OCPBUGS-90560: remove GCP boot disk image defaulting from admission webhook

[nader-ziada]

Stop setting disk.Image at admission time so the GCP provider actuator can resolve it dynamically at reconcile time using the coreos-bootimages ConfigMap and machine architecture. Add RBAC for the machine-api-controllers SA to read the coreos-bootimages ConfigMap in the MCO namespace.

related to openshift/machine-api-provider-gcp#181

Summary by CodeRabbit

• New Features

  • Machine controllers can now access the boot image configuration required to resolve GCP boot-disk images.

• Bug Fixes

  • GCP disk images are no longer automatically assigned during defaulting.
  • Explicitly provided GCP disk image values are preserved.
  • GCP disks without an image now remain unspecified instead of receiving an automatic default.

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-90560, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Stop setting disk.Image at admission time so the GCP provider actuator can resolve it dynamically at reconcile time using the coreos-bootimages ConfigMap and machine architecture. Add RBAC for the machine-api-controllers SA to read the coreos-bootimages ConfigMap in the MCO namespace.

related to openshift/machine-api-provider-gcp#181

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 01659f93-e479-48a5-8613-c38ee328f765

📥 Commits

Reviewing files that changed from the base of the PR and between 4aca753 and 664c9b5.

📒 Files selected for processing (1)

• install/0000_30_machine-api-operator_09_rbac.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The webhook no longer defaults GCP disk images. Related test fixtures omit image values. New RBAC resources grant the machine API controllers access to boot image resources.

Changes

GCP disk image handling

Layer / File(s)	Summary
Remove GCP image defaults pkg/webhooks/machine_webhook.go, pkg/webhooks/machine_webhook_test.go, pkg/webhooks/machineset_webhook_test.go	The webhook no longer defines or assigns default GCP disk images. Related test fixtures omit the Image field.

Machine API RBAC

Layer / File(s)	Summary
Grant boot image resource access install/0000_30_machine-api-operator_09_rbac.yaml	Adds a namespaced Role and RoleBinding for coreos-bootimages access. The controller ClusterRole gains get access to osimagestreams.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 664c9

The change removes webhook image defaulting and grants the controller read access needed to resolve boot images during reconciliation. No concrete current-head merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing GCP boot disk image defaulting from the admission webhook.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No failure condition is introduced. The PR diff adds RBAC and changes GCP disk-image defaulting. The only test-file changes remove Image: defaultGCPDiskImage() fixture fields. The touched tests use …
Test Structure And Quality	✅ Passed	PASS. The pull request changes only standard testing.T fixture expectations in the webhook tests; it adds no Ginkgo It blocks, cluster-resource setup, cleanup, or wait operations. The changed test…
Microshift Test Compatibility	✅ Passed	The pull request adds no new Ginkgo e2e tests. The exact diff changes one RBAC manifest, webhook code, and three existing unit-test fixtures. The test changes only remove Image fields from existing …
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added. The pull-request diff changes only two existing standard Go test fixtures by removing GCP disk image fields; both files use func Test... (t *testing.T) and contai…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR adds only RBAC objects and changes GCP disk-image defaulting. The added Role, RoleBinding, and ClusterRole permission contain no pod scheduling fields. The webhook change only removes GCP…
Ote Binary Stdout Contract	✅ Passed	PASS: The PR changes only the RBAC manifest, GCP webhook defaulting, and unit-test fixtures. It does not change the OTE binary, suite setup, or process-level initialization. The changed Go hunks add n…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds no new Ginkgo e2e tests. The only changed test files use standard Go Test... functions, and the diff adds no Ginkgo declarations or IPv4/external-network test logic. Exis…
No-Weak-Crypto	✅ Passed	PASS. The pull-request diff only removes GCP disk-image defaulting and adds RBAC for ConfigMap and OS image stream reads. No changed line adds MD5, SHA-1, DES, 3DES, RC4, Blowfish, ECB mode, custom cr…
Container-Privileges	✅ Passed	PASS. The complete pull-request diff adds only RBAC rules for coreos-bootimages and osimagestreams, plus Go logic and tests. The added YAML contains no privileged: true, hostPID, hostNetwork…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The PR adds RBAC resources, removes GCP image defaulting, and updates test fixtures. It adds no logging calls or sensitive values to log messages. Existing webhook log statements are unchanged. …

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[nader-ziada]

/cc @RadekManak

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign theobarberbany for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[nader-ziada]

This PR should only merge after openshift/machine-api-provider-gcp#181

[damdo]

/retest

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-90560, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Stop setting disk.Image at admission time so the GCP provider actuator can resolve it dynamically at reconcile time using the coreos-bootimages ConfigMap and machine architecture. Add RBAC for the machine-api-controllers SA to read the coreos-bootimages ConfigMap in the MCO namespace.

related to openshift/machine-api-provider-gcp#181

Summary by CodeRabbit

• New Features

• Machine controllers can now access the boot image configuration required to resolve GCP boot-disk images.

• Bug Fixes

• GCP disk images are no longer automatically assigned during defaulting.

• Explicitly provided GCP disk image values are preserved.

• GCP disks without an image now remain unspecified instead of receiving an automatic default.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[nrb]

/test okd-scos-images

[damdo]

/test okd-scos-images

[openshift-ci]

@nader-ziada: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.