Skip to content

CNTRLPLANE-2205: feat(aws): enable shared role in e2e - #7400

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
sjenning:shared-role-e2e-enable
Dec 17, 2025
Merged

CNTRLPLANE-2205: feat(aws): enable shared role in e2e#7400
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
sjenning:shared-role-e2e-enable

Conversation

@sjenning

@sjenning sjenning commented Dec 16, 2025

Copy link
Copy Markdown
Contributor

This commit enables the use of a shared role on AWS for all test clusters 4.20 and newer, except TestUpgradeControlPlane, which continues to verify the use individual roles. This test cluster was also chosen to avoid having to do complex filtering for z-stream releases that do not contain the required HCCO fix.

#7383


Note

Enable AWS shared IAM role for e2e clusters by default (gated to 4.20+), while the control plane upgrade test continues to use individual roles.

  • E2E AWS defaults (test/e2e/util/options.go):
    • Enable SharedRole: true by default; auto-disable for versions < 4.20.0 due to HCCO fix requirement.
    • Preserve existing PublicOnly behavior toggle for versions < 4.16.0.
  • Control plane upgrade test (test/e2e/control_plane_upgrade_test.go):
    • For AWS, explicitly set clusterOpts.AWSPlatform.SharedRole = false to validate individual roles during upgrade.

Written by Cursor Bugbot for commit 99bef30. This will update automatically on new commits. Configure here.

This commit enables the use of a shared role on AWS for all
test clusters except TestUpgradeControlPlane, which continues
to verify the use individual roles.  This test cluster was also
choosen to avoid having to do complex filtering for z-stream
releases that do not contain the required HCCO fix.
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 16, 2025
@openshift-ci

openshift-ci Bot commented Dec 16, 2025

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Dec 16, 2025

Copy link
Copy Markdown
Contributor

Walkthrough

The pull request adds AWS platform-specific configuration for the SharedRole setting in test utilities. One file introduces a platform check to disable SharedRole for AWS, while another adds default SharedRole configuration with version-based conditional adjustments in test setup options.

Changes

Cohort / File(s) Change Summary
AWS SharedRole Configuration
test/e2e/control_plane_upgrade_test.go
Adds platform-specific logic to set clusterOpts.AWSPlatform.SharedRole to false when the platform is AWS, enabling verification of individual roles functionality.
AWS SharedRole Defaults and Versioning
test/e2e/util/options.go
Adds default SharedRole: true to AWS raw create options and introduces version-based conditional logic to disable SharedRole for AWS versions below 4.20.0.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

  • Review the version check logic in options.go to confirm the 4.20.0 threshold is appropriate
  • Verify that the platform-specific adjustment in control_plane_upgrade_test.go correctly applies only to AWS and doesn't inadvertently affect other platforms
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 4d0a522 and 99bef30.

📒 Files selected for processing (2)
  • test/e2e/control_plane_upgrade_test.go (1 hunks)
  • test/e2e/util/options.go (1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

  • test/e2e/control_plane_upgrade_test.go
  • test/e2e/util/options.go
🧬 Code graph analysis (2)
test/e2e/control_plane_upgrade_test.go (1)
api/hypershift/v1beta1/hostedcluster_types.go (1)
  • AWSPlatform (1212-1212)
test/e2e/util/options.go (1)
test/e2e/util/version.go (1)
  • IsLessThan (106-108)
🔇 Additional comments (3)
test/e2e/util/options.go (2)

287-287: LGTM: SharedRole default enabled for AWS.

Enabling SharedRole: true by default aligns with the PR objective to use shared IAM roles across test clusters, reducing resource overhead.


294-298: The version guard is correctly implemented. PR #7383 has been merged into release-4.20, and version 4.20.0 is the appropriate threshold for when the HCCO shared roles fix becomes available. The code properly disables SharedRole for versions prior to 4.20.0.

test/e2e/control_plane_upgrade_test.go (1)

31-34: LGTM: Platform-specific SharedRole override for coverage.

Explicitly disabling SharedRole for AWS in this test ensures that individual IAM role behavior continues to be verified, while other tests benefit from the shared role optimization.


Comment @coderabbitai help to get the list of available commands and usage tips.

@sjenning

sjenning commented Dec 16, 2025

Copy link
Copy Markdown
Contributor Author

/hold

until #7383 is accepted into both a 4.20 ci and nightly payload https://amd64.ocp.releases.ci.openshift.org/#4.20.0-0.ci

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 16, 2025
@sjenning

Copy link
Copy Markdown
Contributor Author

/test e2e-aws

@openshift-ci openshift-ci Bot added the area/testing Indicates the PR includes changes for e2e testing label Dec 16, 2025
@openshift-ci

openshift-ci Bot commented Dec 16, 2025

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 16, 2025
@sjenning sjenning changed the title feat(aws): enable shared role in e2e CNTRLPLANE-2205: feat(aws): enable shared role in e2e Dec 16, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 16, 2025
@openshift-ci-robot

openshift-ci-robot commented Dec 16, 2025

Copy link
Copy Markdown

@sjenning: This pull request references CNTRLPLANE-2205 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This commit enables the use of a shared role on AWS for all test clusters except TestUpgradeControlPlane, which continues to verify the use individual roles. This test cluster was also choosen to avoid having to do complex filtering for z-stream releases that do not contain the required HCCO fix.

#7383

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@sjenning

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Dec 16, 2025

Copy link
Copy Markdown
Contributor
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@sjenning
sjenning marked this pull request as ready for review December 17, 2025 01:02
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 17, 2025
@openshift-ci-robot

openshift-ci-robot commented Dec 17, 2025

Copy link
Copy Markdown

@sjenning: This pull request references CNTRLPLANE-2205 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This commit enables the use of a shared role on AWS for all test clusters except TestUpgradeControlPlane, which continues to verify the use individual roles. This test cluster was also choosen to avoid having to do complex filtering for z-stream releases that do not contain the required HCCO fix.

#7383


[!NOTE]
Cursor Bugbot is generating a summary for commit 99bef30. Configure here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@sjenning

Copy link
Copy Markdown
Contributor Author

/verified by e2e

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Dec 17, 2025
@openshift-ci-robot

Copy link
Copy Markdown

@sjenning: This PR has been marked as verified by e2e.

Details

In response to this:

/verified by e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from bryan-cox and devguyio December 17, 2025 01:03
@openshift-ci-robot

openshift-ci-robot commented Dec 17, 2025

Copy link
Copy Markdown

@sjenning: This pull request references CNTRLPLANE-2205 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This commit enables the use of a shared role on AWS for all test clusters 4.20 and newer, except TestUpgradeControlPlane, which continues to verify the use individual roles. This test cluster was also chosen to avoid having to do complex filtering for z-stream releases that do not contain the required HCCO fix.

#7383


[!NOTE]
Enable AWS shared IAM role for e2e clusters by default (gated to 4.20+), while the control plane upgrade test continues to use individual roles.

  • E2E AWS defaults (test/e2e/util/options.go):
    • Enable SharedRole: true by default; auto-disable for versions < 4.20.0 due to HCCO fix requirement.
    • Preserve existing PublicOnly behavior toggle for versions < 4.16.0.
  • Control plane upgrade test (test/e2e/control_plane_upgrade_test.go):
    • For AWS, explicitly set clusterOpts.AWSPlatform.SharedRole = false to validate individual roles during upgrade.

Written by Cursor Bugbot for commit 99bef30. This will update automatically on new commits. Configure here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jparrill

jparrill commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

Looks like it was added into these releases:

I think we can remove the hold. Let this to you @sjenning.

@jparrill

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Dec 17, 2025
@sjenning sjenning added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Dec 17, 2025
@sjenning

Copy link
Copy Markdown
Contributor Author

/override okd-scos-images

@sjenning

Copy link
Copy Markdown
Contributor Author

/hold cancel

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 17, 2025
@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

@sjenning: /override requires failed status contexts, check run or a prowjob name to operate on.
The following unknown contexts/checkruns were given:

  • okd-scos-images

Only the following failed contexts/checkruns were expected:

  • CodeRabbit
  • ci/prow/e2e-aks
  • ci/prow/e2e-aks-4-21
  • ci/prow/e2e-aws
  • ci/prow/e2e-aws-4-21
  • ci/prow/e2e-aws-upgrade-hypershift-operator
  • ci/prow/e2e-kubevirt-aws-ovn-reduced
  • ci/prow/images
  • ci/prow/okd-scos-images
  • ci/prow/security
  • ci/prow/unit
  • ci/prow/verify
  • pull-ci-openshift-hypershift-main-e2e-aks
  • pull-ci-openshift-hypershift-main-e2e-aks-4-21
  • pull-ci-openshift-hypershift-main-e2e-aws
  • pull-ci-openshift-hypershift-main-e2e-aws-4-21
  • pull-ci-openshift-hypershift-main-e2e-aws-upgrade-hypershift-operator
  • pull-ci-openshift-hypershift-main-e2e-kubevirt-aws-ovn-reduced
  • pull-ci-openshift-hypershift-main-images
  • pull-ci-openshift-hypershift-main-okd-scos-images
  • pull-ci-openshift-hypershift-main-security
  • pull-ci-openshift-hypershift-main-unit
  • pull-ci-openshift-hypershift-main-verify
  • tide

If you are trying to override a checkrun that has a space in it, you must put a double quote on the context.

Details

In response to this:

/override okd-scos-images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@sjenning

Copy link
Copy Markdown
Contributor Author

/override ci/prow/okd-scos-images

@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

@sjenning: Overrode contexts on behalf of sjenning: ci/prow/okd-scos-images

Details

In response to this:

/override ci/prow/okd-scos-images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD c8d1b84 and 2 for PR HEAD 99bef30 in total

@bryan-cox

Copy link
Copy Markdown
Member

/test e2e-aks

@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 30a1781 and 1 for PR HEAD 99bef30 in total

@sjenning

Copy link
Copy Markdown
Contributor Author

/override ci/prow/e2e-aks

Two runs flaked on different tests

@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

@sjenning: Overrode contexts on behalf of sjenning: ci/prow/e2e-aks

Details

In response to this:

/override ci/prow/e2e-aks

Two runs flaked on different tests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@sjenning

Copy link
Copy Markdown
Contributor Author

/override ci/prow/okd-scos-images
/override ci/prow/e2e-aks

@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

@sjenning: Overrode contexts on behalf of sjenning: ci/prow/e2e-aks, ci/prow/okd-scos-images

Details

In response to this:

/override ci/prow/okd-scos-images
/override ci/prow/e2e-aks

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

@sjenning: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 9b65ae1 into openshift:main Dec 17, 2025
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. approved Indicates a PR has been approved by an approver from all required OWNERS files. area/testing Indicates the PR includes changes for e2e testing jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants