[release-5.0] CNTRLPLANE-3871: promote OSStreams feature gate to Default by jparrill · Pull Request #9372 · openshift/hypershift

jparrill · 2026-08-21T12:55:27Z

Summary

Graduate the OSStreams feature gate from TechPreviewNoUpgrade to Default, enabling dual-stream RHEL 9/10 NodePool boot image resolution without requiring TechPreview.

Key behavior change: upgrading a NodePool from OCP 4.x to 5.0+ now switches nodes to rhel-10 (version-derived). Only an explicit spec.osImageStream pin overrides version-derived resolution. Upgrading the HyperShift Operator alone never causes a NodePool rollout — version-derived resolution returns rhel-9 for all OCP <5.0 NodePools regardless of the feature gate state.

Commits

build: bump openshift/api to 3db6c4b03286 — vendor update to the merge commit of openshift/api#2993 (OSStreams graduation re-applied after revert openshift/api#2989)
feat: promote OSStreams feature gate to Default — enable OSStreams in all 4 Default feature gate YAMLs, add configv1.Default to feature gate registration, regenerate NodePool CRD with osImageStream fields and CEL validation
feat: resolve RHEL stream from release version on upgrade — remove status preservation from GetRHELStreamForBootImage, aligning it with GetRHELStream. Resolution order: spec → FG check → version-derived
test: update OSImageStream tests for graduation — remove [FeatureGate:OSStreams] annotations, rename [Feature:NodePoolOSImageStream] to [Feature:OSStreams], update upgrade test to expect rhel-10 after OCP 5.0, remove stale TODO([CNTRLPLANE-3871](https://redhat.atlassian.net/browse/CNTRLPLANE-3871)), register upgrade verification in lifecycle suite, fix pre-existing Gherkin naming violations in aws_test.go
test: add major-version upgrade test for osImageStream — new NodePoolMajorVersionUpgradeTest (v1 e2e) that upgrades 4.22→5.0 and asserts status.osImageStream = rhel-10. Auto-skips on same-minor upgrades.
fix: only expect crun runtime handler on RHEL-10 nodes — guard the crun RuntimeHandler assertion in e2e behind a RHEL-10 check, since RHEL-9 nodes use runc and don't advertise crun.
test: use explicit Azure Marketplace image for RHEL-10 OS verification — the OCP 5.0 release payload does not yet include RHEL-10 Azure Marketplace images (no-purchase-plan is empty for rhel-10). This commit: (a) skips default NP OS verification on Azure when the expected stream is rhel-10, (b) creates a dedicated rhel-10 NodePool with explicit aro_5-0_x64_gen2 marketplace image to verify RHEL-10 boots correctly, (c) moves nodepool-osimagestream tests from the private cluster test group to the public cluster — the private cluster API is unreachable from the test pod (dial tcp 10.0.0.4:443: i/o timeout), and verifyNodeOSMatchesStream needs hosted cluster API access to list nodes. Tracked by openshift/installer#10764; remove the workaround when that PR merges.

Customer scenario resolution table

All scenarios assume the customer journey: upgrade HO first, then (optionally) upgrade NodePool to OCP 5.x.

#	Stage	OCP	spec	runc	FG	Resolution	Stream	Rollout?
1	HO pre	4.x	empty	no	off	FG disabled	rhel-9	— (initial state)
2	HO pre	4.x	empty	yes	off	FG disabled	rhel-9	— (initial state)
3	HO post	4.x	empty	no	on	version-derived, OCP <5	rhel-9	NO ✅
4	HO post	4.x	empty	yes	on	version-derived, OCP <5	rhel-9	NO ✅
5	HO post	4.x	rhel-9	no	on	explicit spec	rhel-9	NO ✅
6	HO post	4.x	rhel-10	no	on	validation: OCP <5	ERROR	—
7	NP to 5.x	5.x	empty	no	on	version-derived, OCP ≥5	rhel-10	YES (expected) ✅
8	NP to 5.x	5.x	empty	yes	on	version-derived, runc constraint	rhel-9	NO ✅
9	NP to 5.x	5.x	rhel-9	no	on	explicit spec	rhel-9	NO ✅
10	NP to 5.x	5.x	rhel-10	no	on	explicit spec	rhel-10	YES (expected) ✅
11	NP to 5.x	5.x	rhel-10	yes	on	validation: runc incompatible	ERROR	—

Key invariants:

HO upgrade never causes rollout — rows 3-5 show identical stream to rows 1-2
NP version upgrade drives OS change — row 7 is the expected rhel-9→rhel-10 transition
Explicit spec always wins — rows 5, 9, 10

GA product impact

ROSA/ARO: Managed upgrade pipelines control the release version. The rhel-9→rhel-10 switch on 4.x→5.0 upgrade is the expected and tested behavior. rhel-10 boot images (AMIs/VHDs) are provided by the 5.0 release payload — no manual image preparation needed. No action required from SRE teams.
IBM Cloud: Same version-derived behavior applies. Boot images are resolved via StreamForName() from the release payload metadata. No platform-specific impact.
MCE (self-managed): Customers upgrading their fleet from OCP 4.x to 5.0 will see nodes switch to rhel-10 automatically. spec.osImageStream: rhel-9 is the escape hatch if they need to stay on rhel-9 temporarily. This is documented in the enhancement.
Existing OCP 4.x clusters: No impact. Version-derived resolution still returns rhel-9 for all OCP <5.0 NodePools. Operator deployment does not trigger any rollout.

CI job for major-version upgrade validation: CNTRLPLANE-3871: add major-version-upgrade presubmit for HyperShift OSStreams graduation release#83595 (PREVIOUS=4.22, upgrades 4.22→5.0)
Jira: CNTRLPLANE-3871
API graduation (main): openshift/api#2993 — merged
API graduation revert: openshift/api#2989 — merged
MCO proxy fix: MCO#6420, backport MCO#6423

Test plan

make verify passes
Unit tests: 27 cases in TestGetRHELStreamForBootImage + TestValidateOSImageStream + TestUsesRuncRuntime
e2e compiles (go build -tags e2e ./test/e2e/... + go build -tags e2ev2 ./test/e2e/v2/...)
Manual verification: cross-version upgrade 4.22→5.1 on live cluster — status.osImageStream switches from rhel-9 to rhel-10 (verification comment)
CI: /test e2e-aws-major-version-upgrade (requires CNTRLPLANE-3871: add major-version-upgrade presubmit for HyperShift OSStreams graduation release#83595 merged first)
CI: e2e-aws (existing upgrade tests unaffected — major-version test auto-skips on same-minor)
CI: e2e-aws-upgrade-hypershift-operator — expected failure explained: pre-upgrade HO (FG off) creates NP on OCP 5.1 with rhel-9, post-upgrade HO (FG on) resolves rhel-10. This is a CI-only scenario — customers cannot have NPs on OCP 5.x before upgrading HO. Will pass once this PR merges.

🤖 Generated with Claude Code

Bumps openshift/api to the merge commit of api#2997, which applies the OSStreams feature gate graduation on release-5.0. Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

Enable OSStreams in all 4 Default feature gate YAMLs, add configv1.Default to feature gate registration, regenerate NodePool CRD with osImageStream fields and CEL validation. Add OSStreams to TestAllHypershiftOperatorFeatureGates expected maps (Default=true, TechPreview=true, DevPreview=false) and to TestFeatureGateConstants to prevent accidental revert. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

Remove status preservation from GetRHELStreamForBootImage, aligning it with GetRHELStream. Resolution order: spec, FG check, version-derived. Also removes debug log. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

Remove [FeatureGate:OSStreams] annotations, rename [Feature:NodePoolOSImageStream] to [Feature:OSStreams], update upgrade test to expect version-derived stream after OCP 5.0, remove stale TODO(CNTRLPLANE-3871), register upgrade verification in lifecycle suite, add informational osImageStream log to v1 upgrade test, derive expected stream from target version instead of hardcoding. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

New NodePoolMajorVersionUpgradeTest (v1 e2e) that upgrades from OCP 4.22 to 5.0 and asserts status.osImageStream = rhel-10. Auto-skips on same-major upgrades. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

openshift-merge-bot · 2026-08-21T12:55:30Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-08-21T12:55:32Z

@jparrill: This pull request references CNTRLPLANE-3871 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "5.0.0." or "openshift-5.0.0.", but it targets "openshift-5.1" instead.

Details

In response to this:

Summary

Backport of #9328 to release-5.0. Graduates the OSStreams feature gate from TechPreviewNoUpgrade to Default, enabling dual-stream RHEL 9/10 NodePool boot image resolution without requiring TechPreview.

Commits

build: bump openshift/api to e543cc5080e8 — vendor update to the merge commit of openshift/api#2997 (OSStreams graduation on release-5.0)

feat: promote OSStreams feature gate to Default — cherry-pick from CNTRLPLANE-3871: promote OSStreams feature gate to Default #9328

feat: resolve RHEL stream from release version on upgrade — cherry-pick from CNTRLPLANE-3871: promote OSStreams feature gate to Default #9328

test: update OSImageStream tests for graduation — cherry-pick from CNTRLPLANE-3871: promote OSStreams feature gate to Default #9328

test: add major-version upgrade test for osImageStream — cherry-pick from CNTRLPLANE-3871: promote OSStreams feature gate to Default #9328

Customer scenario resolution table

# Stage OCP spec runc FG Resolution Stream Rollout?

1 HO pre 4.x empty no off FG disabled rhel-9 — (initial state)

2 HO pre 4.x empty yes off FG disabled rhel-9 — (initial state)

3 HO post 4.x empty no on version-derived, OCP <5 rhel-9 NO ✅

4 HO post 4.x empty yes on version-derived, OCP <5 rhel-9 NO ✅

5 HO post 4.x rhel-9 no on explicit spec rhel-9 NO ✅

6 HO post 4.x rhel-10 no on validation: OCP <5 ERROR —

7 NP to 5.x 5.x empty no on version-derived, OCP ≥5 rhel-10 YES (expected) ✅

8 NP to 5.x 5.x empty yes on version-derived, runc constraint rhel-9 NO ✅

9 NP to 5.x 5.x rhel-9 no on explicit spec rhel-9 NO ✅

10 NP to 5.x 5.x rhel-10 no on explicit spec rhel-10 YES (expected) ✅

11 NP to 5.x 5.x rhel-10 yes on validation: runc incompatible ERROR —

Related

Main PR: CNTRLPLANE-3871: promote OSStreams feature gate to Default #9328

API graduation (release-5.0): openshift/api#2997 — merged

Jira: CNTRLPLANE-3871

Test plan

go build ./... passes

Lint: 0 issues

verify-crd-schema: expected failure — new resourceTags patterns from API bump are intentional (/override verify-crd-schema)

CI: presubmit tests

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-21T12:55:37Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ebcaff6a-f432-4a3d-84ca-981be0dceb94

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

jparrill · 2026-08-21T13:01:05Z

/hold

Dependency PR #9328

JoelSpeed · 2026-08-21T13:06:58Z

/approve for API

openshift-ci · 2026-08-21T13:07:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jparrill]
~~api/OWNERS~~ [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jparrill · 2026-08-21T13:22:13Z

/test images

jparrill · 2026-08-21T14:01:54Z

/pipeline required

openshift-merge-bot · 2026-08-21T14:01:57Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-22
/test e2e-aws-4-22
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-aks-external-oidc
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

jparrill · 2026-08-21T14:16:01Z

/test e2e-v2-aws-techpreview-osimagestream

csrwng · 2026-08-21T15:38:00Z

/lgtm

jparrill · 2026-08-24T13:18:26Z

/hold cancel

jparrill · 2026-08-24T13:21:36Z

/pipeline required

openshift-merge-bot · 2026-08-24T13:21:39Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-22
/test e2e-aws-4-22
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-aks-external-oidc
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

jparrill · 2026-08-24T13:23:18Z

/verified by E2E passing + OSStream tests

OSStream: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_hypershift/9372/pull-ci-openshift-hypershift-release-5.0-e2e-v2-aws-techpreview-osimagestream/2091057930882256896

openshift-ci-robot · 2026-08-24T13:23:30Z

@jparrill: This PR has been marked as verified by E2E passing + OSStream tests.

Details

In response to this:

/verified by E2E passing + OSStream tests

OSStream: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_hypershift/9372/pull-ci-openshift-hypershift-release-5.0-e2e-v2-aws-techpreview-osimagestream/2091057930882256896

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jparrill · 2026-08-24T13:25:27Z

/retest-required

jparrill · 2026-08-24T13:27:11Z

/test e2e-aws

jparrill · 2026-08-24T13:27:19Z

/test e2e-aks

jparrill · 2026-08-24T13:31:43Z

/override ci/prow/e2e-aws-upgrade-hypershift-operator

Justification: #9328 (comment)

openshift-ci · 2026-08-24T13:38:15Z

@jparrill: Overrode contexts on behalf of jparrill: ci/prow/e2e-aws-upgrade-hypershift-operator

Details

In response to this:

/override ci/prow/e2e-aws-upgrade-hypershift-operator

Justification: #9328 (comment)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-08-24T13:42:09Z

@jparrill: Overrode contexts on behalf of jparrill: ci/prow/e2e-aws-upgrade-hypershift-operator

Details

In response to this:

/override ci/prow/e2e-aws-upgrade-hypershift-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sdodson · 2026-08-24T13:44:41Z

/lgtm

openshift-merge-bot · 2026-08-24T13:45:30Z

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

jparrill · 2026-08-24T14:25:51Z

/test e2e-v2-azure-self-managed

jparrill · 2026-08-24T15:24:39Z

/test e2e-aws-4-22

openshift-merge-bot · 2026-08-24T15:56:26Z

/retest-required

Remaining retests: 0 against base HEAD a7fbf21 and 2 for PR HEAD 458a532 in total

jparrill · 2026-08-24T15:58:58Z

/override ci/prow/e2e-aws-upgrade-hypershift-operator

Justification: #9328 (comment)

openshift-ci · 2026-08-24T16:11:11Z

@jparrill: Overrode contexts on behalf of jparrill: ci/prow/e2e-aws-upgrade-hypershift-operator

Details

In response to this:

/override ci/prow/e2e-aws-upgrade-hypershift-operator

Justification: #9328 (comment)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jparrill · 2026-08-24T18:31:25Z

/test e2e-kubevirt-aws-ovn-reduced

jparrill · 2026-08-24T18:31:32Z

/retest-required

jparrill · 2026-08-24T19:28:33Z

/test e2e-v2-azure-self-managed

jparrill · 2026-08-24T20:20:47Z

/test e2e-v2-gke

openshift-ci · 2026-08-24T20:28:53Z

@jparrill: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-upgrade-hypershift-operator	`458a532`	link	true	`/test e2e-aws-upgrade-hypershift-operator`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jparrill and others added 5 commits August 21, 2026 14:49

build: bump openshift/api to e543cc5080e8

79feb93

Bumps openshift/api to the merge commit of api#2997, which applies the OSStreams feature gate graduation on release-5.0. Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 21, 2026

openshift-ci Bot added the do-not-merge/needs-area label Aug 21, 2026

openshift-ci Bot requested review from clebs and ironcladlou August 21, 2026 12:56

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 21, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 21, 2026

openshift-ci Bot assigned csrwng Aug 21, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 21, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 24, 2026

sdodson added backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Aug 24, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 24, 2026

openshift-ci Bot assigned sdodson Aug 24, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 24, 2026

sdodson merged commit 07a7273 into openshift:release-5.0 Aug 24, 2026
15 of 21 checks passed

Uh oh!

Conversation

jparrill commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commits

Customer scenario resolution table

GA product impact

Related

Test plan

Uh oh!

openshift-merge-bot Bot commented Aug 21, 2026

Uh oh!

openshift-ci-robot commented Aug 21, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commits

Customer scenario resolution table

Related

Test plan

Uh oh!

coderabbitai Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

jparrill commented Aug 21, 2026

Uh oh!

JoelSpeed commented Aug 21, 2026

Uh oh!

openshift-ci Bot commented Aug 21, 2026

Uh oh!

jparrill commented Aug 21, 2026

Uh oh!

jparrill commented Aug 21, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 21, 2026

Uh oh!

jparrill commented Aug 21, 2026

Uh oh!

csrwng commented Aug 21, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

openshift-ci-robot commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Aug 24, 2026

Uh oh!

openshift-ci Bot commented Aug 24, 2026

Uh oh!

sdodson commented Aug 24, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

openshift-ci Bot commented Aug 24, 2026

Uh oh!

jparrill commented Aug 24, 2026

Uh oh!

jparrill commented Aug 21, 2026 •

edited

Loading

openshift-ci-robot commented Aug 21, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 21, 2026 •

edited

Loading

jparrill commented Aug 24, 2026 •

edited

Loading