vsphere: fail CAPI machine generation on DNS or SOAP auth errors

[nikhilprajapati-world]

Summary

• vSphere IPI create manifests no longer treats a vCenter DNS or SOAP auth failure as success. ClusterAPI.Generate() returned nil after a warning, so classic IPI continued with zero CAPI control-plane machines.
• The swallow was documented as an assisted-installer defense, but ABI does not use this asset. IPI now fails with the resolve/auth error.
• Networks() gets its own 60s timeout from the parent context instead of nesting under the 30s DNS lookup context.

Fixes: https://redhat.atlassian.net/browse/OCPBUGS-126723

Test plan

• go test -mod=vendor ./pkg/asset/machines/ -run TestVSphereCAPIPreflight
• vSphere IPI install-config.yaml with platform.vsphere.vcenters[0].server: vcenter.bogus.invalid — openshift-install create manifests fails with unable to resolve vSphere server (previously warned and exited 0 with no cluster-api/machines/)
• SOAP auth failure on Networks() fails with authentication failure to vCenter instead of succeeding with zero CAPI machines
• Valid vCenter still generates CAPI machines under cluster-api/machines/

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • vSphere machine-manifest generation now stops with an error when vCenter DNS resolution fails or authentication is rejected.
  • Network loading receives its own timeout, preventing slow DNS lookups from reducing the available network-loading time.
• Tests
  • Added coverage for DNS failures, authentication failures, network errors, successful preflight checks, and independent timeout behavior.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@nikhilprajapati-world: This pull request references Jira Issue OCPBUGS-126723, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• vSphere IPI create manifests no longer treats a vCenter DNS or SOAP auth failure as success. ClusterAPI.Generate() returned nil after a warning, so classic IPI continued with zero CAPI control-plane machines.
• The swallow was documented as an assisted-installer defense, but ABI does not use this asset. IPI now fails with the resolve/auth error.
• Networks() gets its own 60s timeout from the parent context instead of nesting under the 30s DNS lookup context.

Fixes: https://redhat.atlassian.net/browse/OCPBUGS-126723

Test plan

• go test -mod=vendor ./pkg/asset/machines/ -run TestVSphereCAPIPreflight
• vSphere IPI install-config.yaml with platform.vsphere.vcenters[0].server: vcenter.bogus.invalid — openshift-install create manifests fails with unable to resolve vSphere server (previously warned and exited 0 with no cluster-api/machines/)
• SOAP auth failure on Networks() fails with authentication failure to vCenter instead of succeeding with zero CAPI machines
• Valid vCenter still generates CAPI machines under cluster-api/machines/

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: ab99e03b-ca16-4c03-abe1-78217bd01286

📥 Commits

Reviewing files that changed from the base of the PR and between 91cd2fe and e4b6cee.

📒 Files selected for processing (2)

• pkg/asset/machines/clusterapi.go
• pkg/asset/machines/clusterapi_vsphere_test.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The vSphere control-plane preflight logic now uses a dedicated helper with separate DNS and network timeouts. DNS resolution and SOAP authentication failures propagate from machine generation. New tests cover errors, success, and timeout independence.

Changes

vSphere preflight handling

Layer / File(s)	Summary
Preflight implementation and integration pkg/asset/machines/clusterapi.go	Adds separate DNS and network timeout constants, introduces hostLookup and vsphereCAPIPreflight, and propagates DNS and SOAP authentication errors from the vSphere generation path.
Preflight behavior tests pkg/asset/machines/clusterapi_vsphere_test.go	Tests DNS failure, SOAP authentication failure, non-SOAP network errors, successful network loading, and the independent network timeout budget.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e4b6c

The vSphere preflight now stops generation on DNS and authentication failures while retaining an independent Networks timeout. No actionable risk remains.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The change introduces internal vCenter hostnames into user-visible error logs. vsphereCAPIPreflight formats server into both DNS and SOAP authentication errors (clusterapi.go:540 and `clusterapi…	Keep the required failure behavior, but do not include the configured vCenter server in returned errors that reach command logging. Use generic messages such as unable to resolve vSphere server and authentication failure to vCenter, and…
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the vSphere CAPI behavior change: machine generation now fails on DNS or SOAP authentication errors.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed tests use static names: two fixed Go test identifiers and four literal t.Run case names. They contain no generated identifiers, timestamps, node or namespace names, IP addresses, or runt…
Test Structure And Quality	✅ Passed	PASS — The pull request adds standard Go tests with testing.T and testify/assert, not Ginkgo tests. No It, BeforeEach, AfterEach, Eventually, or Consistently blocks are present. The test…
Microshift Test Compatibility	✅ Passed	The pull request adds pkg/asset/machines/clusterapi_vsphere_test.go with standard Go Test... unit tests. It adds no Ginkgo It, Describe, Context, or similar e2e tests. The tests use only `co…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds a standard Go testing unit test, TestVSphereCAPIPreflight, in pkg/asset/machines/clusterapi_vsphere_test.go. It does not add Ginkgo It, Describe, Context, or When e…
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only vSphere CAPI machine preflight behavior and adds unit tests. The diff adds DNS and Networks timeouts and propagates DNS/SOAP errors; it does not add or modify deployments, controll…
Ote Binary Stdout Contract	✅ Passed	The pull request changes only pkg/asset/machines/clusterapi.go and a unit-test file. The production changes add timeout constants and vsphereCAPIPreflight, which returns errors and does not write …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests, not Ginkgo e2e tests. The added file uses testing.T, t.Run, testify/assert, and stubbed DNS/network callbacks. It does not add It, `Describe…
No-Weak-Crypto	✅ Passed	PASS. The pull request changes only vSphere DNS lookup, network timeout handling, error propagation, and tests. The authoritative diff introduces no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cr…
Container-Privileges	✅ Passed	PASS. The pull request changes only Go source and tests: pkg/asset/machines/clusterapi.go and pkg/asset/machines/clusterapi_vsphere_test.go. The authoritative diff adds no container or Kubernetes …

Full details: No-Sensitive-Data-In-Logs

Explanation

The change introduces internal vCenter hostnames into user-visible error logs. vsphereCAPIPreflight formats server into both DNS and SOAP authentication errors (clusterapi.go:540 and clusterapi.go:550). ClusterAPI.Generate returns these errors, FetchAndPersist propagates them, and cmd/openshift-install/create.go logs the final error with logrus.Fatal. The SOAP path is new: the base revision logged only the generic message authentication failure to vCenter, while the pull request adds the configured hostname. vCenter server values can be internal hostnames.

Resolution

Keep the required failure behavior, but do not include the configured vCenter server in returned errors that reach command logging. Use generic messages such as unable to resolve vSphere server and authentication failure to vCenter, and wrap only sanitized error details. Review the wrapped DNS/SOAP errors as well, because they may contain endpoint or other sensitive connection details.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign bfournie for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@nikhilprajapati-world: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

Summary

• vSphere IPI create manifests no longer treats a vCenter DNS or SOAP auth failure as success. ClusterAPI.Generate() returned nil after a warning, so classic IPI continued with zero CAPI control-plane machines.
• The swallow was documented as an assisted-installer defense, but ABI does not use this asset. IPI now fails with the resolve/auth error.
• Networks() gets its own 60s timeout from the parent context instead of nesting under the 30s DNS lookup context.

Fixes: https://redhat.atlassian.net/browse/OCPBUGS-126723

Test plan

• go test -mod=vendor ./pkg/asset/machines/ -run TestVSphereCAPIPreflight
• vSphere IPI install-config.yaml with platform.vsphere.vcenters[0].server: vcenter.bogus.invalid — openshift-install create manifests fails with unable to resolve vSphere server (previously warned and exited 0 with no cluster-api/machines/)
• SOAP auth failure on Networks() fails with authentication failure to vCenter instead of succeeding with zero CAPI machines
• Valid vCenter still generates CAPI machines under cluster-api/machines/

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
• vSphere machine-manifest generation now stops with an error when vCenter DNS resolution fails or authentication is rejected.
• Network loading receives its own timeout, preventing slow DNS lookups from reducing the available network-loading time.
• Tests
• Added coverage for DNS failures, authentication failures, network errors, successful preflight checks, and independent timeout behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@nikhilprajapati-world: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/golint	e4b6cee	link	true	/test golint

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.