OCPBUGS-105434: [release-4.21] fix router component ordering to prevent missing HAProxy backends - #9263
Conversation
…-creating components Add a predicate to the router component that ensures all expected HCP router routes exist and are ready before reconciling on ARO-HCP clusters. This includes kube-apiserver-internal, konnectivity-server, oauth-internal, ignition-server, and conditionally metrics-proxy when metrics forwarding is enabled. The router also declares explicit WithDependencies on ignition-server and metrics-proxy components to give the informer cache more time to sync after those components create their routes via server-side apply. Add a TODO for introducing live reloading (like shared proxy) so the router config is updated when routes change after the initial reconcile. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…dencies The metrics-proxy component is conditional (only created when MetricsForwarding.Mode=Forward), so declaring it as a hard dependency causes a deadlock on platforms where it is never instantiated (e.g. GKE). The router predicate already ensures metrics-proxy routes exist before reconciling, making the explicit dependency unnecessary. Update all 5 router fixture YAML files to match the actual declared dependency (ignition-server only). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…AS dependency The ignition-server only needs the management cluster KAS (via its service account token), not the hosted cluster KAS. Including it in the implicit KAS dependency creates a deadlock on private clusters with KMS encryption (e.g. Azure ARO-HCP with private Key Vault): Router → ignition-server → KAS → Router (for KMS connectivity) By excluding ignition-server from the KAS dependency, its deployment and route are created independently, unblocking the router, which in turn provides the network path KAS needs to reach the KMS endpoint. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The oauth-internal route is only created by the infra reconciler when OAuth is enabled (HCPOAuthEnabled). When OAuth is disabled (e.g. OIDC authentication), the route is never created, causing the ARO router predicate to wait forever — a deadlock. Move oauth-internal from the unconditional base list to a conditional append gated on HCPOAuthEnabled, matching how the infra reconciler decides whether to create the route. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…icit KAS dependency The ignition-server-proxy component does not need the hosted KAS — it only proxies to the ignition-server, which is already excluded. Including it in the implicit KAS dependency creates the same deadlock as ignition-server on private clusters with KMS encryption: the router waits for the ignition-server-proxy Service to exist, but ignition- server-proxy waits for KAS, which waits for the router. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/valid-reference
|
@bennerv: This pull request references Jira Issue OCPBUGS-98213, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
/jira cherrypick OCPBUGS-98213 |
openshift-ci
Bot
added
area/control-plane-operator
|
@bennerv: Jira Issue OCPBUGS-98213 has been cloned as Jira Issue OCPBUGS-105434. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
changed the title
|
@bennerv: This pull request references Jira Issue OCPBUGS-105434, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira cherrypick OCPBUGS-101964 |
|
@bennerv: Jira Issue OCPBUGS-101964 has been cloned as Jira Issue OCPBUGS-105435. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
changed the title
|
@bennerv: This pull request references Jira Issue OCPBUGS-105435, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
bennerv
changed the title
|
@bennerv: This pull request references Jira Issue OCPBUGS-105434, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
- Remove endpoint_resolver and metrics_proxy references (packages do not exist on release-4.21) - Remove metricsProxyRouteRequired and related tests (MetricsForwarding API does not exist on release-4.21) - Replace azureutil.IsAroHCPByHCP with azureutil.IsAroHCP (ByHCP variant does not exist on release-4.21) - Remove AzureTopologyPrivate from test helper (type does not exist on release-4.21) - Add SwiftPodNetworkInstanceAnnotation to aroHCP test helper and SetAsAroHCPTest calls (IsPrivateHCP checks env var on release-4.21) - Use FakeReleaseProvider instead of gomock-generated mock (mock file not generated on release-4.21) - Only check ignitionserverv2.ComponentName in router ordering test (metricsproxyv2 does not exist on release-4.21) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
7b97370 to
cc36777
Compare
|
/verified by @twolff-gh Single rollout, complete HAProxy config from the first reconcile. CPO override test cluster (4.21, cpo-override-2512) showed 1 configmap create, no subsequent CPO updates, single replicaset. kubeAudit for router configmap: Prow e2e-parallel: |
openshift-ci-robot
removed
the
jira/invalid-bug
|
@bryan-cox: This pull request references Jira Issue OCPBUGS-105434, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@celebdor: This pull request references Jira Issue OCPBUGS-105434, which is valid. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/invalid-bug
|
@celebdor: This pull request references Jira Issue OCPBUGS-105434, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
csrwng
added
approved
|
/jira refresh |
|
@csrwng: This pull request references Jira Issue OCPBUGS-105434, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@bryan-cox: This pull request references Jira Issue OCPBUGS-105434, which is valid. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bennerv, bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Scheduling required tests: |
|
@bennerv: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
9b020a0
into
openshift:release-4.21
|
@bennerv: Jira Issue Verification Checks: Jira Issue OCPBUGS-105434 Jira Issue OCPBUGS-105434 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in release 4.21.0-0.nightly-2026-08-11-211246 |
|
/cherry-pick release-4.20 |
|
@bennerv: #9263 failed to apply on top of branch "release-4.20": DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
9 participants
Summary
Cherry-pick of PR #8971 to release-4.21 with manual conflict resolution and adaptation fixes.
Commits
77e577f6c4: fix(control-plane-operator): ensure router component runs after route-creating componentsc995ad02f6: fix(control-plane-operator): drop metrics-proxy from router WithDependencies2b9df60b2f: fix(control-plane-component): exclude ignition-server from implicit KAS dependency00e36f3406: fix(router): conditionally include oauth-internal in ARO route predicated565a6ed5b: fix(control-plane-component): exclude ignition-server-proxy from implicit KAS dependencyFixes Applied
hostedcontrolplane_controller.go(router positioned after ignitionproxyv2; endpoint_resolver, metrics_proxy, kubestorageversionmigrator components do not exist on release-4.21)hostedcontrolplane_controller_test.go(test functions present on main but not on release-4.21)endpointresolverv2andmetricsProxyRouteRequired(endpoint_resolver package and MetricsForwarding API do not exist on release-4.21)azureutil.IsAroHCPByHCPwithazureutil.IsAroHCP(ByHCP variant does not exist on release-4.21)AzureTopologyPrivatefrom test helper (type does not exist on release-4.21)SwiftPodNetworkInstanceAnnotationandSetAsAroHCPTestto ARO test cases (IsPrivateHCP/IsAroHCP are env-var based on release-4.21)FakeReleaseProviderinstead of gomock-generated mock (mock file not generated on release-4.21)References
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com