is stale, the watch on owned ServiceAccounts will requeue us
-						log.V(2).Info("ServiceAccount already exists but is not in the cache yet, relying on the owned-object watch to requeue")
-						return ctrl.Result{}, nil
+						// the cache is stale; requeue after a short delay instead of relying on the
+						// owned-object watch, which will not fire if the ServiceAccount is owned by another controller
+						log.V(2).Info("ServiceAccount already exists but is not in the cache yet, will requeue")
+						return ctrl.Result{RequeueAfter: requeueAfterStaleCache}, nil
 					}
 					log.Error(getErr, "unable to get existing ServiceAccount")
 					return ctrl.Result{}, getErr
@@ -306,8 +311,9 @@ func (r *WorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 						fmt.Sprintf(stateMsgErrorServiceAccountNotOwned, existingServiceAccount.Name),
 					)
 				}
-				// the cache is stale, the watch on owned ServiceAccounts will requeue us
-				return ctrl.Result{}, nil
+				// the cache is stale (the owner index did not return the ServiceAccount), requeue after
+				// a short delay so we pick it up once the cache catches up
+				return ctrl.Result{RequeueAfter: requeueAfterStaleCache}, nil
 			}
 			log.Error(err, "unable to create ServiceAccount")
 			return ctrl.Result{}, err