Skip to content

CORS-4542: restrict ClusterAPI machine management to only supported platforms - #10717

Merged
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
tthvo:CORS-4542
Jul 29, 2026
Merged

CORS-4542: restrict ClusterAPI machine management to only supported platforms#10717
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
tthvo:CORS-4542

Conversation

@tthvo

@tthvo tthvo commented Jul 28, 2026

Copy link
Copy Markdown
Member

Description

The PR introduces the following:

  • Reject controlPlane.management: ClusterAPI because it is not implemented in either installer or CPMS.
  • Replace FeatureGateClusterAPIComputeInstall by FeatureGateClusterAPIMachineManagementAWS and scope to AWS only, as that is the only platform where it is implemented

The effect of this change is that installer-created worker machinesets will use CAPI as soon as platform support is promoted.

Follow-up for #10659

Summary by CodeRabbit

  • New Features

    • Added support for Cluster API machine management on AWS worker and edge machine pools.
    • Machine pool management now defaults to Cluster API on AWS compute/edge when the required feature gate is enabled.
  • Bug Fixes

    • Improved validation for Cluster API machine management, including rejecting unsupported configurations (AWS control-plane and non-AWS platforms).
  • Tests

    • Expanded feature-gate and machine-pool default/validation test coverage for AWS compute and edge scenarios.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot

openshift-ci-robot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@tthvo: This pull request references CORS-4542 which is a valid jira issue.

Details

In response to this:

Description

The PR introduces the following:

  • Reject controlPlane.management: ClusterAPI because it is not implemented in either installer or CPMS.
  • Replace FeatureGateClusterAPIComputeInstall by FeatureGateClusterAPIMachineManagementAWS and scope to AWS only, as that is the only platform where it is implemented

The effect of this change is that installer-created worker machinesets will use CAPI as soon as platform support is promoted.

Follow-up for #10659

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 28, 2026
@coderabbitai

coderabbitai Bot commented Jul 28, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1d6e00dc-3c09-4e1d-9297-e57e86c787a8

📥 Commits

Reviewing files that changed from the base of the PR and between b8a4aa2 and e333fe9.

📒 Files selected for processing (9)
  • pkg/types/aws/validation/featuregates.go
  • pkg/types/aws/validation/featuregates_test.go
  • pkg/types/defaults/machinepools.go
  • pkg/types/defaults/machinepools_test.go
  • pkg/types/validation/featuregate_test.go
  • pkg/types/validation/featuregates.go
  • pkg/types/validation/installconfig.go
  • pkg/types/validation/machinepools.go
  • pkg/types/validation/machinepools_test.go
💤 Files with no reviewable changes (1)
  • pkg/types/validation/featuregates.go
🚧 Files skipped from review as they are similar to previous changes (6)
  • pkg/types/validation/machinepools.go
  • pkg/types/validation/installconfig.go
  • pkg/types/aws/validation/featuregates_test.go
  • pkg/types/aws/validation/featuregates.go
  • pkg/types/validation/machinepools_test.go
  • pkg/types/validation/featuregate_test.go

📝 Walkthrough

Walkthrough

Changes

AWS Cluster API machine management

Layer / File(s) Summary
AWS defaults and feature-gate detection
pkg/types/defaults/machinepools.go, pkg/types/defaults/machinepools_test.go, pkg/types/aws/validation/*
AWS compute and edge pools default to Cluster API management only when the AWS feature gate is enabled, and configured pools require that gate.
Machine management validation
pkg/types/validation/installconfig.go, pkg/types/validation/machinepools.go, pkg/types/validation/machinepools_test.go
Cluster API management is accepted for AWS worker and edge pools and rejected for AWS control-plane and non-AWS pools.
Feature-gate validation updates
pkg/types/validation/featuregates.go, pkg/types/validation/featuregate_test.go
Generic Cluster API install checks are removed, and indexed AWS compute management validation expectations are updated.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the PR’s main change: limiting ClusterAPI machine management to supported platforms.
Docstring Coverage ✅ Passed Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PASS: the changed tests use static, descriptive t.Run case names; no Ginkgo titles or dynamic values (timestamps, IDs, node/namespace names) appear in test names.
Test Structure And Quality ✅ Passed PASS: The changed tests are focused table-driven unit tests, not Ginkgo specs; no cluster resources, waits, or cleanup gaps were introduced.
Microshift Test Compatibility ✅ Passed No new Ginkgo/e2e tests were added; changed tests are unit tests only, with no MicroShift-unsupported APIs or missing protections.
Single Node Openshift (Sno) Test Compatibility ✅ Passed All touched tests are plain testing.T unit tests under pkg/types; no Ginkgo e2e tests or SNO/multi-node assumptions were added.
Topology-Aware Scheduling Compatibility ✅ Passed Only install-config validation/defaulting changed; no manifests, controllers, affinity, spread, or nodeSelector logic was introduced.
Ote Binary Stdout Contract ✅ Passed Touched files only add validation/defaulting and table tests; no main/init/TestMain setup stdout writes or fmt.Print/klog/log.SetOutput in the diff.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the touched tests are table-driven unit tests with no IPv4 or external-network assumptions.
No-Weak-Crypto ✅ Passed No MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto/secret-comparison code was added in the touched files.
Container-Privileges ✅ Passed No container/K8s manifests were changed; the PR only touches Go validation/defaulting code, and no privileged/host* or allowPrivilegeEscalation fields appear.
No-Sensitive-Data-In-Logs ✅ Passed PASS: The PR adds no new logging calls; touched code only adjusts validation/defaulting and error paths, with no sensitive-data log output introduced.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions


Comment @coderabbitai help to get the list of available commands.

@tthvo

tthvo commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

/cc @mdbooth

@openshift-ci
openshift-ci Bot requested a review from mdbooth July 28, 2026 06:20

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/types/validation/installconfig.go`:
- Around line 1699-1706: The AWS branch in the platform management validation
must reject every machine-pool role except MachinePoolComputeRoleName and
MachinePoolEdgeRoleName; update the role check around the existing
platform.Name() switch while preserving the current error behavior. Add an
invalid AWS arbiter-management case in pkg/types/validation/machinepools_test.go
lines 254-293 to verify MachinePoolArbiterRoleName is rejected.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: eba34791-5971-454e-98d4-77df57003ed2

📥 Commits

Reviewing files that changed from the base of the PR and between 25d6f5e and b8a4aa2.

📒 Files selected for processing (9)
  • pkg/types/aws/validation/featuregates.go
  • pkg/types/aws/validation/featuregates_test.go
  • pkg/types/defaults/machinepools.go
  • pkg/types/defaults/machinepools_test.go
  • pkg/types/validation/featuregate_test.go
  • pkg/types/validation/featuregates.go
  • pkg/types/validation/installconfig.go
  • pkg/types/validation/machinepools.go
  • pkg/types/validation/machinepools_test.go
💤 Files with no reviewable changes (1)
  • pkg/types/validation/featuregates.go

Comment thread pkg/types/validation/installconfig.go
@tthvo

tthvo commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

/test e2e-aws-ovn-dualstack-ipv6-primary-techpreview
/test e2e-aws-ovn-dualstack-ipv4-primary-techpreview
/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv6-primary-techpreview
/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv4-primary-techpreview

@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv6-primary-techpreview
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv4-primary-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a6cd3550-8a4c-11f1-8cdf-adccde30ffe0-0

@tthvo

tthvo commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-azure-nat-gateway-single-zone

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn

@mdbooth

mdbooth commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Lets keep it simple and close #10659.

@mdbooth mdbooth left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine except for the incorrect (and now duplicated) use of FeatureSets in the tests. Just use the FeatureGate, because that's the only thing you control.

Comment thread pkg/types/defaults/machinepools_test.go Outdated
Comment thread pkg/types/defaults/machinepools_test.go Outdated
@tthvo

tthvo commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

/pipeline required
/test e2e-aws-ovn-dualstack-ipv6-primary-techpreview
/test e2e-aws-ovn-dualstack-ipv4-primary-techpreview
/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv6-primary-techpreview
/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv4-primary-techpreview

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-azure-nat-gateway-single-zone

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn

@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv6-primary-techpreview
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-installer-dualstack-ipv4-primary-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/6bde8730-8ab7-11f1-9e31-6a71fec509f0-0

@tthvo

tthvo commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

/cc @sadasu

@openshift-ci
openshift-ci Bot requested a review from sadasu July 28, 2026 20:45
@mdbooth

mdbooth commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/test ?

@mdbooth

mdbooth commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/test e2e-aws-ovn-techpreview

@mdbooth

mdbooth commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/lgtm

I would like to see the e2e-aws-ovn-techpreview job pass.

@sadasu

sadasu commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/test e2e-aws-ovn-dualstack-ipv4-primary-techpreview

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 29, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

@sadasu

sadasu commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/approve

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sadasu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 29, 2026
Comment thread pkg/types/validation/featuregates.go
@sadasu

sadasu commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

I have 1 inline comment about featuregate validation. Can new compute or edge manifests be added day-2 with the CAPI management type?

@mdbooth

mdbooth commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

e2e-aws-ovn-techpreview failed due to a flake, but my testing concern is covered by e2e-aws-ovn-dualstack-ipv6-primary-techpreview, which passed.

@tthvo

tthvo commented Jul 29, 2026

Copy link
Copy Markdown
Member Author

Can new compute or edge manifests be added day-2 with the CAPI management type?

Oh yes, day-2 compute/edge machines can be created by directly creating CAPI machine manifests.

The install-config field .management: ClusterAPI is applicable only at install time and controls whether the installer generates day-1 MAPI or CAPI manifests.

@tthvo

tthvo commented Jul 29, 2026

Copy link
Copy Markdown
Member Author

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 29, 2026
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@tthvo: This PR has been marked as verified by [ci/prow/e2e-aws-ovn-dualstack-ipv4-primary-techpreview](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_installer/10717/pull-ci-openshift-installer-main-e2e-aws-ovn-dualstack-ipv4-primary-techpreview/2082474822729732096) and [ci/prow/e2e-aws-ovn-dualstack-ipv6-primary-techpreview](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_installer/10717/pull-ci-openshift-installer-main-e2e-aws-ovn-dualstack-ipv6-primary-techpreview/2082180959435755520)..

Details

In response to this:

/verified by ci/prow/e2e-aws-ovn-dualstack-ipv4-primary-techpreview and ci/prow/e2e-aws-ovn-dualstack-ipv6-primary-techpreview.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@tthvo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-fips e333fe9 link false /test e2e-aws-ovn-fips
ci/prow/e2e-aws-ovn-heterogeneous e333fe9 link false /test e2e-aws-ovn-heterogeneous
ci/prow/e2e-aws-ovn-techpreview e333fe9 link false /test e2e-aws-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@tthvo

tthvo commented Jul 29, 2026

Copy link
Copy Markdown
Member Author

/tide refresh

@openshift-merge-bot
openshift-merge-bot Bot merged commit 759698c into openshift:main Jul 29, 2026
27 of 30 checks passed
@tthvo
tthvo deleted the CORS-4542 branch July 29, 2026 20:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants