Add checks for not topology owned templates to never reconcile.

internal/controllers/topology/cluster/current_state.go

@@ -158,6 +158,12 @@ func (r *Reconciler) getCurrentMachineDeploymentState(ctx context.Context, clust
 	for i := range md.Items {
 		m := &md.Items[i]
 
+		// check that the MachineDeployment has the ClusterTopologyOwnedLabel label.
+		// Nb. This is to make sure that a managed topology cluster does not have a reference to an object that is not
+		// owned by the topology.
+		if !labels.IsTopologyOwned(m) {
+			return nil, fmt.Errorf(" %s is not topology owned", tlog.KObj{Obj: m})
+		}
 		// Retrieve the name which is assigned in Cluster's topology
 		// from a well-defined label.
 		mdTopologyName, ok := m.ObjectMeta.Labels[clusterv1.ClusterTopologyMachineDeploymentLabelName]

internal/controllers/topology/cluster/current_state_test.go

@@ -97,6 +97,14 @@ func TestGetCurrentState(t *testing.T) {
 		WithInfrastructureTemplate(machineDeploymentInfrastructure).
 		Build()
 
+	machineDeploymentNotTopologyOwned := builder.MachineDeployment(metav1.NamespaceDefault, "md1").
+		WithLabels(map[string]string{
+			clusterv1.ClusterLabelName: "cluster1",
+		}).
+		WithBootstrapTemplate(machineDeploymentBootstrap).
+		WithInfrastructureTemplate(machineDeploymentInfrastructure).
+		Build()
+
 	// MachineHealthChecks for the MachineDeployment and the ControlPlane.
 	machineHealthCheckForMachineDeployment := builder.MachineHealthCheck(machineDeployment.Namespace, machineDeployment.Name).
 		WithSelector(*selectorForMachineDeploymentMHC(machineDeployment)).
@@ -380,6 +388,18 @@ func TestGetCurrentState(t *testing.T) {
 			// Expect error to be thrown as no managed MachineDeployment is reconcilable unless it has a ClusterTopologyMachineDeploymentLabelName.
 			wantErr: true,
 		},
+		{
+			name: "Fails if there are MachineDeployments without the topology.cluster.x-k8s.io/owned",
+			cluster: builder.Cluster(metav1.NamespaceDefault, "cluster1").
+				Build(),
+			class: clusterClassWithControlPlaneInfra,
+			objects: []client.Object{
+				clusterClassWithControlPlaneInfra,
+				machineDeploymentNotTopologyOwned,
+			},
+			// Expect error to be thrown as no managed MachineDeployment is reconcilable unless it has a ClusterTopologyOwnedLabel.
+			wantErr: true,
+		},
 		{
 			name: "Fails if there are MachineDeployments with the same topology.cluster.x-k8s.io/deployment-name",
 			cluster: builder.Cluster(metav1.NamespaceDefault, "cluster1").