MCO-1985: Move boot image skew enforcement to Default#2758
MCO-1985: Move boot image skew enforcement to Default#2758openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
@djoshy: This pull request references MCO-1985 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Skipping CI for Draft Pull Request. |
|
Hello @djoshy! Some important instructions when contributing to openshift/api: |
openshift-ci
bot
added
the
size/XXL
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThis pull request enables the BootImageSkewEnforcement feature across multiple environments and cluster profiles. Changes include activating the feature gate in Default and OKD cluster profiles in features.go, moving BootImageSkewEnforcement from disabled to enabled lists in multiple featureGate YAML files, and adding comprehensive spec and status field definitions to MachineConfiguration CRDs with validation rules for boot image version skew enforcement modes (Automatic, Manual, None). The feature table in features.md is updated to reflect the enabled state. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.5.0)Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Comment |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan Review Summary by QodoPromote BootImageSkewEnforcement feature gate to default
WalkthroughsDescription• Promote BootImageSkewEnforcement feature gate to default • Enable feature for Default and OKD cluster profiles • Update CRD manifests with boot image skew enforcement configuration • Reorganize feature gate documentation and manifests Diagramflowchart LR
A["BootImageSkewEnforcement<br/>Feature Gate"] -->|enable inDefault<br/>inOKD| B["Default & OKD<br/>Profiles"]
C["CRD Manifests"] -->|add spec &<br/>status fields| D["Boot Image Skew<br/>Configuration"]
E["Feature Gate<br/>Documentation"] -->|reorganize| F["Enabled by Default<br/>Section"]
File Changes1. features/features.go
|
Code Review by Qodo
1. Machinesets status bypass
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| - message: when skew enforcement is in Automatic mode, managedBootImagesStatus | ||
| must contain a MachineManager opting in all MachineAPI MachineSets | ||
| rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' | ||
| ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || | ||
| self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode | ||
| == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): | ||
| true' |
There was a problem hiding this comment.
1. Machinesets status bypass 🐞 Bug ✓ Correctness
The new CEL rule that is supposed to ensure managedBootImagesStatus contains a MachineSet MachineManager with selection.mode='All' when bootImageSkewEnforcementStatus.mode is Automatic explicitly passes when status.managedBootImagesStatus.machineManagers is absent, so the rule does not actually enforce its own message in that case.
Agent Prompt
### Issue description
The MachineConfiguration CRD CEL validation for `bootImageSkewEnforcementStatus.mode == "Automatic"` currently passes when `status.managedBootImagesStatus.machineManagers` is missing, despite the error message stating it *must contain* an opting-in MachineSet MachineManager.
### Issue Context
This rule is now active in the Default/OKD feature sets and should enforce that Automatic skew enforcement has an explicit MachineSet opt-in (`selection.mode == "All"`) in status.
### Fix Focus Areas
- payload-manifests/crds/0000_80_machine-config_01_machineconfigurations-Default.crd.yaml[1507-1513]
- payload-manifests/crds/0000_80_machine-config_01_machineconfigurations-OKD.crd.yaml[1507-1513]
- operator/v1/types_machineconfiguration.go[20-23]
### Implementation notes
- Change the rule shape from `!(hasValue()) || exists(...)` to `hasValue() && exists(...)` (or equivalent) so absence fails validation in Automatic mode.
- Regenerate the CRD manifests after updating the source annotations (so operator/v1 and payload-manifests stay in sync).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
/pipeline required |
|
Scheduling tests matching the |
|
/lgtm Passing well aside from the notes in the PR description, LGTM |
|
@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-feature-promotion DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: JoelSpeed The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage. |
|
/verified by CI and promotion tests |
openshift-ci-robot
added
the
verified
|
@djoshy: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
|
@djoshy: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
This PR promotes the
BootImageSkewEnforcementfeature gate to default.Notes on feature promotion tests:
baremetalclusters:Automatictests are disabled as the MCO does not manage boot image updates for this platform.vSphereclusters: TheVerify Automatic mode permits other machine managerstest is disabled asvSpheredoes not currently support control plane boot image updates.