Improve uniqueness of ClusterControlPlane Id and name

[Atish-iaf]

nsx-operator uses the following name pattern when generating cluster-control-plane names.
fmt.Sprintf("%s-%s-%s", s.NSXConfig.CoeConfig.Cluster, namespace, name)
"-" as delimiter when generating cluster-control-plane names results in following two different namespaces and clusters to have the same name

1. namespace: xx, cluster: yy-zz, result: xx-yy-zz
2. namespace: xx-yy, cluster: zz, result: xx-yy-zz

Use _ instead of - as delimiter when generating cluster-control-plane names because
K8s doesn't allow namespace and name to include underscore _.

Do not change existing NSXServiceAccount cluster-control-plane Id and name.
This new name pattern should only apply to new NSXServiceAccount CRs created after this new name pattern is enabled in nsx-operator.

Delete PrincipalIdentity and ClusterControlPlane node by NSXServiceAccount UID.

Test summary
Doesn't change status.clusterName in existing NSXServiceAccount CR

apiVersion: nsx.vmware.com/v1alpha1
kind: NSXServiceAccount
metadata:
  creationTimestamp: "2026-03-26T05:05:19Z"
  finalizers:
  - nsxserviceaccount.nsx.vmware.com/finalizer
  generation: 1
  name: cluster-default-antrea
  namespace: antrea-test
  ownerReferences:
  - apiVersion: cluster.x-k8s.io/v1beta2
    kind: Cluster
    name: cluster-default
    uid: ab0ab128-df31-4e77-bbe0-23a73215d571
  resourceVersion: "11427886"
  uid: fa0c7a30-192e-4830-a61f-f86d9ae39fdd
spec: {}
status:
  clusterID: 303a3ee7-d500-4d80-99a3-899e74413651
  clusterName: 65106a70-649c-49c7-a891-32fad66b9e84-antrea-test-cluster-default-antrea
  conditions:
  - lastTransitionTime: "2026-03-26T05:05:18Z"
    message: Success.
    observedGeneration: 1
    reason: RealizationSuccess
    status: "True"
    type: Realized
  nsxManagers:
  - 10.162.160.211:443
  phase: realized
  proxyEndpoints:
    addresses:
    - ip: 192.168.0.10
    ports:
    - name: rest-api
      port: 10091
      protocol: TCP
    - name: nsx-rpc-fwd-proxy
      port: 10092
      protocol: TCP
  reason: Success
  secrets:
  - name: cluster-default-antrea-nsx-cert
    namespace: antrea-test
  vpcPath: /orgs/default/projects/65106a70-649c-49c7-a891-32fad66b9e84/vpcs/antrea-test-default-vpc

For new NSXServiceAccount CR, it uses the new pattern _ to join namespace and name instead of - when generating clusterName so that it is unique.

apiVersion: nsx.vmware.com/v1alpha1
kind: NSXServiceAccount
metadata:
  creationTimestamp: "2026-03-26T05:11:42Z"
  finalizers:
  - nsxserviceaccount.nsx.vmware.com/finalizer
  generation: 1
  name: test-cluster-default-antrea
  namespace: antrea
  ownerReferences:
  - apiVersion: cluster.x-k8s.io/v1beta2
    kind: Cluster
    name: test-cluster-default
    uid: 9f3f1cfe-2c30-4d76-9a52-2dc28efc49ed
  resourceVersion: "11432691"
  uid: ca4792ad-2225-449d-8416-a88e127fe3e6
spec: {}
status:
  clusterID: 989ebfc2-0455-42f3-bcff-6b38eb7ebef4
  clusterName: 65106a70-649c-49c7-a891-32fad66b9e84_antrea_test-cluster-default-antrea
  conditions:
  - lastTransitionTime: "2026-03-26T05:11:43Z"
    message: Success.
    observedGeneration: 1
    reason: RealizationSuccess
    status: "True"
    type: Realized
  nsxManagers:
  - 10.162.160.211:443
  phase: realized
  proxyEndpoints:
    addresses:
    - ip: 192.168.0.10
    ports:
    - name: rest-api
      port: 10091
      protocol: TCP
    - name: nsx-rpc-fwd-proxy
      port: 10092
      protocol: TCP
  reason: Success
  secrets:
  - name: test-cluster-default-antrea-nsx-cert
    namespace: antrea
  vpcPath: /orgs/default/projects/65106a70-649c-49c7-a891-32fad66b9e84/vpcs/antrea-default-vpc

[zhengxiexie]

Can one of the admins verify this patch?

[codecov-commenter]

Codecov Report

❌ Patch coverage is 90.24390% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.80%. Comparing base (5434566) to head (43c5956).

Files with missing lines	Patch %	Lines
pkg/nsx/services/nsxserviceaccount/cluster.go	90.24%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1386      +/-   ##
==========================================
+ Coverage   76.75%   76.80%   +0.04%     
==========================================
  Files         151      151              
  Lines       21319    21335      +16     
==========================================
+ Hits        16364    16386      +22     
+ Misses       3785     3780       -5     
+ Partials     1170     1169       -1     

Flag	Coverage Δ
unit-tests	76.80% <90.24%> (+0.04%)	⬆️

Files with missing lines	Coverage Δ
pkg/nsx/services/nsxserviceaccount/cluster.go	82.55% <90.24%> (+1.93%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Atish-iaf]

Hi @edwardbadboy @liu4480
Could you please help to review this patch ?
Thanks!

[edwardbadboy]

There is a typo in PR title and commit message title: ClusterClontrolPlane -> ClusterControlPlane

[edwardbadboy]

When DeleteNSXServiceAccount is called by the garbageCollector, the namespace and name can be parsed from a cluster-control-plane/SV-NS-ClusterName resource (from its tags), and there is no corresponding K8s NSXSA resource. When getClusterName is called with getClusterName("", "NS", "ClusterName"), it will return SV_NS_ClusterName which doesn't match the existing CCPN ID SV-NS-ClusterName.

Need to think of how to solve this corner case.

[Atish-iaf]

Thanks, updated to delete CCP and PI by getting CCP and PI from store using NSXSA uid.