From 1c886766eb3e771e420294843beeee3bd60d98da Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 10 Jun 2026 10:53:42 -0400 Subject: [PATCH 01/11] feat(api): add CpuOptions with NestedVirtualization to AWSNodePoolPlatform Add CpuOptions struct with NestedVirtualization field to AWSNodePoolPlatform for configuring nested virtualization on EC2 instances (C8i, M8i, R8i families). - Add CpuOptions type with omitzero value semantics - Add MinProperties=1 validation marker - Regenerate deepcopy and featuregated CRD manifests Co-Authored-By: Claude Opus 4 --- api/hypershift/v1beta1/aws.go | 17 +++++++++++++++++ api/hypershift/v1beta1/zz_generated.deepcopy.go | 16 ++++++++++++++++ .../AAA_ungated.yaml | 15 +++++++++++++++ .../GCPPlatform.yaml | 15 +++++++++++++++ .../OSStreams.yaml | 15 +++++++++++++++ .../OpenStack.yaml | 15 +++++++++++++++ 6 files changed, 93 insertions(+) diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index 93effa553e8a..3391854d3014 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -75,6 +75,12 @@ type AWSNodePoolPlatform struct { // // +optional Placement *PlacementOptions `json:"placement,omitempty"` + + // cpuOptions specifies CPU configuration for EC2 instances. + // Supported on C8i, M8i, and R8i instance families. + // + // +optional + CpuOptions CpuOptions `json:"cpuOptions,omitzero,omitempty"` } // PlacementOptions specifies the placement options for the EC2 instances. @@ -176,6 +182,17 @@ const ( AWSResourceTagOverridePolicyDeny AWSResourceTagOverridePolicy = "Deny" ) +// CpuOptions specifies CPU configuration for EC2 instances. +// +kubebuilder:validation:MinProperties=1 +type CpuOptions struct { + // nestedVirtualization indicates whether to enable nested virtualization on the instance. + // Supported on C8i, M8i, and R8i instance families. + // + // +optional + // +kubebuilder:validation:Enum=enabled;disabled + NestedVirtualization string `json:"nestedVirtualization,omitempty"` +} + // MarketType describes the market type for EC2 instances. type MarketType string diff --git a/api/hypershift/v1beta1/zz_generated.deepcopy.go b/api/hypershift/v1beta1/zz_generated.deepcopy.go index 702745ff3476..7d4408d7d146 100644 --- a/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -350,6 +350,7 @@ func (in *AWSNodePoolPlatform) DeepCopyInto(out *AWSNodePoolPlatform) { *out = new(PlacementOptions) (*in).DeepCopyInto(*out) } + out.CpuOptions = in.CpuOptions } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSNodePoolPlatform. @@ -1634,6 +1635,21 @@ func (in *ControlPlaneVersionStatus) DeepCopy() *ControlPlaneVersionStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CpuOptions) DeepCopyInto(out *CpuOptions) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CpuOptions. +func (in *CpuOptions) DeepCopy() *CpuOptions { + if in == nil { + return nil + } + out := new(CpuOptions) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *DNSSpec) DeepCopyInto(out *DNSSpec) { *out = *in diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml index 2dd3ed7489bd..c4ccf8ff61df 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml @@ -409,6 +409,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml index 340287f3a459..20836549cff5 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml @@ -409,6 +409,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml index d931fdf9fa01..70b184e2cd4a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml @@ -442,6 +442,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml index 52db786bf579..25687a035620 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml @@ -409,6 +409,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. From 3c20084c17853dd9650ab597354663f989c83519 Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 10 Jun 2026 10:53:43 -0400 Subject: [PATCH 02/11] feat(cli): add --nested-virtualization flag for AWS cluster and nodepool creation Add --nested-virtualization flag to hypershift create cluster aws and hypershift create nodepool aws commands. When set, configures CpuOptions.NestedVirtualization on the NodePool's AWS platform spec. Co-Authored-By: Claude Opus 4 --- cmd/cluster/aws/create.go | 7 +++++++ cmd/nodepool/aws/create.go | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/cmd/cluster/aws/create.go b/cmd/cluster/aws/create.go index 119329243d02..f6156c929c53 100644 --- a/cmd/cluster/aws/create.go +++ b/cmd/cluster/aws/create.go @@ -62,6 +62,7 @@ type RawCreateOptions struct { AutoNode bool UseROSAManagedPolicies bool SharedRole bool + NestedVirtualization string } // validatedCreateOptions is a private wrapper that enforces a call of Validate() before Complete() can be invoked. @@ -407,6 +408,11 @@ func (o *CreateOptions) GenerateNodePools(constructor core.DefaultNodePoolConstr EncryptionKey: o.RootVolumeEncryptionKey, }, } + if o.NestedVirtualization != "" { + nodePool.Spec.Platform.AWS.CpuOptions = hyperv1.CpuOptions{ + NestedVirtualization: o.NestedVirtualization, + } + } nodePools = append(nodePools, nodePool) } return nodePools @@ -511,6 +517,7 @@ func bindCoreOptions(opts *RawCreateOptions, flags *flag.FlagSet) { flags.BoolVar(&opts.PublicOnly, "public-only", opts.PublicOnly, "If true, creates a cluster that does not have private subnets or NAT gateway and assigns public IPs to all instances.") flags.BoolVar(&opts.UseROSAManagedPolicies, "use-rosa-managed-policies", opts.UseROSAManagedPolicies, "Use ROSA managed policies for the operator roles and worker instance profile") flags.BoolVar(&opts.SharedRole, "shared-role", opts.SharedRole, "Create a single shared role with all role policies instead of individual component roles") + flags.StringVar(&opts.NestedVirtualization, "nested-virtualization", opts.NestedVirtualization, "Enable nested virtualization on EC2 instances (enabled or disabled). Supported on C8i, M8i, and R8i instance families.") _ = flags.MarkDeprecated("multi-arch", "Multi-arch validation is now performed automatically based on the release image and signaled in the HostedCluster.Status.PayloadArch.") } diff --git a/cmd/nodepool/aws/create.go b/cmd/nodepool/aws/create.go index 427fe3bb35e7..0bcd19dd8cdb 100644 --- a/cmd/nodepool/aws/create.go +++ b/cmd/nodepool/aws/create.go @@ -22,6 +22,7 @@ type AWSPlatformCreateOptions struct { RootVolumeIOPS int64 RootVolumeSize int64 RootVolumeEncryptionKey string + NestedVirtualization string } type RawAWSPlatformCreateOptions struct { @@ -104,6 +105,7 @@ func NewCreateCommand(coreOpts *core.CreateNodePoolOptions) *cobra.Command { } BindDeveloperOptions(platformOpts, cmd.Flags()) + cmd.Flags().StringVar(&platformOpts.NestedVirtualization, "nested-virtualization", platformOpts.NestedVirtualization, "Enable nested virtualization on EC2 instances (enabled or disabled). Supported on C8i, M8i, and R8i instance families.") cmd.RunE = func(cmd *cobra.Command, args []string) error { ctx := cmd.Context() @@ -171,6 +173,11 @@ func (o *CompletedAWSPlatformCreateOptions) UpdateNodePool(ctx context.Context, {ID: &o.SecurityGroupID}, } } + if o.NestedVirtualization != "" { + nodePool.Spec.Platform.AWS.CpuOptions = hyperv1.CpuOptions{ + NestedVirtualization: o.NestedVirtualization, + } + } return nil } From 84e81db39a145625fdde1812315b287d6be7b7ff Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 10 Jun 2026 10:53:43 -0400 Subject: [PATCH 03/11] feat(hypershift-operator): wire CpuOptions to AWSMachineTemplate for nested virtualization Propagate CpuOptions.NestedVirtualization from NodePool spec to CAPA AWSMachineTemplateSpec.CPUOptions during AWSMachineTemplate reconciliation. Co-Authored-By: Claude Opus 4 --- hypershift-operator/controllers/nodepool/aws.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hypershift-operator/controllers/nodepool/aws.go b/hypershift-operator/controllers/nodepool/aws.go index a2a6b2283854..501e0ae5e9a1 100644 --- a/hypershift-operator/controllers/nodepool/aws.go +++ b/hypershift-operator/controllers/nodepool/aws.go @@ -207,6 +207,10 @@ func buildAWSSecurityGroups(nodePool *hyperv1.NodePool, hostedCluster *hyperv1.H } func applyAWSPlacementOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachineTemplateSpec) { + if cpuOptions := nodePool.Spec.Platform.AWS.CpuOptions; cpuOptions.NestedVirtualization != "" { + spec.Template.Spec.CPUOptions.NestedVirtualization = capiaws.NestedVirtualizationPolicy(cpuOptions.NestedVirtualization) + } + placement := nodePool.Spec.Platform.AWS.Placement if placement == nil { return @@ -248,6 +252,7 @@ func applyAWSPlacementOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachi spec.Template.Spec.CapacityReservationID = capacityReservation.ID spec.Template.Spec.CapacityReservationPreference = capiaws.CapacityReservationPreference(capacityReservation.Preference) } + } func awsAdditionalTags(nodePool *hyperv1.NodePool, hostedCluster *hyperv1.HostedCluster, infraName string) capiaws.Tags { From b08cc1ca203dae923bd81639edbd33c74f96032e Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 10 Jun 2026 10:53:43 -0400 Subject: [PATCH 04/11] docs: regenerate API reference for CpuOptions Regenerate aggregated-docs.md and api.md to include the new CpuOptions type and NestedVirtualization field documentation. Co-Authored-By: Claude Opus 4 --- docs/content/reference/api.md | 46 +++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index 7e7407c6afc7..347e13993152 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -2024,6 +2024,21 @@ PlacementOptions

placement specifies the placement options for the EC2 instances.

+ + +cpuOptions,omitzero
+ + +CpuOptions + + + + +(Optional) +

cpuOptions specifies CPU configuration for EC2 instances. +Supported on C8i, M8i, and R8i instance families.

+ + ###AWSNodePoolResourceTag { #hypershift.openshift.io/v1beta1.AWSNodePoolResourceTag } @@ -7006,6 +7021,37 @@ int64 +###CpuOptions { #hypershift.openshift.io/v1beta1.CpuOptions } +

+(Appears on: +AWSNodePoolPlatform) +

+

+

CpuOptions specifies CPU configuration for EC2 instances.

+

+ + + + + + + + + + + + + +
FieldDescription
+nestedVirtualization
+ +string + +		 +(Optional) +

nestedVirtualization indicates whether to enable nested virtualization on the instance. +Supported on C8i, M8i, and R8i instance families.

+
###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }

(Appears on: From 111f6112bd0f0c09e11ba50f50fc148684f49417 Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 10 Jun 2026 11:29:08 -0400 Subject: [PATCH 05/11] fix(aws): require manifests for nested virtualization Remove the AWS create-time nested virtualization flags so this option is only set through rendered manifests where the instance type can be reviewed. Add API compatibility, controller, and envtest coverage for CpuOptions so the new field is protected against regressions. Signed-off-by: Jesse Jaggars Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Cursor --- api/hypershift/v1beta1/nodepool_types_test.go | 94 +++++++++++++++++++ cmd/cluster/aws/create.go | 8 -- .../stable.nodepools.aws.testsuite.yaml | 80 ++++++++++++++++ cmd/nodepool/aws/create.go | 7 -- .../controllers/nodepool/aws_test.go | 17 ++++ 5 files changed, 191 insertions(+), 15 deletions(-) diff --git a/api/hypershift/v1beta1/nodepool_types_test.go b/api/hypershift/v1beta1/nodepool_types_test.go index 1db4cc7ec75c..c329f3492544 100644 --- a/api/hypershift/v1beta1/nodepool_types_test.go +++ b/api/hypershift/v1beta1/nodepool_types_test.go @@ -17,6 +17,11 @@ type nodePoolAutoScalingNMinus1 struct { Max int32 `json:"max"` } +type awsNodePoolPlatformNMinus1 struct { + InstanceType string `json:"instanceType"` + Subnet AWSResourceReference `json:"subnet"` +} + func TestNodePoolAutoScalingSerializationCompatibility(t *testing.T) { tests := []struct { name string @@ -296,3 +301,92 @@ func TestAWSEndpointServiceResourceTagSerializationCompatibility(t *testing.T) { }) } } + +func TestAWSNodePoolPlatformSerializationCompatibility(t *testing.T) { + tests := []struct { + name string + // current is the N (current) version of the struct + current AWSNodePoolPlatform + // expectedJSON is the expected JSON output from marshalling current + expectedJSON string + // nMinus1Result is the expected result when unmarshalling into the N-1 struct + nMinus1Result awsNodePoolPlatformNMinus1 + }{ + { + name: "When cpuOptions are set it should round-trip to N-1", + current: AWSNodePoolPlatform{ + InstanceType: "m6i.large", + Subnet: AWSResourceReference{ + ID: ptr.To("subnet-1234567890abcdef0"), + }, + CpuOptions: CpuOptions{ + NestedVirtualization: "enabled", + }, + }, + expectedJSON: `{"instanceType":"m6i.large","subnet":{"id":"subnet-1234567890abcdef0"},"cpuOptions":{"nestedVirtualization":"enabled"}}`, + nMinus1Result: awsNodePoolPlatformNMinus1{ + InstanceType: "m6i.large", + Subnet: AWSResourceReference{ + ID: ptr.To("subnet-1234567890abcdef0"), + }, + }, + }, + { + name: "When cpuOptions are omitted it should preserve N-1 JSON shape", + current: AWSNodePoolPlatform{ + InstanceType: "m6i.large", + Subnet: AWSResourceReference{ + ID: ptr.To("subnet-1234567890abcdef0"), + }, + }, + expectedJSON: `{"instanceType":"m6i.large","subnet":{"id":"subnet-1234567890abcdef0"}}`, + nMinus1Result: awsNodePoolPlatformNMinus1{ + InstanceType: "m6i.large", + Subnet: AWSResourceReference{ + ID: ptr.To("subnet-1234567890abcdef0"), + }, + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + data, err := json.Marshal(tt.current) + if err != nil { + t.Fatalf("failed to marshal current struct: %v", err) + } + if string(data) != tt.expectedJSON { + t.Errorf("unexpected JSON output: got %s, want %s", string(data), tt.expectedJSON) + } + + var nMinus1 awsNodePoolPlatformNMinus1 + if err := json.Unmarshal(data, &nMinus1); err != nil { + t.Fatalf("N-1 failed to unmarshal JSON from N: %v", err) + } + if nMinus1.InstanceType != tt.nMinus1Result.InstanceType { + t.Errorf("N-1 instanceType mismatch: got %s, want %s", nMinus1.InstanceType, tt.nMinus1Result.InstanceType) + } + if ptr.Deref(nMinus1.Subnet.ID, "") != ptr.Deref(tt.nMinus1Result.Subnet.ID, "") { + t.Errorf("N-1 subnet ID mismatch: got %q, want %q", ptr.Deref(nMinus1.Subnet.ID, ""), ptr.Deref(tt.nMinus1Result.Subnet.ID, "")) + } + + nMinus1Data, err := json.Marshal(tt.nMinus1Result) + if err != nil { + t.Fatalf("failed to marshal N-1 struct: %v", err) + } + var roundTripped AWSNodePoolPlatform + if err := json.Unmarshal(nMinus1Data, &roundTripped); err != nil { + t.Fatalf("N failed to unmarshal JSON from N-1: %v", err) + } + if roundTripped.InstanceType != tt.nMinus1Result.InstanceType { + t.Errorf("InstanceType mismatch after N-1 round-trip: got %s, want %s", roundTripped.InstanceType, tt.nMinus1Result.InstanceType) + } + if ptr.Deref(roundTripped.Subnet.ID, "") != ptr.Deref(tt.nMinus1Result.Subnet.ID, "") { + t.Errorf("Subnet ID mismatch after N-1 round-trip: got %q, want %q", ptr.Deref(roundTripped.Subnet.ID, ""), ptr.Deref(tt.nMinus1Result.Subnet.ID, "")) + } + if roundTripped.CpuOptions != (CpuOptions{}) { + t.Errorf("CpuOptions mismatch after N-1 round-trip: got %+v, want zero value", roundTripped.CpuOptions) + } + }) + } +} diff --git a/cmd/cluster/aws/create.go b/cmd/cluster/aws/create.go index f6156c929c53..66c70188222f 100644 --- a/cmd/cluster/aws/create.go +++ b/cmd/cluster/aws/create.go @@ -62,7 +62,6 @@ type RawCreateOptions struct { AutoNode bool UseROSAManagedPolicies bool SharedRole bool - NestedVirtualization string } // validatedCreateOptions is a private wrapper that enforces a call of Validate() before Complete() can be invoked. @@ -408,11 +407,6 @@ func (o *CreateOptions) GenerateNodePools(constructor core.DefaultNodePoolConstr EncryptionKey: o.RootVolumeEncryptionKey, }, } - if o.NestedVirtualization != "" { - nodePool.Spec.Platform.AWS.CpuOptions = hyperv1.CpuOptions{ - NestedVirtualization: o.NestedVirtualization, - } - } nodePools = append(nodePools, nodePool) } return nodePools @@ -517,8 +511,6 @@ func bindCoreOptions(opts *RawCreateOptions, flags *flag.FlagSet) { flags.BoolVar(&opts.PublicOnly, "public-only", opts.PublicOnly, "If true, creates a cluster that does not have private subnets or NAT gateway and assigns public IPs to all instances.") flags.BoolVar(&opts.UseROSAManagedPolicies, "use-rosa-managed-policies", opts.UseROSAManagedPolicies, "Use ROSA managed policies for the operator roles and worker instance profile") flags.BoolVar(&opts.SharedRole, "shared-role", opts.SharedRole, "Create a single shared role with all role policies instead of individual component roles") - flags.StringVar(&opts.NestedVirtualization, "nested-virtualization", opts.NestedVirtualization, "Enable nested virtualization on EC2 instances (enabled or disabled). Supported on C8i, M8i, and R8i instance families.") - _ = flags.MarkDeprecated("multi-arch", "Multi-arch validation is now performed automatically based on the release image and signaled in the HostedCluster.Status.PayloadArch.") } diff --git a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml index 5b13721fed87..284a6ab71e48 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml @@ -4,6 +4,86 @@ crdName: nodepools.hypershift.openshift.io version: v1beta1 tests: onCreate: + # --- AWS CPU options validation --- + - name: when nested virtualization is enabled it should pass + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: NodePool + spec: + arch: amd64 + clusterName: some-cluster + management: + autoRepair: false + upgradeType: Replace + release: + image: quay.io/openshift-release-dev/ocp-release:4.17.0-rc.0-x86_64 + replicas: 0 + platform: + aws: + instanceProfile: a-profile + instanceType: m6i.large + rootVolume: + size: 120 + type: gp3 + subnet: + id: "subnet-any" + cpuOptions: + nestedVirtualization: enabled + type: AWS + + - name: when cpuOptions is empty it should fail + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: NodePool + spec: + arch: amd64 + clusterName: some-cluster + management: + autoRepair: false + upgradeType: Replace + release: + image: quay.io/openshift-release-dev/ocp-release:4.17.0-rc.0-x86_64 + replicas: 0 + platform: + aws: + instanceProfile: a-profile + instanceType: m6i.large + rootVolume: + size: 120 + type: gp3 + subnet: + id: "subnet-any" + cpuOptions: {} + type: AWS + expectedError: "platform.aws.cpuOptions: Invalid value: \"object\": should have at least 1 properties" + + - name: when nested virtualization has an invalid value it should fail + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: NodePool + spec: + arch: amd64 + clusterName: some-cluster + management: + autoRepair: false + upgradeType: Replace + release: + image: quay.io/openshift-release-dev/ocp-release:4.17.0-rc.0-x86_64 + replicas: 0 + platform: + aws: + instanceProfile: a-profile + instanceType: m6i.large + rootVolume: + size: 120 + type: gp3 + subnet: + id: "subnet-any" + cpuOptions: + nestedVirtualization: unsupported + type: AWS + expectedError: "Unsupported value: \"unsupported\": supported values: \"disabled\", \"enabled\"" + # --- AWS Placement / Capacity Reservation validation --- - name: when tenancy is host and capacity reservation is specified it should fail initial: | diff --git a/cmd/nodepool/aws/create.go b/cmd/nodepool/aws/create.go index 0bcd19dd8cdb..427fe3bb35e7 100644 --- a/cmd/nodepool/aws/create.go +++ b/cmd/nodepool/aws/create.go @@ -22,7 +22,6 @@ type AWSPlatformCreateOptions struct { RootVolumeIOPS int64 RootVolumeSize int64 RootVolumeEncryptionKey string - NestedVirtualization string } type RawAWSPlatformCreateOptions struct { @@ -105,7 +104,6 @@ func NewCreateCommand(coreOpts *core.CreateNodePoolOptions) *cobra.Command { } BindDeveloperOptions(platformOpts, cmd.Flags()) - cmd.Flags().StringVar(&platformOpts.NestedVirtualization, "nested-virtualization", platformOpts.NestedVirtualization, "Enable nested virtualization on EC2 instances (enabled or disabled). Supported on C8i, M8i, and R8i instance families.") cmd.RunE = func(cmd *cobra.Command, args []string) error { ctx := cmd.Context() @@ -173,11 +171,6 @@ func (o *CompletedAWSPlatformCreateOptions) UpdateNodePool(ctx context.Context, {ID: &o.SecurityGroupID}, } } - if o.NestedVirtualization != "" { - nodePool.Spec.Platform.AWS.CpuOptions = hyperv1.CpuOptions{ - NestedVirtualization: o.NestedVirtualization, - } - } return nil } diff --git a/hypershift-operator/controllers/nodepool/aws_test.go b/hypershift-operator/controllers/nodepool/aws_test.go index 6bff1cbf502e..0f805fbfbdd1 100644 --- a/hypershift-operator/controllers/nodepool/aws_test.go +++ b/hypershift-operator/controllers/nodepool/aws_test.go @@ -1826,6 +1826,7 @@ func TestApplyAWSPlacementOptions(t *testing.T) { testCases := []struct { name string nodePool *hyperv1.NodePool + expectedNestedVirtualization capiaws.NestedVirtualizationPolicy expectedSpotMarketOptions *capiaws.SpotMarketOptions expectedMarketType capiaws.MarketType expectedTenancy string @@ -1844,6 +1845,21 @@ func TestApplyAWSPlacementOptions(t *testing.T) { }, }, }, + { + name: "When nested virtualization is enabled, it should set CPUOptions on spec", + nodePool: &hyperv1.NodePool{ + Spec: hyperv1.NodePoolSpec{ + Platform: hyperv1.NodePoolPlatform{ + AWS: &hyperv1.AWSNodePoolPlatform{ + CpuOptions: hyperv1.CpuOptions{ + NestedVirtualization: "enabled", + }, + }, + }, + }, + }, + expectedNestedVirtualization: capiaws.NestedVirtualizationPolicyEnabled, + }, { name: "When marketType is Spot with no MaxPrice, it should set empty SpotMarketOptions", nodePool: &hyperv1.NodePool{ @@ -1990,6 +2006,7 @@ func TestApplyAWSPlacementOptions(t *testing.T) { spec := &capiaws.AWSMachineTemplateSpec{} applyAWSPlacementOptions(tc.nodePool, spec) + g.Expect(spec.Template.Spec.CPUOptions.NestedVirtualization).To(Equal(tc.expectedNestedVirtualization)) g.Expect(spec.Template.Spec.SpotMarketOptions).To(Equal(tc.expectedSpotMarketOptions)) g.Expect(spec.Template.Spec.MarketType).To(Equal(tc.expectedMarketType)) g.Expect(spec.Template.Spec.Tenancy).To(Equal(tc.expectedTenancy)) From 4f13ad38e9ad5babeec37bb308c00d77b43a0e8b Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 10 Jun 2026 13:36:05 -0400 Subject: [PATCH 06/11] docs: regenerate aggregated-docs.md Signed-off-by: Jesse Jaggars --- api/hypershift/v1beta1/nodepool_types_test.go | 6 ++++-- .../stable.nodepools.aws.testsuite.yaml | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/api/hypershift/v1beta1/nodepool_types_test.go b/api/hypershift/v1beta1/nodepool_types_test.go index c329f3492544..e0f4d4ada436 100644 --- a/api/hypershift/v1beta1/nodepool_types_test.go +++ b/api/hypershift/v1beta1/nodepool_types_test.go @@ -18,8 +18,10 @@ type nodePoolAutoScalingNMinus1 struct { } type awsNodePoolPlatformNMinus1 struct { - InstanceType string `json:"instanceType"` - Subnet AWSResourceReference `json:"subnet"` + // instanceType is the EC2 instance type. + InstanceType string `json:"instanceType"` //nolint:kubeapilinter // test-only N-1 compat struct + // subnet is the subnet reference. + Subnet AWSResourceReference `json:"subnet"` //nolint:kubeapilinter // test-only N-1 compat struct } func TestNodePoolAutoScalingSerializationCompatibility(t *testing.T) { diff --git a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml index 284a6ab71e48..75183406d365 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml @@ -55,7 +55,7 @@ tests: id: "subnet-any" cpuOptions: {} type: AWS - expectedError: "platform.aws.cpuOptions: Invalid value: \"object\": should have at least 1 properties" + expectedError: "cpuOptions in body should have at least 1 properties" - name: when nested virtualization has an invalid value it should fail initial: | @@ -82,7 +82,7 @@ tests: cpuOptions: nestedVirtualization: unsupported type: AWS - expectedError: "Unsupported value: \"unsupported\": supported values: \"disabled\", \"enabled\"" + expectedError: "Unsupported value: \"unsupported\": supported values: \"enabled\", \"disabled\"" # --- AWS Placement / Capacity Reservation validation --- - name: when tenancy is host and capacity reservation is specified it should fail From 0de600ac565d228c2d1499411ac0ee901f2a8045 Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Thu, 11 Jun 2026 09:47:36 -0400 Subject: [PATCH 07/11] fix(aws): use typed NestedVirtualizationPolicy enum and harden controller Replace raw string with typed NestedVirtualizationPolicy constants (enabled/disabled) for CpuOptions.NestedVirtualization. Add nil-guard for AWS platform in applyAWSMachineOptions. Expand test coverage with disabled and nil-platform cases in unit tests and CEL envtest suite. Regenerate client apply config and API docs. --- api/hypershift/v1beta1/aws.go | 15 +- api/hypershift/v1beta1/nodepool_types_test.go | 2 +- .../hypershift/v1beta1/cpuoptions.go | 42 + .../stable.nodepools.aws.testsuite.yaml | 26 + docs/content/reference/api.md | 1141 +++-------------- .../controllers/nodepool/aws.go | 8 +- .../controllers/nodepool/aws_test.go | 31 +- .../hypershift/api/hypershift/v1beta1/aws.go | 30 + 8 files changed, 310 insertions(+), 985 deletions(-) create mode 100644 client/applyconfiguration/hypershift/v1beta1/cpuoptions.go diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index 3391854d3014..c0712779a28a 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -183,6 +183,8 @@ const ( ) // CpuOptions specifies CPU configuration for EC2 instances. +// At least one field must be specified when cpuOptions is present. +// // +kubebuilder:validation:MinProperties=1 type CpuOptions struct { // nestedVirtualization indicates whether to enable nested virtualization on the instance. @@ -190,9 +192,20 @@ type CpuOptions struct { // // +optional // +kubebuilder:validation:Enum=enabled;disabled - NestedVirtualization string `json:"nestedVirtualization,omitempty"` + NestedVirtualization NestedVirtualizationPolicy `json:"nestedVirtualization,omitempty"` } +// NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled. +type NestedVirtualizationPolicy string + +const ( + // NestedVirtualizationEnabled enables nested virtualization on the instance. + NestedVirtualizationEnabled NestedVirtualizationPolicy = "enabled" + + // NestedVirtualizationDisabled disables nested virtualization on the instance. + NestedVirtualizationDisabled NestedVirtualizationPolicy = "disabled" +) + // MarketType describes the market type for EC2 instances. type MarketType string diff --git a/api/hypershift/v1beta1/nodepool_types_test.go b/api/hypershift/v1beta1/nodepool_types_test.go index e0f4d4ada436..e3d12ea0494a 100644 --- a/api/hypershift/v1beta1/nodepool_types_test.go +++ b/api/hypershift/v1beta1/nodepool_types_test.go @@ -322,7 +322,7 @@ func TestAWSNodePoolPlatformSerializationCompatibility(t *testing.T) { ID: ptr.To("subnet-1234567890abcdef0"), }, CpuOptions: CpuOptions{ - NestedVirtualization: "enabled", + NestedVirtualization: NestedVirtualizationEnabled, }, }, expectedJSON: `{"instanceType":"m6i.large","subnet":{"id":"subnet-1234567890abcdef0"},"cpuOptions":{"nestedVirtualization":"enabled"}}`, diff --git a/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go b/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go new file mode 100644 index 000000000000..9deed3e518ce --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go @@ -0,0 +1,42 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +import ( + hypershiftv1beta1 "github.com/openshift/hypershift/api/hypershift/v1beta1" +) + +// CpuOptionsApplyConfiguration represents a declarative configuration of the CpuOptions type for use +// with apply. +type CpuOptionsApplyConfiguration struct { + NestedVirtualization *hypershiftv1beta1.NestedVirtualizationPolicy `json:"nestedVirtualization,omitempty"` +} + +// CpuOptionsApplyConfiguration constructs a declarative configuration of the CpuOptions type for use with +// apply. +func CpuOptions() *CpuOptionsApplyConfiguration { + return &CpuOptionsApplyConfiguration{} +} + +// WithNestedVirtualization sets the NestedVirtualization field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the NestedVirtualization field is set to the value of the last call. +func (b *CpuOptionsApplyConfiguration) WithNestedVirtualization(value hypershiftv1beta1.NestedVirtualizationPolicy) *CpuOptionsApplyConfiguration { + b.NestedVirtualization = &value + return b +} diff --git a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml index 75183406d365..ab8c1824f59b 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml @@ -31,6 +31,32 @@ tests: nestedVirtualization: enabled type: AWS + - name: when nested virtualization is disabled it should pass + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: NodePool + spec: + arch: amd64 + clusterName: some-cluster + management: + autoRepair: false + upgradeType: Replace + release: + image: quay.io/openshift-release-dev/ocp-release:4.17.0-rc.0-x86_64 + replicas: 0 + platform: + aws: + instanceProfile: a-profile + instanceType: m6i.large + rootVolume: + size: 120 + type: gp3 + subnet: + id: "subnet-any" + cpuOptions: + nestedVirtualization: disabled + type: AWS + - name: when cpuOptions is empty it should fail initial: | apiVersion: hypershift.openshift.io/v1beta1 diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index 347e13993152..5515a8944204 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -1005,24 +1005,6 @@ Capabilities This field is optional and once set cannot be changed.

- - -monitoring,omitzero
- - -MonitoringSpec - - - - -(Optional) -

monitoring configures monitoring for the hosted cluster, including -forwarding of control plane metrics to the hosted cluster’s monitoring stack. -When omitted, metrics forwarding behavior is determined by the -hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility. -If neither is set, metrics forwarding is disabled.

- - @@ -1381,50 +1363,6 @@ NodePoolStatus -###AESCBCKeyStatus { #hypershift.openshift.io/v1beta1.AESCBCKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash -of its contents for fingerprinting.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-secret,omitzero
- - -SecretReference - - -		 -

secret is a reference to the secret containing the AESCBC key.

-
-dataHash
- -string - -		 -

dataHash is the hex-encoded SHA-256 hash of the secret’s “key” data field -at the time re-encryption completed.

-
###AESCBCSpec { #hypershift.openshift.io/v1beta1.AESCBCSpec }

(Appears on: @@ -1467,8 +1405,6 @@ Kubernetes core/v1.LocalObjectReference (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

-

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. -The system automatically manages the previous key via the status field.

@@ -1767,8 +1703,7 @@ string ###AWSKMSKeyEntry { #hypershift.openshift.io/v1beta1.AWSKMSKeyEntry }

(Appears on: -AWSKMSSpec, -SecretEncryptionKeyStatus) +AWSKMSSpec)

AWSKMSKeyEntry defines metadata to locate the encryption key in AWS

@@ -1847,8 +1782,6 @@ AWSKMSKeyEntry (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

-

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. -The system automatically manages the previous key via the status field.

@@ -2316,7 +2249,7 @@ addition to any security groups specified in the NodePool.

###AWSResourceReference { #hypershift.openshift.io/v1beta1.AWSResourceReference }

(Appears on: -AWSCloudProviderConfig, +AWSCloudProviderConfig, AWSNodePoolPlatform)

@@ -2364,6 +2297,7 @@ They are applied according to the rules defined by the AWS API: ###AWSResourceTag { #hypershift.openshift.io/v1beta1.AWSResourceTag }

+

AWSResourceTag is a tag to apply to AWS resources created for the cluster.

Deprecated: Use AWSClusterResourceTag, AWSNodePoolResourceTag, or AWSEndpointServiceResourceTag instead. AWSClusterResourceTag preserves the @@ -3292,7 +3226,7 @@ string ###AutoNode { #hypershift.openshift.io/v1beta1.AutoNode }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -3324,7 +3258,7 @@ ProvisionerConfig ###AutoNodeStatus { #hypershift.openshift.io/v1beta1.AutoNodeStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -3385,7 +3319,7 @@ Used by the metrics collector for billing aggregation.

###AvailabilityPolicy { #hypershift.openshift.io/v1beta1.AvailabilityPolicy }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -3510,113 +3444,12 @@ This is only valid for self-managed Azure.

###AzureClientID { #hypershift.openshift.io/v1beta1.AzureClientID }

(Appears on: -ManagedIdentity, +ManagedIdentity, WorkloadIdentity)

AzureClientID is a string that represents the client ID of a managed identity.

-###AzureContainerRegistryConfig { #hypershift.openshift.io/v1beta1.AzureContainerRegistryConfig } -

-(Appears on: -AzurePlatformSpec) -

-

-

AzureContainerRegistryConfig configures Azure Container Registry integration for a hosted cluster.

-

- - - - - - - - - - - - - -
FieldDescription
-credentials,omitzero
- - -AzureContainerRegistryCredentialConfig - - -		 -

credentials configures authentication for worker nodes pulling images from ACR -using a user-assigned managed identity. -The identity does not need to be in the same subscription or resource group as the -HostedCluster, but it must be in the same Azure AD tenant. The management cluster’s -CAPZ identity must have Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action -on the identity’s scope to attach it to worker virtual machines at creation time.

-
-###AzureContainerRegistryCredentialConfig { #hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialConfig } -

-(Appears on: -AzureContainerRegistryConfig) -

-

-

AzureContainerRegistryCredentialConfig configures authentication credentials for Azure Container Registry.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-type
- - -AzureContainerRegistryCredentialType - - -		 -

type specifies the credential type used for ACR image pulls.

-
-managedIdentity,omitzero
- - -UserAssignedManagedIdentity - - -		 -(Optional) -

managedIdentity identifies the user-assigned managed identity used for ACR image pulls.

-
-###AzureContainerRegistryCredentialType { #hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialType } -

-(Appears on: -AzureContainerRegistryCredentialConfig) -

-

-

AzureContainerRegistryCredentialType identifies the type of credential used for ACR image pulls.

-

- - - - - - - - - - -
ValueDescription

"ManagedIdentity"

AzureContainerRegistryCredentialManagedIdentity uses a user-assigned managed identity for ACR authentication.

-
###AzureDiagnosticsStorageAccountType { #hypershift.openshift.io/v1beta1.AzureDiagnosticsStorageAccountType }

(Appears on: @@ -3697,8 +3530,7 @@ applications and dev/test.

###AzureKMSKey { #hypershift.openshift.io/v1beta1.AzureKMSKey }

(Appears on: -AzureKMSSpec, -SecretEncryptionKeyStatus) +AzureKMSSpec)

@@ -3789,8 +3621,6 @@ AzureKMSKey (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

-

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. -The system automatically manages the previous key via the status field.

@@ -3869,15 +3699,6 @@ and traffic must be routed through the private router (Swift).

-###AzureManagedIdentityResourceID { #hypershift.openshift.io/v1beta1.AzureManagedIdentityResourceID } -

-(Appears on: -UserAssignedManagedIdentity) -

-

-

AzureManagedIdentityResourceID is an ARM resource ID for a user-assigned managed identity -in the format /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{name}.

-

###AzureMarketplaceImage { #hypershift.openshift.io/v1beta1.AzureMarketplaceImage }

(Appears on: @@ -4346,24 +4167,6 @@ string -containerRegistry,omitzero
- - -AzureContainerRegistryConfig - - - - -(Optional) -

containerRegistry configures how worker nodes authenticate to Azure Container Registry (ACR). -When set, the managed identity is attached to worker virtual machines and its resource ID is -written into the worker cloud provider config so kubelet’s ACR credential provider can -authenticate without image pull secrets. -Changing this value will trigger a rollout for all existing NodePools in the cluster.

- - - - topology
@@ -4923,7 +4726,7 @@ Azure’s API.

###AzureSubnetResourceID { #hypershift.openshift.io/v1beta1.AzureSubnetResourceID }

(Appears on: -AzurePrivateLinkServiceSpec, +AzurePrivateLinkServiceSpec, AzurePrivateLinkSpec)

@@ -4935,7 +4738,7 @@ The expected format is:

###AzureSubscriptionID { #hypershift.openshift.io/v1beta1.AzureSubscriptionID }

(Appears on: -AzurePrivateLinkServiceSpec, +AzurePrivateLinkServiceSpec, AzurePrivateLinkSpec)

@@ -5271,7 +5074,7 @@ used in workload identity authentication for Azure Private Link Service operatio ###Capabilities { #hypershift.openshift.io/v1beta1.Capabilities }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5442,7 +5245,7 @@ of an instance

###ClusterAutoscaling { #hypershift.openshift.io/v1beta1.ClusterAutoscaling }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5617,7 +5420,7 @@ Maximum of 3 expanders can be specified.

###ClusterConfiguration { #hypershift.openshift.io/v1beta1.ClusterConfiguration }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5899,7 +5702,7 @@ This is only consumed when NetworkType is OVNKubernetes.

###ClusterNetworking { #hypershift.openshift.io/v1beta1.ClusterNetworking }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -6059,7 +5862,7 @@ Defaults to “Normal”.

###ClusterVersionStatus { #hypershift.openshift.io/v1beta1.ClusterVersionStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -6301,14 +6104,6 @@ underlying cluster’s ClusterVersion.

ClusterVersionUpgradeable indicates the Upgradeable condition in the underlying cluster’s ClusterVersion.

-

"ConfigOperatorReconciliationSucceeded"

-

ConfigOperatorReconciliationSucceeded indicates if the HostedCluster Config -Operator (HCCO) reconciliation succeeded. The HCCO is responsible for -reconciling resources inside the hosted cluster (e.g. global configuration, -CRDs, RBAC, and connectivity checks). -A failure here often means a software bug, a non-stable cluster, or -connectivity issues between the control plane and the hosted cluster.

-

"Available"

ControlPlaneComponentAvailable indicates whether the ControlPlaneComponent is available.

@@ -6346,13 +6141,6 @@ A failure here often means a software bug or a non-stable cluster.

most recent etcd backup. True means the last backup completed successfully; False means a backup is in progress or the last backup failed.

-

"EtcdDataEncryptionUpToDate"

-

EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the -currently active encryption key. -True: all data confirmed encrypted with the active key. -False: re-encryption is in progress or has failed. -Absent: encryption is not configured.

-

"EtcdRecoveryActive"

EtcdRecoveryActive indicates that the Etcd cluster is failing and the recovery job was triggered.

@@ -6554,7 +6342,7 @@ and reports missing images if any.

###ConfigurationStatus { #hypershift.openshift.io/v1beta1.ConfigurationStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -6685,7 +6473,7 @@ ControlPlaneComponentStatus (Optional)

conditions contains details for the current state of the ControlPlane Component. If there is an error, then the Available condition will be false.

-

Current condition types are: “Available”, “RolloutComplete”

+

Current condition types are: “Available”

@@ -6714,18 +6502,6 @@ string

resources is a list of the resources reconciled by this component.

- - -observedGeneration
- -int64 - - - -(Optional) -

observedGeneration reports which generation of the HostedControlPlane spec has been reconciled by this component.

- - ###ControlPlaneManagedIdentities { #hypershift.openshift.io/v1beta1.ControlPlaneManagedIdentities } @@ -6961,7 +6737,7 @@ string ###ControlPlaneVersionStatus { #hypershift.openshift.io/v1beta1.ControlPlaneVersionStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -7027,7 +6803,8 @@ int64 AWSNodePoolPlatform)

-

CpuOptions specifies CPU configuration for EC2 instances.

+

CpuOptions specifies CPU configuration for EC2 instances. +At least one field must be specified when cpuOptions is present.

@@ -7041,7 +6818,9 @@ int64
nestedVirtualization
-string + +NestedVirtualizationPolicy + 		@@ -7055,7 +6834,7 @@ Supported on C8i, M8i, and R8i instance families.

###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -7281,13 +7060,50 @@ UserManagedDiagnostics

-###EncryptionKeyReference { #hypershift.openshift.io/v1beta1.EncryptionKeyReference } +###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType } +

+(Appears on: +EtcdSpec) +

+

+

EtcdManagementType is a enum specifying the strategy for managing the cluster’s etcd instance

+

+ + + + + + + + + + + + +
ValueDescription

"Managed"

Managed means HyperShift should provision and operator the etcd cluster +automatically.

+

"Unmanaged"

Unmanaged means HyperShift will not provision or manage the etcd cluster, +and the user is responsible for doing so.

+
+###EtcdShardResource { #hypershift.openshift.io/v1beta1.EtcdShardResource }

(Appears on: -EncryptionMigrationHistory) +ManagedEtcdShardSpec, +UnmanagedEtcdShardSpec)

-

EncryptionKeyReference identifies an encryption key by its provider and fingerprint.

+

EtcdShardResource identifies a Kubernetes resource type to be routed to an +etcd shard. It is used to build the KAS –etcd-servers-overrides flag. +The combination of apiGroup and resource uniquely identifies a resource type.

+

Routing only takes effect for resource types compiled into the +kube-apiserver binary (built-in types such as events, pods, or +coordination.k8s.io/leases). This is a kube-apiserver limitation: +–etcd-servers-overrides does not apply to other resource types. In +particular, resources backed by CustomResourceDefinitions and resources +served by aggregated API servers (such as the openshift.io groups served +by openshift-apiserver and oauth-apiserver) are NOT routed: entries for +such resources are accepted but have no effect, and their data remains in +the default shard while the configured shard stays empty.

@@ -7299,37 +7115,46 @@ UserManagedDiagnostics
-provider
+apiGroup
- -SecretEncryptionProvider - +string 		-

provider identifies the encryption provider.

+

apiGroup is the API group of the resource (e.g., “coordination.k8s.io” +for leases). An empty string designates the core API group (e.g., +events, pods, configmaps). For core-group resources, specify +apiGroup: “” explicitly (e.g., {apiGroup: “”, resource: “events”}). +When non-empty, must be at most 253 characters in length and consist +of only lowercase alphanumeric characters, hyphens and periods. Each +period separated segment must start and end with an alphanumeric +character.
-fingerprint
+resource
string 		-

fingerprint is the hex-encoded SHA-256 hash of the key’s identity fields.

+

resource is the plural resource name (e.g., “events”, “leases”, +“configmaps”). Must be a valid DNS label (RFC 1123): lowercase +alphanumeric characters or hyphens, starting and ending with an +alphanumeric character, max 63 characters.
-###EncryptionMigrationHistory { #hypershift.openshift.io/v1beta1.EncryptionMigrationHistory } +###EtcdShardSchedulingSpec { #hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec }

(Appears on: -SecretEncryptionStatus) +ManagedEtcdShardSpec, +ManagedEtcdSpec)

-

EncryptionMigrationHistory records a key rotation, including in-progress rotations.

+

EtcdShardSchedulingSpec configures pod placement for a single etcd shard.

@@ -7341,280 +7166,72 @@ string + +
-from,omitzero
+nodeSelector
- -EncryptionKeyReference - +map[string]string 		-

from is the key that data was migrated from (the previous active key).

+(Optional) +

nodeSelector constrains this shard’s pods to nodes matching the +specified labels, in addition to the framework’s control plane node +selector. Keys and values must be valid Kubernetes label key/value +pairs. Maximum 16 entries.
-to,omitzero
+tolerations
- -EncryptionKeyReference + +[]Kubernetes core/v1.Toleration 		-

to is the key that data was migrated to (the target key).

+(Optional) +

tolerations allows this shard’s pods to schedule on nodes with +matching taints, in addition to the framework’s control plane +tolerations. Maximum 16 entries.
+###EtcdSpec { #hypershift.openshift.io/v1beta1.EtcdSpec } +

+(Appears on: +HostedClusterSpec, +HostedControlPlaneSpec) +

+

+

EtcdSpec specifies configuration for a control plane etcd cluster.

+

+ + + + + + + + - - - - - - - -
FieldDescription
-state
+managementType
- -EncryptionMigrationState + +EtcdManagementType 		-

state tracks the current phase of this rotation.

+

managementType defines how the etcd cluster is managed. +This can be either Managed or Unmanaged. +This field is immutable.
-startedTime,omitzero
- - -Kubernetes meta/v1.Time - - -		 -

startedTime is when the rotation was initiated.

-
-completionTime,omitzero
- - -Kubernetes meta/v1.Time - - -		 -(Optional) -

completionTime is when the rotation finished. Not set while the rotation is in progress.

-
-###EncryptionMigrationState { #hypershift.openshift.io/v1beta1.EncryptionMigrationState } -

-(Appears on: -EncryptionMigrationHistory) -

-

-

EncryptionMigrationState tracks the lifecycle of a key rotation.

-

- - - - - - - - - - - - - - - - - - -
ValueDescription

"Completed"

EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key.

-

"Interrupted"

EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted -with the target key (e.g., targetKey replaced during ReadOnlyDeploy).

-

"Migrating"

EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write -provider and re-encryption (StorageVersionMigration) is in progress.

-

"ReadOnlyDeploy"

EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only -provider. The old key remains the write provider.

-

"WritePromote"

EncryptionMigrationStateWritePromote means the new key is being promoted to write provider. -The old key becomes read-only.

-
-###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType } -

-(Appears on: -EtcdSpec) -

-

-

EtcdManagementType is a enum specifying the strategy for managing the cluster’s etcd instance

-

- - - - - - - - - - - - -
ValueDescription

"Managed"

Managed means HyperShift should provision and operator the etcd cluster -automatically.

-

"Unmanaged"

Unmanaged means HyperShift will not provision or manage the etcd cluster, -and the user is responsible for doing so.

-
-###EtcdShardResource { #hypershift.openshift.io/v1beta1.EtcdShardResource } -

-(Appears on: -ManagedEtcdShardSpec, -UnmanagedEtcdShardSpec) -

-

-

EtcdShardResource identifies a Kubernetes resource type to be routed to an -etcd shard. It is used to build the KAS –etcd-servers-overrides flag. -The combination of apiGroup and resource uniquely identifies a resource type.

-

Routing only takes effect for resource types compiled into the -kube-apiserver binary (built-in types such as events, pods, or -coordination.k8s.io/leases). This is a kube-apiserver limitation: -–etcd-servers-overrides does not apply to other resource types. In -particular, resources backed by CustomResourceDefinitions and resources -served by aggregated API servers (such as the openshift.io groups served -by openshift-apiserver and oauth-apiserver) are NOT routed: entries for -such resources are accepted but have no effect, and their data remains in -the default shard while the configured shard stays empty.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-apiGroup
- -string - -		 -

apiGroup is the API group of the resource (e.g., “coordination.k8s.io” -for leases). An empty string designates the core API group (e.g., -events, pods, configmaps). For core-group resources, specify -apiGroup: “” explicitly (e.g., {apiGroup: “”, resource: “events”}). -When non-empty, must be at most 253 characters in length and consist -of only lowercase alphanumeric characters, hyphens and periods. Each -period separated segment must start and end with an alphanumeric -character.

-
-resource
- -string - -		 -

resource is the plural resource name (e.g., “events”, “leases”, -“configmaps”). Must be a valid DNS label (RFC 1123): lowercase -alphanumeric characters or hyphens, starting and ending with an -alphanumeric character, max 63 characters.

-
-###EtcdShardSchedulingSpec { #hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec } -

-(Appears on: -ManagedEtcdShardSpec, -ManagedEtcdSpec) -

-

-

EtcdShardSchedulingSpec configures pod placement for a single etcd shard.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-nodeSelector
- -map[string]string - -		 -(Optional) -

nodeSelector constrains this shard’s pods to nodes matching the -specified labels, in addition to the framework’s control plane node -selector. Keys and values must be valid Kubernetes label key/value -pairs. Maximum 16 entries.

-
-tolerations
- - -[]Kubernetes core/v1.Toleration - - -		 -(Optional) -

tolerations allows this shard’s pods to schedule on nodes with -matching taints, in addition to the framework’s control plane -tolerations. Maximum 16 entries.

-
-###EtcdSpec { #hypershift.openshift.io/v1beta1.EtcdSpec } -

-(Appears on: -HostedClusterSpec, -HostedControlPlaneSpec) -

-

-

EtcdSpec specifies configuration for a control plane etcd cluster.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-managementType
- - -EtcdManagementType - - -		 -

managementType defines how the etcd cluster is managed. -This can be either Managed or Unmanaged. -This field is immutable.

-
-managed
+managed
ManagedEtcdSpec @@ -7747,8 +7364,8 @@ string ###FilterByNeutronTags { #hypershift.openshift.io/v1beta1.FilterByNeutronTags }

(Appears on: -NetworkFilter, -RouterFilter, +NetworkFilter, +RouterFilter, SubnetFilter)

@@ -8569,7 +8186,7 @@ Standard instances run until explicitly stopped and are not subject to automatic ###GCPResourceLabel { #hypershift.openshift.io/v1beta1.GCPResourceLabel }

(Appears on: -GCPNodePoolPlatform, +GCPNodePoolPlatform, GCPPlatformSpec)

@@ -8622,8 +8239,8 @@ See https://c ###GCPResourceName { #hypershift.openshift.io/v1beta1.GCPResourceName }

(Appears on: -GCPNodePoolPlatform, -GCPPrivateServiceConnectSpec, +GCPNodePoolPlatform, +GCPPrivateServiceConnectSpec, GCPResourceReference)

@@ -8672,7 +8289,7 @@ See https://clo ###GCPServiceAccountEmail { #hypershift.openshift.io/v1beta1.GCPServiceAccountEmail }

(Appears on: -GCPNodeServiceAccount, +GCPNodeServiceAccount, GCPServiceAccountsEmails)

@@ -10116,24 +9733,6 @@ Capabilities This field is optional and once set cannot be changed.
-monitoring,omitzero
- - -MonitoringSpec - - -		 -(Optional) -

monitoring configures monitoring for the hosted cluster, including -forwarding of control plane metrics to the hosted cluster’s monitoring stack. -When omitted, metrics forwarding behavior is determined by the -hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility. -If neither is set, metrics forwarding is disabled.

-
###HostedClusterStatus { #hypershift.openshift.io/v1beta1.HostedClusterStatus } @@ -10358,20 +9957,6 @@ successful etcd backup snapshot. Persisted here because HCPEtcdBackup CRs are ephemeral and may be deleted by retention policies.

- - -secretEncryption,omitzero
- - -SecretEncryptionStatus - - - - -(Optional) -

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

- - ###HostedControlPlaneSpec { #hypershift.openshift.io/v1beta1.HostedControlPlaneSpec } @@ -10717,22 +10302,6 @@ OperatorConfiguration -monitoring,omitzero
- - -MonitoringSpec - - - - -(Optional) -

monitoring configures monitoring for the hosted cluster, including -forwarding of control plane metrics to the hosted cluster’s monitoring stack. -When omitted, metrics forwarding is not configured and will be inactive.

- - - - imageContentSources
@@ -11176,20 +10745,6 @@ ConfigurationStatus

configuration contains the cluster configuration status of the HostedCluster

- - -secretEncryption,omitzero
- - -SecretEncryptionStatus - - - - -(Optional) -

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

- - ###IBMCloudKMSAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec } @@ -11280,8 +10835,7 @@ authentication to interact with IBM Cloud KMS APIs

###IBMCloudKMSKeyEntry { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry }

(Appears on: -IBMCloudKMSSpec, -SecretEncryptionKeyStatus) +IBMCloudKMSSpec)

IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key

@@ -11451,7 +11005,7 @@ call IBM Cloud KMS APIs

###IBMCloudPlatformSpec { #hypershift.openshift.io/v1beta1.IBMCloudPlatformSpec }

(Appears on: -NodePoolPlatform, +NodePoolPlatform, PlatformSpec)

@@ -11484,7 +11038,7 @@ github.com/openshift/api/config/v1.IBMCloudProviderType ###ImageContentSource { #hypershift.openshift.io/v1beta1.ImageContentSource }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -12563,7 +12117,7 @@ Value of Filesystem is implied when not included in claim spec.

###KubevirtPlatformCredentials { #hypershift.openshift.io/v1beta1.KubevirtPlatformCredentials }

(Appears on: -KubeVirtNodePoolStatus, +KubeVirtNodePoolStatus, KubevirtPlatformSpec)

@@ -13507,7 +13061,7 @@ is empty.

###ManagedIdentity { #hypershift.openshift.io/v1beta1.ManagedIdentity }

(Appears on: -AzureKMSSpec, +AzureKMSSpec, ControlPlaneManagedIdentities)

@@ -13577,7 +13131,7 @@ credentialsSecretName must also be unique within the Azure Key Vault. See more d ###MarketType { #hypershift.openshift.io/v1beta1.MarketType }

(Appears on: -CapacityReservationOptions, +CapacityReservationOptions, PlacementOptions)

@@ -13602,13 +13156,12 @@ Spot instances use spare EC2 capacity at reduced prices but may be interrupted.< -###MetricsForwardingMode { #hypershift.openshift.io/v1beta1.MetricsForwardingMode } +###MultiQueueSetting { #hypershift.openshift.io/v1beta1.MultiQueueSetting }

(Appears on: -MetricsForwardingSpec) +KubevirtNodePoolPlatform)

-

MetricsForwardingMode controls whether metrics forwarding is active for a hosted cluster.

@@ -13617,80 +13170,19 @@ Spot instances use spare EC2 capacity at reduced prices but may be interrupted.< - - - - + + + +
Description

"Forward"

MetricsForwardingModeForward indicates metrics forwarding is active.

-

"None"

MetricsForwardingModeNone indicates metrics forwarding is inactive.

-

"Disable"

"Enable"
-###MetricsForwardingSpec { #hypershift.openshift.io/v1beta1.MetricsForwardingSpec } +###NestedVirtualizationPolicy { #hypershift.openshift.io/v1beta1.NestedVirtualizationPolicy }

(Appears on: -MonitoringSpec) +CpuOptions)

-

MetricsForwardingSpec configures metrics forwarding for the hosted cluster.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-mode
- - -MetricsForwardingMode - - -		 -

mode controls whether metrics forwarding is active for this hosted cluster. -When set to “Forward”, metrics-proxy and endpoint-resolver are deployed in the -control plane, and a metrics-forwarder is deployed in the hosted cluster. -When set to “None”, metrics forwarding is inactive.

-
-metricsSet
- - -MetricsSet - - -		 -(Optional) -

metricsSet specifies which set of metrics to forward to the hosted -cluster’s monitoring stack. This controls only the metrics-proxy forwarding -path and does not affect management-cluster-side ServiceMonitor/PodMonitor -relabel configurations. -When not specified, the value from monitoring.metricsSet is used, which itself -falls back to the global METRICS_SET environment variable (default “Telemetry”).

-

“Telemetry” forwards only the minimal set of metrics required for OpenShift Telemetry. -“SRE” forwards the Telemetry set plus additional metrics defined in the sre-metric-set -ConfigMap, needed for SRE dashboards and alerts. -“All” forwards all metrics from control plane components without filtering, -which produces significantly higher metrics volume.

-
-###MetricsSet { #hypershift.openshift.io/v1beta1.MetricsSet } -

-(Appears on: -MetricsForwardingSpec, -MonitoringSpec) -

-

-

MetricsSet specifies the set of metrics to collect and forward from hosted clusters.

+

NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled.

@@ -13699,101 +13191,12 @@ which produces significantly higher metrics volume.

- - - - - - - -
Description

"All"

MetricsSetAll collects all metrics from control plane components without -any filtering. Use this for debugging or when full metric visibility is -needed, but be aware it produces significantly higher metrics volume.

-

"SRE"

MetricsSetSRE collects the metrics defined in the sre-metric-set ConfigMap, -which includes the Telemetry set plus additional metrics needed for SRE -monitoring dashboards and alerts. Use this for clusters that require -SRE observability.

-

"Telemetry"

MetricsSetTelemetry collects only the minimal set of metrics required for -OpenShift Telemetry. Use this to minimize metrics volume while still -satisfying cluster telemetry requirements.

-
-###MonitoringSpec { #hypershift.openshift.io/v1beta1.MonitoringSpec } -

-(Appears on: -HostedClusterSpec, -HostedControlPlaneSpec) -

-

-

MonitoringSpec configures monitoring for the hosted cluster. -At least one field must be specified when this struct is present.

-

- - - - - - - - - - - + - - - + - - - -
FieldDescription
-metricsForwarding,omitzero
- - -MetricsForwardingSpec - - -		 -(Optional) -

metricsForwarding configures forwarding of control plane metrics into -the hosted cluster’s monitoring stack. -When omitted, metrics forwarding behavior is determined by the -hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility. -If neither is set, metrics forwarding is disabled.

+

"disabled"

NestedVirtualizationDisabled disables nested virtualization on the instance.

-metricsSet
- - -MetricsSet - - +

"enabled"

NestedVirtualizationEnabled enables nested virtualization on the instance.

 -(Optional) -

metricsSet specifies which set of metrics to collect and forward. -This overrides the global METRICS_SET environment variable configured on the HyperShift Operator. -When not specified, the global METRICS_SET value is used, which defaults to “Telemetry”.

-

“Telemetry” collects only the minimal set of metrics required for OpenShift Telemetry. -“SRE” collects the Telemetry set plus additional metrics defined in the sre-metric-set ConfigMap, -needed for SRE dashboards and alerts. -“All” collects all metrics from control plane components without filtering, -which produces significantly higher metrics volume.

-
-###MultiQueueSetting { #hypershift.openshift.io/v1beta1.MultiQueueSetting } -

-(Appears on: -KubevirtNodePoolPlatform) -

-

-

- - - - - - - - - - -
ValueDescription

"Disable"

"Enable"
###NetworkFilter { #hypershift.openshift.io/v1beta1.NetworkFilter } @@ -13870,7 +13273,7 @@ FilterByNeutronTags ###NetworkParam { #hypershift.openshift.io/v1beta1.NetworkParam }

(Appears on: -OpenStackPlatformSpec, +OpenStackPlatformSpec, PortSpec)

@@ -13975,7 +13378,7 @@ int32

min is the minimum number of nodes to maintain in the pool. -Can be set to 0 for scale-from-zero for AWS and Azure platforms. +Can be set to 0 for scale-from-zero for AWS platform. Must be >= 0 and <= .Max.

@@ -14885,7 +14288,7 @@ progress and detecting stuck nodes.

###OLMCatalogPlacement { #hypershift.openshift.io/v1beta1.OLMCatalogPlacement }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -14911,7 +14314,7 @@ the management cluster.

###OSImageStreamReference { #hypershift.openshift.io/v1beta1.OSImageStreamReference }

(Appears on: -NodePoolSpec, +NodePoolSpec, NodePoolStatus)

@@ -15504,7 +14907,7 @@ This value must be a valid IPv4 or IPv6 address.

###OperatorConfiguration { #hypershift.openshift.io/v1beta1.OperatorConfiguration }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -15774,7 +15177,7 @@ do not support Capacity Reservations. Compatible with “default” and ###PlatformSpec { #hypershift.openshift.io/v1beta1.PlatformSpec }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -15920,7 +15323,7 @@ GCPPlatformSpec ###PlatformStatus { #hypershift.openshift.io/v1beta1.PlatformStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -15953,8 +15356,8 @@ AWSPlatformStatus ###PlatformType { #hypershift.openshift.io/v1beta1.PlatformType }

(Appears on: -KarpenterConfig, -NodePoolPlatform, +KarpenterConfig, +NodePoolPlatform, PlatformSpec)

@@ -16598,7 +16001,7 @@ crn:v1:bluemix:public:iam::::serviceRole:Manager ###PowerVSResourceReference { #hypershift.openshift.io/v1beta1.PowerVSResourceReference }

(Appears on: -PowerVSNodePoolPlatform, +PowerVSNodePoolPlatform, PowerVSPlatformSpec)

@@ -16808,7 +16211,7 @@ KarpenterConfig ###Release { #hypershift.openshift.io/v1beta1.Release }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, NodePoolSpec)

@@ -17239,124 +16642,10 @@ When omitted, the autoscaler defaults to 50%.

-###SecretEncryptionKeyStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus } -

-(Appears on: -SecretEncryptionStatus) -

-

-

SecretEncryptionKeyStatus records the active key identity using the same types as the spec.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-provider
- - -SecretEncryptionProvider - - -		 -

provider identifies the encryption provider.

-
-azure,omitzero
- - -AzureKMSKey - - -		 -(Optional) -

azure holds the Azure KMS key identity fields.

-
-aws,omitzero
- - -AWSKMSKeyEntry - - -		 -(Optional) -

aws holds the AWS KMS key identity fields.

-
-ibmCloud,omitzero
- - -IBMCloudKMSKeyEntry - - -		 -(Optional) -

ibmCloud holds the IBM Cloud KMS key identity fields.

-
-aescbc,omitzero
- - -AESCBCKeyStatus - - -		 -(Optional) -

aescbc holds a reference to the AESCBC key secret.

-
-###SecretEncryptionProvider { #hypershift.openshift.io/v1beta1.SecretEncryptionProvider } -

-(Appears on: -EncryptionKeyReference, -SecretEncryptionKeyStatus) -

-

-

SecretEncryptionProvider identifies the encryption provider recorded in status. -This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC.

-

- - - - - - - - - - - - - - - - -
ValueDescription

"AESCBC"

"AWS"

"Azure"

"IBMCloud"

###SecretEncryptionSpec { #hypershift.openshift.io/v1beta1.SecretEncryptionSpec }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -17414,74 +16703,6 @@ AESCBCSpec -###SecretEncryptionStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionStatus } -

-(Appears on: -HostedClusterStatus, -HostedControlPlaneStatus) -

-

-

SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption.

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-activeKey,omitzero
- - -SecretEncryptionKeyStatus - - -		 -(Optional) -

activeKey is the encryption key specification that all etcd data is confirmed encrypted with. -Updated after successful re-encryption.

-
-targetKey,omitzero
- - -SecretEncryptionKeyStatus - - -		 -(Optional) -

targetKey is the key being rolled out during an active rotation. Snapshot from -spec.secretEncryption’s active key when the rotation starts. The CPO uses this -(not the current spec) during the rotation, so mid-rotation spec changes are -safely queued until the current rotation completes. Cleared when rotation completes.

-
-history
- - -[]EncryptionMigrationHistory - - -		 -(Optional) -

history contains a list of key rotations applied to this cluster. The newest -entry is first in the list. Entries have state Completed when re-encryption -has finished. The current rotation phase is always history[0].state when -history[0] is not Completed or Interrupted.

-
###SecretEncryptionType { #hypershift.openshift.io/v1beta1.SecretEncryptionType }

(Appears on: @@ -17508,8 +16729,7 @@ history[0] is not Completed or Interrupted.

###SecretReference { #hypershift.openshift.io/v1beta1.SecretReference }

(Appears on: -AESCBCKeyStatus, -HCPEtcdBackupAzureBlob, +HCPEtcdBackupAzureBlob, HCPEtcdBackupS3)

@@ -17647,7 +16867,7 @@ The specifics of the setup are platform dependent.

###ServicePublishingStrategyMapping { #hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -18204,41 +17424,6 @@ capacity.

-###UserAssignedManagedIdentity { #hypershift.openshift.io/v1beta1.UserAssignedManagedIdentity } -

-(Appears on: -AzureContainerRegistryCredentialConfig) -

-

-

UserAssignedManagedIdentity identifies a user-assigned managed identity by its ARM resource ID.

-

- - - - - - - - - - - - - -
FieldDescription
-resourceID
- - -AzureManagedIdentityResourceID - - -		 -

resourceID is the ARM resource ID of the user-assigned managed identity -in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. -The identity must have the AcrPull role on the target Azure Container Registry. -It does not need to be in the same subscription or resource group as the HostedCluster, -but it must be in the same Azure AD tenant.

-
###UserManagedDiagnostics { #hypershift.openshift.io/v1beta1.UserManagedDiagnostics }

(Appears on: @@ -18354,7 +17539,7 @@ string ###WorkloadIdentity { #hypershift.openshift.io/v1beta1.WorkloadIdentity }

(Appears on: -AzureKMSSpec, +AzureKMSSpec, AzureWorkloadIdentities)

diff --git a/hypershift-operator/controllers/nodepool/aws.go b/hypershift-operator/controllers/nodepool/aws.go index 501e0ae5e9a1..926a6341346b 100644 --- a/hypershift-operator/controllers/nodepool/aws.go +++ b/hypershift-operator/controllers/nodepool/aws.go @@ -111,7 +111,7 @@ func awsMachineTemplateSpec(infraName string, hostedCluster *hyperv1.HostedClust }, } - applyAWSPlacementOptions(nodePool, awsMachineTemplateSpec) + applyAWSMachineOptions(nodePool, awsMachineTemplateSpec) if hostedCluster.Annotations[hyperv1.AWSMachinePublicIPs] == "true" { awsMachineTemplateSpec.Template.Spec.PublicIP = ptr.To(true) @@ -206,7 +206,11 @@ func buildAWSSecurityGroups(nodePool *hyperv1.NodePool, hostedCluster *hyperv1.H return securityGroups, nil } -func applyAWSPlacementOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachineTemplateSpec) { +func applyAWSMachineOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachineTemplateSpec) { + if nodePool.Spec.Platform.AWS == nil { + return + } + if cpuOptions := nodePool.Spec.Platform.AWS.CpuOptions; cpuOptions.NestedVirtualization != "" { spec.Template.Spec.CPUOptions.NestedVirtualization = capiaws.NestedVirtualizationPolicy(cpuOptions.NestedVirtualization) } diff --git a/hypershift-operator/controllers/nodepool/aws_test.go b/hypershift-operator/controllers/nodepool/aws_test.go index 0f805fbfbdd1..2b8f0cab9e9a 100644 --- a/hypershift-operator/controllers/nodepool/aws_test.go +++ b/hypershift-operator/controllers/nodepool/aws_test.go @@ -1820,7 +1820,7 @@ func TestBuildAWSSecurityGroups(t *testing.T) { } } -func TestApplyAWSPlacementOptions(t *testing.T) { +func TestApplyAWSMachineOptions(t *testing.T) { capacityReservationID := "cr-0123456789abcdef0" testCases := []struct { @@ -1852,7 +1852,7 @@ func TestApplyAWSPlacementOptions(t *testing.T) { Platform: hyperv1.NodePoolPlatform{ AWS: &hyperv1.AWSNodePoolPlatform{ CpuOptions: hyperv1.CpuOptions{ - NestedVirtualization: "enabled", + NestedVirtualization: hyperv1.NestedVirtualizationEnabled, }, }, }, @@ -1860,6 +1860,31 @@ func TestApplyAWSPlacementOptions(t *testing.T) { }, expectedNestedVirtualization: capiaws.NestedVirtualizationPolicyEnabled, }, + { + name: "When nested virtualization is disabled, it should set CPUOptions on spec", + nodePool: &hyperv1.NodePool{ + Spec: hyperv1.NodePoolSpec{ + Platform: hyperv1.NodePoolPlatform{ + AWS: &hyperv1.AWSNodePoolPlatform{ + CpuOptions: hyperv1.CpuOptions{ + NestedVirtualization: hyperv1.NestedVirtualizationDisabled, + }, + }, + }, + }, + }, + expectedNestedVirtualization: capiaws.NestedVirtualizationPolicyDisabled, + }, + { + name: "When AWS platform is nil, it should not modify spec", + nodePool: &hyperv1.NodePool{ + Spec: hyperv1.NodePoolSpec{ + Platform: hyperv1.NodePoolPlatform{ + AWS: nil, + }, + }, + }, + }, { name: "When marketType is Spot with no MaxPrice, it should set empty SpotMarketOptions", nodePool: &hyperv1.NodePool{ @@ -2004,7 +2029,7 @@ func TestApplyAWSPlacementOptions(t *testing.T) { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) spec := &capiaws.AWSMachineTemplateSpec{} - applyAWSPlacementOptions(tc.nodePool, spec) + applyAWSMachineOptions(tc.nodePool, spec) g.Expect(spec.Template.Spec.CPUOptions.NestedVirtualization).To(Equal(tc.expectedNestedVirtualization)) g.Expect(spec.Template.Spec.SpotMarketOptions).To(Equal(tc.expectedSpotMarketOptions)) diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go index 93effa553e8a..c0712779a28a 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go @@ -75,6 +75,12 @@ type AWSNodePoolPlatform struct { // // +optional Placement *PlacementOptions `json:"placement,omitempty"` + + // cpuOptions specifies CPU configuration for EC2 instances. + // Supported on C8i, M8i, and R8i instance families. + // + // +optional + CpuOptions CpuOptions `json:"cpuOptions,omitzero,omitempty"` } // PlacementOptions specifies the placement options for the EC2 instances. @@ -176,6 +182,30 @@ const ( AWSResourceTagOverridePolicyDeny AWSResourceTagOverridePolicy = "Deny" ) +// CpuOptions specifies CPU configuration for EC2 instances. +// At least one field must be specified when cpuOptions is present. +// +// +kubebuilder:validation:MinProperties=1 +type CpuOptions struct { + // nestedVirtualization indicates whether to enable nested virtualization on the instance. + // Supported on C8i, M8i, and R8i instance families. + // + // +optional + // +kubebuilder:validation:Enum=enabled;disabled + NestedVirtualization NestedVirtualizationPolicy `json:"nestedVirtualization,omitempty"` +} + +// NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled. +type NestedVirtualizationPolicy string + +const ( + // NestedVirtualizationEnabled enables nested virtualization on the instance. + NestedVirtualizationEnabled NestedVirtualizationPolicy = "enabled" + + // NestedVirtualizationDisabled disables nested virtualization on the instance. + NestedVirtualizationDisabled NestedVirtualizationPolicy = "disabled" +) + // MarketType describes the market type for EC2 instances. type MarketType string From ccc4a569a2866987459331686f518b9f03cc2ff1 Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Tue, 7 Jul 2026 11:09:36 -0400 Subject: [PATCH 08/11] fix: address CodeRabbit review feedback - Remove redundant omitempty from CpuOptions JSON tag (omitzero suffices for zero-value struct omission, matching SpotOptions pattern) - Add descriptive failure messages to all Gomega assertions in TestApplyAWSMachineOptions for easier debugging --- api/hypershift/v1beta1/aws.go | 2 +- .../hypershift/v1beta1/awsnodepoolplatform.go | 27 ++++--- client/applyconfiguration/utils.go | 2 + .../nodepools-CustomNoUpgrade.crd.yaml | 15 ++++ .../nodepools-Default.crd.yaml | 15 ++++ .../nodepools-TechPreviewNoUpgrade.crd.yaml | 15 ++++ docs/content/reference/aggregated-docs.md | 72 +++++++++++++++++++ .../controllers/nodepool/aws_test.go | 12 ++-- .../hypershift/api/hypershift/v1beta1/aws.go | 2 +- .../v1beta1/zz_generated.deepcopy.go | 16 +++++ 10 files changed, 161 insertions(+), 17 deletions(-) diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index c0712779a28a..b588f205e2a8 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -80,7 +80,7 @@ type AWSNodePoolPlatform struct { // Supported on C8i, M8i, and R8i instance families. // // +optional - CpuOptions CpuOptions `json:"cpuOptions,omitzero,omitempty"` + CpuOptions CpuOptions `json:"cpuOptions,omitzero"` } // PlacementOptions specifies the placement options for the EC2 instances. diff --git a/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go b/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go index d3e9abb2321e..e283a43c006a 100644 --- a/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go +++ b/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go @@ -24,15 +24,16 @@ import ( // AWSNodePoolPlatformApplyConfiguration represents a declarative configuration of the AWSNodePoolPlatform type for use // with apply. type AWSNodePoolPlatformApplyConfiguration struct { - InstanceType *string `json:"instanceType,omitempty"` - InstanceProfile *string `json:"instanceProfile,omitempty"` - Subnet *AWSResourceReferenceApplyConfiguration `json:"subnet,omitempty"` - AMI *string `json:"ami,omitempty"` - ImageType *hypershiftv1beta1.ImageType `json:"imageType,omitempty"` - SecurityGroups []AWSResourceReferenceApplyConfiguration `json:"securityGroups,omitempty"` - RootVolume *VolumeApplyConfiguration `json:"rootVolume,omitempty"` - ResourceTags []AWSNodePoolResourceTagApplyConfiguration `json:"resourceTags,omitempty"` - Placement *PlacementOptionsApplyConfiguration `json:"placement,omitempty"` + InstanceType *string `json:"instanceType,omitempty"` + InstanceProfile *string `json:"instanceProfile,omitempty"` + Subnet *AWSResourceReferenceApplyConfiguration `json:"subnet,omitempty"` + AMI *string `json:"ami,omitempty"` + ImageType *hypershiftv1beta1.ImageType `json:"imageType,omitempty"` + SecurityGroups []AWSResourceReferenceApplyConfiguration `json:"securityGroups,omitempty"` + RootVolume *VolumeApplyConfiguration `json:"rootVolume,omitempty"` + ResourceTags []AWSNodePoolResourceTagApplyConfiguration `json:"resourceTags,omitempty"` + Placement *PlacementOptionsApplyConfiguration `json:"placement,omitempty"` + CpuOptions *CpuOptionsApplyConfiguration `json:"cpuOptions,omitempty"` } // AWSNodePoolPlatformApplyConfiguration constructs a declarative configuration of the AWSNodePoolPlatform type for use with @@ -122,3 +123,11 @@ func (b *AWSNodePoolPlatformApplyConfiguration) WithPlacement(value *PlacementOp b.Placement = value return b } + +// WithCpuOptions sets the CpuOptions field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CpuOptions field is set to the value of the last call. +func (b *AWSNodePoolPlatformApplyConfiguration) WithCpuOptions(value *CpuOptionsApplyConfiguration) *AWSNodePoolPlatformApplyConfiguration { + b.CpuOptions = value + return b +} diff --git a/client/applyconfiguration/utils.go b/client/applyconfiguration/utils.go index 60aa551483d5..9288c7ed7dce 100644 --- a/client/applyconfiguration/utils.go +++ b/client/applyconfiguration/utils.go @@ -175,6 +175,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.ControlPlaneUpdateHistoryApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("ControlPlaneVersionStatus"): return &hypershiftv1beta1.ControlPlaneVersionStatusApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("CpuOptions"): + return &hypershiftv1beta1.CpuOptionsApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("DataPlaneManagedIdentities"): return &hypershiftv1beta1.DataPlaneManagedIdentitiesApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("Diagnostics"): diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml index c7223a9eddbf..e50b081853f6 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml @@ -445,6 +445,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml index fcc412213e2c..9a19f30378b5 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml @@ -412,6 +412,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml index 0bcefa0abd6a..98ee45db246c 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml @@ -445,6 +445,21 @@ spec: is chosen based on the NodePool release payload image. maxLength: 255 type: string + cpuOptions: + description: |- + cpuOptions specifies CPU configuration for EC2 instances. + Supported on C8i, M8i, and R8i instance families. + minProperties: 1 + properties: + nestedVirtualization: + description: |- + nestedVirtualization indicates whether to enable nested virtualization on the instance. + Supported on C8i, M8i, and R8i instance families. + enum: + - enabled + - disabled + type: string + type: object imageType: description: |- imageType specifies the type of image to use for node instances. diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index 1eeb3b030f55..df3f340963bf 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -41128,6 +41128,21 @@ PlacementOptions

placement specifies the placement options for the EC2 instances.

+ + +cpuOptions,omitzero
+ + +CpuOptions + + + + +(Optional) +

cpuOptions specifies CPU configuration for EC2 instances. +Supported on C8i, M8i, and R8i instance families.

+ + ###AWSNodePoolResourceTag { #hypershift.openshift.io/v1beta1.AWSNodePoolResourceTag } @@ -46110,6 +46125,40 @@ int64 +###CpuOptions { #hypershift.openshift.io/v1beta1.CpuOptions } +

+(Appears on: +AWSNodePoolPlatform) +

+

+

CpuOptions specifies CPU configuration for EC2 instances. +At least one field must be specified when cpuOptions is present.

+

+ + + + + + + + + + + + + +
FieldDescription
+nestedVirtualization
+ + +NestedVirtualizationPolicy + + +		 +(Optional) +

nestedVirtualization indicates whether to enable nested virtualization on the instance. +Supported on C8i, M8i, and R8i instance families.

+
###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }

(Appears on: @@ -52854,6 +52903,29 @@ which produces significantly higher metrics volume.

+###NestedVirtualizationPolicy { #hypershift.openshift.io/v1beta1.NestedVirtualizationPolicy } +

+(Appears on: +CpuOptions) +

+

+

NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled.

+

+ + + + + + + + + + + + +
ValueDescription

"disabled"

NestedVirtualizationDisabled disables nested virtualization on the instance.

+

"enabled"

NestedVirtualizationEnabled enables nested virtualization on the instance.

+
###NetworkFilter { #hypershift.openshift.io/v1beta1.NetworkFilter }

(Appears on: diff --git a/hypershift-operator/controllers/nodepool/aws_test.go b/hypershift-operator/controllers/nodepool/aws_test.go index 2b8f0cab9e9a..fee97c4fb941 100644 --- a/hypershift-operator/controllers/nodepool/aws_test.go +++ b/hypershift-operator/controllers/nodepool/aws_test.go @@ -2031,12 +2031,12 @@ func TestApplyAWSMachineOptions(t *testing.T) { spec := &capiaws.AWSMachineTemplateSpec{} applyAWSMachineOptions(tc.nodePool, spec) - g.Expect(spec.Template.Spec.CPUOptions.NestedVirtualization).To(Equal(tc.expectedNestedVirtualization)) - g.Expect(spec.Template.Spec.SpotMarketOptions).To(Equal(tc.expectedSpotMarketOptions)) - g.Expect(spec.Template.Spec.MarketType).To(Equal(tc.expectedMarketType)) - g.Expect(spec.Template.Spec.Tenancy).To(Equal(tc.expectedTenancy)) - g.Expect(spec.Template.Spec.CapacityReservationID).To(Equal(tc.expectedCapacityReservationID)) - g.Expect(spec.Template.Spec.CapacityReservationPreference).To(Equal(tc.expectedCapReservationPreference)) + g.Expect(spec.Template.Spec.CPUOptions.NestedVirtualization).To(Equal(tc.expectedNestedVirtualization), "CPUOptions.NestedVirtualization mismatch") + g.Expect(spec.Template.Spec.SpotMarketOptions).To(Equal(tc.expectedSpotMarketOptions), "SpotMarketOptions mismatch") + g.Expect(spec.Template.Spec.MarketType).To(Equal(tc.expectedMarketType), "MarketType mismatch") + g.Expect(spec.Template.Spec.Tenancy).To(Equal(tc.expectedTenancy), "Tenancy mismatch") + g.Expect(spec.Template.Spec.CapacityReservationID).To(Equal(tc.expectedCapacityReservationID), "CapacityReservationID mismatch") + g.Expect(spec.Template.Spec.CapacityReservationPreference).To(Equal(tc.expectedCapReservationPreference), "CapacityReservationPreference mismatch") }) } } diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go index c0712779a28a..b588f205e2a8 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go @@ -80,7 +80,7 @@ type AWSNodePoolPlatform struct { // Supported on C8i, M8i, and R8i instance families. // // +optional - CpuOptions CpuOptions `json:"cpuOptions,omitzero,omitempty"` + CpuOptions CpuOptions `json:"cpuOptions,omitzero"` } // PlacementOptions specifies the placement options for the EC2 instances. diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go index 702745ff3476..7d4408d7d146 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -350,6 +350,7 @@ func (in *AWSNodePoolPlatform) DeepCopyInto(out *AWSNodePoolPlatform) { *out = new(PlacementOptions) (*in).DeepCopyInto(*out) } + out.CpuOptions = in.CpuOptions } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSNodePoolPlatform. @@ -1634,6 +1635,21 @@ func (in *ControlPlaneVersionStatus) DeepCopy() *ControlPlaneVersionStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CpuOptions) DeepCopyInto(out *CpuOptions) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CpuOptions. +func (in *CpuOptions) DeepCopy() *CpuOptions { + if in == nil { + return nil + } + out := new(CpuOptions) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *DNSSpec) DeepCopyInto(out *DNSSpec) { *out = *in From 9b6af5e631e310fa193ee3f3ef1fe760aac71702 Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Wed, 12 Aug 2026 10:06:07 -0400 Subject: [PATCH 09/11] refactor(api): address PR review feedback for CpuOptions naming and conventions Rename CpuOptions to CPUOptions per Go acronym convention. Rename NestedVirtualization field to NestedVirtualizationPolicy to match the type name. Change enum values from lowercase enabled/disabled to PascalCase Enabled/Disabled per OpenShift API convention. Add explicit mapping in the controller between HyperShift and CAPA enum values. Add godoc comments documenting default behavior when cpuOptions is omitted and noting that reverting requires removing the entire cpuOptions field. Split applyAWSMachineOptions back into applyAWSPlacementOptions and a new applyAWSCPUOptions for better separation of concerns. Regenerate CRDs, deepcopy, client, and API docs. Signed-off-by: Jesse Jaggars Commit-Message-Assisted-by: Claude (via Claude Code) --- api/hypershift/v1beta1/aws.go | 20 +++-- api/hypershift/v1beta1/nodepool_types_test.go | 10 +-- .../v1beta1/zz_generated.deepcopy.go | 32 +++---- .../AAA_ungated.yaml | 12 ++- .../GCPPlatform.yaml | 12 ++- .../OSStreams.yaml | 12 ++- .../OpenStack.yaml | 12 ++- .../hypershift/v1beta1/awsnodepoolplatform.go | 10 +-- .../hypershift/v1beta1/cpuoptions.go | 20 ++--- client/applyconfiguration/utils.go | 4 +- .../stable.nodepools.aws.testsuite.yaml | 8 +- .../nodepools-CustomNoUpgrade.crd.yaml | 12 ++- .../nodepools-Default.crd.yaml | 12 ++- .../nodepools-TechPreviewNoUpgrade.crd.yaml | 12 ++- docs/content/reference/aggregated-docs.md | 84 ++++++++++--------- docs/content/reference/api.md | 84 ++++++++++--------- .../controllers/nodepool/aws.go | 18 +++- .../controllers/nodepool/aws_test.go | 11 +-- .../hypershift/api/hypershift/v1beta1/aws.go | 20 +++-- .../v1beta1/zz_generated.deepcopy.go | 32 +++---- 20 files changed, 246 insertions(+), 191 deletions(-) diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index b588f205e2a8..fd4b92a19791 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -78,9 +78,12 @@ type AWSNodePoolPlatform struct { // cpuOptions specifies CPU configuration for EC2 instances. // Supported on C8i, M8i, and R8i instance families. + // When omitted, AWS defaults are used (nested virtualization is not enabled). + // To revert to default behavior after setting cpuOptions, remove the entire + // cpuOptions field rather than clearing individual sub-fields. // // +optional - CpuOptions CpuOptions `json:"cpuOptions,omitzero"` + CPUOptions CPUOptions `json:"cpuOptions,omitzero"` } // PlacementOptions specifies the placement options for the EC2 instances. @@ -182,17 +185,18 @@ const ( AWSResourceTagOverridePolicyDeny AWSResourceTagOverridePolicy = "Deny" ) -// CpuOptions specifies CPU configuration for EC2 instances. +// CPUOptions specifies CPU configuration for EC2 instances. // At least one field must be specified when cpuOptions is present. // // +kubebuilder:validation:MinProperties=1 -type CpuOptions struct { - // nestedVirtualization indicates whether to enable nested virtualization on the instance. +type CPUOptions struct { + // nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. // Supported on C8i, M8i, and R8i instance families. + // When omitted, nested virtualization is not enabled (AWS default behavior). // // +optional - // +kubebuilder:validation:Enum=enabled;disabled - NestedVirtualization NestedVirtualizationPolicy `json:"nestedVirtualization,omitempty"` + // +kubebuilder:validation:Enum=Enabled;Disabled + NestedVirtualizationPolicy NestedVirtualizationPolicy `json:"nestedVirtualizationPolicy,omitempty"` } // NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled. @@ -200,10 +204,10 @@ type NestedVirtualizationPolicy string const ( // NestedVirtualizationEnabled enables nested virtualization on the instance. - NestedVirtualizationEnabled NestedVirtualizationPolicy = "enabled" + NestedVirtualizationEnabled NestedVirtualizationPolicy = "Enabled" // NestedVirtualizationDisabled disables nested virtualization on the instance. - NestedVirtualizationDisabled NestedVirtualizationPolicy = "disabled" + NestedVirtualizationDisabled NestedVirtualizationPolicy = "Disabled" ) // MarketType describes the market type for EC2 instances. diff --git a/api/hypershift/v1beta1/nodepool_types_test.go b/api/hypershift/v1beta1/nodepool_types_test.go index e3d12ea0494a..1878a8f3c561 100644 --- a/api/hypershift/v1beta1/nodepool_types_test.go +++ b/api/hypershift/v1beta1/nodepool_types_test.go @@ -321,11 +321,11 @@ func TestAWSNodePoolPlatformSerializationCompatibility(t *testing.T) { Subnet: AWSResourceReference{ ID: ptr.To("subnet-1234567890abcdef0"), }, - CpuOptions: CpuOptions{ - NestedVirtualization: NestedVirtualizationEnabled, + CPUOptions: CPUOptions{ + NestedVirtualizationPolicy: NestedVirtualizationEnabled, }, }, - expectedJSON: `{"instanceType":"m6i.large","subnet":{"id":"subnet-1234567890abcdef0"},"cpuOptions":{"nestedVirtualization":"enabled"}}`, + expectedJSON: `{"instanceType":"m6i.large","subnet":{"id":"subnet-1234567890abcdef0"},"cpuOptions":{"nestedVirtualizationPolicy":"Enabled"}}`, nMinus1Result: awsNodePoolPlatformNMinus1{ InstanceType: "m6i.large", Subnet: AWSResourceReference{ @@ -386,8 +386,8 @@ func TestAWSNodePoolPlatformSerializationCompatibility(t *testing.T) { if ptr.Deref(roundTripped.Subnet.ID, "") != ptr.Deref(tt.nMinus1Result.Subnet.ID, "") { t.Errorf("Subnet ID mismatch after N-1 round-trip: got %q, want %q", ptr.Deref(roundTripped.Subnet.ID, ""), ptr.Deref(tt.nMinus1Result.Subnet.ID, "")) } - if roundTripped.CpuOptions != (CpuOptions{}) { - t.Errorf("CpuOptions mismatch after N-1 round-trip: got %+v, want zero value", roundTripped.CpuOptions) + if roundTripped.CPUOptions != (CPUOptions{}) { + t.Errorf("CPUOptions mismatch after N-1 round-trip: got %+v, want zero value", roundTripped.CPUOptions) } }) } diff --git a/api/hypershift/v1beta1/zz_generated.deepcopy.go b/api/hypershift/v1beta1/zz_generated.deepcopy.go index 7d4408d7d146..ba1a014292df 100644 --- a/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -350,7 +350,7 @@ func (in *AWSNodePoolPlatform) DeepCopyInto(out *AWSNodePoolPlatform) { *out = new(PlacementOptions) (*in).DeepCopyInto(*out) } - out.CpuOptions = in.CpuOptions + out.CPUOptions = in.CPUOptions } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSNodePoolPlatform. @@ -1051,6 +1051,21 @@ func (in *AzureWorkloadIdentities) DeepCopy() *AzureWorkloadIdentities { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CPUOptions) DeepCopyInto(out *CPUOptions) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CPUOptions. +func (in *CPUOptions) DeepCopy() *CPUOptions { + if in == nil { + return nil + } + out := new(CPUOptions) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Capabilities) DeepCopyInto(out *Capabilities) { *out = *in @@ -1635,21 +1650,6 @@ func (in *ControlPlaneVersionStatus) DeepCopy() *ControlPlaneVersionStatus { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CpuOptions) DeepCopyInto(out *CpuOptions) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CpuOptions. -func (in *CpuOptions) DeepCopy() *CpuOptions { - if in == nil { - return nil - } - out := new(CpuOptions) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *DNSSpec) DeepCopyInto(out *DNSSpec) { *out = *in diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml index c4ccf8ff61df..97565a58cc68 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml @@ -413,15 +413,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml index 20836549cff5..bf13108a4f11 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/GCPPlatform.yaml @@ -413,15 +413,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml index 70b184e2cd4a..232927b25672 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OSStreams.yaml @@ -446,15 +446,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml index 25687a035620..86bf70105613 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml @@ -413,15 +413,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go b/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go index e283a43c006a..9b1f8997391c 100644 --- a/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go +++ b/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go @@ -33,7 +33,7 @@ type AWSNodePoolPlatformApplyConfiguration struct { RootVolume *VolumeApplyConfiguration `json:"rootVolume,omitempty"` ResourceTags []AWSNodePoolResourceTagApplyConfiguration `json:"resourceTags,omitempty"` Placement *PlacementOptionsApplyConfiguration `json:"placement,omitempty"` - CpuOptions *CpuOptionsApplyConfiguration `json:"cpuOptions,omitempty"` + CPUOptions *CPUOptionsApplyConfiguration `json:"cpuOptions,omitempty"` } // AWSNodePoolPlatformApplyConfiguration constructs a declarative configuration of the AWSNodePoolPlatform type for use with @@ -124,10 +124,10 @@ func (b *AWSNodePoolPlatformApplyConfiguration) WithPlacement(value *PlacementOp return b } -// WithCpuOptions sets the CpuOptions field in the declarative configuration to the given value +// WithCPUOptions sets the CPUOptions field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CpuOptions field is set to the value of the last call. -func (b *AWSNodePoolPlatformApplyConfiguration) WithCpuOptions(value *CpuOptionsApplyConfiguration) *AWSNodePoolPlatformApplyConfiguration { - b.CpuOptions = value +// If called multiple times, the CPUOptions field is set to the value of the last call. +func (b *AWSNodePoolPlatformApplyConfiguration) WithCPUOptions(value *CPUOptionsApplyConfiguration) *AWSNodePoolPlatformApplyConfiguration { + b.CPUOptions = value return b } diff --git a/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go b/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go index 9deed3e518ce..8108c38ccfa4 100644 --- a/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go +++ b/client/applyconfiguration/hypershift/v1beta1/cpuoptions.go @@ -21,22 +21,22 @@ import ( hypershiftv1beta1 "github.com/openshift/hypershift/api/hypershift/v1beta1" ) -// CpuOptionsApplyConfiguration represents a declarative configuration of the CpuOptions type for use +// CPUOptionsApplyConfiguration represents a declarative configuration of the CPUOptions type for use // with apply. -type CpuOptionsApplyConfiguration struct { - NestedVirtualization *hypershiftv1beta1.NestedVirtualizationPolicy `json:"nestedVirtualization,omitempty"` +type CPUOptionsApplyConfiguration struct { + NestedVirtualizationPolicy *hypershiftv1beta1.NestedVirtualizationPolicy `json:"nestedVirtualizationPolicy,omitempty"` } -// CpuOptionsApplyConfiguration constructs a declarative configuration of the CpuOptions type for use with +// CPUOptionsApplyConfiguration constructs a declarative configuration of the CPUOptions type for use with // apply. -func CpuOptions() *CpuOptionsApplyConfiguration { - return &CpuOptionsApplyConfiguration{} +func CPUOptions() *CPUOptionsApplyConfiguration { + return &CPUOptionsApplyConfiguration{} } -// WithNestedVirtualization sets the NestedVirtualization field in the declarative configuration to the given value +// WithNestedVirtualizationPolicy sets the NestedVirtualizationPolicy field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the NestedVirtualization field is set to the value of the last call. -func (b *CpuOptionsApplyConfiguration) WithNestedVirtualization(value hypershiftv1beta1.NestedVirtualizationPolicy) *CpuOptionsApplyConfiguration { - b.NestedVirtualization = &value +// If called multiple times, the NestedVirtualizationPolicy field is set to the value of the last call. +func (b *CPUOptionsApplyConfiguration) WithNestedVirtualizationPolicy(value hypershiftv1beta1.NestedVirtualizationPolicy) *CPUOptionsApplyConfiguration { + b.NestedVirtualizationPolicy = &value return b } diff --git a/client/applyconfiguration/utils.go b/client/applyconfiguration/utils.go index 9288c7ed7dce..cee870fc9336 100644 --- a/client/applyconfiguration/utils.go +++ b/client/applyconfiguration/utils.go @@ -175,8 +175,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.ControlPlaneUpdateHistoryApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("ControlPlaneVersionStatus"): return &hypershiftv1beta1.ControlPlaneVersionStatusApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("CpuOptions"): - return &hypershiftv1beta1.CpuOptionsApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("CPUOptions"): + return &hypershiftv1beta1.CPUOptionsApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("DataPlaneManagedIdentities"): return &hypershiftv1beta1.DataPlaneManagedIdentitiesApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("Diagnostics"): diff --git a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml index ab8c1824f59b..b8f83e1b7401 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml @@ -28,7 +28,7 @@ tests: subnet: id: "subnet-any" cpuOptions: - nestedVirtualization: enabled + nestedVirtualizationPolicy: Enabled type: AWS - name: when nested virtualization is disabled it should pass @@ -54,7 +54,7 @@ tests: subnet: id: "subnet-any" cpuOptions: - nestedVirtualization: disabled + nestedVirtualizationPolicy: Disabled type: AWS - name: when cpuOptions is empty it should fail @@ -106,9 +106,9 @@ tests: subnet: id: "subnet-any" cpuOptions: - nestedVirtualization: unsupported + nestedVirtualizationPolicy: unsupported type: AWS - expectedError: "Unsupported value: \"unsupported\": supported values: \"enabled\", \"disabled\"" + expectedError: "Unsupported value: \"unsupported\": supported values: \"Enabled\", \"Disabled\"" # --- AWS Placement / Capacity Reservation validation --- - name: when tenancy is host and capacity reservation is specified it should fail diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml index e50b081853f6..da0d7452e012 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml @@ -449,15 +449,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml index 9a19f30378b5..3836980df5ea 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml @@ -416,15 +416,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml index 98ee45db246c..8b1b94e5cf01 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml @@ -449,15 +449,19 @@ spec: description: |- cpuOptions specifies CPU configuration for EC2 instances. Supported on C8i, M8i, and R8i instance families. + When omitted, AWS defaults are used (nested virtualization is not enabled). + To revert to default behavior after setting cpuOptions, remove the entire + cpuOptions field rather than clearing individual sub-fields. minProperties: 1 properties: - nestedVirtualization: + nestedVirtualizationPolicy: description: |- - nestedVirtualization indicates whether to enable nested virtualization on the instance. + nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. Supported on C8i, M8i, and R8i instance families. + When omitted, nested virtualization is not enabled (AWS default behavior). enum: - - enabled - - disabled + - Enabled + - Disabled type: string type: object imageType: diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index df3f340963bf..35534c9edb21 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -41132,15 +41132,18 @@ PlacementOptions cpuOptions,omitzero
- -CpuOptions + +CPUOptions (Optional)

cpuOptions specifies CPU configuration for EC2 instances. -Supported on C8i, M8i, and R8i instance families.

+Supported on C8i, M8i, and R8i instance families. +When omitted, AWS defaults are used (nested virtualization is not enabled). +To revert to default behavior after setting cpuOptions, remove the entire +cpuOptions field rather than clearing individual sub-fields.

@@ -44372,6 +44375,41 @@ used in workload identity authentication for Azure Private Link Service operatio

+###CPUOptions { #hypershift.openshift.io/v1beta1.CPUOptions } +

+(Appears on: +AWSNodePoolPlatform) +

+

+

CPUOptions specifies CPU configuration for EC2 instances. +At least one field must be specified when cpuOptions is present.

+

+ + + + + + + + + + + + + +
FieldDescription
+nestedVirtualizationPolicy
+ + +NestedVirtualizationPolicy + + +		 +(Optional) +

nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. +Supported on C8i, M8i, and R8i instance families. +When omitted, nested virtualization is not enabled (AWS default behavior).

+
###Capabilities { #hypershift.openshift.io/v1beta1.Capabilities }

(Appears on: @@ -46125,40 +46163,6 @@ int64 -###CpuOptions { #hypershift.openshift.io/v1beta1.CpuOptions } -

-(Appears on: -AWSNodePoolPlatform) -

-

-

CpuOptions specifies CPU configuration for EC2 instances. -At least one field must be specified when cpuOptions is present.

-

- - - - - - - - - - - - - -
FieldDescription
-nestedVirtualization
- - -NestedVirtualizationPolicy - - -		 -(Optional) -

nestedVirtualization indicates whether to enable nested virtualization on the instance. -Supported on C8i, M8i, and R8i instance families.

-
###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }

(Appears on: @@ -52906,7 +52910,7 @@ which produces significantly higher metrics volume.

###NestedVirtualizationPolicy { #hypershift.openshift.io/v1beta1.NestedVirtualizationPolicy }

(Appears on: -CpuOptions) +CPUOptions)

NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled.

@@ -52918,10 +52922,10 @@ which produces significantly higher metrics volume.

Description -

"disabled"

+

"Disabled"

NestedVirtualizationDisabled disables nested virtualization on the instance.

-

"enabled"

+

"Enabled"

NestedVirtualizationEnabled enables nested virtualization on the instance.

diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index 5515a8944204..30c629cfba87 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -1961,15 +1961,18 @@ PlacementOptions cpuOptions,omitzero
- -CpuOptions + +CPUOptions (Optional)

cpuOptions specifies CPU configuration for EC2 instances. -Supported on C8i, M8i, and R8i instance families.

+Supported on C8i, M8i, and R8i instance families. +When omitted, AWS defaults are used (nested virtualization is not enabled). +To revert to default behavior after setting cpuOptions, remove the entire +cpuOptions field rather than clearing individual sub-fields.

@@ -5071,6 +5074,41 @@ used in workload identity authentication for Azure Private Link Service operatio

+###CPUOptions { #hypershift.openshift.io/v1beta1.CPUOptions } +

+(Appears on: +AWSNodePoolPlatform) +

+

+

CPUOptions specifies CPU configuration for EC2 instances. +At least one field must be specified when cpuOptions is present.

+

+ + + + + + + + + + + + + +
FieldDescription
+nestedVirtualizationPolicy
+ + +NestedVirtualizationPolicy + + +		 +(Optional) +

nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. +Supported on C8i, M8i, and R8i instance families. +When omitted, nested virtualization is not enabled (AWS default behavior).

+
###Capabilities { #hypershift.openshift.io/v1beta1.Capabilities }

(Appears on: @@ -6797,40 +6835,6 @@ int64 -###CpuOptions { #hypershift.openshift.io/v1beta1.CpuOptions } -

-(Appears on: -AWSNodePoolPlatform) -

-

-

CpuOptions specifies CPU configuration for EC2 instances. -At least one field must be specified when cpuOptions is present.

-

- - - - - - - - - - - - - -
FieldDescription
-nestedVirtualization
- - -NestedVirtualizationPolicy - - -		 -(Optional) -

nestedVirtualization indicates whether to enable nested virtualization on the instance. -Supported on C8i, M8i, and R8i instance families.

-
###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }

(Appears on: @@ -13179,7 +13183,7 @@ Spot instances use spare EC2 capacity at reduced prices but may be interrupted.< ###NestedVirtualizationPolicy { #hypershift.openshift.io/v1beta1.NestedVirtualizationPolicy }

(Appears on: -CpuOptions) +CPUOptions)

NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled.

@@ -13191,10 +13195,10 @@ Spot instances use spare EC2 capacity at reduced prices but may be interrupted.< Description -

"disabled"

+

"Disabled"

NestedVirtualizationDisabled disables nested virtualization on the instance.

-

"enabled"

+

"Enabled"

NestedVirtualizationEnabled enables nested virtualization on the instance.

diff --git a/hypershift-operator/controllers/nodepool/aws.go b/hypershift-operator/controllers/nodepool/aws.go index 926a6341346b..e25aba989eb3 100644 --- a/hypershift-operator/controllers/nodepool/aws.go +++ b/hypershift-operator/controllers/nodepool/aws.go @@ -111,7 +111,8 @@ func awsMachineTemplateSpec(infraName string, hostedCluster *hyperv1.HostedClust }, } - applyAWSMachineOptions(nodePool, awsMachineTemplateSpec) + applyAWSCPUOptions(nodePool, awsMachineTemplateSpec) + applyAWSPlacementOptions(nodePool, awsMachineTemplateSpec) if hostedCluster.Annotations[hyperv1.AWSMachinePublicIPs] == "true" { awsMachineTemplateSpec.Template.Spec.PublicIP = ptr.To(true) @@ -206,13 +207,22 @@ func buildAWSSecurityGroups(nodePool *hyperv1.NodePool, hostedCluster *hyperv1.H return securityGroups, nil } -func applyAWSMachineOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachineTemplateSpec) { +func applyAWSCPUOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachineTemplateSpec) { if nodePool.Spec.Platform.AWS == nil { return } - if cpuOptions := nodePool.Spec.Platform.AWS.CpuOptions; cpuOptions.NestedVirtualization != "" { - spec.Template.Spec.CPUOptions.NestedVirtualization = capiaws.NestedVirtualizationPolicy(cpuOptions.NestedVirtualization) + switch nodePool.Spec.Platform.AWS.CPUOptions.NestedVirtualizationPolicy { + case hyperv1.NestedVirtualizationEnabled: + spec.Template.Spec.CPUOptions.NestedVirtualization = capiaws.NestedVirtualizationPolicyEnabled + case hyperv1.NestedVirtualizationDisabled: + spec.Template.Spec.CPUOptions.NestedVirtualization = capiaws.NestedVirtualizationPolicyDisabled + } +} + +func applyAWSPlacementOptions(nodePool *hyperv1.NodePool, spec *capiaws.AWSMachineTemplateSpec) { + if nodePool.Spec.Platform.AWS == nil { + return } placement := nodePool.Spec.Platform.AWS.Placement diff --git a/hypershift-operator/controllers/nodepool/aws_test.go b/hypershift-operator/controllers/nodepool/aws_test.go index fee97c4fb941..f2f90ea8c134 100644 --- a/hypershift-operator/controllers/nodepool/aws_test.go +++ b/hypershift-operator/controllers/nodepool/aws_test.go @@ -1851,8 +1851,8 @@ func TestApplyAWSMachineOptions(t *testing.T) { Spec: hyperv1.NodePoolSpec{ Platform: hyperv1.NodePoolPlatform{ AWS: &hyperv1.AWSNodePoolPlatform{ - CpuOptions: hyperv1.CpuOptions{ - NestedVirtualization: hyperv1.NestedVirtualizationEnabled, + CPUOptions: hyperv1.CPUOptions{ + NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled, }, }, }, @@ -1866,8 +1866,8 @@ func TestApplyAWSMachineOptions(t *testing.T) { Spec: hyperv1.NodePoolSpec{ Platform: hyperv1.NodePoolPlatform{ AWS: &hyperv1.AWSNodePoolPlatform{ - CpuOptions: hyperv1.CpuOptions{ - NestedVirtualization: hyperv1.NestedVirtualizationDisabled, + CPUOptions: hyperv1.CPUOptions{ + NestedVirtualizationPolicy: hyperv1.NestedVirtualizationDisabled, }, }, }, @@ -2029,7 +2029,8 @@ func TestApplyAWSMachineOptions(t *testing.T) { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) spec := &capiaws.AWSMachineTemplateSpec{} - applyAWSMachineOptions(tc.nodePool, spec) + applyAWSCPUOptions(tc.nodePool, spec) + applyAWSPlacementOptions(tc.nodePool, spec) g.Expect(spec.Template.Spec.CPUOptions.NestedVirtualization).To(Equal(tc.expectedNestedVirtualization), "CPUOptions.NestedVirtualization mismatch") g.Expect(spec.Template.Spec.SpotMarketOptions).To(Equal(tc.expectedSpotMarketOptions), "SpotMarketOptions mismatch") diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go index b588f205e2a8..fd4b92a19791 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go @@ -78,9 +78,12 @@ type AWSNodePoolPlatform struct { // cpuOptions specifies CPU configuration for EC2 instances. // Supported on C8i, M8i, and R8i instance families. + // When omitted, AWS defaults are used (nested virtualization is not enabled). + // To revert to default behavior after setting cpuOptions, remove the entire + // cpuOptions field rather than clearing individual sub-fields. // // +optional - CpuOptions CpuOptions `json:"cpuOptions,omitzero"` + CPUOptions CPUOptions `json:"cpuOptions,omitzero"` } // PlacementOptions specifies the placement options for the EC2 instances. @@ -182,17 +185,18 @@ const ( AWSResourceTagOverridePolicyDeny AWSResourceTagOverridePolicy = "Deny" ) -// CpuOptions specifies CPU configuration for EC2 instances. +// CPUOptions specifies CPU configuration for EC2 instances. // At least one field must be specified when cpuOptions is present. // // +kubebuilder:validation:MinProperties=1 -type CpuOptions struct { - // nestedVirtualization indicates whether to enable nested virtualization on the instance. +type CPUOptions struct { + // nestedVirtualizationPolicy indicates whether to enable nested virtualization on the instance. // Supported on C8i, M8i, and R8i instance families. + // When omitted, nested virtualization is not enabled (AWS default behavior). // // +optional - // +kubebuilder:validation:Enum=enabled;disabled - NestedVirtualization NestedVirtualizationPolicy `json:"nestedVirtualization,omitempty"` + // +kubebuilder:validation:Enum=Enabled;Disabled + NestedVirtualizationPolicy NestedVirtualizationPolicy `json:"nestedVirtualizationPolicy,omitempty"` } // NestedVirtualizationPolicy indicates whether nested virtualization is enabled or disabled. @@ -200,10 +204,10 @@ type NestedVirtualizationPolicy string const ( // NestedVirtualizationEnabled enables nested virtualization on the instance. - NestedVirtualizationEnabled NestedVirtualizationPolicy = "enabled" + NestedVirtualizationEnabled NestedVirtualizationPolicy = "Enabled" // NestedVirtualizationDisabled disables nested virtualization on the instance. - NestedVirtualizationDisabled NestedVirtualizationPolicy = "disabled" + NestedVirtualizationDisabled NestedVirtualizationPolicy = "Disabled" ) // MarketType describes the market type for EC2 instances. diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go index 7d4408d7d146..ba1a014292df 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -350,7 +350,7 @@ func (in *AWSNodePoolPlatform) DeepCopyInto(out *AWSNodePoolPlatform) { *out = new(PlacementOptions) (*in).DeepCopyInto(*out) } - out.CpuOptions = in.CpuOptions + out.CPUOptions = in.CPUOptions } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSNodePoolPlatform. @@ -1051,6 +1051,21 @@ func (in *AzureWorkloadIdentities) DeepCopy() *AzureWorkloadIdentities { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CPUOptions) DeepCopyInto(out *CPUOptions) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CPUOptions. +func (in *CPUOptions) DeepCopy() *CPUOptions { + if in == nil { + return nil + } + out := new(CPUOptions) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Capabilities) DeepCopyInto(out *Capabilities) { *out = *in @@ -1635,21 +1650,6 @@ func (in *ControlPlaneVersionStatus) DeepCopy() *ControlPlaneVersionStatus { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CpuOptions) DeepCopyInto(out *CpuOptions) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CpuOptions. -func (in *CpuOptions) DeepCopy() *CpuOptions { - if in == nil { - return nil - } - out := new(CpuOptions) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *DNSSpec) DeepCopyInto(out *DNSSpec) { *out = *in From 1f86f2085d85f84394ac11d6b2b792ea1ba6d882 Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Tue, 18 Aug 2026 12:41:58 -0400 Subject: [PATCH 10/11] fix(aws): validate nested virtualization is only enabled on supported instance families Add a check to validateAWSPlatformConfig (surfaced via the ValidPlatformConfig NodePool condition) that rejects cpuOptions.nestedVirtualizationPolicy=Enabled when instanceType isn't a C8i, M8i, or R8i family (including their -flex variants), matching AWS's documented CPU options support matrix. This fails fast with a clear condition message instead of only failing later at the AWS API when the instance is actually launched. Signed-off-by: Jesse Jaggars Commit-Message-Assisted-by: Claude (via Claude Code) --- .../controllers/nodepool/aws.go | 30 +++++++ .../controllers/nodepool/aws_test.go | 78 +++++++++++++++++++ 2 files changed, 108 insertions(+) diff --git a/hypershift-operator/controllers/nodepool/aws.go b/hypershift-operator/controllers/nodepool/aws.go index e25aba989eb3..4e846799e4ee 100644 --- a/hypershift-operator/controllers/nodepool/aws.go +++ b/hypershift-operator/controllers/nodepool/aws.go @@ -527,9 +527,39 @@ func (r NodePoolReconciler) validateAWSPlatformConfig(ctx context.Context, nodeP } } + if err := validateNestedVirtualizationInstanceType(nodePool.Spec.Platform.AWS.CPUOptions, nodePool.Spec.Platform.AWS.InstanceType); err != nil { + return err + } + return nil } +// nestedVirtualizationSupportedInstanceFamilies are the EC2 instance families that support +// CpuOptions.NestedVirtualization, per AWS's "Supported CPU options" documentation: +// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html +// This includes the base family (e.g. "c8i") and its "-flex" variant (e.g. "c8i-flex"), both of +// which were made generally available together for each family. +var nestedVirtualizationSupportedInstanceFamilies = []string{"c8i", "m8i", "r8i"} + +// validateNestedVirtualizationInstanceType returns an error if cpuOptions.nestedVirtualizationPolicy +// is set on an EC2 instance type that doesn't support it. Nested virtualization is only supported +// on 8th generation Intel-based instance types (c8i, m8i, r8i, and their "-flex" variants). +func validateNestedVirtualizationInstanceType(cpuOptions hyperv1.CPUOptions, instanceType string) error { + if cpuOptions.NestedVirtualizationPolicy != hyperv1.NestedVirtualizationEnabled { + // Nothing to validate: the field is unset, or explicitly disabled (a no-op on any instance type). + return nil + } + + family, _, _ := strings.Cut(instanceType, ".") + for _, supported := range nestedVirtualizationSupportedInstanceFamilies { + if family == supported || family == supported+"-flex" { + return nil + } + } + + return fmt.Errorf("cpuOptions.nestedVirtualizationPolicy is only supported on C8i, M8i, and R8i instance families (including their -flex variants), got instanceType %q", instanceType) +} + // getWindowsAMI returns the appropriate Windows AMI for the given region from release image metadata. func getWindowsAMI(region string, specifiedArch string, releaseImage *releaseinfo.ReleaseImage) (string, error) { if releaseImage == nil { diff --git a/hypershift-operator/controllers/nodepool/aws_test.go b/hypershift-operator/controllers/nodepool/aws_test.go index f2f90ea8c134..e6c07a75bd40 100644 --- a/hypershift-operator/controllers/nodepool/aws_test.go +++ b/hypershift-operator/controllers/nodepool/aws_test.go @@ -695,6 +695,84 @@ func TestValidateAWSPlatformConfig(t *testing.T) { } } +func TestValidateNestedVirtualizationInstanceType(t *testing.T) { + testCases := []struct { + name string + cpuOptions hyperv1.CPUOptions + instanceType string + expectedError string + }{ + { + name: "nestedVirtualizationPolicy unset, any instance type is valid", + cpuOptions: hyperv1.CPUOptions{}, + instanceType: "m5.large", + }, + { + name: "enabled on supported c8i family", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "c8i.2xlarge", + }, + { + name: "enabled on supported c8i-flex variant", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "c8i-flex.2xlarge", + }, + { + name: "enabled on supported m8i family", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "m8i.4xlarge", + }, + { + name: "enabled on supported r8i-flex variant", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "r8i-flex.xlarge", + }, + { + name: "disabled on unsupported family is still valid (explicit disable is a no-op everywhere)", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationDisabled}, + instanceType: "m5.large", + }, + { + name: "enabled on unsupported m5 family", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "m5.large", + expectedError: "cpuOptions.nestedVirtualizationPolicy is only supported on C8i, M8i, and R8i instance families", + }, + { + name: "enabled on unsupported c7i family (previous generation)", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "c7i.2xlarge", + expectedError: "cpuOptions.nestedVirtualizationPolicy is only supported on C8i, M8i, and R8i instance families", + }, + { + name: "enabled on unsupported AMD c8a family", + cpuOptions: hyperv1.CPUOptions{NestedVirtualizationPolicy: hyperv1.NestedVirtualizationEnabled}, + instanceType: "c8a.2xlarge", + expectedError: "cpuOptions.nestedVirtualizationPolicy is only supported on C8i, M8i, and R8i instance families", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + err := validateNestedVirtualizationInstanceType(tc.cpuOptions, tc.instanceType) + if tc.expectedError == "" { + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + return + } + + if err == nil { + t.Fatalf("expected an error, got nothing") + } + + if !strings.Contains(err.Error(), tc.expectedError) { + t.Fatalf("expected error to contain %s, got %v", tc.expectedError, err) + } + }) + } +} + func TestGetWindowsAMI(t *testing.T) { testCases := []struct { name string From 9a1adc2d74e7dae57b89cfc4cb15d37778c483bc Mon Sep 17 00:00:00 2001 From: Jesse Jaggars Date: Fri, 21 Aug 2026 12:29:53 -0400 Subject: [PATCH 11/11] chore: regenerate applyconfiguration and API docs after rebase Fix minor gofmt column-alignment drift in the CPUOptions applyconfiguration struct and pick up unrelated API doc updates (Azure/monitoring/encryption types) that had fallen behind main since this branch was last rebased. Signed-off-by: Jesse Jaggars Commit-Message-Assisted-by: Claude (via Claude Code) --- .../hypershift/v1beta1/awsnodepoolplatform.go | 20 +- docs/content/reference/api.md | 1135 ++++++++++++++--- 2 files changed, 998 insertions(+), 157 deletions(-) diff --git a/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go b/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go index 9b1f8997391c..a7ff0815ebe5 100644 --- a/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go +++ b/client/applyconfiguration/hypershift/v1beta1/awsnodepoolplatform.go @@ -24,16 +24,16 @@ import ( // AWSNodePoolPlatformApplyConfiguration represents a declarative configuration of the AWSNodePoolPlatform type for use // with apply. type AWSNodePoolPlatformApplyConfiguration struct { - InstanceType *string `json:"instanceType,omitempty"` - InstanceProfile *string `json:"instanceProfile,omitempty"` - Subnet *AWSResourceReferenceApplyConfiguration `json:"subnet,omitempty"` - AMI *string `json:"ami,omitempty"` - ImageType *hypershiftv1beta1.ImageType `json:"imageType,omitempty"` - SecurityGroups []AWSResourceReferenceApplyConfiguration `json:"securityGroups,omitempty"` - RootVolume *VolumeApplyConfiguration `json:"rootVolume,omitempty"` - ResourceTags []AWSNodePoolResourceTagApplyConfiguration `json:"resourceTags,omitempty"` - Placement *PlacementOptionsApplyConfiguration `json:"placement,omitempty"` - CPUOptions *CPUOptionsApplyConfiguration `json:"cpuOptions,omitempty"` + InstanceType *string `json:"instanceType,omitempty"` + InstanceProfile *string `json:"instanceProfile,omitempty"` + Subnet *AWSResourceReferenceApplyConfiguration `json:"subnet,omitempty"` + AMI *string `json:"ami,omitempty"` + ImageType *hypershiftv1beta1.ImageType `json:"imageType,omitempty"` + SecurityGroups []AWSResourceReferenceApplyConfiguration `json:"securityGroups,omitempty"` + RootVolume *VolumeApplyConfiguration `json:"rootVolume,omitempty"` + ResourceTags []AWSNodePoolResourceTagApplyConfiguration `json:"resourceTags,omitempty"` + Placement *PlacementOptionsApplyConfiguration `json:"placement,omitempty"` + CPUOptions *CPUOptionsApplyConfiguration `json:"cpuOptions,omitempty"` } // AWSNodePoolPlatformApplyConfiguration constructs a declarative configuration of the AWSNodePoolPlatform type for use with diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index 30c629cfba87..680bbce659fa 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -1005,6 +1005,24 @@ Capabilities This field is optional and once set cannot be changed.

+ + +monitoring,omitzero
+ + +MonitoringSpec + + + + +(Optional) +

monitoring configures monitoring for the hosted cluster, including +forwarding of control plane metrics to the hosted cluster’s monitoring stack. +When omitted, metrics forwarding behavior is determined by the +hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility. +If neither is set, metrics forwarding is disabled.

+ + @@ -1363,6 +1381,50 @@ NodePoolStatus +###AESCBCKeyStatus { #hypershift.openshift.io/v1beta1.AESCBCKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash +of its contents for fingerprinting.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+secret,omitzero
+ + +SecretReference + + +		 +

secret is a reference to the secret containing the AESCBC key.

+
+dataHash
+ +string + +		 +

dataHash is the hex-encoded SHA-256 hash of the secret’s “key” data field +at the time re-encryption completed.

+
###AESCBCSpec { #hypershift.openshift.io/v1beta1.AESCBCSpec }

(Appears on: @@ -1405,6 +1467,8 @@ Kubernetes core/v1.LocalObjectReference (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -1703,7 +1767,8 @@ string ###AWSKMSKeyEntry { #hypershift.openshift.io/v1beta1.AWSKMSKeyEntry }

(Appears on: -AWSKMSSpec) +AWSKMSSpec, +SecretEncryptionKeyStatus)

AWSKMSKeyEntry defines metadata to locate the encryption key in AWS

@@ -1782,6 +1847,8 @@ AWSKMSKeyEntry (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -2252,7 +2319,7 @@ addition to any security groups specified in the NodePool.

###AWSResourceReference { #hypershift.openshift.io/v1beta1.AWSResourceReference }

(Appears on: -AWSCloudProviderConfig, +AWSCloudProviderConfig, AWSNodePoolPlatform)

@@ -2300,7 +2367,6 @@ They are applied according to the rules defined by the AWS API: ###AWSResourceTag { #hypershift.openshift.io/v1beta1.AWSResourceTag }

-

AWSResourceTag is a tag to apply to AWS resources created for the cluster.

Deprecated: Use AWSClusterResourceTag, AWSNodePoolResourceTag, or AWSEndpointServiceResourceTag instead. AWSClusterResourceTag preserves the @@ -3229,7 +3295,7 @@ string ###AutoNode { #hypershift.openshift.io/v1beta1.AutoNode }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -3261,7 +3327,7 @@ ProvisionerConfig ###AutoNodeStatus { #hypershift.openshift.io/v1beta1.AutoNodeStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -3322,7 +3388,7 @@ Used by the metrics collector for billing aggregation.

###AvailabilityPolicy { #hypershift.openshift.io/v1beta1.AvailabilityPolicy }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -3447,12 +3513,113 @@ This is only valid for self-managed Azure.

###AzureClientID { #hypershift.openshift.io/v1beta1.AzureClientID }

(Appears on: -ManagedIdentity, +ManagedIdentity, WorkloadIdentity)

AzureClientID is a string that represents the client ID of a managed identity.

+###AzureContainerRegistryConfig { #hypershift.openshift.io/v1beta1.AzureContainerRegistryConfig } +

+(Appears on: +AzurePlatformSpec) +

+

+

AzureContainerRegistryConfig configures Azure Container Registry integration for a hosted cluster.

+

+ + + + + + + + + + + + + +
FieldDescription
+credentials,omitzero
+ + +AzureContainerRegistryCredentialConfig + + +		 +

credentials configures authentication for worker nodes pulling images from ACR +using a user-assigned managed identity. +The identity does not need to be in the same subscription or resource group as the +HostedCluster, but it must be in the same Azure AD tenant. The management cluster’s +CAPZ identity must have Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action +on the identity’s scope to attach it to worker virtual machines at creation time.

+
+###AzureContainerRegistryCredentialConfig { #hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialConfig } +

+(Appears on: +AzureContainerRegistryConfig) +

+

+

AzureContainerRegistryCredentialConfig configures authentication credentials for Azure Container Registry.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+type
+ + +AzureContainerRegistryCredentialType + + +		 +

type specifies the credential type used for ACR image pulls.

+
+managedIdentity,omitzero
+ + +UserAssignedManagedIdentity + + +		 +(Optional) +

managedIdentity identifies the user-assigned managed identity used for ACR image pulls.

+
+###AzureContainerRegistryCredentialType { #hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialType } +

+(Appears on: +AzureContainerRegistryCredentialConfig) +

+

+

AzureContainerRegistryCredentialType identifies the type of credential used for ACR image pulls.

+

+ + + + + + + + + + +
ValueDescription

"ManagedIdentity"

AzureContainerRegistryCredentialManagedIdentity uses a user-assigned managed identity for ACR authentication.

+
###AzureDiagnosticsStorageAccountType { #hypershift.openshift.io/v1beta1.AzureDiagnosticsStorageAccountType }

(Appears on: @@ -3533,7 +3700,8 @@ applications and dev/test.

###AzureKMSKey { #hypershift.openshift.io/v1beta1.AzureKMSKey }

(Appears on: -AzureKMSSpec) +AzureKMSSpec, +SecretEncryptionKeyStatus)

@@ -3624,6 +3792,8 @@ AzureKMSKey (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -3702,6 +3872,15 @@ and traffic must be routed through the private router (Swift).

+###AzureManagedIdentityResourceID { #hypershift.openshift.io/v1beta1.AzureManagedIdentityResourceID } +

+(Appears on: +UserAssignedManagedIdentity) +

+

+

AzureManagedIdentityResourceID is an ARM resource ID for a user-assigned managed identity +in the format /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{name}.

+

###AzureMarketplaceImage { #hypershift.openshift.io/v1beta1.AzureMarketplaceImage }

(Appears on: @@ -4170,6 +4349,24 @@ string +containerRegistry,omitzero
+ + +AzureContainerRegistryConfig + + + + +(Optional) +

containerRegistry configures how worker nodes authenticate to Azure Container Registry (ACR). +When set, the managed identity is attached to worker virtual machines and its resource ID is +written into the worker cloud provider config so kubelet’s ACR credential provider can +authenticate without image pull secrets. +Changing this value will trigger a rollout for all existing NodePools in the cluster.

+ + + + topology
@@ -4729,7 +4926,7 @@ Azure’s API.

###AzureSubnetResourceID { #hypershift.openshift.io/v1beta1.AzureSubnetResourceID }

(Appears on: -AzurePrivateLinkServiceSpec, +AzurePrivateLinkServiceSpec, AzurePrivateLinkSpec)

@@ -4741,7 +4938,7 @@ The expected format is:

###AzureSubscriptionID { #hypershift.openshift.io/v1beta1.AzureSubscriptionID }

(Appears on: -AzurePrivateLinkServiceSpec, +AzurePrivateLinkServiceSpec, AzurePrivateLinkSpec)

@@ -5112,7 +5309,7 @@ When omitted, nested virtualization is not enabled (AWS default behavior).

###Capabilities { #hypershift.openshift.io/v1beta1.Capabilities }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5283,7 +5480,7 @@ of an instance

###ClusterAutoscaling { #hypershift.openshift.io/v1beta1.ClusterAutoscaling }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5458,7 +5655,7 @@ Maximum of 3 expanders can be specified.

###ClusterConfiguration { #hypershift.openshift.io/v1beta1.ClusterConfiguration }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5740,7 +5937,7 @@ This is only consumed when NetworkType is OVNKubernetes.

###ClusterNetworking { #hypershift.openshift.io/v1beta1.ClusterNetworking }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -5900,7 +6097,7 @@ Defaults to “Normal”.

###ClusterVersionStatus { #hypershift.openshift.io/v1beta1.ClusterVersionStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -6142,6 +6339,14 @@ underlying cluster’s ClusterVersion.

ClusterVersionUpgradeable indicates the Upgradeable condition in the underlying cluster’s ClusterVersion.

+

"ConfigOperatorReconciliationSucceeded"

+

ConfigOperatorReconciliationSucceeded indicates if the HostedCluster Config +Operator (HCCO) reconciliation succeeded. The HCCO is responsible for +reconciling resources inside the hosted cluster (e.g. global configuration, +CRDs, RBAC, and connectivity checks). +A failure here often means a software bug, a non-stable cluster, or +connectivity issues between the control plane and the hosted cluster.

+

"Available"

ControlPlaneComponentAvailable indicates whether the ControlPlaneComponent is available.

@@ -6179,6 +6384,13 @@ A failure here often means a software bug or a non-stable cluster.

most recent etcd backup. True means the last backup completed successfully; False means a backup is in progress or the last backup failed.

+

"EtcdDataEncryptionUpToDate"

+

EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the +currently active encryption key. +True: all data confirmed encrypted with the active key. +False: re-encryption is in progress or has failed. +Absent: encryption is not configured.

+

"EtcdRecoveryActive"

EtcdRecoveryActive indicates that the Etcd cluster is failing and the recovery job was triggered.

@@ -6380,7 +6592,7 @@ and reports missing images if any.

###ConfigurationStatus { #hypershift.openshift.io/v1beta1.ConfigurationStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -6511,7 +6723,7 @@ ControlPlaneComponentStatus (Optional)

conditions contains details for the current state of the ControlPlane Component. If there is an error, then the Available condition will be false.

-

Current condition types are: “Available”

+

Current condition types are: “Available”, “RolloutComplete”

@@ -6540,6 +6752,18 @@ string

resources is a list of the resources reconciled by this component.

+ + +observedGeneration
+ +int64 + + + +(Optional) +

observedGeneration reports which generation of the HostedControlPlane spec has been reconciled by this component.

+ + ###ControlPlaneManagedIdentities { #hypershift.openshift.io/v1beta1.ControlPlaneManagedIdentities } @@ -6775,7 +6999,7 @@ string ###ControlPlaneVersionStatus { #hypershift.openshift.io/v1beta1.ControlPlaneVersionStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -6838,7 +7062,7 @@ int64 ###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -7064,50 +7288,13 @@ UserManagedDiagnostics -###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType } -

-(Appears on: -EtcdSpec) -

-

-

EtcdManagementType is a enum specifying the strategy for managing the cluster’s etcd instance

-

- - - - - - - - - - - - -
ValueDescription

"Managed"

Managed means HyperShift should provision and operator the etcd cluster -automatically.

-

"Unmanaged"

Unmanaged means HyperShift will not provision or manage the etcd cluster, -and the user is responsible for doing so.

-
-###EtcdShardResource { #hypershift.openshift.io/v1beta1.EtcdShardResource } +###EncryptionKeyReference { #hypershift.openshift.io/v1beta1.EncryptionKeyReference }

(Appears on: -ManagedEtcdShardSpec, -UnmanagedEtcdShardSpec) +EncryptionMigrationHistory)

-

EtcdShardResource identifies a Kubernetes resource type to be routed to an -etcd shard. It is used to build the KAS –etcd-servers-overrides flag. -The combination of apiGroup and resource uniquely identifies a resource type.

-

Routing only takes effect for resource types compiled into the -kube-apiserver binary (built-in types such as events, pods, or -coordination.k8s.io/leases). This is a kube-apiserver limitation: -–etcd-servers-overrides does not apply to other resource types. In -particular, resources backed by CustomResourceDefinitions and resources -served by aggregated API servers (such as the openshift.io groups served -by openshift-apiserver and oauth-apiserver) are NOT routed: entries for -such resources are accepted but have no effect, and their data remains in -the default shard while the configured shard stays empty.

+

EncryptionKeyReference identifies an encryption key by its provider and fingerprint.

@@ -7119,46 +7306,37 @@ the default shard while the configured shard stays empty.

-apiGroup
+provider
-string + +SecretEncryptionProvider + 		-

apiGroup is the API group of the resource (e.g., “coordination.k8s.io” -for leases). An empty string designates the core API group (e.g., -events, pods, configmaps). For core-group resources, specify -apiGroup: “” explicitly (e.g., {apiGroup: “”, resource: “events”}). -When non-empty, must be at most 253 characters in length and consist -of only lowercase alphanumeric characters, hyphens and periods. Each -period separated segment must start and end with an alphanumeric -character.

+

provider identifies the encryption provider.
-resource
+fingerprint
string 		-

resource is the plural resource name (e.g., “events”, “leases”, -“configmaps”). Must be a valid DNS label (RFC 1123): lowercase -alphanumeric characters or hyphens, starting and ending with an -alphanumeric character, max 63 characters.

+

fingerprint is the hex-encoded SHA-256 hash of the key’s identity fields.
-###EtcdShardSchedulingSpec { #hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec } +###EncryptionMigrationHistory { #hypershift.openshift.io/v1beta1.EncryptionMigrationHistory }

(Appears on: -ManagedEtcdShardSpec, -ManagedEtcdSpec) +SecretEncryptionStatus)

-

EtcdShardSchedulingSpec configures pod placement for a single etcd shard.

+

EncryptionMigrationHistory records a key rotation, including in-progress rotations.

@@ -7170,75 +7348,283 @@ alphanumeric character, max 63 characters.

- -
-nodeSelector
+from,omitzero
-map[string]string + +EncryptionKeyReference + 		-(Optional) -

nodeSelector constrains this shard’s pods to nodes matching the -specified labels, in addition to the framework’s control plane node -selector. Keys and values must be valid Kubernetes label key/value -pairs. Maximum 16 entries.

+

from is the key that data was migrated from (the previous active key).
-tolerations
+to,omitzero
- -[]Kubernetes core/v1.Toleration + +EncryptionKeyReference 		-(Optional) -

tolerations allows this shard’s pods to schedule on nodes with -matching taints, in addition to the framework’s control plane -tolerations. Maximum 16 entries.

+

to is the key that data was migrated to (the target key).
-###EtcdSpec { #hypershift.openshift.io/v1beta1.EtcdSpec } -

-(Appears on: -HostedClusterSpec, -HostedControlPlaneSpec) -

-

-

EtcdSpec specifies configuration for a control plane etcd cluster.

-

- - - - - - - - + + + + + + + +
FieldDescription
-managementType
+state
- -EtcdManagementType + +EncryptionMigrationState 		-

managementType defines how the etcd cluster is managed. -This can be either Managed or Unmanaged. -This field is immutable.

+

state tracks the current phase of this rotation.
-managed
+startedTime,omitzero
- -ManagedEtcdSpec + +Kubernetes meta/v1.Time + + +		 +

startedTime is when the rotation was initiated.

+
+completionTime,omitzero
+ + +Kubernetes meta/v1.Time + + +		 +(Optional) +

completionTime is when the rotation finished. Not set while the rotation is in progress.

+
+###EncryptionMigrationState { #hypershift.openshift.io/v1beta1.EncryptionMigrationState } +

+(Appears on: +EncryptionMigrationHistory) +

+

+

EncryptionMigrationState tracks the lifecycle of a key rotation.

+

+ + + + + + + + + + + + + + + + + + +
ValueDescription

"Completed"

EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key.

+

"Interrupted"

EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted +with the target key (e.g., targetKey replaced during ReadOnlyDeploy).

+

"Migrating"

EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write +provider and re-encryption (StorageVersionMigration) is in progress.

+

"ReadOnlyDeploy"

EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only +provider. The old key remains the write provider.

+

"WritePromote"

EncryptionMigrationStateWritePromote means the new key is being promoted to write provider. +The old key becomes read-only.

+
+###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType } +

+(Appears on: +EtcdSpec) +

+

+

EtcdManagementType is a enum specifying the strategy for managing the cluster’s etcd instance

+

+ + + + + + + + + + + + +
ValueDescription

"Managed"

Managed means HyperShift should provision and operator the etcd cluster +automatically.

+

"Unmanaged"

Unmanaged means HyperShift will not provision or manage the etcd cluster, +and the user is responsible for doing so.

+
+###EtcdShardResource { #hypershift.openshift.io/v1beta1.EtcdShardResource } +

+(Appears on: +ManagedEtcdShardSpec, +UnmanagedEtcdShardSpec) +

+

+

EtcdShardResource identifies a Kubernetes resource type to be routed to an +etcd shard. It is used to build the KAS –etcd-servers-overrides flag. +The combination of apiGroup and resource uniquely identifies a resource type.

+

Routing only takes effect for resource types compiled into the +kube-apiserver binary (built-in types such as events, pods, or +coordination.k8s.io/leases). This is a kube-apiserver limitation: +–etcd-servers-overrides does not apply to other resource types. In +particular, resources backed by CustomResourceDefinitions and resources +served by aggregated API servers (such as the openshift.io groups served +by openshift-apiserver and oauth-apiserver) are NOT routed: entries for +such resources are accepted but have no effect, and their data remains in +the default shard while the configured shard stays empty.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+apiGroup
+ +string + +		 +

apiGroup is the API group of the resource (e.g., “coordination.k8s.io” +for leases). An empty string designates the core API group (e.g., +events, pods, configmaps). For core-group resources, specify +apiGroup: “” explicitly (e.g., {apiGroup: “”, resource: “events”}). +When non-empty, must be at most 253 characters in length and consist +of only lowercase alphanumeric characters, hyphens and periods. Each +period separated segment must start and end with an alphanumeric +character.

+
+resource
+ +string + +		 +

resource is the plural resource name (e.g., “events”, “leases”, +“configmaps”). Must be a valid DNS label (RFC 1123): lowercase +alphanumeric characters or hyphens, starting and ending with an +alphanumeric character, max 63 characters.

+
+###EtcdShardSchedulingSpec { #hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec } +

+(Appears on: +ManagedEtcdShardSpec, +ManagedEtcdSpec) +

+

+

EtcdShardSchedulingSpec configures pod placement for a single etcd shard.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+nodeSelector
+ +map[string]string + +		 +(Optional) +

nodeSelector constrains this shard’s pods to nodes matching the +specified labels, in addition to the framework’s control plane node +selector. Keys and values must be valid Kubernetes label key/value +pairs. Maximum 16 entries.

+
+tolerations
+ + +[]Kubernetes core/v1.Toleration + + +		 +(Optional) +

tolerations allows this shard’s pods to schedule on nodes with +matching taints, in addition to the framework’s control plane +tolerations. Maximum 16 entries.

+
+###EtcdSpec { #hypershift.openshift.io/v1beta1.EtcdSpec } +

+(Appears on: +HostedClusterSpec, +HostedControlPlaneSpec) +

+

+

EtcdSpec specifies configuration for a control plane etcd cluster.

+

+ + + + + + + + + + + + + + @@ -7368,8 +7754,8 @@ string ###FilterByNeutronTags { #hypershift.openshift.io/v1beta1.FilterByNeutronTags }

(Appears on: -NetworkFilter, -RouterFilter, +NetworkFilter, +RouterFilter, SubnetFilter)

@@ -8190,7 +8576,7 @@ Standard instances run until explicitly stopped and are not subject to automatic ###GCPResourceLabel { #hypershift.openshift.io/v1beta1.GCPResourceLabel }

(Appears on: -GCPNodePoolPlatform, +GCPNodePoolPlatform, GCPPlatformSpec)

@@ -8243,8 +8629,8 @@ See https://c ###GCPResourceName { #hypershift.openshift.io/v1beta1.GCPResourceName }

(Appears on: -GCPNodePoolPlatform, -GCPPrivateServiceConnectSpec, +GCPNodePoolPlatform, +GCPPrivateServiceConnectSpec, GCPResourceReference)

@@ -8293,7 +8679,7 @@ See https://clo ###GCPServiceAccountEmail { #hypershift.openshift.io/v1beta1.GCPServiceAccountEmail }

(Appears on: -GCPNodeServiceAccount, +GCPNodeServiceAccount, GCPServiceAccountsEmails)

@@ -9737,6 +10123,24 @@ Capabilities This field is optional and once set cannot be changed.

+ + + +
FieldDescription
+managementType
+ + +EtcdManagementType + + +		 +

managementType defines how the etcd cluster is managed. +This can be either Managed or Unmanaged. +This field is immutable.

+
+managed
+ + +ManagedEtcdSpec
+monitoring,omitzero
+ + +MonitoringSpec + + +		 +(Optional) +

monitoring configures monitoring for the hosted cluster, including +forwarding of control plane metrics to the hosted cluster’s monitoring stack. +When omitted, metrics forwarding behavior is determined by the +hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility. +If neither is set, metrics forwarding is disabled.

+
###HostedClusterStatus { #hypershift.openshift.io/v1beta1.HostedClusterStatus } @@ -9961,6 +10365,20 @@ successful etcd backup snapshot. Persisted here because HCPEtcdBackup CRs are ephemeral and may be deleted by retention policies.

+ + +secretEncryption,omitzero
+ + +SecretEncryptionStatus + + + + +(Optional) +

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

+ + ###HostedControlPlaneSpec { #hypershift.openshift.io/v1beta1.HostedControlPlaneSpec } @@ -10306,6 +10724,22 @@ OperatorConfiguration +monitoring,omitzero
+ + +MonitoringSpec + + + + +(Optional) +

monitoring configures monitoring for the hosted cluster, including +forwarding of control plane metrics to the hosted cluster’s monitoring stack. +When omitted, metrics forwarding is not configured and will be inactive.

+ + + + imageContentSources
@@ -10749,6 +11183,20 @@ ConfigurationStatus

configuration contains the cluster configuration status of the HostedCluster

+ + +secretEncryption,omitzero
+ + +SecretEncryptionStatus + + + + +(Optional) +

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

+ + ###IBMCloudKMSAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec } @@ -10839,7 +11287,8 @@ authentication to interact with IBM Cloud KMS APIs

###IBMCloudKMSKeyEntry { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry }

(Appears on: -IBMCloudKMSSpec) +IBMCloudKMSSpec, +SecretEncryptionKeyStatus)

IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key

@@ -11009,7 +11458,7 @@ call IBM Cloud KMS APIs

###IBMCloudPlatformSpec { #hypershift.openshift.io/v1beta1.IBMCloudPlatformSpec }

(Appears on: -NodePoolPlatform, +NodePoolPlatform, PlatformSpec)

@@ -11042,7 +11491,7 @@ github.com/openshift/api/config/v1.IBMCloudProviderType ###ImageContentSource { #hypershift.openshift.io/v1beta1.ImageContentSource }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -12121,7 +12570,7 @@ Value of Filesystem is implied when not included in claim spec.

###KubevirtPlatformCredentials { #hypershift.openshift.io/v1beta1.KubevirtPlatformCredentials }

(Appears on: -KubeVirtNodePoolStatus, +KubeVirtNodePoolStatus, KubevirtPlatformSpec)

@@ -13065,7 +13514,7 @@ is empty.

###ManagedIdentity { #hypershift.openshift.io/v1beta1.ManagedIdentity }

(Appears on: -AzureKMSSpec, +AzureKMSSpec, ControlPlaneManagedIdentities)

@@ -13135,7 +13584,7 @@ credentialsSecretName must also be unique within the Azure Key Vault. See more d ###MarketType { #hypershift.openshift.io/v1beta1.MarketType }

(Appears on: -CapacityReservationOptions, +CapacityReservationOptions, PlacementOptions)

@@ -13160,6 +13609,180 @@ Spot instances use spare EC2 capacity at reduced prices but may be interrupted.< +###MetricsForwardingMode { #hypershift.openshift.io/v1beta1.MetricsForwardingMode } +

+(Appears on: +MetricsForwardingSpec) +

+

+

MetricsForwardingMode controls whether metrics forwarding is active for a hosted cluster.

+

+ + + + + + + + + + + + +
ValueDescription

"Forward"

MetricsForwardingModeForward indicates metrics forwarding is active.

+

"None"

MetricsForwardingModeNone indicates metrics forwarding is inactive.

+
+###MetricsForwardingSpec { #hypershift.openshift.io/v1beta1.MetricsForwardingSpec } +

+(Appears on: +MonitoringSpec) +

+

+

MetricsForwardingSpec configures metrics forwarding for the hosted cluster.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+mode
+ + +MetricsForwardingMode + + +		 +

mode controls whether metrics forwarding is active for this hosted cluster. +When set to “Forward”, metrics-proxy and endpoint-resolver are deployed in the +control plane, and a metrics-forwarder is deployed in the hosted cluster. +When set to “None”, metrics forwarding is inactive.

+
+metricsSet
+ + +MetricsSet + + +		 +(Optional) +

metricsSet specifies which set of metrics to forward to the hosted +cluster’s monitoring stack. This controls only the metrics-proxy forwarding +path and does not affect management-cluster-side ServiceMonitor/PodMonitor +relabel configurations. +When not specified, the value from monitoring.metricsSet is used, which itself +falls back to the global METRICS_SET environment variable (default “Telemetry”).

+

“Telemetry” forwards only the minimal set of metrics required for OpenShift Telemetry. +“SRE” forwards the Telemetry set plus additional metrics defined in the sre-metric-set +ConfigMap, needed for SRE dashboards and alerts. +“All” forwards all metrics from control plane components without filtering, +which produces significantly higher metrics volume.

+
+###MetricsSet { #hypershift.openshift.io/v1beta1.MetricsSet } +

+(Appears on: +MetricsForwardingSpec, +MonitoringSpec) +

+

+

MetricsSet specifies the set of metrics to collect and forward from hosted clusters.

+

+ + + + + + + + + + + + + + +
ValueDescription

"All"

MetricsSetAll collects all metrics from control plane components without +any filtering. Use this for debugging or when full metric visibility is +needed, but be aware it produces significantly higher metrics volume.

+

"SRE"

MetricsSetSRE collects the metrics defined in the sre-metric-set ConfigMap, +which includes the Telemetry set plus additional metrics needed for SRE +monitoring dashboards and alerts. Use this for clusters that require +SRE observability.

+

"Telemetry"

MetricsSetTelemetry collects only the minimal set of metrics required for +OpenShift Telemetry. Use this to minimize metrics volume while still +satisfying cluster telemetry requirements.

+
+###MonitoringSpec { #hypershift.openshift.io/v1beta1.MonitoringSpec } +

+(Appears on: +HostedClusterSpec, +HostedControlPlaneSpec) +

+

+

MonitoringSpec configures monitoring for the hosted cluster. +At least one field must be specified when this struct is present.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+metricsForwarding,omitzero
+ + +MetricsForwardingSpec + + +		 +(Optional) +

metricsForwarding configures forwarding of control plane metrics into +the hosted cluster’s monitoring stack. +When omitted, metrics forwarding behavior is determined by the +hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility. +If neither is set, metrics forwarding is disabled.

+
+metricsSet
+ + +MetricsSet + + +		 +(Optional) +

metricsSet specifies which set of metrics to collect and forward. +This overrides the global METRICS_SET environment variable configured on the HyperShift Operator. +When not specified, the global METRICS_SET value is used, which defaults to “Telemetry”.

+

“Telemetry” collects only the minimal set of metrics required for OpenShift Telemetry. +“SRE” collects the Telemetry set plus additional metrics defined in the sre-metric-set ConfigMap, +needed for SRE dashboards and alerts. +“All” collects all metrics from control plane components without filtering, +which produces significantly higher metrics volume.

+
###MultiQueueSetting { #hypershift.openshift.io/v1beta1.MultiQueueSetting }

(Appears on: @@ -13277,7 +13900,7 @@ FilterByNeutronTags ###NetworkParam { #hypershift.openshift.io/v1beta1.NetworkParam }

(Appears on: -OpenStackPlatformSpec, +OpenStackPlatformSpec, PortSpec)

@@ -13382,7 +14005,7 @@ int32

min is the minimum number of nodes to maintain in the pool. -Can be set to 0 for scale-from-zero for AWS platform. +Can be set to 0 for scale-from-zero for AWS and Azure platforms. Must be >= 0 and <= .Max.

@@ -14292,7 +14915,7 @@ progress and detecting stuck nodes.

###OLMCatalogPlacement { #hypershift.openshift.io/v1beta1.OLMCatalogPlacement }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -14318,7 +14941,7 @@ the management cluster.

###OSImageStreamReference { #hypershift.openshift.io/v1beta1.OSImageStreamReference }

(Appears on: -NodePoolSpec, +NodePoolSpec, NodePoolStatus)

@@ -14911,7 +15534,7 @@ This value must be a valid IPv4 or IPv6 address.

###OperatorConfiguration { #hypershift.openshift.io/v1beta1.OperatorConfiguration }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -15181,7 +15804,7 @@ do not support Capacity Reservations. Compatible with “default” and ###PlatformSpec { #hypershift.openshift.io/v1beta1.PlatformSpec }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -15327,7 +15950,7 @@ GCPPlatformSpec ###PlatformStatus { #hypershift.openshift.io/v1beta1.PlatformStatus }

(Appears on: -HostedClusterStatus, +HostedClusterStatus, HostedControlPlaneStatus)

@@ -15360,8 +15983,8 @@ AWSPlatformStatus ###PlatformType { #hypershift.openshift.io/v1beta1.PlatformType }

(Appears on: -KarpenterConfig, -NodePoolPlatform, +KarpenterConfig, +NodePoolPlatform, PlatformSpec)

@@ -16005,7 +16628,7 @@ crn:v1:bluemix:public:iam::::serviceRole:Manager ###PowerVSResourceReference { #hypershift.openshift.io/v1beta1.PowerVSResourceReference }

(Appears on: -PowerVSNodePoolPlatform, +PowerVSNodePoolPlatform, PowerVSPlatformSpec)

@@ -16215,7 +16838,7 @@ KarpenterConfig ###Release { #hypershift.openshift.io/v1beta1.Release }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, NodePoolSpec)

@@ -16646,10 +17269,124 @@ When omitted, the autoscaler defaults to 50%.

+###SecretEncryptionKeyStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus } +

+(Appears on: +SecretEncryptionStatus) +

+

+

SecretEncryptionKeyStatus records the active key identity using the same types as the spec.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+provider
+ + +SecretEncryptionProvider + + +		 +

provider identifies the encryption provider.

+
+azure,omitzero
+ + +AzureKMSKey + + +		 +(Optional) +

azure holds the Azure KMS key identity fields.

+
+aws,omitzero
+ + +AWSKMSKeyEntry + + +		 +(Optional) +

aws holds the AWS KMS key identity fields.

+
+ibmCloud,omitzero
+ + +IBMCloudKMSKeyEntry + + +		 +(Optional) +

ibmCloud holds the IBM Cloud KMS key identity fields.

+
+aescbc,omitzero
+ + +AESCBCKeyStatus + + +		 +(Optional) +

aescbc holds a reference to the AESCBC key secret.

+
+###SecretEncryptionProvider { #hypershift.openshift.io/v1beta1.SecretEncryptionProvider } +

+(Appears on: +EncryptionKeyReference, +SecretEncryptionKeyStatus) +

+

+

SecretEncryptionProvider identifies the encryption provider recorded in status. +This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC.

+

+ + + + + + + + + + + + + + + + +
ValueDescription

"AESCBC"

"AWS"

"Azure"

"IBMCloud"

###SecretEncryptionSpec { #hypershift.openshift.io/v1beta1.SecretEncryptionSpec }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -16707,6 +17444,74 @@ AESCBCSpec +###SecretEncryptionStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionStatus } +

+(Appears on: +HostedClusterStatus, +HostedControlPlaneStatus) +

+

+

SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption.

+

+ + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+activeKey,omitzero
+ + +SecretEncryptionKeyStatus + + +		 +(Optional) +

activeKey is the encryption key specification that all etcd data is confirmed encrypted with. +Updated after successful re-encryption.

+
+targetKey,omitzero
+ + +SecretEncryptionKeyStatus + + +		 +(Optional) +

targetKey is the key being rolled out during an active rotation. Snapshot from +spec.secretEncryption’s active key when the rotation starts. The CPO uses this +(not the current spec) during the rotation, so mid-rotation spec changes are +safely queued until the current rotation completes. Cleared when rotation completes.

+
+history
+ + +[]EncryptionMigrationHistory + + +		 +(Optional) +

history contains a list of key rotations applied to this cluster. The newest +entry is first in the list. Entries have state Completed when re-encryption +has finished. The current rotation phase is always history[0].state when +history[0] is not Completed or Interrupted.

+
###SecretEncryptionType { #hypershift.openshift.io/v1beta1.SecretEncryptionType }

(Appears on: @@ -16733,7 +17538,8 @@ AESCBCSpec ###SecretReference { #hypershift.openshift.io/v1beta1.SecretReference }

(Appears on: -HCPEtcdBackupAzureBlob, +AESCBCKeyStatus, +HCPEtcdBackupAzureBlob, HCPEtcdBackupS3)

@@ -16871,7 +17677,7 @@ The specifics of the setup are platform dependent.

###ServicePublishingStrategyMapping { #hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping }

(Appears on: -HostedClusterSpec, +HostedClusterSpec, HostedControlPlaneSpec)

@@ -17428,6 +18234,41 @@ capacity.

+###UserAssignedManagedIdentity { #hypershift.openshift.io/v1beta1.UserAssignedManagedIdentity } +

+(Appears on: +AzureContainerRegistryCredentialConfig) +

+

+

UserAssignedManagedIdentity identifies a user-assigned managed identity by its ARM resource ID.

+

+ + + + + + + + + + + + + +
FieldDescription
+resourceID
+ + +AzureManagedIdentityResourceID + + +		 +

resourceID is the ARM resource ID of the user-assigned managed identity +in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. +The identity must have the AcrPull role on the target Azure Container Registry. +It does not need to be in the same subscription or resource group as the HostedCluster, +but it must be in the same Azure AD tenant.

+
###UserManagedDiagnostics { #hypershift.openshift.io/v1beta1.UserManagedDiagnostics }

(Appears on: @@ -17543,7 +18384,7 @@ string ###WorkloadIdentity { #hypershift.openshift.io/v1beta1.WorkloadIdentity }

(Appears on: -AzureKMSSpec, +AzureKMSSpec, AzureWorkloadIdentities)