NE-2376: Remove restriction of unmanaged x-k8s.io by rikatz · Pull Request #1336 · openshift/cluster-ingress-operator

rikatz · 2026-01-07T13:50:06Z

Previously, cluster-ingress-operator would manage and block any updates to CRDs that were from group gateway.networking.x-k8s.io.

After some analysis we identified that OSSM/Istio does filter these resources in case it does not have a flag to enable alpha APIs, which means it is safe to allow users to deploy these CRDs.

This way, this change removes any restriction on x-k8s.io group, and removes any further reconciliation from CIO on x-k8s.io group.

openshift-ci-robot · 2026-01-07T13:50:10Z

@rikatz: This pull request references NE-2376 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Previously, cluster-ingress-operator would manage and block any updates to CRDs that were from group gateway.networking.x-k8s.io.

After some analysis we identified that OSSM/Istio does filter these resources in case it does not have a flag to enable alpha APIs, which means it is safe to allow users to deploy these CRDs.

This way, this change removes any restriction on x-k8s.io group, and removes any further reconciliation from CIO on x-k8s.io group.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rikatz · 2026-01-07T14:49:15Z

/hold
discussing with @shaneutt about the implications here

rikatz · 2026-01-08T21:59:35Z

/test okd-scos-images

rikatz · 2026-01-08T22:36:15Z

/hold

merge it after openshift/origin#30658 is merged and has a new release, otherwise this may break openshift/origin

rikatz · 2026-01-22T22:09:21Z

/retest

rikatz · 2026-01-22T23:20:47Z

/hold cancel

davidesalerno · 2026-01-23T09:34:06Z

Changes looks good to me, I've got only one question: should we consider adding a release note or documentation about this change?

/approve

rikatz · 2026-01-23T10:24:21Z

/retest-required

@davidesalerno we will add docs about it, it will be its own Jira. Also this will be backported from 4.19 to 4.21

rikatz · 2026-01-23T17:29:32Z

/cc @rhamini3

How to test:

On a new cluster with this version try to install https://github.com/kubernetes-sigs/gateway-api/blob/main/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml - Should work, because it is part of x-k8s.io
On this same cluster, try to install https://github.com/kubernetes-sigs/gateway-api/blob/main/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml - Should fail, because our VAPs block updates on k8s.io group

rhamini3 · 2026-01-26T20:52:28Z

marking PR as verified as pre-merge is successful. the xlistener set CRD is successfully installed while the tlsRoutes CRD is blocked by the VAP

% oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.22.0-0-2026-01-26-185026-test-ci-ln-irn5cfb-latest   True        False         76m     Cluster version is 4.22.0-0-2026-01-26-185026-test-ci-ln-irn5cfb-latest

% oc apply -f config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml 
customresourcedefinition.apiextensions.k8s.io/xlistenersets.gateway.networking.x-k8s.io created
iamin@iamin-mac gateway-api % oc apply -f config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml 
Error from server (Forbidden): error when creating "config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml": customresourcedefinitions.apiextensions.k8s.io "tlsroutes.gateway.networking.k8s.io" is forbidden: ValidatingAdmissionPolicy 'openshift-ingress-operator-gatewayapi-crd-admission' with binding 'openshift-ingress-operator-gatewayapi-crd-admission' denied request: Gateway API Custom Resource Definitions are managed by the Ingress Operator and may not be modified

rhamini3 · 2026-01-26T20:57:56Z

/verified by @rhamini3

openshift-ci-robot · 2026-01-26T20:58:08Z

@rhamini3: This PR has been marked as verified by @rhamini3.

Details

In response to this:

/verified by @rhamini3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rikatz · 2026-01-27T18:58:23Z

/verified by @rikatz re-adding, last commit was just a rebase over master

openshift-ci-robot · 2026-01-27T18:58:36Z

@rikatz: This PR has been marked as verified by @rikatz re-adding,last commit was just a rebase over master.

Details

In response to this:

/verified by @rikatz re-adding, last commit was just a rebase over master

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Miciah · 2026-01-27T19:07:12Z

/assign

rikatz · 2026-01-27T19:29:38Z

/assign @davidesalerno @alebedev87

rikatz · 2026-02-09T13:30:21Z

/retest

rikatz · 2026-02-09T17:39:19Z

/verified by @rikatz re-adding, last commit was just a rebase over master

openshift-ci-robot · 2026-02-09T17:39:32Z

@rikatz: This PR has been marked as verified by @rikatz re-adding,last commit was just a rebase over master.

Details

In response to this:

/verified by @rikatz re-adding, last commit was just a rebase over master

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rikatz · 2026-02-09T17:40:05Z

/retest

alebedev87 · 2026-02-09T20:58:03Z

/unassign

Letting Miciah give the final ok.

Miciah

/approve
/lgtm

Thanks!

Miciah · 2026-02-13T21:51:28Z

pkg/operator/controller/gatewayapi/controller.go

-		crd := o.(*apiextensionsv1.CustomResourceDefinition)
-		return crd.Spec.Group == gatewayapiv1.GroupName || crd.Spec.Group == experimentalGatewayAPIGroupName
+		crd, ok := o.(*apiextensionsv1.CustomResourceDefinition)
+		return ok && crd.Spec.Group == gatewayapiv1.GroupName


There has been some debate about whether the type assertion needs to guard against panic: #1165 (comment)

In any case, the operator is already inconsistent in this respect across the various controllers, and I don't consider it to be a major issue.

yeah I am in favor of trying to be as defensive as possible. I've seen weird panics happening on weird places, and I prefer to have 2 extra lines instead of having some misbehavior :D

Miciah · 2026-02-13T21:51:29Z

pkg/operator/controller/gatewayapi/controller_test.go

 			olmEnabled:                  true,
 			existingObjects: []runtime.Object{
 				co("ingress"),
-				crd("listenersets.gateway.networking.x-k8s.io"),


It would make sense to have a test case with listenersets.gateway.networking.k8s.io (without x-) to represent a real CRD name which the current version of the operator should flag as problematic. (Also, it would be satisfying when we do add support for listenersets to correct all the tests that say "this shouldn't work" to say instead "this should work"!) However, it it isn't a major issue.

this is a unit test. We do not really really on the CRD name, but more on the group as defined on https://github.com/openshift/cluster-ingress-operator/pull/1336/files#diff-bea9a36dd02f12bbe121fcd437437e64ffde3aadaf50872f7d259b4b023fa8f9R263 as you have commented below :)

So being listenerset or not here would not change once we really support it.

I don't understand. managedCRDMap does not have listenersets, so a unit test with listenersets.gateway.networking.k8s.io would expect {"unmanagedGatewayAPICRDNames":"listenersets.gateway.networking.k8s.io"} right now, right?

Oh, I see what you're saying—the test's fake indexer doesn't actually use managedCRDMap as the real indexer does; instead, the fake indexer checks for an artificial group-name to determine whether or not the CRD is managed, and so while using listenersets.gateway.networking.k8s.io might make for a more realistic test case, it wouldn't actually improve test coverage given the fake indexer.

Fair enough. Improving the test's fake indexer to be more realistic is out of scope for this PR.

Miciah · 2026-02-13T21:51:30Z

pkg/operator/controller/gatewayapi/controller_test.go

 					// Assume that all experimental CRDs are unmanaged.
-					if strings.Contains(o.GetName(), "gateway.networking.x-k8s.io") {
+					if strings.Contains(o.GetName(), "test.gateway.networking.k8s.io") {


I'm not sure the code comment makes sense anymore?

openshift-ci · 2026-02-13T21:52:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidesalerno, Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah,davidesalerno]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Previously, cluster-ingress-operator would manage and block any updates to CRDs that were from group gateway.networking.x-k8s.io. After some analysis we identified that OSSM/Istio does filter these resources in case it does not have a flag to enable alpha APIs, which means it is safe to allow users to deploy these CRDs. This way, this change removes any restriction on x-k8s.io group, and removes any further reconciliation from CIO on x-k8s.io group.

rikatz · 2026-02-16T13:07:03Z

/verified by @rikatz re-adding, last commit was just a rebase over master

openshift-ci-robot · 2026-02-16T13:07:17Z

@rikatz: This PR has been marked as verified by @rikatz re-adding,last commit was just a rebase over master.

Details

In response to this:

/verified by @rikatz re-adding, last commit was just a rebase over master

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rikatz · 2026-02-16T18:26:58Z

/retest-required

Miciah · 2026-02-16T20:48:36Z

Thanks! Only change since my previous was a rebase and a fix to a code comment, so
/lgtm

I see the comment-fix is in a separate commit; if you like, you should be able to use /label tide/merge-method-squash to keep it in the same logical commit without needing to force-push (and trigger rerunning CI).

rikatz · 2026-02-16T20:57:28Z

/label tide/merge-method-squash

rikatz · 2026-02-16T20:57:56Z

thanks. CI seems a bit flaky on other parts, I will keep an eye on it so we can get it merged :)

rikatz · 2026-02-18T17:12:10Z

/retest-required

rikatz · 2026-02-18T20:27:02Z

/test hypershift-e2e-aks

rikatz · 2026-02-18T23:50:22Z

/test hypershift-e2e-aks

openshift-ci · 2026-02-19T01:43:31Z

@rikatz: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 7, 2026

openshift-ci bot requested review from Miciah and bentito January 7, 2026 13:51

rikatz force-pushed the ne-2376 branch from 2c30ee1 to 468c7a5 Compare January 7, 2026 13:53

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 7, 2026

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 22, 2026

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 23, 2026

openshift-ci bot requested a review from rhamini3 January 23, 2026 17:29

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jan 26, 2026

rikatz force-pushed the ne-2376 branch from 468c7a5 to 9f107af Compare January 27, 2026 17:40

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Jan 27, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jan 27, 2026

openshift-ci bot assigned Miciah Jan 27, 2026

openshift-ci bot assigned alebedev87 Jan 27, 2026

rikatz force-pushed the ne-2376 branch from 9f107af to 740de35 Compare February 6, 2026 18:32

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Feb 6, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Feb 9, 2026

openshift-ci bot unassigned alebedev87 Feb 9, 2026

Miciah reviewed Feb 13, 2026

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 13, 2026

rikatz added 2 commits February 16, 2026 08:58

address comments

5463929

rikatz force-pushed the ne-2376 branch from 740de35 to 5463929 Compare February 16, 2026 13:06

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Feb 16, 2026

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 16, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Feb 16, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 16, 2026

openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Feb 16, 2026

Comments

Conversation

rikatz commented Jan 7, 2026

Uh oh!

openshift-ci-robot commented Jan 7, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rikatz commented Jan 7, 2026

Uh oh!

rikatz commented Jan 8, 2026

Uh oh!

rikatz commented Jan 8, 2026

Uh oh!

rikatz commented Jan 22, 2026

Uh oh!

rikatz commented Jan 22, 2026

Uh oh!

davidesalerno commented Jan 23, 2026

Uh oh!

rikatz commented Jan 23, 2026

Uh oh!

rikatz commented Jan 23, 2026

Uh oh!

rhamini3 commented Jan 26, 2026

Uh oh!

rhamini3 commented Jan 26, 2026

Uh oh!

openshift-ci-robot commented Jan 26, 2026

Uh oh!

rikatz commented Jan 27, 2026

Uh oh!

openshift-ci-robot commented Jan 27, 2026

Uh oh!

Miciah commented Jan 27, 2026

Uh oh!

rikatz commented Jan 27, 2026

Uh oh!

rikatz commented Feb 9, 2026

Uh oh!

rikatz commented Feb 9, 2026

Uh oh!

openshift-ci-robot commented Feb 9, 2026

Uh oh!

rikatz commented Feb 9, 2026

Uh oh!

alebedev87 commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Miciah left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Feb 13, 2026

Uh oh!

rikatz commented Feb 16, 2026

Uh oh!

openshift-ci-robot commented Feb 16, 2026

Uh oh!

rikatz commented Feb 16, 2026

Uh oh!

Miciah commented Feb 16, 2026

openshift-ci-robot commented Jan 7, 2026 •

edited by openshift-ci bot

Loading

alebedev87 commented Feb 9, 2026 •

edited

Loading