Skip to content

CNTRLPLANE-4014,CNTRLPLANE-4020: Add per-component operator log level configuration - #8878

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
dhgautam99:OCPSTRAT-3156-kas-operator-config
Sep 1, 2026
Merged

CNTRLPLANE-4014,CNTRLPLANE-4020: Add per-component operator log level configuration#8878
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
dhgautam99:OCPSTRAT-3156-kas-operator-config

Conversation

@dhgautam99

@dhgautam99 dhgautam99 commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds per-component operator log level configuration for hosted control plane components, gated behind the HCPUserFacingOperatorLogs feature gate (TechPreviewNoUpgrade).

  • Introduce LogLevel enum (Normal, Debug, Trace, TraceAll) and ComponentLogLevelSpec type in the API
  • Add OperatorConfiguration fields for 8 components: kube-apiserver, etcd, kube-controller-manager, kube-scheduler, openshift-controller-manager, openshift-apiserver, openshift-oauth-apiserver, and oauth-server
  • Wire resolve functions per component to map LogLevel to klog verbosity (--v=) or etcd log level
  • Components that previously had no hardcoded --v flag use the (int, bool) return pattern — --v is only injected when LogLevel is explicitly set, preserving existing defaults
  • KAS supports a deprecation path: OperatorConfiguration field takes precedence over the legacy hypershift.openshift.io/kube-api-server-verbose annotation
  • LogLevel is a non-pointer value type with omitempty; "no opinion" is expressed by omitting the field
  • Remove hardcoded --v=2 from kube-scheduler and oauth-apiserver static manifests, replacing with dynamic resolution

Components

Component Resolve pattern Default when unset
kube-apiserver int (always returns fallback 2) --v=2 (preserves annotation behavior)
etcd inline != "" check etcd default log level
kube-controller-manager (int, bool) no --v injected
kube-scheduler (int, bool) no --v injected
openshift-controller-manager (int, bool) no --v injected
openshift-apiserver (int, bool) no --v injected
openshift-oauth-apiserver (int, bool) no --v injected
oauth-server (int, bool) no --v injected

Test plan

  • Unit tests for LogLevelToKlogVerbosity and LogLevelToEtcdLevel (support/util/loglevel_test.go)
  • Unit tests for each component's resolve function
  • Golden fixture tests for all components across all log level variants
  • CEL envtest YAML suite for operatorConfiguration CRD validation
  • make verify passes
  • make test-envtest-ocp passes (K8s 1.35)

Which issue(s) this PR fixes

Fixes CNTRLPLANE-3300

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot

openshift-ci-robot commented Jun 30, 2026

Copy link
Copy Markdown

@dhgautam99: This pull request references OCPSTRAT-3156 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the feature to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Add ComponentLogLevelSpec type and OperatorConfiguration.KubeAPIServer field to allow per-component log level configuration via the HostedCluster API
  • Add LogLevelToKlogVerbosity utility to map LogLevel enum values (Normal, Debug, Trace, TraceAll) to klog verbosity integers
  • Add resolveKASVerbosity in KAS deployment to support precedence chain: API field > deprecated annotation > default(2)
  • Add envtest YAML suite for kubeAPIServer logLevel CRD validation
  • Add unit tests for LogLevelToKlogVerbosity and resolveKASVerbosity

Test plan

  • Unit tests for LogLevelToKlogVerbosity (support/util/loglevel_test.go)
  • Unit tests for resolveKASVerbosity (control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment_test.go)
  • Envtest YAML suite for kubeAPIServer logLevel validation (cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.operatorconfiguration.testsuite.yaml)
  • make verify passes
  • make test-envtest-ocp passes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 30, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 30, 2026
@openshift-ci

openshift-ci Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci openshift-ci Bot added do-not-merge/needs-area needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jun 30, 2026
@coderabbitai

coderabbitai Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The API adds ComponentLogLevelSpec and OperatorConfiguration.KubeAPIServer for kube-apiserver verbosity. The deprecated annotation documents precedence in favor of the API field. A utility maps LogLevel values to klog verbosity, while the deployment controller resolves --v from the API field, annotation, or default 2. Tests cover mappings, precedence, deployment fixtures, and feature-gate configurations.

Sequence Diagram(s)

sequenceDiagram
  participant HostedControlPlane
  participant KASDeploymentController
  participant LogLevelToKlogVerbosity
  participant KubeAPIServerContainer

  HostedControlPlane->>KASDeploymentController: provide operator config or annotation
  KASDeploymentController->>LogLevelToKlogVerbosity: map LogLevel to verbosity
  LogLevelToKlogVerbosity-->>KASDeploymentController: return verbosity
  KASDeploymentController->>KASDeploymentController: parse annotation or use default 2
  KASDeploymentController->>KubeAPIServerContainer: set --v argument
Loading

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
No-Weak-Crypto ❌ Error The PR adds DES-CBC3-SHA to generated TLS cipher-suite allowlists in HCPUserFacingOperatorLogs CRDs, introducing weak 3DES usage. Remove the 3DES/DES cipher from the allowlists and regenerate the manifests, keeping only modern cipher suites.
✅ Passed checks (10 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Changed test titles are static and descriptive; no generated suffixes, timestamps, UUIDs, or other dynamic data appear in test names.
Test Structure And Quality ✅ Passed No Ginkgo tests were added/changed; the new code is table-driven unit tests only, with single-purpose cases and no cluster waits/timeouts to review.
Topology-Aware Scheduling Compatibility ✅ Passed Touched controller code only adds kube-apiserver verbosity resolution; no new affinity, selectors, spread constraints, replica math, or topology assumptions were introduced.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the changed tests are standard unit tests/envtest YAML and show no IPv4-only or external-network assumptions.
Container-Privileges ✅ Passed No changed manifest or fixture adds privileged, hostPID/hostNetwork/hostIPC, allowPrivilegeEscalation:true, SYS_ADMIN, or root settings; kube-apiserver fixture only sets readOnlyRootFilesystem.
No-Sensitive-Data-In-Logs ✅ Passed No new logging calls or sensitive-data output were added; changes only set KAS verbosity flags and tests/docs mention secrets in comments, not logs.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: adding per-component operator log level configuration.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added area/api Indicates the PR includes changes for the API area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/documentation Indicates the PR includes changes for documentation area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release and removed do-not-merge/needs-area labels Jun 30, 2026
@dhgautam99 dhgautam99 changed the title OCPSTRAT-3156: Add per-component log level configuration for kubeAPIServer CNTRLPLANE-3300: Add per-component log level configuration for kubeAPIServer Jun 30, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 30, 2026

Copy link
Copy Markdown

@dhgautam99: This pull request references CNTRLPLANE-3300 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Add ComponentLogLevelSpec type and OperatorConfiguration.KubeAPIServer field to allow per-component log level configuration via the HostedCluster API
  • Add LogLevelToKlogVerbosity utility to map LogLevel enum values (Normal, Debug, Trace, TraceAll) to klog verbosity integers
  • Add resolveKASVerbosity in KAS deployment to support precedence chain: API field > deprecated annotation > default(2)
  • Add envtest YAML suite for kubeAPIServer logLevel CRD validation
  • Add unit tests for LogLevelToKlogVerbosity and resolveKASVerbosity

Test plan

  • Unit tests for LogLevelToKlogVerbosity (support/util/loglevel_test.go)
  • Unit tests for resolveKASVerbosity (control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment_test.go)
  • Envtest YAML suite for kubeAPIServer logLevel validation (cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.operatorconfiguration.testsuite.yaml)
  • make verify passes
  • make test-envtest-ocp passes

Summary by CodeRabbit

  • New Features

  • Added a new option to configure kube-apiserver log verbosity directly in the cluster configuration.

  • Introduced clearer log level choices, including Normal, Debug, Trace, and TraceAll.

  • Bug Fixes

  • Improved how kube-apiserver verbosity is determined, with predictable fallback behavior when no setting is provided.

  • When both configuration methods are present, the newer setting now takes priority.

  • Documentation

  • Marked the older annotation-based verbosity setting as deprecated and documented the replacement.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@dhgautam99
dhgautam99 force-pushed the OCPSTRAT-3156-kas-operator-config branch from 48f74b4 to fefb0fd Compare July 1, 2026 08:54
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 1, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
api/hypershift/v1beta1/hostedcluster_types.go (1)

2634-2637: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider value type + omitzero instead of pointer for KubeAPIServer.

ComponentLogLevelSpec has only an optional LogLevel field with a kubebuilder default (Normal), so nil vs. a zero-value struct carry no distinct meaning here — this is the exact case the API guidelines call out for preferring a non-pointer struct with omitzero over a pointer with omitempty. Note that MonitoringSpec in this same file already follows the value+omitzero pattern for a newly-added optional struct field.

♻️ Suggested change
-	// kubeAPIServer configures the log verbosity of the kube-apiserver component.
-	// +optional
-	KubeAPIServer *ComponentLogLevelSpec `json:"kubeAPIServer,omitempty"`
+	// kubeAPIServer configures the log verbosity of the kube-apiserver component.
+	// +optional
+	KubeAPIServer ComponentLogLevelSpec `json:"kubeAPIServer,omitzero"`

Note the sibling fields ClusterVersionOperator, ClusterNetworkOperator, and IngressOperator in this same struct use the pointer+omitempty pattern already, so this isn't a new inconsistency, but per the API guidelines new additions should prefer the value+omitzero form.

As per coding guidelines, "Use omitempty for scalar fields, slices, and maps, and use omitzero for struct fields because omitempty does not omit non-pointer structs" and "Use pointers in CRD types only when the zero value is a valid, distinct user choice; do not use pointers just to model required nested structs."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/hypershift/v1beta1/hostedcluster_types.go` around lines 2634 - 2637, The
KubeAPIServer field is modeled as a pointer with omitempty even though
ComponentLogLevelSpec is just an optional struct with a defaulted LogLevel, so
nil and an empty struct are not meaningfully different. Update the HostedCluster
spec field to use a value type instead of a pointer and switch the JSON tag to
omitzero, following the same pattern used by MonitoringSpec. Keep the existing
sibling fields like ClusterVersionOperator and IngressOperator unchanged; only
adjust KubeAPIServer in hostedcluster_types.go.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@api/hypershift/v1beta1/hostedcluster_types.go`:
- Around line 2634-2637: The KubeAPIServer field is modeled as a pointer with
omitempty even though ComponentLogLevelSpec is just an optional struct with a
defaulted LogLevel, so nil and an empty struct are not meaningfully different.
Update the HostedCluster spec field to use a value type instead of a pointer and
switch the JSON tag to omitzero, following the same pattern used by
MonitoringSpec. Keep the existing sibling fields like ClusterVersionOperator and
IngressOperator unchanged; only adjust KubeAPIServer in hostedcluster_types.go.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 4fdd3da5-5ded-43a8-8f22-55b1625cddc4

📥 Commits

Reviewing files that changed from the base of the PR and between 48f74b4 and fefb0fd.

⛔ Files ignored due to path filters (37)
  • api/hypershift/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*.go, !**/zz_generated*
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • client/applyconfiguration/hypershift/v1beta1/componentloglevelspec.go is excluded by !client/**
  • client/applyconfiguration/hypershift/v1beta1/operatorconfiguration.go is excluded by !client/**
  • client/applyconfiguration/utils.go is excluded by !client/**
  • cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.operatorconfiguration.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml
  • cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
  • cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
  • cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
  • cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
  • cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
  • cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
📒 Files selected for processing (4)
  • api/hypershift/v1beta1/hostedcluster_types.go
  • api/hypershift/v1beta1/operator.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment_test.go
💤 Files with no reviewable changes (2)
  • control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • api/hypershift/v1beta1/operator.go

@github-actions
github-actions Bot temporarily deployed to docs-preview/pr-8878 July 1, 2026 09:05 Inactive
@codecov

codecov Bot commented Jul 1, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 96.73913% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.25%. Comparing base (55da12f) to head (468531a).

⚠️ Current head 468531a differs from pull request most recent head d01f5a2

Please upload reports for the commit d01f5a2 to get more accurate results.

Files with missing lines Patch % Lines
support/util/loglevel.go 90.00% 2 Missing ⚠️
...controllers/hostedcontrolplane/v2/ocm/component.go 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8878      +/-   ##
==========================================
- Coverage   46.64%   46.25%   -0.40%     
==========================================
  Files         784      785       +1     
  Lines       98880    98512     -368     
==========================================
- Hits        46123    45563     -560     
- Misses      49628    49864     +236     
+ Partials     3129     3085      -44     
Files with missing lines Coverage Δ
...trollers/hostedcontrolplane/v2/etcd/statefulset.go 75.15% <100.00%> (+3.20%) ⬆️
...ontrollers/hostedcontrolplane/v2/kas/deployment.go 58.62% <100.00%> (+7.90%) ⬆️
...ontrollers/hostedcontrolplane/v2/kcm/deployment.go 91.54% <100.00%> (+4.40%) ⬆️
...hostedcontrolplane/v2/kube_scheduler/deployment.go 50.00% <100.00%> (+50.00%) ⬆️
...ntrollers/hostedcontrolplane/v2/oapi/deployment.go 61.18% <100.00%> (+1.87%) ⬆️
...trollers/hostedcontrolplane/v2/oauth/deployment.go 22.91% <100.00%> (+6.06%) ⬆️
...ostedcontrolplane/v2/oauth_apiserver/deployment.go 100.00% <100.00%> (+4.00%) ⬆️
...ontrollers/hostedcontrolplane/v2/ocm/deployment.go 100.00% <100.00%> (ø)
...controllers/hostedcontrolplane/v2/ocm/component.go 0.00% <0.00%> (ø)
support/util/loglevel.go 90.00% <90.00%> (ø)

... and 39 files with indirect coverage changes

Flag Coverage Δ
cmd-support 39.80% <90.00%> (-0.48%) ⬇️
cpo-hostedcontrolplane 48.66% <98.61%> (-0.29%) ⬇️
cpo-other 46.11% <ø> (-1.50%) ⬇️
hypershift-operator 57.13% <ø> (+0.02%) ⬆️
other 34.71% <ø> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@hypershift-jira-solve-ci

hypershift-jira-solve-ci Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

I now have complete understanding of both lint errors. Let me verify my understanding by cross-referencing the exact error messages:

  1. Error 1 (hostedcluster_types.go:2637:2): optionalfields: field OperatorConfiguration.KubeAPIServer does not allow the zero value. It must have the omitzero tag. — The KubeAPIServer *ComponentLogLevelSpec field is marked +optional but ComponentLogLevelSpec has +kubebuilder:validation:MinProperties=1, meaning a zero-value (empty {}) would be invalid. The kubeapilinter requires omitzero tag instead of (or in addition to) omitempty.

  2. Error 2 (operator.go:52:2): defaults: field ComponentLogLevelSpec.LogLevel should use +default marker instead of +kubebuilder:default — The kubeapilinter prefers the shorter +default marker over the verbose +kubebuilder:default.

Test Failure Analysis Complete

Job Information

Test Failure Analysis

Error

hypershift/v1beta1/hostedcluster_types.go:2637:2: optionalfields: field OperatorConfiguration.KubeAPIServer does not allow the zero value. It must have the omitzero tag. (kubeapilinter)
	KubeAPIServer *ComponentLogLevelSpec `json:"kubeAPIServer,omitempty"`
	^

hypershift/v1beta1/operator.go:52:2: defaults: field ComponentLogLevelSpec.LogLevel should use +default marker instead of +kubebuilder:default (kubeapilinter)
	LogLevel LogLevel `json:"logLevel,omitempty"`
	^

2 issues:
* kubeapilinter: 2
make[1]: *** [Makefile:113: api-lint] Error 1
make: *** [Makefile:121: lint] Error 2

Summary

The make lint CI job failed with 2 kubeapilinter violations in the new API types introduced by PR #8878. Both errors are in the api/ module lint pass (api-lint target). The first error is on the new KubeAPIServer field in OperatorConfiguration which uses omitempty but — because ComponentLogLevelSpec has MinProperties=1 validation — the zero value (empty {}) is invalid, so the linter requires omitzero instead. The second error is on ComponentLogLevelSpec.LogLevel which uses the verbose +kubebuilder:default=Normal marker when the linter requires the shorter +default=Normal form.

Root Cause

Two kubeapilinter rule violations in the newly added API types:

1. optionalfields rule violation (hostedcluster_types.go:2637)

The KubeAPIServer *ComponentLogLevelSpec field on OperatorConfiguration is declared with json:"kubeAPIServer,omitempty". However, ComponentLogLevelSpec carries the marker +kubebuilder:validation:MinProperties=1, which means an empty/zero-value struct {} would fail validation. The kubeapilinter optionalfields checker detects this contradiction: with MinProperties=1, the zero value is not a valid value, so the JSON struct tag must use omitzero (not omitempty) to ensure the field is omitted when it holds its zero value. The omitzero tag (available in Go 1.24+ / encoding/json/v2 semantics used by controller-runtime) omits the field when the struct is its zero value, while omitempty only omits when the value is nil for pointer types — but the linter enforces omitzero for types with non-trivial zero-value validation constraints.

Fix: Change json:"kubeAPIServer,omitempty" to json:"kubeAPIServer,omitzero,omitempty" (or just json:"kubeAPIServer,omitzero" depending on project convention — check other fields with MinProperties in the same codebase).

2. defaults rule violation (operator.go:52)

The LogLevel field on ComponentLogLevelSpec uses +kubebuilder:default=Normal. The kubeapilinter defaults checker requires the shorter +default=Normal marker form instead. This is a project-level linter convention enforced by the kube-api-linter plugin loaded via .golangci.yml.

Fix: Replace // +kubebuilder:default=Normal with // +default=Normal.

Recommendations
  1. Fix the omitzero tag: In api/hypershift/v1beta1/hostedcluster_types.go, change the KubeAPIServer field's JSON tag:

    // Before:
    KubeAPIServer *ComponentLogLevelSpec `json:"kubeAPIServer,omitempty"`
    // After:
    KubeAPIServer *ComponentLogLevelSpec `json:"kubeAPIServer,omitzero,omitempty"`

    Check other +optional pointer fields with MinProperties constraints in the same file for the project's preferred pattern (some use omitzero alone, some use both).

  2. Fix the default marker: In api/hypershift/v1beta1/operator.go, change:

    // Before:
    // +kubebuilder:default=Normal
    // After:
    // +default=Normal
  3. Re-run make lint locally to confirm both issues are resolved before pushing.

  4. Run make verify after changes — updating the marker may affect generated CRD manifests (zz_generated.featuregated-crd-manifests/), so regeneration with make generate may be needed.

Evidence
Evidence Detail
Failed Step Run make lint (step 5, concluded failure at 09:07:02 UTC)
Lint Target api-lint (Makefile:113) — runs golangci-lint on the api/ submodule with --new-from-rev=origin/main
Linter kubeapilinter (kube-api-linter custom plugin loaded from hack/tools/bin/kube-api-linter.so)
Issue Count 2 issues (both kubeapilinter), out of 1102 pre-filtering issues → 2 after exclusion rules
Error 1 hostedcluster_types.go:2637:2optionalfields rule: OperatorConfiguration.KubeAPIServer needs omitzero tag because ComponentLogLevelSpec has MinProperties=1
Error 2 operator.go:52:2defaults rule: ComponentLogLevelSpec.LogLevel should use +default not +kubebuilder:default
Root lint (non-api) Passed with 0 issues (separate golangci-lint run on the main module)
PR Source api/hypershift/v1beta1/hostedcluster_types.go line 2634: KubeAPIServer *ComponentLogLevelSpec \json:"kubeAPIServer,omitempty"``
PR Source api/hypershift/v1beta1/operator.go line 51: // +kubebuilder:default=Normal
Exit Code make: *** [Makefile:121: lint] Error 2Process completed with exit code 2

@dhgautam99
dhgautam99 force-pushed the OCPSTRAT-3156-kas-operator-config branch from fefb0fd to d7859b5 Compare July 1, 2026 12:58
@github-actions
github-actions Bot temporarily deployed to docs-preview/pr-8878 July 1, 2026 13:04 Inactive
@openshift-ci openshift-ci Bot added area/platform/aws PR/issue for AWS (AWSPlatform) platform area/platform/azure PR/issue for Azure (AzurePlatform) platform area/platform/gcp PR/issue for GCP (GCPPlatform) platform area/platform/kubevirt PR/issue for KubeVirt (KubevirtPlatform) platform area/platform/openstack PR/issue for OpenStack (OpenStackPlatform) platform area/platform/powervs PR/issue for PowerVS (PowerVSPlatform) platform labels Jul 1, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 9674af4 and 2 for PR HEAD 468531a in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 7a31335 and 1 for PR HEAD 468531a in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 8e91adf and 0 for PR HEAD 468531a in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/hold

Revision 468531a was retested 3 times: holding

@vsolanki12

Copy link
Copy Markdown
Contributor

/unhold

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 0b61ee9 and 2 for PR HEAD 468531a in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 9631a28 and 1 for PR HEAD 468531a in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD a2a920b and 0 for PR HEAD 468531a in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/hold

Revision 468531a was retested 3 times: holding

@dhgautam99

Copy link
Copy Markdown
Contributor Author

/unhold

@dhgautam99

Copy link
Copy Markdown
Contributor Author

/test e2e-v2-azure-self-managed

@PoornimaSingour

Copy link
Copy Markdown
Contributor

/rebase

@github-actions

Copy link
Copy Markdown

🤖 Rebasing PR onto main: workflow run

…og levels

Introduce OperatorConfiguration in the HostedCluster API so operators can
set per-component log verbosity for the control plane components, replacing
hardcoded verbosity flags.

- Add ComponentLogLevelSpec and LogLevel (Normal/Debug/Trace/TraceAll)
  with CEL validation and godocs. etcd log levels are restricted to
  Normal and Debug.
- Wire log-level configuration through kube-apiserver, kube-controller-manager,
  kube-scheduler, openshift-apiserver, openshift-controller-manager,
  openshift-oauth-apiserver, oauth-server, and etcd deployments.
- For kube-apiserver, fall back to the existing verbosity annotation when
  the API field is unset; the API field takes precedence when both are set.
- Add unit tests covering log-level resolution for all components.
@dhgautam99

Copy link
Copy Markdown
Contributor Author

/verified by @dhgautam99 as per #8878 comment

@openshift-ci-robot

Copy link
Copy Markdown

@dhgautam99: This PR has been marked as verified by @dhgautam99 as per [#8878 comment](https://github.com/openshift/hypershift/pull/8878#issuecomment-5408360928).

Details

In response to this:

/verified by @dhgautam99 as per #8878 comment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@clebs

clebs commented Aug 27, 2026

Copy link
Copy Markdown
Member

/lgtm

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 4a90b97 and 2 for PR HEAD d01f5a2 in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD a84d736 and 1 for PR HEAD d01f5a2 in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 0eec409 and 0 for PR HEAD d01f5a2 in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/hold

Revision d01f5a2 was retested 3 times: holding

@dhgautam99

Copy link
Copy Markdown
Contributor Author

/unhold

@dhgautam99

Copy link
Copy Markdown
Contributor Author

/retest

@dhgautam99

Copy link
Copy Markdown
Contributor Author

/test verify-deps
/test verify
/test unit
/test images
/test okd-scos-images
/test security

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 63781a0 and 2 for PR HEAD d01f5a2 in total

@dhgautam99

Copy link
Copy Markdown
Contributor Author

/test e2e-v2-azure-self-managed
/test e2e-v2-gke

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 6c6d9de and 1 for PR HEAD d01f5a2 in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 51713fb and 0 for PR HEAD d01f5a2 in total

@openshift-ci

openshift-ci Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

@dhgautam99: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/api Indicates the PR includes changes for the API area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/documentation Indicates the PR includes changes for documentation area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release area/platform/aws PR/issue for AWS (AWSPlatform) platform area/platform/azure PR/issue for Azure (AzurePlatform) platform area/platform/gcp PR/issue for GCP (GCPPlatform) platform area/platform/kubevirt PR/issue for KubeVirt (KubevirtPlatform) platform area/platform/openstack PR/issue for OpenStack (OpenStackPlatform) platform area/platform/powervs PR/issue for PowerVS (PowerVSPlatform) platform jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.