Skip to content

CNTRLPLANE-4150: release-5.0: feat: Maintain ingress serving cert for HostedCluster ingress - #9604

Open
deads2k wants to merge 7 commits into
openshift:release-5.0from
deads2k:5.0-ingress-cert
Open

CNTRLPLANE-4150: release-5.0: feat: Maintain ingress serving cert for HostedCluster ingress#9604
deads2k wants to merge 7 commits into
openshift:release-5.0from
deads2k:5.0-ingress-cert

Conversation

@deads2k

@deads2k deads2k commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

backport #9132

per the AI

Conflicts resolved in five files:

  • API conditions and vendored copy: Added IngressDefaultCertificateSynced without importing the unrelated logging deprecation condition. Regenerated vendor.
  • Two HCPUserFacingOperatorLogs.yaml manifests: Kept them absent because release-5.0 lacks that feature gate.
  • Azure E2E matrix: Added hosted-cluster-ingress to release-5.0’s existing public test group, preserving its parallel layout.

Passed: make update, affected API/controller/unit tests, ingress envtests, E2E v2 compilation, and diff checks. Cluster E2E execution remains for CI.

deads2k and others added 7 commits September 14, 2026 09:50
@deads2k @claude
feat(api): add ingress defaultCertificate field and synced condition
302867d 
Add an optional defaultCertificate reference to IngressOperatorSpec (shared by
HostedCluster and HostedControlPlane) so managed services can supply a custom
TLS certificate for the default ingress controller:

- Add IngressDefaultCertificateReference with a CEL rule validating the secret
  name as an RFC 1123 DNS subdomain, plus MinLength/MaxLength bounds.
- Add the IngressDefaultCertificateSynced condition type and its reasons
  (SecretNotFound, InvalidCertificateSecret, PlatformNotSupported).
- Document that a guest cluster-admin override of the ingress controller
  certificate takes precedence over this field.
- Regenerate deepcopy and the featuregated CRD manifests.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2d05470)
@deads2k @claude
chore(api): regenerate CRDs, clients, deepcopy, and vendor
fda1062 
Regenerated output for the ingress defaultCertificate field and the
IngressDefaultCertificateSynced condition:

- applyconfiguration clients for IngressDefaultCertificateReference and
  IngressOperatorSpec.
- Installed CRD manifests for hostedclusters and hostedcontrolplanes.
- Vendored copy of the api module.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit aa8e527)
@deads2k @claude
feat(hypershift-operator): sync ingress default certificate and repor…
8e73abd 
…t status

Sync the user-provided ingress default certificate secret from the HostedCluster
namespace into the control plane namespace and surface the outcome:

- Report the IngressDefaultCertificateSynced condition via optimistic-lock
  status patching; degrade gracefully (no reconcile failure) on a missing or
  malformed source secret, preserving the previously synced certificate.
- Skip the sync on IBM Cloud (PlatformNotSupported) and when the ingress
  capability is disabled, since no ingress controller consumes the certificate.
- When the certificate is unset, clean up the stale synced secret and condition,
  short-circuiting the common path before any re-Get/DeepCopy.
- Annotate the referenced secret before validation and index HostedClusters by
  the referenced secret name so a delete+recreate re-enqueues the owner promptly.
- Also invoke the sync from the legacy reconcile path.
- Add unit tests for the sync and the secret-referencing enqueue mapper.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit d346163)
@deads2k @claude
feat(control-plane-operator): use user-provided ingress default certi…
6985379 
…ficate in HCCO

Propagate the user-provided default certificate into the hosted cluster:

- When a custom certificate is configured, HCCO sources default-ingress-cert
  from the synced service-provider secret; otherwise it falls back to the
  CPO-generated wildcard.
- Do not fail reconciliation (do not degrade the HostedCluster) when the synced
  secret has not landed yet, and treat IBM Cloud as having no custom certificate.
- Add the ServiceProviderDefaultIngressServingCert manifest and thread
  DefaultCertificate through the ingress params.
- Add unit tests for certificate-source selection and params.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 408113b)
@deads2k @claude
test(e2e): add ingress default certificate coverage
9b1a56e 
- Add a v2 lifecycle test covering propagation, rotation, TLS handshake, the
  IngressDefaultCertificateSynced condition, source-secret deletion, revert to
  the wildcard, and a malformed-source negative case. Wire it into the Azure
  public group and skip it on Azure until the ingress endpoint is reachable from
  the build farm.
- Add envtest cases for the defaultCertificate name (CEL, MinLength, MaxLength).
- Add an IngressOperatorSpec serialization round-trip test and move
  GenerateCustomCertificate to test/e2e/v2/util to satisfy the e2eutilallowlist.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 004ae9b)
@deads2k @claude
docs: regenerate API reference for ingress default certificate
3a1eba8 
Regenerate the API reference and aggregated docs for the defaultCertificate
field and the IngressDefaultCertificateSynced condition.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 01dee99)
@deads2k
test(e2e): verify ingress certificates are not copied when ingress is…
39891d8 
… disabled

Assert that both destination secrets and the synced condition remain absent
 after configuring a valid source certificate. Skip the enabled-ingress
 lifecycle tests safely when ingress is disabled.

Signed-off-by: David Eads <deads@redhat.com>
(cherry picked from commit 57221be)
@openshift-ci

openshift-ci Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 14, 2026
@openshift-ci-robot

openshift-ci-robot commented Sep 14, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@deads2k: This pull request references CNTRLPLANE-4150 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

backport #9132

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: dae7a4a7-4e02-4679-9f88-d12a09813ab1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the area/api Indicates the PR includes changes for the API label Sep 14, 2026
@openshift-ci

openshift-ci Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: deads2k
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/documentation Indicates the PR includes changes for documentation area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release area/platform/azure PR/issue for Azure (AzurePlatform) platform area/testing Indicates the PR includes changes for e2e testing and removed do-not-merge/needs-area labels Sep 14, 2026
@deads2k deads2k changed the title CNTRLPLANE-4150: feat: Maintain ingress serving cert for HostedCluster ingress - #9132 CNTRLPLANE-4150: release-5.0: feat: Maintain ingress serving cert for HostedCluster ingress - #9132 Sep 14, 2026
@deads2k deads2k changed the title CNTRLPLANE-4150: release-5.0: feat: Maintain ingress serving cert for HostedCluster ingress - #9132 CNTRLPLANE-4150: release-5.0: feat: Maintain ingress serving cert for HostedCluster ingress Sep 14, 2026
@openshift-ci

openshift-ci Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

@deads2k: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify 39891d8 link true /test verify

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ironcladlou ironcladlou Awaiting requested review from ironcladlou
@muraee muraee Awaiting requested review from muraee

Assignees

No one assigned

Labels

area/api Indicates the PR includes changes for the API area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/documentation Indicates the PR includes changes for documentation area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release area/platform/azure PR/issue for Azure (AzurePlatform) platform area/testing Indicates the PR includes changes for e2e testing jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@deads2k @openshift-ci-robot