Skip to content

Reapply "Merge pull request #476 from mfbonfigli/SPLAT-2713_update-cc…#492

Draft
mfbonfigli wants to merge 1 commit into
openshift:mainfrom
mfbonfigli:SPLAT-2713_reapply-pr-476
Draft

Reapply "Merge pull request #476 from mfbonfigli/SPLAT-2713_update-cc…#492
mfbonfigli wants to merge 1 commit into
openshift:mainfrom
mfbonfigli:SPLAT-2713_reapply-pr-476

Conversation

@mfbonfigli

@mfbonfigli mfbonfigli commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Summary

Re-applies #476, which was reverted in #491 due to two NLB BYO Security Group transition tests failing in upgrade jobs.

The root cause of the issue is not related to the tests, but related to the fact that during cluster upgrades the master node IAM permissions do not get updated by the installer. This results in a 5.0 cluster without the new SetSecurityGroup permission, which is required for the e2e tests to pass, causing the failures. Since 4.22 > 5.0 upgrade jobs do not run during presubmits this was noticed only after the PR was merged.

Those failures are being addressed separately (openshift/release#81974) by patching the master IAM role in the CI upgrade step (openshift/release) prior to the test execution. This PR is to be merged only after that one is merged.

What this brings back

Updates the vendored cloud-provider-aws e2e test module, pulling in upstream NLB BYO Security Group transition tests

Fixes getRegionFromEnv() to validate the value of LEASED_RESOURCE against the AWS region format before using it as AWS_REGION, this prevents HyperShift CI from poisoning the region with a UUID lease value

Adds Infrastructure object fallback for region discovery when no valid region is found in environment variables

Moves AWSRegionPattern and GetRegionFromInfrastructure to the common package for shared use between main.go and the aws e2e package

Fixes a flaky unit test for BareMetal platform config sync

Summary by CodeRabbit

  • Bug Fixes
    • Improved AWS region detection by validating configured regions and falling back to the cluster’s infrastructure configuration when needed.
    • Added support for AWS region identifiers across supported partitions.
    • Improved reliability of BareMetal configuration-sync verification by allowing asynchronous reconciliation to complete before checking results.

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 16, 2026
@openshift-ci

openshift-ci Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci

openshift-ci Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign theobarberbany for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 16, 2026

Copy link
Copy Markdown

Walkthrough

AWS test region resolution now uses shared validation and Infrastructure lookup, with environment-based fallback selection. The BareMetal config-sync test now waits for the expected empty ConfigMap state.

Changes

AWS region discovery

Layer / File(s) Summary
Shared region helper and contract
openshift-tests/ccm-aws-tests/e2e/common/helper.go, openshift-tests/ccm-aws-tests/e2e/aws/helper.go
Adds the shared AWS region pattern and Infrastructure lookup, then updates AWS configuration loading to use them.
Region selection integration
openshift-tests/ccm-aws-tests/main.go, openshift-tests/ccm-aws-tests/e2e/aws/helper.go, openshift-tests/ccm-aws-tests/go.mod
Validates environment regions, falls back to Infrastructure with a timeout, reorders kubeconfig initialization, and updates the AWS e2e dependency.

BareMetal test synchronization

Layer / File(s) Summary
Eventually-based ConfigMap assertion
pkg/controllers/cloud_config_sync_controller_test.go
The BareMetal test polls for an empty ConfigMap list instead of checking immediately.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TestInitialization
  participant Environment
  participant Infrastructure
  participant AWSConfig
  TestInitialization->>Environment: read and validate region candidates
  Environment-->>TestInitialization: valid region or no match
  TestInitialization->>Infrastructure: request cluster AWS region
  Infrastructure-->>TestInitialization: return region
  TestInitialization->>AWSConfig: set validated region
Loading

Possibly related PRs

Suggested labels: jira/valid-reference

Suggested reviewers: mtulio, redhat-chai-bot

🚥 Pre-merge checks | ✅ 10 | ❌ 5

❌ Failed checks (4 warnings, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality ⚠️ Warning The BareMetal test uses Expect inside Eventually, so a transient List error can fail immediately and bypass the retry timeout pattern used elsewhere. Change the callback to use g.Expect inside Eventually (or return (int,error)) and keep the 2m/5s timeout; add a helpful failure message if desired.
Microshift Test Compatibility ⚠️ Warning New AWS e2e specs are untagged, and the suite now calls config.openshift.io Infrastructure via GetRegionFromInfrastructure; MicroShift lacks that API. Add a [apigroup:config.openshift.io] tag or MicroShift skip, or remove the Infrastructure-based path when running on MicroShift.
Ipv6 And Disconnected Network Test Compatibility ⚠️ Warning The PR adds vendored Ginkgo e2e tests that call public AWS endpoints and build http://%s:%d/... without net.JoinHostPort, so they’re not IPv6/disconnected-safe. Use IPv6-safe host formatting (net.JoinHostPort), and if the test needs AWS/public internet, mark it [Skipped:Disconnected] or gate on cluster/IP family.
Title check ❓ Inconclusive The title is generic and truncated, so it doesn’t clearly describe the actual changes in the PR. Rename it to a concise, specific summary of the main change, such as reapplying the CCM AWS test region handling updates.
✅ Passed checks (10 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No added/changed Ginkgo titles contain dynamic data; the modified BareMetal spec remains the static title "should skip config sync for BareMetal platform".
Single Node Openshift (Sno) Test Compatibility ✅ Passed The new e2e loadbalancer tests only use one sampled schedulable node and one-replica pods; I found no >1-node, cross-node, drain, or HA assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed PASS: The PR only changes AWS test helpers and a unit test; no manifests/operator/controller scheduling fields (nodeSelector, affinity, replicas, PDBs) were introduced.
Ote Binary Stdout Contract ✅ Passed No new process-level stdout writes were introduced; the added region logic logs via logrus or returns errors, and the touched helpers don’t print to stdout.
No-Weak-Crypto ✅ Passed No weak-crypto primitives or secret comparisons were added; the only hit is a module listing in vendor/modules.txt, not source usage.
Container-Privileges ✅ Passed No changed file adds container/K8s manifest privilege settings, and a scan of all diff files found no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation flags.
No-Sensitive-Data-In-Logs ✅ Passed The new logs only print AWS region/env names and fallback status; they don’t expose secrets, PII, hostnames, or customer data.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/controllers/cloud_config_sync_controller_test.go`:
- Around line 607-611: Update the Eventually callback in the config map cleanup
test to use an injected Gomega instance, replacing the global Expect around
cl.List with g.Expect so transient list errors are retried. Preserve the
existing namespace filter and zero-length assertion.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bad9daf6-aecd-49da-a165-e3a0fa5371c9

📥 Commits

Reviewing files that changed from the base of the PR and between 4aa859c and c541aab.

⛔ Files ignored due to path filters (4)
  • openshift-tests/ccm-aws-tests/go.sum is excluded by !**/*.sum
  • openshift-tests/ccm-aws-tests/vendor/k8s.io/cloud-provider-aws/tests/e2e/cloudconfig.go is excluded by !**/vendor/**
  • openshift-tests/ccm-aws-tests/vendor/k8s.io/cloud-provider-aws/tests/e2e/loadbalancer.go is excluded by !**/vendor/**
  • openshift-tests/ccm-aws-tests/vendor/modules.txt is excluded by !**/vendor/**
📒 Files selected for processing (5)
  • openshift-tests/ccm-aws-tests/e2e/aws/helper.go
  • openshift-tests/ccm-aws-tests/e2e/common/helper.go
  • openshift-tests/ccm-aws-tests/go.mod
  • openshift-tests/ccm-aws-tests/main.go
  • pkg/controllers/cloud_config_sync_controller_test.go

Comment on lines +607 to +611
Eventually(func() int {
allCMs := &corev1.ConfigMapList{}
Expect(cl.List(ctx, allCMs, &client.ListOptions{Namespace: targetNamespaceName})).To(Succeed())
return len(allCMs.Items)
}, 2*time.Minute, 5*time.Second).Should(BeZero())

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the surrounding section of the test
sed -n '560,635p' pkg/controllers/cloud_config_sync_controller_test.go

# Look for nearby Eventually usage patterns in the repo
rg -n "Eventually\\(func\\(" pkg/controllers -g '*.go' | head -n 40

# Check whether this file imports and uses Gomega's callback-with-g pattern elsewhere
rg -n "func\\(g Gomega\\)|WithT\\(|Expect\\(" pkg/controllers/cloud_config_sync_controller_test.go

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 15174


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '560,635p' pkg/controllers/cloud_config_sync_controller_test.go
rg -n "Eventually\\(func\\(" pkg/controllers -g '*.go' | head -n 40
rg -n "func\\(g Gomega\\)|WithT\\(|Expect\\(" pkg/controllers/cloud_config_sync_controller_test.go

Repository: openshift/cluster-cloud-controller-manager-operator

Length of output: 15174


🌐 Web query:

Gomega Eventually callback global Expect inside function fails immediately transient error retry behavior

💡 Result:

In Gomega, if you use the global Expect function inside a callback passed to Eventually, any failure of that assertion will cause the entire test to fail immediately, bypassing the retry mechanism [1][2][3]. This happens because the global Expect is not designed to be caught and retried by Eventually [2]. To achieve the desired transient error retry behavior, you must use a Gomega Gomega instance provided by the callback itself [2][4]. When you define your callback to accept a Gomega argument, Gomega passes a special instance that captures failures and allows Eventually to treat them as transient, triggering a retry instead of an immediate test failure [5][2][4]. Correct usage pattern: Eventually(func(g Gomega) { // Use the provided 'g' instead of the global 'Expect' g.Expect(actual).To(Equal(expected)) }, "5s", "100ms").Should(Succeed) By using the injected g.Expect, failures inside the function are intercepted by Eventually, allowing it to poll and retry until the assertion succeeds or the timeout is reached [5][2]. Using the global Expect will cause the test to exit immediately upon the first failure [1][3].

Citations:


Use g.Expect inside Eventually
The global Expect here can fail the spec immediately on a transient List error, bypassing Eventually retries. Use Eventually(func(g Gomega) int { ... g.Expect(...) ... }) or return (int, error) from the callback instead.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controllers/cloud_config_sync_controller_test.go` around lines 607 - 611,
Update the Eventually callback in the config map cleanup test to use an injected
Gomega instance, replacing the global Expect around cl.List with g.Expect so
transient list errors are retried. Preserve the existing namespace filter and
zero-length assertion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant