Skip to content

OCPBUGS-79667: Use feature-gate annotation for Sail Library RBAC#1393

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
gcs278:sail-clusterrole-GA
Mar 30, 2026
Merged

OCPBUGS-79667: Use feature-gate annotation for Sail Library RBAC#1393
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
gcs278:sail-clusterrole-GA

Conversation

@gcs278
Copy link
Copy Markdown
Contributor

@gcs278 gcs278 commented Mar 19, 2026

Summary

Replace feature-set annotations with the new release.openshift.io/feature-gate annotation to conditionally deploy Sail Library RBAC based on the GatewayAPI feature gate state.

This leverages the new CVO capability that applies manifests based on enabled feature gates, allowing atomic feature promotion without manual payload adjustments.

Problem

The CVO only includes TechPreview-annotated manifests in the release payload during cluster installation. When the feature set is changed on a running cluster:

  1. The CVO restarts with the new feature set
  2. But the payload manifests remain filtered based on the original install-time feature set
  3. TechPreview manifests are permanently unavailable on clusters installed with the Default feature set

This means if a cluster is installed with Default feature set, the Sail Library RBAC manifests would never be applied, even if a user enables TechPreviewNoUpgrade later and creates a GatewayClass.

Solution

Use the new release.openshift.io/feature-gate: GatewayAPI annotation instead of release.openshift.io/feature-set: TechPreviewNoUpgrade on:

  • manifests/00-cluster-role-sail-library.yaml
  • manifests/01-cluster-role-binding-sail-library.yaml

The CVO will apply these manifests when the GatewayAPI feature gate is enabled, eliminating the install-time filtering limitation. This approach allows:

  • Manifests to be applied dynamically based on feature gate state
  • Atomic feature promotion without adjusting conditional manifests
  • Gateway API functionality on any cluster with the feature gate enabled

Context

🤖 Generated with Claude Code

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 19, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Mar 19, 2026

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Remove TechPreviewNoUpgrade annotation from Sail ClusterRole and ClusterRoleBinding to avoid breakage when GatewayAPIWithoutOLM is promoted to GA.

Required to merge before openshift/api#2772

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@gcs278 gcs278 marked this pull request as draft March 19, 2026 18:57
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 19, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: da54b1ed-69bc-4000-b0cd-f756c6a184c2

📥 Commits

Reviewing files that changed from the base of the PR and between ed0eb2b and b088953.

📒 Files selected for processing (2)
  • manifests/00-cluster-role-sail-library.yaml
  • manifests/01-cluster-role-binding-sail-library.yaml
✅ Files skipped from review due to trivial changes (1)
  • manifests/00-cluster-role-sail-library.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • manifests/01-cluster-role-binding-sail-library.yaml

📝 Walkthrough

Walkthrough

Updated annotations in two manifests: manifests/00-cluster-role-sail-library.yaml (ClusterRole metadata.annotations) and manifests/01-cluster-role-binding-sail-library.yaml (ClusterRoleBinding metadata.annotations). In each file the release.openshift.io/feature-set: DevPreviewNoUpgrade,TechPreviewNoUpgrade entry was removed and release.openshift.io/feature-gate: GatewayAPIWithoutOLM was added. No other fields, RBAC rules, subjects, roleRef, apiVersion, or kind were changed.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 19, 2026
@openshift-ci openshift-ci bot requested review from jcmoraisjr and miheer March 19, 2026 18:58
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 19, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/0ab81910-23c6-11f1-8635-bf728c1f5aad-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 20, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/1e4a3720-2406-11f1-93e5-9f16732fd0e5-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 20, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/0ddd5ec0-2493-11f1-8cf8-effe9a495bea-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 21, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/69a77f80-24c8-11f1-9403-ad1a7c99fb97-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 21, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/8a761690-24c8-11f1-9c74-da2cb51d6692-0

@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 23, 2026

/test e2e-gcp-ovn-techpreview

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 23, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/6d5568f0-2710-11f1-9d03-561b26d4f2f7-0

@gcs278 gcs278 force-pushed the sail-clusterrole-GA branch from 790388c to a51eaff Compare March 25, 2026 19:59
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Mar 25, 2026

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

Remove TechPreviewNoUpgrade annotations from Sail Library ClusterRole and ClusterRoleBinding to enable Gateway API functionality on all OpenShift clusters as we promote to GA.

Problem

The CVO only includes TechPreview-annotated manifests in the release payload during cluster installation. When the feature set is changed on a running cluster:

  1. The CVO restarts with the new feature set
  2. But the payload manifests remain filtered based on the original install-time feature set
  3. TechPreview manifests are permanently unavailable on clusters installed with the Default feature set

This means if a cluster is installed with Default feature set, the Sail Library RBAC manifests would never be applied, even if a user enables TechPreviewNoUpgrade later and creates a GatewayClass.

Solution

Remove the release.openshift.io/feature-set: TechPreviewNoUpgrade annotations from:

  • manifests/00-cluster-role-sail-library.yaml
  • manifests/01-cluster-role-binding-sail-library.yaml

This ensures the Sail Library RBAC is included in all cluster installations, allowing Gateway API to function correctly as we promote the feature to GA.

Context

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@gcs278 gcs278 marked this pull request as ready for review March 25, 2026 20:01
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 25, 2026
@openshift-ci openshift-ci bot requested review from bentito and davidesalerno March 25, 2026 20:02
@gcs278 gcs278 force-pushed the sail-clusterrole-GA branch from a51eaff to ed0eb2b Compare March 25, 2026 20:36
@gcs278 gcs278 changed the title NE-2471: Remove feature-set annotations from Sail Library RBAC OCPBUGS-79667: Remove feature-set annotations from Sail Library RBAC Mar 25, 2026
@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 25, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@gcs278: This pull request references Jira Issue OCPBUGS-79667, which is invalid:

  • expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove TechPreviewNoUpgrade annotations from Sail Library ClusterRole and ClusterRoleBinding to enable Gateway API functionality on all OpenShift clusters as we promote to GA.

Problem

The CVO only includes TechPreview-annotated manifests in the release payload during cluster installation. When the feature set is changed on a running cluster:

  1. The CVO restarts with the new feature set
  2. But the payload manifests remain filtered based on the original install-time feature set
  3. TechPreview manifests are permanently unavailable on clusters installed with the Default feature set

This means if a cluster is installed with Default feature set, the Sail Library RBAC manifests would never be applied, even if a user enables TechPreviewNoUpgrade later and creates a GatewayClass.

Solution

Remove the release.openshift.io/feature-set: TechPreviewNoUpgrade annotations from:

  • manifests/00-cluster-role-sail-library.yaml
  • manifests/01-cluster-role-binding-sail-library.yaml

This ensures the Sail Library RBAC is included in all cluster installations, allowing Gateway API to function correctly as we promote the feature to GA.

Context

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 25, 2026

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 25, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@gcs278: This pull request references Jira Issue OCPBUGS-79667, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (iamin@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 26, 2026
@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 26, 2026

/unhold

Updated to release.openshift.io/feature-gate

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 26, 2026
@rhamini3
Copy link
Copy Markdown
Contributor

/verified by @rhamini3

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 26, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rhamini3: This PR has been marked as verified by @rhamini3.

Details

In response to this:

/verified by @rhamini3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD a6176ea and 2 for PR HEAD b088953 in total

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 27, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/8ca6afd0-2976-11f1-87dd-3a0e2dc903f1-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 27, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/899a4840-2978-11f1-88a5-2fdf52f0125a-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 27, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/7c1b46a0-2979-11f1-9476-ac2dbf9a0ed8-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 27, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/0ad0efd0-297a-11f1-95c5-290d9ec10095-0

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD d16dd45 and 1 for PR HEAD b088953 in total

@lihongan
Copy link
Copy Markdown

/retest-required

@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 27, 2026

Teardown failure in hypershift
/test e2e-hypershift

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 27, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/61957ad0-29e2-11f1-9921-6bbab26a3719-0

@Miciah
Copy link
Copy Markdown
Contributor

Miciah commented Mar 27, 2026

The commit message says "based on the GatewayAPI feature gate state" but should say "based on the GatewayAPIWithoutOLM feature gate". However, it isn't worth doing another force-push just to fix that issue.

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD dde7a93 and 0 for PR HEAD b088953 in total

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

/hold

Revision b088953 was retested 3 times: holding

@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 27, 2026

e2e-hypershift is about 50% succeeding, and mostly flaking on teardowns, though I did see one TestNodePool/HostedCluster0/Main/TestNodePoolInPlaceUpgrade failure that wasn't Teardown.

/test e2e-hypershift

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD dde7a93 and 2 for PR HEAD b088953 in total

@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 27, 2026

/test e2e-hypershift

@rikatz
Copy link
Copy Markdown
Member

rikatz commented Mar 28, 2026

/retest-required

1 similar comment
@rikatz
Copy link
Copy Markdown
Member

rikatz commented Mar 29, 2026

/retest-required

@gcs278
Copy link
Copy Markdown
Contributor Author

gcs278 commented Mar 29, 2026

e2e-aws-operator pod failed to schedule, and the failures in e2e-aws-ovn-serial-2-of2 look unrelated:
/retest

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 29, 2026

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/322df070-2bc1-11f1-9068-51d08a5996e8-0

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 30, 2026

@gcs278: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit 019903c into openshift:master Mar 30, 2026
19 checks passed
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@gcs278: Jira Issue Verification Checks: Jira Issue OCPBUGS-79667
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-79667 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

Replace feature-set annotations with the new release.openshift.io/feature-gate annotation to conditionally deploy Sail Library RBAC based on the GatewayAPI feature gate state.

This leverages the new CVO capability that applies manifests based on enabled feature gates, allowing atomic feature promotion without manual payload adjustments.

Problem

The CVO only includes TechPreview-annotated manifests in the release payload during cluster installation. When the feature set is changed on a running cluster:

  1. The CVO restarts with the new feature set
  2. But the payload manifests remain filtered based on the original install-time feature set
  3. TechPreview manifests are permanently unavailable on clusters installed with the Default feature set

This means if a cluster is installed with Default feature set, the Sail Library RBAC manifests would never be applied, even if a user enables TechPreviewNoUpgrade later and creates a GatewayClass.

Solution

Use the new release.openshift.io/feature-gate: GatewayAPI annotation instead of release.openshift.io/feature-set: TechPreviewNoUpgrade on:

  • manifests/00-cluster-role-sail-library.yaml
  • manifests/01-cluster-role-binding-sail-library.yaml

The CVO will apply these manifests when the GatewayAPI feature gate is enabled, eliminating the install-time filtering limitation. This approach allows:

  • Manifests to be applied dynamically based on feature gate state
  • Atomic feature promotion without adjusting conditional manifests
  • Gateway API functionality on any cluster with the feature gate enabled

Context

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot
Copy link
Copy Markdown
Contributor

Fix included in accepted release 4.22.0-0.nightly-2026-04-01-092906

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants