CNTRLPLANE-4150: feat: Maintain ingress serving cert for HostedCluster ingress - #9132
Merged
openshift-merge-bot[bot] merged 7 commits intoSep 11, 2026
Conversation
Contributor
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe API adds Sequence Diagram(s)sequenceDiagram
participant HostedClusterReconciler
participant KubernetesAPI
participant SourceSecret
participant ControlPlaneSecret
HostedClusterReconciler->>KubernetesAPI: Read DefaultCertificate reference
HostedClusterReconciler->>SourceSecret: Get and annotate configured Secret
SourceSecret-->>HostedClusterReconciler: Return TLS data or retrieval error
HostedClusterReconciler->>HostedClusterReconciler: Validate tls.crt and tls.key
HostedClusterReconciler->>ControlPlaneSecret: Create or update validated TLS data
HostedClusterReconciler->>KubernetesAPI: Patch IngressDefaultCertificateSynced status
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (9 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
area/api
openshift-ci
Bot
added
area/cli
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
hypershift-operator/controllers/hostedcluster/ingress_default_cert_sync_test.go (1)
20-27: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd a test case for
OperatorConfigurationset butIngressOperatornil.The two no-op cases (Lines 29-38, 40-52) both exercise the same code path (
OperatorConfiguration == nil), since a zero-valueHostedClusterSpecalready has a nilOperatorConfiguration. The intermediate nil check (hcluster.Spec.OperatorConfiguration.IngressOperator == nil, Line 2101 inhostedcluster_controller.go) is not directly exercised by any case.♻️ Suggested additional test case
+ { + name: "When IngressOperator is nil, it should be a no-op", + hcluster: &hyperv1.HostedCluster{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-cluster", + Namespace: "clusters", + }, + Spec: hyperv1.HostedClusterSpec{ + OperatorConfiguration: &hyperv1.OperatorConfiguration{ + IngressOperator: nil, + }, + }, + }, + expectError: false, + expectSync: false, + },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hypershift-operator/controllers/hostedcluster/ingress_default_cert_sync_test.go` around lines 20 - 27, Add a test case to TestReconcileIngressDefaultCertSync where HostedCluster.Spec.OperatorConfiguration is initialized but OperatorConfiguration.IngressOperator is nil, and assert the expected no-op behavior. Keep the existing nil-OperatorConfiguration case unchanged so the intermediate IngressOperator nil guard is exercised separately.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/hypershift/v1beta1/operator.go`:
- Line 309: The defaultCertificate field in api/hypershift/v1beta1/operator.go
must use an API CEL rule requiring a non-empty name whenever the reference is
non-nil, with envtest coverage for an empty reference. In
control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go,
update the default-certificate reconciliation logic to return/report an error
for a non-nil reference with an empty name instead of serving the generated
wildcard certificate.
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go`:
- Around line 321-347: Rename the test case in the ingress parameters table from
“DefaultCertificate set via OperatorConfiguration” to a stable “When … it should
…” description, such as “When DefaultCertificate is configured it should
propagate it to ingress parameters.” Leave the test inputs and expected values
unchanged.
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go`:
- Around line 1430-1432: Add focused unit tests for the certificate-source
selection logic surrounding sourceCert in the reconciliation flow: verify custom
certificate copying, fallback to the CPO-generated wildcard certificate when no
custom source is provided, and propagation of custom-secret retrieval failures.
Add these cases in the relevant resources controller test suite rather than
relying on params_test.go, which only covers parameter propagation.
In `@hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go`:
- Around line 2094-2137: Update reconcileIngressDefaultCertSync to always sync
the referenced source secret to the fixed
manifests.IngressDefaultIngressControllerCert().Name destination, and handle a
removed or changed DefaultCertificate.Name by deleting the previously synced
control-plane secret so stale TLS private key material does not remain.
---
Nitpick comments:
In
`@hypershift-operator/controllers/hostedcluster/ingress_default_cert_sync_test.go`:
- Around line 20-27: Add a test case to TestReconcileIngressDefaultCertSync
where HostedCluster.Spec.OperatorConfiguration is initialized but
OperatorConfiguration.IngressOperator is nil, and assert the expected no-op
behavior. Keep the existing nil-OperatorConfiguration case unchanged so the
intermediate IngressOperator nil guard is exercised separately.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 3b7f5413-cb5d-48f0-a7f1-76ede80f12a2
⛔ Files ignored due to path filters (40)
api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/zz_generated*.go,!**/zz_generated*api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/EtcdSharding.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**client/applyconfiguration/hypershift/v1beta1/ingressoperatorspec.gois excluded by!client/**cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamldocs/content/reference/aggregated-docs.mdis excluded by!docs/content/reference/aggregated-docs.mddocs/content/reference/api.mdis excluded by!docs/content/reference/api.mdvendor/github.com/openshift/hypershift/api/hypershift/v1beta1/operator.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**,!**/zz_generated*.go,!**/zz_generated*
📒 Files selected for processing (9)
api/hypershift/v1beta1/operator.goapi/hypershift/v1beta1/operator_test.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.gohypershift-operator/controllers/hostedcluster/hostedcluster_controller.gohypershift-operator/controllers/hostedcluster/ingress_default_cert_sync_test.gotest/e2e/util/util_ingress_operator_configuration.gotest/e2e/v2/tests/hosted_cluster_ingress_test.go
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #9132 +/- ##
==========================================
+ Coverage 47.37% 47.43% +0.05%
==========================================
Files 792 792
Lines 99774 99904 +130
==========================================
+ Hits 47269 47388 +119
- Misses 49344 49350 +6
- Partials 3161 3166 +5
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
deads2k
changed the title
bennerv
reviewed
Jul 27, 2026
4 tasks
muraee
reviewed
Jul 28, 2026
muraee
reviewed
Jul 28, 2026
JoelSpeed
reviewed
Jul 28, 2026
Member
|
With respect to https://redhat.atlassian.net/browse/OCPSTRAT-3499, there are a few things missing: AC3: When set, the IngressController CR uses the specified secret reference Whether this is a real gap or just imprecise acceptance criteria language depends on interpretation. The functional outcome is the same. But it does mean the IngressController CR gives no signal that a custom cert is in use versus the auto-generated one.
CORRECTION: AC5 — The test explicitly gets observed-default-ingress-cert from the control plane namespace, checks ca.crt parses as valid PEM, then builds an HTTP client using only that CA and does a TLS handshake against the canary route. It does this for the initial cert AND after rotation. The original comment calling it "completely unaddressed" was wrong. AC6: E2E test validates the custom cert flow
The JIRA says "E2E test validates the custom cert flow." These tests validate that a secret exists with expected keys — they don't exercise the actual feature end-to-end. CORRECTION: AC6 — The test uses Equal(certPEM) and Equal(keyPEM) for byte-for-byte comparison, not just "non-empty" checks. It creates the cert itself, sets defaultCertificate on the HC, does TLS handshakes, and tests rotation. Our original comment saying "they don't exercise the actual feature end-to-end" was wrong. The only thing the test genuinely doesn't cover is removal/revert to auto-generated. |
openshift-ci
Bot
added
the
needs-rebase
deads2k
force-pushed
the
maintain-ingress-serving-cert
branch
from
July 30, 2026 19:08
b2e8a89 to
576ef3c
Compare
openshift-ci
Bot
removed
the
needs-rebase
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (3)
control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go (1)
320-346: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winTest case name still doesn't follow "When ... it should ..." format.
This was flagged in a prior review round and remains unaddressed.
As per coding guidelines, "Always use 'When ... it should ...' format for describing test cases when creating unit tests."
♻️ Proposed fix
- name: "DefaultCertificate set via OperatorConfiguration", + name: "When DefaultCertificate is configured it should propagate it to ingress parameters",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go` around lines 320 - 346, Rename the test case in the IngressParams test table from “DefaultCertificate set via OperatorConfiguration” to a description following the required “When ... it should ...” format, while leaving the test setup and assertions unchanged.Source: Coding guidelines
control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go (1)
1430-1446: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winUnit test coverage for source-selection/fallback/error paths still appears missing.
This was already flagged in a prior review round; the tests added in this PR round (
ingress_default_cert_sync_test.go) cover a different function (the hosted-cluster-side secret sync), not this custom-cert vs. generated-wildcard selection/fallback logic inreconcileIngressController.As per coding guidelines, "Unit test any code changes and additions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go` around lines 1430 - 1446, Add unit tests for the source-selection logic in reconcileIngressController, covering custom default certificate selection, generated wildcard certificate fallback, successful control-plane retrieval, and retrieval errors for both paths. Verify the selected source certificate and accumulated error behavior, including sourceCert being nil after a failed lookup; do not rely on ingress_default_cert_sync_test.go, which exercises a different function.Source: Coding guidelines
hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go (1)
2094-2131: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winStale synced ingress TLS secret is never cleaned up when the reference is removed or changed.
reconcileIngressDefaultCertSyncno-ops whenDefaultCertificate.Nameis empty (line 2100-2104), but it never deletes a previously-syncedServiceProviderDefaultIngressServingCertsecret from the control-plane namespace. If a user removes or changes the reference, the old secret — including private key material — remains behind indefinitely in the CP namespace, even thoughresources.go's fallback logic no longer reads it.This mirrors a concern raised in a prior review round ("Delete stale synced ingress TLS secrets when the source reference changes" / muraee: "clean it up when the reference is removed from the API"). The fixed destination name (addressing the earlier "sync to a fixed secret name" ask) is now in place, but the deletion-on-removal behavior is still missing.
🔒 Proposed fix sketch
if hcluster.Spec.OperatorConfiguration == nil || hcluster.Spec.OperatorConfiguration.IngressOperator == nil || len(hcluster.Spec.OperatorConfiguration.IngressOperator.DefaultCertificate.Name) == 0 { - return nil + dest := cpomanifests.ServiceProviderDefaultIngressServingCert(controlPlaneNamespace) + if _, err := k8sutil.DeleteIfNeeded(ctx, r.Client, dest); err != nil { + return fmt.Errorf("failed to delete stale ingress default certificate secret: %w", err) + } + return nil }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go` around lines 2094 - 2131, Update reconcileIngressDefaultCertSync to delete the fixed ServiceProviderDefaultIngressServingCert secret when DefaultCertificate is unset, and before syncing a changed reference, so stale TLS data and private keys are removed. Preserve the existing source validation and sync behavior when a valid reference is present, using the existing client and controlPlaneNamespace.
🧹 Nitpick comments (1)
control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go (1)
1446-1453: 🧹 Nitpick | 🔵 TrivialIngressController still references a fixed cert secret regardless of custom-certificate configuration.
Per the PR's acceptance-criteria review, the
IngressControllerresource always points at the sameIngressDefaultIngressControllerCert()secret name; only the contents copied into it change based onp.DefaultCertificate. This makes it impossible to tell from theIngressControllerresource alone whether a custom certificate is configured — functionally equivalent, but an observability/traceability gap noted as still open.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go` around lines 1446 - 1453, Update the IngressController resource construction/reconciliation alongside the sourceCert handling so its certificate-secret reference reflects whether a custom certificate is configured, rather than always using manifests.IngressDefaultIngressControllerCert(). Preserve the existing default secret reference when sourceCert is absent and use the custom-certificate-specific reference when it is present.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/hypershift/v1beta1/operator.go`:
- Around line 313-320: Update the Name field in
IngressDefaultCertificateReference to include omitempty in its JSON tag,
preserving the existing field name and validation markers.
---
Duplicate comments:
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go`:
- Around line 320-346: Rename the test case in the IngressParams test table from
“DefaultCertificate set via OperatorConfiguration” to a description following
the required “When ... it should ...” format, while leaving the test setup and
assertions unchanged.
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go`:
- Around line 1430-1446: Add unit tests for the source-selection logic in
reconcileIngressController, covering custom default certificate selection,
generated wildcard certificate fallback, successful control-plane retrieval, and
retrieval errors for both paths. Verify the selected source certificate and
accumulated error behavior, including sourceCert being nil after a failed
lookup; do not rely on ingress_default_cert_sync_test.go, which exercises a
different function.
In `@hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go`:
- Around line 2094-2131: Update reconcileIngressDefaultCertSync to delete the
fixed ServiceProviderDefaultIngressServingCert secret when DefaultCertificate is
unset, and before syncing a changed reference, so stale TLS data and private
keys are removed. Preserve the existing source validation and sync behavior when
a valid reference is present, using the existing client and
controlPlaneNamespace.
---
Nitpick comments:
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go`:
- Around line 1446-1453: Update the IngressController resource
construction/reconciliation alongside the sourceCert handling so its
certificate-secret reference reflects whether a custom certificate is
configured, rather than always using
manifests.IngressDefaultIngressControllerCert(). Preserve the existing default
secret reference when sourceCert is absent and use the
custom-certificate-specific reference when it is present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a9ca151c-6d2a-45e8-8e71-60ac908f2545
⛔ Files ignored due to path filters (40)
api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/zz_generated*.go,!**/zz_generated*api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/NetworkObservabilityInstall.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/EtcdSharding.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/NetworkObservabilityInstall.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**client/applyconfiguration/hypershift/v1beta1/ingressdefaultcertificatereference.gois excluded by!client/**client/applyconfiguration/hypershift/v1beta1/ingressoperatorspec.gois excluded by!client/**client/applyconfiguration/utils.gois excluded by!client/**cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamldocs/content/reference/aggregated-docs.mdis excluded by!docs/content/reference/aggregated-docs.mddocs/content/reference/api.mdis excluded by!docs/content/reference/api.md
📒 Files selected for processing (9)
api/hypershift/v1beta1/operator.goapi/hypershift/v1beta1/operator_test.gocontrol-plane-operator/controllers/hostedcontrolplane/manifests/ingress.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.gohypershift-operator/controllers/hostedcluster/hostedcluster_controller.gohypershift-operator/controllers/hostedcluster/ingress_default_cert_sync_test.gohypershift-operator/controllers/hostedcluster/reconcile_legacy.go
deads2k
force-pushed
the
maintain-ingress-serving-cert
branch
from
July 30, 2026 20:31
576ef3c to
b1e0575
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (2)
control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go (1)
320-346: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winTest case name still doesn't follow the required format.
This was flagged in a prior review round but the name wasn't updated. As per path instructions, "Always use 'When ... it should ...' format for describing test cases when creating unit tests."
🐛 Proposed fix
- name: "DefaultCertificate set via OperatorConfiguration", + name: "When DefaultCertificate is configured it should propagate it to ingress parameters",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go` around lines 320 - 346, The test case named “DefaultCertificate set via OperatorConfiguration” in the IngressParams test table must follow the required “When ... it should ...” naming format. Rename only this case to clearly describe that setting DefaultCertificate via OperatorConfiguration produces the expected ingress parameters.Source: Path instructions
hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go (1)
2094-2131: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winStale synced certificate secret is never cleaned up when the reference is removed.
The destination secret name is now fixed (
cpomanifests.ServiceProviderDefaultIngressServingCert), addressing part of the earlier feedback, but whenDefaultCertificate.Nameis cleared (reverting to the auto-generated wildcard cert), this function just returnsnilat line 2103 without deleting the previously-synced secret. The old private key material remains in the control-plane namespace indefinitely even though it's no longer referenced anywhere.🔒 Proposed fix
if hcluster.Spec.OperatorConfiguration == nil || hcluster.Spec.OperatorConfiguration.IngressOperator == nil || len(hcluster.Spec.OperatorConfiguration.IngressOperator.DefaultCertificate.Name) == 0 { - return nil + dest := cpomanifests.ServiceProviderDefaultIngressServingCert(controlPlaneNamespace) + if _, err := util.DeleteIfNeeded(ctx, r.Client, dest); err != nil { + return fmt.Errorf("failed to delete stale ingress default certificate secret: %w", err) + } + return nil }This mirrors the still-open thread from muraee/deads2k on this exact function.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go` around lines 2094 - 2131, Update reconcileIngressDefaultCertSync so that when DefaultCertificate is unset, it deletes the fixed destination secret returned by ServiceProviderDefaultIngressServingCert in controlPlaneNamespace before returning. Preserve the no-op behavior when ingress configuration is absent, and treat a not-found deletion as successful while propagating other deletion errors.
🧹 Nitpick comments (2)
api/hypershift/v1beta1/operator.go (1)
307-307: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRedundant
omitemptyalongsideomitzeroon a struct field.
omitemptyhas no effect on non-pointer struct fields (Go'sisEmptyValuedoesn't handleStructkind), so onlyomitzeroactually omitsDefaultCertificatehere. As per coding guidelines, "Use omitempty for scalar fields, slices, and maps, and use omitzero for struct fields because omitempty does not omit non-pointer structs."♻️ Proposed fix
- DefaultCertificate IngressDefaultCertificateReference `json:"defaultCertificate,omitzero,omitempty"` + DefaultCertificate IngressDefaultCertificateReference `json:"defaultCertificate,omitzero"`🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/hypershift/v1beta1/operator.go` at line 307, Remove the redundant omitempty option from the DefaultCertificate field in the operator API type, leaving omitzero to control omission of the non-pointer IngressDefaultCertificateReference struct while preserving the existing JSON field name.Source: Path instructions
control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go (1)
1420-1429: 📐 Maintainability & Code Quality | 🔵 TrivialIngressController resource still doesn't indicate whether a custom certificate is configured.
ingress.ReconcileDefaultIngressControlleris called without any parameter reflectingp.DefaultCertificate; only the secret's data is swapped underneath. Functionally the guest cert is served correctly, but as flagged in review, theIngressControllerresource gives no signal (annotation/label/status) that a custom default certificate is in effect, which is a debuggability gap for operators/SREs inspecting the resource directly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go` around lines 1420 - 1429, The reconcileIngressController flow must propagate p.DefaultCertificate to the IngressController resource so the resource visibly indicates when a custom default certificate is configured. Update the relevant ingress reconciliation symbols, including ReconcileDefaultIngressController or the resource metadata/status handling, to set the established annotation, label, or status signal while preserving existing certificate behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.go`:
- Around line 320-346: The test case named “DefaultCertificate set via
OperatorConfiguration” in the IngressParams test table must follow the required
“When ... it should ...” naming format. Rename only this case to clearly
describe that setting DefaultCertificate via OperatorConfiguration produces the
expected ingress parameters.
In `@hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go`:
- Around line 2094-2131: Update reconcileIngressDefaultCertSync so that when
DefaultCertificate is unset, it deletes the fixed destination secret returned by
ServiceProviderDefaultIngressServingCert in controlPlaneNamespace before
returning. Preserve the no-op behavior when ingress configuration is absent, and
treat a not-found deletion as successful while propagating other deletion
errors.
---
Nitpick comments:
In `@api/hypershift/v1beta1/operator.go`:
- Line 307: Remove the redundant omitempty option from the DefaultCertificate
field in the operator API type, leaving omitzero to control omission of the
non-pointer IngressDefaultCertificateReference struct while preserving the
existing JSON field name.
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go`:
- Around line 1420-1429: The reconcileIngressController flow must propagate
p.DefaultCertificate to the IngressController resource so the resource visibly
indicates when a custom default certificate is configured. Update the relevant
ingress reconciliation symbols, including ReconcileDefaultIngressController or
the resource metadata/status handling, to set the established annotation, label,
or status signal while preserving existing certificate behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c6322acf-e798-4267-b0d8-c08f9064ef17
⛔ Files ignored due to path filters (50)
api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!**/zz_generated*.go,!**/zz_generated*api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/IngressComponentRouteLabels.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/NetworkObservabilityInstall.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSGroupPreferences.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/EtcdSharding.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/IngressComponentRouteLabels.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/NetworkObservabilityInstall.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSGroupPreferences.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**client/applyconfiguration/hypershift/v1beta1/ingressdefaultcertificatereference.gois excluded by!client/**client/applyconfiguration/hypershift/v1beta1/ingressoperatorspec.gois excluded by!client/**client/applyconfiguration/utils.gois excluded by!client/**cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamlcmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/**,!cmd/install/assets/**/*.yamldocs/content/reference/aggregated-docs.mdis excluded by!docs/content/reference/aggregated-docs.mddocs/content/reference/api.mdis excluded by!docs/content/reference/api.mdvendor/github.com/openshift/hypershift/api/hypershift/v1beta1/operator.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**,!**/zz_generated*.go,!**/zz_generated*
📒 Files selected for processing (11)
api/hypershift/v1beta1/operator.goapi/hypershift/v1beta1/operator_test.gocontrol-plane-operator/controllers/hostedcontrolplane/manifests/ingress.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/ingress/params_test.gocontrol-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.gohypershift-operator/controllers/hostedcluster/hostedcluster_controller.gohypershift-operator/controllers/hostedcluster/ingress_default_cert_sync_test.gohypershift-operator/controllers/hostedcluster/reconcile_legacy.gotest/e2e/util/util_ingress_operator_configuration.gotest/e2e/v2/tests/hosted_cluster_ingress_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
- control-plane-operator/controllers/hostedcontrolplane/manifests/ingress.go
Member
|
/test e2e-v2-aws |
openshift-ci-robot
removed
the
verified
openshift-ci
Bot
removed
lgtm
Member
|
/lgtm Putting these back on from rebase |
|
@bryan-cox: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
Scheduling tests matching the |
- Add a v2 lifecycle test covering propagation, rotation, TLS handshake, the IngressDefaultCertificateSynced condition, source-secret deletion, revert to the wildcard, and a malformed-source negative case. Wire it into the Azure public group and skip it on Azure until the ingress endpoint is reachable from the build farm. - Add envtest cases for the defaultCertificate name (CEL, MinLength, MaxLength). - Add an IngressOperatorSpec serialization round-trip test and move GenerateCustomCertificate to test/e2e/v2/util to satisfy the e2eutilallowlist. Signed-off-by: David Eads <deads@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Regenerate the API reference and aggregated docs for the defaultCertificate field and the IngressDefaultCertificateSynced condition. Signed-off-by: David Eads <deads@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… disabled Assert that both destination secrets and the synced condition remain absent after configuring a valid source certificate. Skip the enabled-ingress lifecycle tests safely when ingress is disabled. Signed-off-by: David Eads <deads@redhat.com>
Contributor
|
New changes are detected. LGTM label has been removed. |
Contributor
|
Scheduling tests matching the |
Contributor
Author
|
simple lint fix. reapplied labels. |
Member
|
/lgtm Putting these back on from lint fix |
|
@bryan-cox: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
Contributor
Contributor
Contributor
|
/hold Revision 57221be was retested 3 times: holding |
Member
|
/hold cancel |
Member
|
/test e2e-aws I'm tempted to override this if it fails again. It looks like the last three failures were all different and unrelated. |
Contributor
Contributor
Member
|
/test e2e-aws |
Contributor
Contributor
|
/hold Revision 57221be was retested 3 times: holding |
Member
|
/hold cancel |
Member
|
/override ci/prow/e2e-aws This test is failing on this PR over different issues each time. Moving this PR on so we can start the backporting process. |
Contributor
|
@bryan-cox: Overrode contexts on behalf of bryan-cox: ci/prow/e2e-aws DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Contributor
|
@deads2k: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@deads2k: #9132 failed to apply on top of branch "release-5.0": DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Our ingress/router is ~synonymous with OpenShift and is used to serve our webconsole. This places it in a special situation where it must logically exist on newly created clusters. Rather than try to re-orient a successful part of our product in the market, we will instead allow the serving certificate only to be managed by a service provider using the API provided by Hypershift. This change adds a field to specify a default serving certificate and have it injected into the HostedCluster's default ingress namespace.
Summary by CodeRabbit
New Features
Bug Fixes