Skip to content

OCPNODE-4125: Promote CRIOCredentialProviderConfig feature gate Default#2844

Draft
QiWang19 wants to merge 1 commit into
openshift:masterfrom
QiWang19:promote-criocp
Draft

OCPNODE-4125: Promote CRIOCredentialProviderConfig feature gate Default#2844
QiWang19 wants to merge 1 commit into
openshift:masterfrom
QiWang19:promote-criocp

Conversation

@QiWang19

@QiWang19 QiWang19 commented May 14, 2026

Copy link
Copy Markdown
Member
  • Promote CRIOCredentialProviderConfig feature gate Default
  • Delete the manual override directory

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci

openshift-ci Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 14, 2026
@openshift-ci

openshift-ci Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

Hello @QiWang19! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@coderabbitai

coderabbitai Bot commented May 14, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The PR enables CRIOCredentialProviderConfig for Default and OKD feature sets in code, documentation, and four FeatureGate manifests covering Hypershift and SelfManagedHA. The CRD removes the v1alpha1 version, retaining v1 as the served storage version. A related test configuration removes its top-level version: v1 field.

Suggested reviewers: everettraven, jsafrane, sadasu

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Description check ❓ Inconclusive No author description was provided, so there isn't enough text to evaluate meaningful relevance. Add a brief description of the feature-gate promotion and affected manifests to make the PR easier to review.
✅ Passed checks (14 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo test titles were added or changed; the touched YAML test names are static and deterministic.
Test Structure And Quality ✅ Passed No Ginkgo test code changed; the only test file is declarative YAML, and the rest are feature-gate/manifest updates.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the diff only updates feature-gate/CRD YAML and a test manifest, with no It/Describe/Context/When usage.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only changes feature-gate/YAML data and a config test fixture, with no multi-node assumptions to review.
Topology-Aware Scheduling Compatibility ✅ Passed Diff only changes feature-gate manifests, CRD schema, and test metadata; no affinity, node selectors, replicas, or topology logic appear.
Ote Binary Stdout Contract ✅ Passed The PR only changes declarative feature-gate data and pure helper setters; no stdout writes or process-level entrypoints appear in touched files.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the diff only changes feature-gate/manifest YAML and one config test-data YAML, with no IPv4 or external connectivity code.
No-Weak-Crypto ✅ Passed Only feature-gate/manifest changes; no weak-crypto algorithms, custom crypto, or secret/token comparisons in touched files.
Container-Privileges ✅ Passed The diff only touches CRDs, feature-gate configs, docs, and tests; no privileged/hostPID/hostNetwork/hostIPC/allowPrivilegeEscalation or SYS_ADMIN settings appear.
No-Sensitive-Data-In-Logs ✅ Passed Changed files only adjust feature-gate YAML/docs/tests; no new logging or secret/PII-bearing strings were added.
Title check ✅ Passed The title clearly summarizes the main change: promoting CRIOCredentialProviderConfig to Default.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label May 14, 2026
@openshift-ci

openshift-ci Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@QiWang19

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@QiWang19 QiWang19 changed the title Promote CRIOCredentialProviderConfig feature gate Default OCPNODE-4125: Promote CRIOCredentialProviderConfig feature gate Default May 14, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 14, 2026
@openshift-ci-robot

openshift-ci-robot commented May 14, 2026

Copy link
Copy Markdown

@QiWang19: This pull request references OCPNODE-4125 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Comment thread features/features.go Outdated
productScope(ocpSpecific).
enhancementPR("https://github.com/openshift/enhancements/pull/1861").
enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
enable(inDefault(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You'll need inOKD() too here

@QiWang19

QiWang19 commented Jun 1, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@openshift-ci openshift-ci Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 1, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
features/features.go (1)

157-163: ⚠️ Potential issue | 🟠 Major

CRIOCredentialProviderConfig feature-promotion: OKD payload featuregates updated, but CRD feature-set annotation still mismatched

  • FeatureGateCRIOCredentialProviderConfig enables inDefault() and inOKD() (plus Dev/TechPreviewNoUpgrade) in features/features.go.
  • payload-manifests/featuregates/*-OKD*.yaml includes CRIOCredentialProviderConfig.
  • payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml still lists release.openshift.io/feature-set: CustomNoUpgrade,Default,DevPreviewNoUpgrade,TechPreviewNoUpgrade (missing OKD, still including CustomNoUpgrade), so the CRD feature-set payloads need regeneration to match the promoted feature gate.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@features/features.go` around lines 157 - 163,
FeatureGateCRIOCredentialProviderConfig is promoted to include inDefault() and
inOKD(), but the CRD resource for CRIOCredentialProviderConfig still has a
mismatched release.openshift.io/feature-set annotation; regenerate the CRD
payloads for the CRIOCredentialProviderConfig CRD so the annotation matches the
feature gate promotion (remove CustomNoUpgrade, add OKD) and ensure the
resulting payload manifests (CRD and featuregates YAMLs for
OKD/Default/DevPreviewNoUpgrade/TechPreviewNoUpgrade) are consistent with
FeatureGateCRIOCredentialProviderConfig.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@features/features.go`:
- Around line 157-163: FeatureGateCRIOCredentialProviderConfig is promoted to
include inDefault() and inOKD(), but the CRD resource for
CRIOCredentialProviderConfig still has a mismatched
release.openshift.io/feature-set annotation; regenerate the CRD payloads for the
CRIOCredentialProviderConfig CRD so the annotation matches the feature gate
promotion (remove CustomNoUpgrade, add OKD) and ensure the resulting payload
manifests (CRD and featuregates YAMLs for
OKD/Default/DevPreviewNoUpgrade/TechPreviewNoUpgrade) are consistent with
FeatureGateCRIOCredentialProviderConfig.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 848b3736-6b18-4b6a-8969-24cf4e2631b6

📥 Commits

Reviewing files that changed from the base of the PR and between a036844 and 67426b0.

⛔ Files ignored due to path filters (1)
  • config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
📒 Files selected for processing (7)
  • features.md
  • features/features.go
  • payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
💤 Files with no reviewable changes (4)
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
✅ Files skipped from review due to trivial changes (1)
  • payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml

@QiWang19

QiWang19 commented Jun 1, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
tools/codegen/cmd/featuregate-test-analyzer.go (1)

828-832: ⚡ Quick win

Move regex compilation outside the loop.

The ocpRelease regex is compiled on every iteration of the loop, which is inefficient. Follow the established pattern in this file (see nonHypershiftPlatforms at Line 599) and define it as a package-level variable.

♻️ Proposed refactor to define regex at package level

Add the regex near the other package-level regex definitions:

 var (
 	requiredSelfManagedJobVariants = []JobVariant{
 		{
 			Cloud:        "aws",
 			Architecture: "amd64",
 			Topology:     "ha",
 		},
 	nonHypershiftPlatforms        = regexp.MustCompile("(?i)nutanix|metal|vsphere|openstack|azure|gcp")
+	ocpReleasePattern             = regexp.MustCompile(`^\d+\.\d+$`)
 	requiredHypershiftJobVariants = []JobVariant{

Then update the function to use the package-level variable:

 	// Only consider OCP releases (e.g. "4.18", "5.0"), skip OKD ("5.0-okd"),
 	// HCM ("aro-integration"), and other non-OCP releases.
-	ocpRelease := regexp.MustCompile(`^\d+\.\d+$`)
 	for _, release := range result.Releases {
-		if !ocpRelease.MatchString(release) {
+		if !ocpReleasePattern.MatchString(release) {
 			continue
 		}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/codegen/cmd/featuregate-test-analyzer.go` around lines 828 - 832, Move
the regexp.MustCompile call out of the loop and declare a package-level variable
(following the pattern used by nonHypershiftPlatforms) so it is compiled once;
e.g., add a top-level var ocpRelease = regexp.MustCompile(`^\d+\.\d+$`) near the
other package-level regexes, then in the loop inside the code that iterates over
result.Releases simply use ocpRelease.MatchString(release) instead of
recompiling each iteration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tools/codegen/cmd/featuregate-test-analyzer.go`:
- Around line 828-832: Move the regexp.MustCompile call out of the loop and
declare a package-level variable (following the pattern used by
nonHypershiftPlatforms) so it is compiled once; e.g., add a top-level var
ocpRelease = regexp.MustCompile(`^\d+\.\d+$`) near the other package-level
regexes, then in the loop inside the code that iterates over result.Releases
simply use ocpRelease.MatchString(release) instead of recompiling each
iteration.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 20b8a977-c410-40cb-a108-9e912cd26fb3

📥 Commits

Reviewing files that changed from the base of the PR and between 67426b0 and c6b79ac.

📒 Files selected for processing (1)
  • tools/codegen/cmd/featuregate-test-analyzer.go

@JoelSpeed

Copy link
Copy Markdown
Contributor

@QiWang19 I think the feature gate analyzer should now be fixed, you can drop your temporary patch

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 2, 2026
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 2, 2026
@QiWang19

QiWang19 commented Jun 2, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

1 similar comment
@QiWang19

QiWang19 commented Jun 3, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@QiWang19 QiWang19 closed this Jun 4, 2026
@QiWang19 QiWang19 reopened this Jun 4, 2026
@QiWang19

QiWang19 commented Jun 4, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

1 similar comment
@QiWang19

QiWang19 commented Jun 8, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@QiWang19

QiWang19 commented Jun 9, 2026

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

2 similar comments
@QiWang19

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@QiWang19

Copy link
Copy Markdown
Member Author

/test verify-feature-promotion

@QiWang19

Copy link
Copy Markdown
Member Author

/test all
/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

@openshift-ci

openshift-ci Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

@QiWang19: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-upgrade 6672c2a link true /test e2e-upgrade
ci/prow/minor-e2e-upgrade-minor 6672c2a link true /test minor-e2e-upgrade-minor
ci/prow/e2e-aws-ovn 6672c2a link true /test e2e-aws-ovn
ci/prow/verify 6672c2a link true /test verify
ci/prow/e2e-aws-serial-techpreview-2of2 6672c2a link true /test e2e-aws-serial-techpreview-2of2
ci/prow/e2e-gcp 6672c2a link true /test e2e-gcp
ci/prow/e2e-aws-serial-1of2 6672c2a link true /test e2e-aws-serial-1of2
ci/prow/verify-feature-promotion 6672c2a link true /test verify-feature-promotion
ci/prow/e2e-aws-ovn-hypershift 6672c2a link true /test e2e-aws-ovn-hypershift
ci/prow/e2e-aws-serial-2of2 6672c2a link true /test e2e-aws-serial-2of2
ci/prow/e2e-upgrade-out-of-change 6672c2a link true /test e2e-upgrade-out-of-change
ci/prow/e2e-azure 6672c2a link true /test e2e-azure
ci/prow/e2e-aws-ovn-hypershift-conformance 6672c2a link true /test e2e-aws-ovn-hypershift-conformance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci openshift-ci Bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 14, 2026
@QiWang19

Copy link
Copy Markdown
Member Author

/test all
/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants