Async cs interaction from backend combined - #6121
Merged
openshift-merge-bot[bot] merged 17 commits intoJul 17, 2026
Merged
Conversation
openshift-ci
Bot
requested review from
David Eads (deads2k) and
Gerd Oberlechner (geoberle)
July 16, 2026 17:47
Collaborator
Author
|
/hold Not intended to merge, only opened to verify that the 4 PRs together work as expected |
Copilot started reviewing on behalf of
Manyanda Chitimbo (machi1990)
July 16, 2026 17:48
View session
Collaborator
Author
|
/assign David Eads (@deads2k) |
Cluster Service no longer returns synchronous 400s for platform uniqueness checks after async CS create migration. Move those checks to the frontend so invalid cluster PUTs fail at admission time with the same error messages CS used in performSpecValidation. These checks are best-effort and may not catch concurrent creates. - Prefetch subscription clusters and node pools in newClusterAdmissionContext - Add admitClusterManagedResourceGroupName, admitClusterSubnetResourceID, and admitClusterNetworkSecurityGroupResourceID (CREATE only) - Add NSG same-subscription and not-in-MRG rules to static validation (parity with validateAroHcpClusterNetworkSecurityGroupResourceId) Co-authored-by: Cursor <cursoragent@cursor.com>
Mirror CS validateAroHcpSwiftSubnetSameVnet: vnetIntegrationSubnetId must use the same VNet as subnetId. Co-authored-by: Cursor <cursoragent@cursor.com>
Mirror CS validateAzureOperatorsAuthenticationManagedIdentitiesUniqueWithinCluster across service, control-plane, and data-plane operator identities.
Align with CS validateAroHcpEtcdEncryptionDataEncryptionKeyManagementMode: only CustomerManaged is accepted until platform-managed etcd encryption is supported.
Stop calling PostCluster during HCP cluster create in the frontend. Persist the cluster and enqueue the ARM operation with an empty ClusterServiceID; the backend controller now owns CS provisioning. Remove frontend-only provision-shard and noop provision/deprovision flags.
…rontendCRUD Add an explicit setClusterServiceID step so frontend integration tests mirror deferred CS create (backend stamps the ID) without auto-mutating Cosmos in httpCreate. Parent CS IDs are stamped in artifact steps and Go helpers (StampRandomClusterServiceID); child IDs derive from the parent. - Random cluster HREFs by default, or fixed IDs via cluster-service-id.json - Seed the CS mock (loadClusterService) before cluster updates so GetCluster/UpdateCluster paths are exercised - Name setClusterServiceID step suffixes after the target resource - Stamp CS ID before completeOperation to match production ordering; update mid-suite cosmosCompare expectations (e.g. create-current instanceVersion) - BuildCSCluster/clusterCSVersionID now require ControlPlaneVersion .DesiredVersion on the ServiceProviderCluster, removing the old fallback to the customer-facing version on the HCP cluster document - Document child-create vs cluster-update patterns in claude.md Co-authored-by: Cursor <cursoragent@cursor.com>
Move Cluster Service interaction out of the frontend create path and hand it off to the backend's async externalauth creation controllers. External Auth create operations no longer set an InternalID as it is not needed anymore when using the new external auth creation approach in backend.
…Complete After external auth create moved to the backend, frontend integration tests no longer persist serviceProviderProperties.clusterServiceID on create. Update/delete paths still require it, so tests that only run the frontend would fail with "clusterServiceID is required". Add createExternalAuthAndComplete to the integrationutils test helper DeriveClusterServiceID, which is used by external auth cross-version roundtrip tests.
Stop calling Cluster Service synchronously from the frontend on cluster PUT/PATCH. Cluster configuration changes are now persisted to Cosmos and propagated to CS by the backend ClusterClusterServiceUpdateDispatch controller. - Remove UpdateCluster and UpdateClusterAutoscaler calls from updateHCPClusterInCosmos. The frontend only writes the cluster document and creates the update operation. - Create update operations with an empty internal ID instead of the CS cluster ID, since CS propagation is no longer tied to the frontend request path. - Add syncClusterClusterServiceUpdateDispatch integration test step to invoke the dispatch syncer directly against the CS mock.
Stop calling Cluster Service synchronously from the frontend on node pool PUT/PATCH. Node Pool configuration changes are now persisted to Cosmos and propagated to CS by the backend NodePoolClusterServiceUpdateDispatch controller. - Remove the UpdateNodePool call from updateNodePoolInCosmos. The frontend only writes the node pool document and creates the update operation. - Create update operations with an empty internal ID instead of the CS node pool ID, since CS propagation is no longer tied to the frontend request path.
Stop calling Cluster Service synchronously from the frontend on external auth PUT/PATCH. External Auth configuration changes are now persisted to Cosmos and propagated to CS by the backend ExternalAuthClusterServiceUpdateDispatch controller. - Remove UpdateExternalAuth call from updateExternalAuthInCosmos. The frontend only writes the external auth document and creates the update operation. - Create update operations with an empty internal ID instead of the CS external auth ID, since CS propagation is no longer tied to the frontend request path.
Now that Clusters Service calls have been moved to the RP backend, the frontend pods need only write to Cosmos DB before responding to client requests. This can be done atomically using Cosmos DB's Transactional Batch Operations and therefore the cloud-distributed locking pattern is no longer needed. The locking pattern was a bottleneck in high-traffic subscriptions and was the source of much latency in the Azure control plane.
Manyanda Chitimbo (machi1990)
force-pushed
the
async-cs-interaction-from-backend-combined
branch
from
July 17, 2026 08:59
4831ab0 to
57d9b7f
Compare
Copilot started reviewing on behalf of
Manyanda Chitimbo (machi1990)
July 17, 2026 08:59
View session
Copilot started reviewing on behalf of
Manyanda Chitimbo (machi1990)
July 17, 2026 09:41
View session
Collaborator
Author
|
/retest |
Collaborator
Author
|
/test e2e-parallel |
Collaborator
|
/hold cancel Current plan is to serially rollout production, so the rollout is good. Additionally, the following states will result if we skew
At any point, we can safely downgrade to the previous deployed level. I'm going to merge this as our best option. If it breaks, first downgrade. Then get me on slack and point it out for us to debug. /lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, machi1990 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
7 tasks
12 tasks
This was referenced Jul 21, 2026
This was referenced Jul 21, 2026
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Async cs interaction from backend combined
Why
Contains the change of:
#6041 externalauth create enablement. Depends on phase1 PR c439110 (Wed Jul 8 04:04:35 2026)
#6082 cluster create enablement. Depends on phase1 PR 50e62e1 (Wed Jul 8 20:52:35 2026 +0000)
#6067 updates for all resources enablement. Depends on phase1 PR eea2b31 (Tue Jul 14 05:39:21 2026 +0000)
#5538 subscription lock removal from frontend. Depends on all the three above being rolled out to prod
PRs that we want to run e2e test together and verify that they actually works combined.
Testing
Testing is required for feature completion and tests should be part of the pull
request along with the feature changes.
Describe the testing provided. If you did not add tests, provide a clear
justification.
Special notes for your reviewer
This is not intended for merge but to verify the PRs together things works as expected
PR Checklist
If E2E tests are included:
demonstrate that the test is able to detect a defect/error and fail with
proper error message and logs which communicates nature of the problem.