CNTRLPLANE-2677: Add HCPEtcdBackup CRD API and feature gate - #7898
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@jparrill: This pull request references CNTRLPLANE-2677 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a new HCPEtcdBackup API/CRD and feature gate, extends HostedCluster/HostedControlPlane backup fields, and generates client/applyconfiguration/informer/lister/fake code, CRD manifests, operator feature-gate registration and tests, plus docs to support feature-gated etcd backups to S3 or Azure Blob with encryption and immutability rules. Changes
Sequence Diagram(s)sequenceDiagram
participant User as User
participant APIServer as API Server
participant Controller as HCPEtcdBackup Controller
participant Storage as S3/Azure
participant KMS as KMS
User->>APIServer: Create HCPEtcdBackup (spec: storageType, backend config, encryption)
APIServer->>Controller: Notify controller of new HCPEtcdBackup
Controller->>APIServer: Read secrets / HostedCluster backup config
Controller->>KMS: (optional) Prepare or validate encryption key
Controller->>Storage: Upload etcd snapshot with encryption
Storage-->>Controller: Return snapshot URL / status
Controller->>APIServer: Update HCPEtcdBackup.status (conditions, snapshotURL, encryptionMetadata)
APIServer-->>User: status reflects BackupCompleted / BackupFailed
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jparrill The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
approved
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
/test unit |
|
/test verify |
|
/test e2e-aws |
|
@jparrill: This pull request references CNTRLPLANE-2677 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
api/hypershift/v1beta1/etcdbackup_types.go (1)
51-68: Add CEL validation to enforce union discriminator constraints.The union discriminator markers (
+unionDiscriminator,+unionMember) provide documentation but don't enforce runtime validation. Consider adding+kubebuilder:validation:XValidationrules to ensure:
- The correct storage config is provided for the selected
storageType.- Only one storage config is provided at a time.
Suggested CEL validation markers
// HCPEtcdBackupSpec defines the desired state of HCPEtcdBackup. +// +kubebuilder:validation:XValidation:rule="self.storageType != 'S3' || has(self.s3)",message="s3 configuration is required when storageType is S3" +// +kubebuilder:validation:XValidation:rule="self.storageType != 'AzureBlob' || has(self.azureBlob)",message="azureBlob configuration is required when storageType is AzureBlob" +// +kubebuilder:validation:XValidation:rule="!(has(self.s3) && has(self.azureBlob))",message="only one storage configuration should be provided" type HCPEtcdBackupSpec struct {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@api/hypershift/v1beta1/etcdbackup_types.go` around lines 51 - 68, Add kubebuilder XValidation CEL rules on HCPEtcdBackupSpec to enforce the union discriminator: validate that when StorageType == "S3" then S3 is non-null and AzureBlob is null, when StorageType == "AzureBlob" then AzureBlob is non-null and S3 is null, and ensure at most one of S3/AzureBlob is set. Apply the XValidation annotations referencing the StorageType field and the pointer fields S3 and AzureBlob so the API server enforces (1) correct config present for the selected StorageType and (2) mutual exclusivity of S3 and AzureBlob for HCPEtcdBackupSpec.cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml (1)
159-168: Consider adding cross-field validation for storageType consistency.The schema requires
storageTypebut doesn't enforce that the corresponding storage configuration (s3orazureBlob) is provided when a specificstorageTypeis selected. A user could setstorageType: S3without providing thes3configuration, or provide boths3andazureBlobsimultaneously.Consider adding CEL validations at the spec level:
- When
storageTypeisS3, requires3to be set andazureBlobto be unset.- When
storageTypeisAzureBlob, requireazureBlobto be set ands3to be unset.Example CEL validation to add at the spec level
x-kubernetes-validations: - message: "s3 configuration is required when storageType is S3" rule: "self.storageType != 'S3' || has(self.s3)" - message: "azureBlob configuration is required when storageType is AzureBlob" rule: "self.storageType != 'AzureBlob' || has(self.azureBlob)" - message: "only one storage configuration should be provided" rule: "!(has(self.s3) && has(self.azureBlob))"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml` around lines 159 - 168, Add cross-field CEL validations at the CRD spec level to enforce consistency between storageType and its configuration fields: ensure when storageType == "S3" that s3 is present and azureBlob is absent, when storageType == "AzureBlob" that azureBlob is present and s3 is absent, and forbid both s3 and azureBlob together; implement these as x-kubernetes-validations entries referencing the spec (use the symbols storageType, s3, azureBlob and x-kubernetes-validations) with clear messages for each rule so the CRD rejects mismatched or duplicate storage configs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml`:
- Around line 3058-3069: Update the HCPEtcdBackupConfig Go struct to add
kubebuilder/CEL validation tags on the encryptionKeyURL and kmsKeyARN fields:
annotate encryptionKeyURL with a kubebuilder validation pattern that enforces an
https URL (e.g. +kubebuilder:validation:Pattern=`^https://[^/]+/.*$` or a
stricter URL regex) and annotate kmsKeyARN with a kubebuilder validation pattern
that matches AWS ARN format (e.g.
+kubebuilder:validation:Pattern=`^arn:aws:[a-z0-9-]+:[a-z0-9-]*:[0-9]*:[^\\s]+$`),
then regenerate the CRDs so the zz_generated.crd-manifests include these
CEL/schema checks; target the HCPEtcdBackupConfig type and the encryptionKeyURL
and kmsKeyARN field tags when making the change.
In
`@cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml`:
- Around line 3174-3189: The backup schema must validate provider-specific keys
and prevent mixed settings: add a kubebuilder/CRD pattern validation to
encryptionKeyURL (e.g., a regex matching Azure Key Vault key URLs like
https://<vault>.vault.azure.net/keys/<key>[/<version>]) and to kmsKeyARN (e.g.,
a regex matching AWS KMS ARNs like
arn:aws:kms:<region>:<account-id>:key/<key-id>), and add an
x-kubernetes-validations CEL rule on the backup object to reject payloads where
both encryptionKeyURL and kmsKeyARN are present (expression:
"!(has(self.encryptionKeyURL) && has(self.kmsKeyARN))" with an appropriate
message). Target the properties named encryptionKeyURL and kmsKeyARN and the
parent backup object in the CRD when making these changes.
---
Nitpick comments:
In `@api/hypershift/v1beta1/etcdbackup_types.go`:
- Around line 51-68: Add kubebuilder XValidation CEL rules on HCPEtcdBackupSpec
to enforce the union discriminator: validate that when StorageType == "S3" then
S3 is non-null and AzureBlob is null, when StorageType == "AzureBlob" then
AzureBlob is non-null and S3 is null, and ensure at most one of S3/AzureBlob is
set. Apply the XValidation annotations referencing the StorageType field and the
pointer fields S3 and AzureBlob so the API server enforces (1) correct config
present for the selected StorageType and (2) mutual exclusivity of S3 and
AzureBlob for HCPEtcdBackupSpec.
In
`@cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml`:
- Around line 159-168: Add cross-field CEL validations at the CRD spec level to
enforce consistency between storageType and its configuration fields: ensure
when storageType == "S3" that s3 is present and azureBlob is absent, when
storageType == "AzureBlob" that azureBlob is present and s3 is absent, and
forbid both s3 and azureBlob together; implement these as
x-kubernetes-validations entries referencing the spec (use the symbols
storageType, s3, azureBlob and x-kubernetes-validations) with clear messages for
each rule so the CRD rejects mismatched or duplicate storage configs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 36ae42cc-6d7f-4107-9a9c-ad6d9b6600ab
⛔ Files ignored due to path filters (5)
api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/zz_generated*api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*
📒 Files selected for processing (17)
api/hypershift/v1beta1/etcdbackup_types.goapi/hypershift/v1beta1/featuregates/featureGate-Hypershift-Default.yamlapi/hypershift/v1beta1/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yamlapi/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-Default.yamlapi/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yamlapi/hypershift/v1beta1/hostedcluster_types.goapi/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yamlapi/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yamlapi/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yamlhypershift-operator/featuregate/feature.gohypershift-operator/featuregate/feature_test.go
Test Resultse2e-aws
Failed TestsTotal failed tests: 24
... and 19 more failed tests e2e-aks
Failed TestsTotal failed tests: 16
... and 11 more failed tests |
dcf56ca to
6d67ccb
Compare
|
@jparrill: This pull request references CNTRLPLANE-2677 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
api/hypershift/v1beta1/etcdbackup_types.go (1)
51-68: Consider adding CEL validation to enforce union member presence.The union pattern uses
storageTypeas discriminator but doesn't enforce that the corresponding storage configuration (s3orazureBlob) is provided. A user could setstorageType: S3without providing thes3field.♻️ Proposed fix to add CEL validation
// HCPEtcdBackupSpec defines the desired state of HCPEtcdBackup. +// +kubebuilder:validation:XValidation:rule="self.storageType == 'S3' ? has(self.s3) : true",message="s3 configuration is required when storageType is S3" +// +kubebuilder:validation:XValidation:rule="self.storageType == 'AzureBlob' ? has(self.azureBlob) : true",message="azureBlob configuration is required when storageType is AzureBlob" type HCPEtcdBackupSpec struct {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@api/hypershift/v1beta1/etcdbackup_types.go` around lines 51 - 68, Add CEL validations on HCPEtcdBackupSpec to enforce the union: add two x-kubernetes-validations (or equivalent kubebuilder marker) with CEL expressions that when StorageType == "S3" then s3 must be present and when StorageType == "AzureBlob" then azureBlob must be present (e.g. self.storageType == "S3" implies self.s3 != null and self.storageType == "AzureBlob" implies self.azureBlob != null), referencing the StorageType, S3, and AzureBlob fields so CRD validation rejects mismatched/missing union members.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@api/hypershift/v1beta1/etcdbackup_types.go`:
- Around line 119-124: The StorageAccount field validation in
etcdbackup_types.go currently uses +kubebuilder:validation:MinLength=1 which is
incorrect for Azure (must be 3–24 chars); update the StorageAccount struct tag
to use +kubebuilder:validation:MinLength=3 (leave MaxLength=24) so the
StorageAccount string field's kubebuilder validation matches Azure requirements
and regenerate CRDs if needed.
---
Nitpick comments:
In `@api/hypershift/v1beta1/etcdbackup_types.go`:
- Around line 51-68: Add CEL validations on HCPEtcdBackupSpec to enforce the
union: add two x-kubernetes-validations (or equivalent kubebuilder marker) with
CEL expressions that when StorageType == "S3" then s3 must be present and when
StorageType == "AzureBlob" then azureBlob must be present (e.g. self.storageType
== "S3" implies self.s3 != null and self.storageType == "AzureBlob" implies
self.azureBlob != null), referencing the StorageType, S3, and AzureBlob fields
so CRD validation rejects mismatched/missing union members.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6ec57230-00d2-4f88-97c8-13a65d34420b
⛔ Files ignored due to path filters (5)
api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/zz_generated*api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*
📒 Files selected for processing (11)
api/hypershift/v1beta1/etcdbackup_types.goapi/hypershift/v1beta1/hostedcluster_types.goapi/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yamlapi/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yamlapi/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yamlcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
- api/hypershift/v1beta1/hostedcluster_types.go
- cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml
- cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml
- cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml
- cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml
- cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml
6d67ccb to
cd11996
Compare
openshift-ci
Bot
added
the
area/documentation
|
@jparrill: This pull request references CNTRLPLANE-2677 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Note on spec immutability
It might be worth considering making the entire spec immutable after creation in a follow-up, since modifying a backup request after it has been submitted (e.g., changing the bucket or region mid-flight) could lead to unexpected behavior. This would be a struct-level Leaving this as a note for future consideration — the current approach covers the critical fields and aligns with the enhancement spec. |
4270e08 to
68ec7e9
Compare
Enable the HCPEtcdBackup feature gate so the new CRD can be selectively activated per feature set. This is required before defining the CRD API types. Register the HCPEtcdBackup feature constant and variable in the hypershift-operator featuregate package, gated behind TechPreviewNoUpgrade. Update the four featuregate YAML manifests (Hypershift and SelfManagedHA, Default and TechPreviewNoUpgrade) and add unit tests covering all feature sets. Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ca187ca to
c8fa304
Compare
openshift-ci-robot
removed
the
verified
openshift-ci
Bot
added
area/platform/aws
|
/lgtm |
|
Scheduling tests matching the |
c8fa304 to
20e32d7
Compare
|
/lgtm |
|
Scheduling tests matching the |
|
/retest-required Infra issue |
…h backup config Why: The HCPEtcdBackup feature requires new API types for the CRD and a backup configuration field in ManagedEtcdSpec to propagate encryption settings from HostedCluster to HostedControlPlane. How: - Define HCPEtcdBackup, HCPEtcdBackupSpec, HCPEtcdBackupStatus and supporting types (S3, AzureBlob, EncryptionMetadata) in etcdbackup_types.go with full validation markers. - Add HCPEtcdBackupConfig with platform-specific blocks (AWS/Azure) and CEL mutual exclusion validation. - Add Backup field to ManagedEtcdSpec behind HCPEtcdBackup feature gate. - Enforce spec immutability via CEL (one-shot backup request). - Enforce union discriminator via CEL (storageType must match backend). - Add regexp validation for kmsKeyARN (^arn:) and encryptionKeyURL (^https://) following existing patterns in aws.go. - Drop pointer for EncryptionMetadata in status (no nil vs zero semantic difference per OpenShift conventions). - Regenerate deepcopy and CRD manifests via make hypershift-api. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>
20e32d7 to
7080fce
Compare
|
/lgtm |
|
Scheduling tests matching the |
|
/test e2e-azure-self-managed |
|
/verified by e2e |
openshift-ci-robot
added
the
verified
|
@jparrill: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jparrill: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
…t#7898) * feat(api): register HCPEtcdBackup feature gate Enable the HCPEtcdBackup feature gate so the new CRD can be selectively activated per feature set. This is required before defining the CRD API types. Register the HCPEtcdBackup feature constant and variable in the hypershift-operator featuregate package, gated behind TechPreviewNoUpgrade. Update the four featuregate YAML manifests (Hypershift and SelfManagedHA, Default and TechPreviewNoUpgrade) and add unit tests covering all feature sets. Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(api): add HCPEtcdBackup CRD types and extend ManagedEtcdSpec with backup config Why: The HCPEtcdBackup feature requires new API types for the CRD and a backup configuration field in ManagedEtcdSpec to propagate encryption settings from HostedCluster to HostedControlPlane. How: - Define HCPEtcdBackup, HCPEtcdBackupSpec, HCPEtcdBackupStatus and supporting types (S3, AzureBlob, EncryptionMetadata) in etcdbackup_types.go with full validation markers. - Add HCPEtcdBackupConfig with platform-specific blocks (AWS/Azure) and CEL mutual exclusion validation. - Add Backup field to ManagedEtcdSpec behind HCPEtcdBackup feature gate. - Enforce spec immutability via CEL (one-shot backup request). - Enforce union discriminator via CEL (storageType must match backend). - Add regexp validation for kmsKeyARN (^arn:) and encryptionKeyURL (^https://) following existing patterns in aws.go. - Drop pointer for EncryptionMetadata in status (no nil vs zero semantic difference per OpenShift conventions). - Regenerate deepcopy and CRD manifests via make hypershift-api. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> --------- Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
8 participants
Summary
HCPEtcdBackupfeature gate (disabled in Default, enabled in TechPreviewNoUpgrade)HCPEtcdBackupCRD API types (HCPEtcdBackup,HCPEtcdBackupSpec,HCPEtcdBackupStatus, S3/AzureBlob storage configs, encryption metadata)HCPEtcdBackupConfigwith platform-specific blocks (AWS/Azure) toManagedEtcdSpecfor HC→HCP propagation of backup encryption configmake hypershift-apiValidation
self == oldSelfon the entireHCPEtcdBackupSpec(one-shot backup request)storageType: S3requiress3block andstorageType: AzureBlobrequiresazureBlobblockawsorazureis specifiedkmsKeyARNrequires^arn:pattern,encryptionKeyURLrequires^https://pattern (following precedents inaws.go)kmsKeyARNandencryptionKeyURLare individually immutable viaself == oldSelfConventions
has()CEL, optional feature-gated struct)EncryptionMetadatain status is a value type (no nil vs zero semantic difference)omitempty(strings) oromitzero(struct pointers) per OpenShift API conventions+requiredmarkers only (no+kubebuilder:validation:Required)This is the first user story in the HCPEtcdBackup epic (CNTRLPLANE-2676). It defines the CRD types, feature gate, and propagation path. No controller logic is included.
JIRA
Test plan
go test ./hypershift-operator/featuregate/...— feature gate tests pass (HCPEtcdBackup disabled in Default, enabled in TechPreview)make hypershift-api— generates deepcopy and CRD manifests without errorsgo build ./...— full build compiles successfullygo test ./cmd/install/...— CRD install tests passManagedEtcdSpec.DeepCopyIntoincludes the newBackupfieldcmd/install/assets/hypershift-operator/zz_generated.crd-manifests/make lint-fix && make verify— linter and verify checks pass🤖 Generated with Claude Code
Summary by CodeRabbit