SPLAT-2588: Promoting AWSServiceLBNetworkSecurityGroup on hypershift by mtulio · Pull Request #2838 · openshift/api

mtulio · 2026-05-07T19:57:48Z

Promotes the AWSServiceLBNetworkSecurityGroup feature gate to Default on Hypershift cluster profiles.

This feature was already GA on SelfManaged (enabled in Default) and was gated behind TechPreviewNoUpgrade on Hypershift.
Hypershift implementation: hypershift/pull/7460

openshift-merge-bot · 2026-05-07T19:57:51Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-05-07T19:57:52Z

@mtulio: This pull request references SPLAT-2588 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-05-07T19:57:55Z

Hello @mtulio! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

openshift-ci · 2026-05-07T19:57:55Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

mtulio · 2026-05-07T19:57:56Z

/test ?

coderabbitai · 2026-05-07T19:58:06Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR enables the AWSServiceLBNetworkSecurityGroup feature for Hypershift Default and OKD. Features/features.go consolidates the feature's enable condition into a single call covering default, OKD, and both tech/dev preview no-upgrade profiles. The Hypershift Default and OKD FeatureGate manifests remove the gate from disabled lists and add it to enabled lists. The features.md documentation table reorders rows and marks AWSServiceLBNetworkSecurityGroup as Enabled for both Hypershift variants.

Suggested reviewers

JoelSpeed
everettraven

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided by the author, making it impossible to assess whether the description relates to the changeset.	Add a description that explains the purpose of promoting AWSServiceLBNetworkSecurityGroup on Hypershift and the rationale behind this change.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly references the main change: promoting AWSServiceLBNetworkSecurityGroup on Hypershift, which directly matches the feature gate modifications across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies feature gate configuration and documentation files (features.md, features/features.go, and payload-manifests YAML). No Ginkgo test files or test names are added or modified.
Test Structure And Quality	✅ Passed	Ginkgo tests properly implement single responsibility, use BeforeEach/AfterEach for setup/cleanup of resources and CRDs, include appropriate timeouts on Eventually calls, provide meaningful asserti...
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. Changes are feature gate configuration and documentation updates only, making the MicroShift test compatibility check not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR does not add any Ginkgo e2e tests. It only modifies feature gate configuration files and documentation, making the SNO test compatibility check not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only modifies feature gate configuration (features.md, features.go, FeatureGate CRDs). No deployment manifests, operator code, controllers, or scheduling constraints are introduced.
Ote Binary Stdout Contract	✅ Passed	PR contains only configuration and documentation changes to feature gates; no process-level code with stdout writes (main, init, TestMain, BeforeSuite, AfterSuite) was added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. Changes are limited to feature gate configuration and documentation, making the IPv6/disconnected network compatibility check inapplicable.
No-Weak-Crypto	✅ Passed	PR makes no cryptographic changes; only promotes AWSServiceLBNetworkSecurityGroup feature gate via configuration updates and documentation changes.
Container-Privileges	✅ Passed	PR modifies only feature gate configurations, documentation, and Go code—no Kubernetes container manifests with security contexts are present or modified.
No-Sensitive-Data-In-Logs	✅ Passed	PR contains no logging statements or sensitive data (passwords, tokens, keys, PII) in code changes. All modifications are configuration/documentation updates for feature gate promotion.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-05-07T19:58:11Z

@mtulio: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

mtulio · 2026-05-07T19:58:50Z

/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance

mtulio · 2026-05-07T20:27:07Z

/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance

mtulio · 2026-05-11T14:05:36Z

/test e2e-aws-ovn-hypershift-conformance

mtulio · 2026-05-11T16:16:54Z

/test e2e-aws-ovn-hypershift

mtulio · 2026-05-11T17:57:52Z

/test all

mtulio · 2026-05-12T14:58:01Z

/test all

mtulio · 2026-05-13T12:28:59Z

/test e2e-aws-ovn-hypershift-conformance

mtulio · 2026-06-05T03:34:05Z

/test e2e-aws-ovn-hypershift-conformance

mtulio · 2026-06-10T22:25:08Z

/test verify-feature-promotion

Hypershift feature has been implemente without gate validation as it is already GA on self-managed by PR openshift/hypershift#7460

openshift-merge-bot · 2026-06-25T12:46:43Z

/retest-required

Remaining retests: 0 against base HEAD 50c3975 and 2 for PR HEAD fd7d48b in total

mtulio · 2026-06-25T14:05:25Z

/test e2e-aws-ovn

mtulio · 2026-06-25T14:58:40Z

many test failures in the e2e-aws-ovn-hypershift-conformance that is unrelated with this PR, all [cloud-provider-aws-e2e-* tests are passing or skipped.

Triggering again:

/test e2e-aws-ovn-hypershift-conformance

openshift-merge-bot · 2026-06-25T15:48:48Z

/retest-required

Remaining retests: 0 against base HEAD fcee122 and 1 for PR HEAD fd7d48b in total

mtulio · 2026-06-25T23:44:44Z

/retest-required

mtulio · 2026-06-26T00:48:24Z

Test Failure Summary for PR #2838

Job 1: `pull-ci-openshift-api-master-e2e-aws-ovn` (Prow link)

Blocking failure (1):
[sig-api-machinery] CRDValidationRatcheting [Privileged:ClusterAdmin] [FeatureGate:CRDValidationRatcheting] MUST NOT fail to update a resource due to CRD Validation Rule errors on unchanged correlatable fields

This is a known low-frequency flake in the CRDValidationRatcheting conformance suite (Jira component: kube-apiserver). Sippy shows a 99.81% pass rate across 3,736 runs in the current period (7 failures), with no open OCPBUGS bugs. The test validates that CRD validation ratcheting allows updates when correlatable fields are unchanged — the failure is a rare timing-sensitive race unrelated to the AWSServiceLBNetworkSecurityGroup feature gate promotion, which modifies only feature gate enablement for Hypershift and does not touch API machinery or CRD validation logic.

Informing failures (10): All 10 informing failures are [Feature:NetworkSegmentation][ovn-kubernetes-ote] tests — a batch failure pattern consistent with known OVN-Kubernetes UserDefinedNetwork flakiness, unrelated to this PR.

Job 2: `pull-ci-openshift-api-master-e2e-aws-ovn-hypershift-conformance` (Prow link)

Blocking failure (1):
[Jira:"Cloud Credential Operator"] Cluster_Operator CCO is enabled [Suite:cco/conformance/parallel][OTP][PolarionID:64885][platform:aws] Critical-CCO-based flow for olm managed operators and AWS STS

This is a heavily failing test with only a 28.01% pass rate across 332 runs (239 failures) in the current Sippy period for release 5.0 (Jira component: Cloud Credential Operator). No open OCPBUGS bug was found linked to this test, though the extremely low pass rate across the entire release indicates a systemic issue with CCO STS credential flow for OLM-managed operators — not a regression introduced by this PR. The AWSServiceLBNetworkSecurityGroup promotion changes only feature gate enablement and does not modify CCO, OLM, or STS credential handling.

Informing failures (11): 10 are [Feature:NetworkSegmentation][ovn-kubernetes-ote] tests (same pattern as Job 1), plus 1 [sig-node] Pod InPlace Resize Container test — all unrelated to this PR.

Conclusion: Neither blocking failure is related to the AWSServiceLBNetworkSecurityGroup feature gate promotion. Both are pre-existing flakes/failures affecting the broader release, not regressions from this change.

mtulio · 2026-06-26T03:41:13Z

/test e2e-gcp

openshift-merge-bot · 2026-06-26T08:45:23Z

/retest-required

Remaining retests: 0 against base HEAD bb02c82 and 0 for PR HEAD fd7d48b in total

mtulio · 2026-06-26T10:59:30Z

Hey @JoelSpeed , can we skip e2e-gcp, looking the history it seems pretty unstable and unrelated to this change

https://prow.ci.openshift.org/job-history/gs/test-platform-results/pr-logs/directory/pull-ci-openshift-api-master-e2e-gcp

mtulio · 2026-06-26T13:02:53Z

/test e2e-gcp

mtulio · 2026-06-26T16:24:34Z

/test e2e-gcp

Update e2e-aws-ovn-conformance-techpreview job to get more runs required to promote API PR openshift/api#2838 This will be reverted to weekly once we have enough runs.

openshift-merge-bot · 2026-06-26T20:46:28Z

/hold

Revision fd7d48b was retested 3 times: holding

mtulio · 2026-06-26T20:51:50Z

This is a permanent failure. Waiting Bryce to revert it per Slack discussion.
/hold cancel
/assign everettraven

mtulio · 2026-06-26T20:52:13Z

/test e2e-gcp

openshift-merge-bot · 2026-06-27T00:46:53Z

/retest-required

Remaining retests: 0 against base HEAD 39631f4 and 2 for PR HEAD fd7d48b in total

openshift-ci · 2026-06-27T05:49:16Z

@mtulio: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Update e2e-aws-ovn-conformance-techpreview job to get more runs required to promote API PR openshift/api#2838 This will be reverted to weekly once we have enough runs.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 7, 2026

openshift-ciBot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 7, 2026

openshift-ciBot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 7, 2026

mtulio changed the title ~~WIP/SPLAT-2588: Removing hypershift gates for AWSServiceLBNetworkSecurityGroup~~SPLAT-2588 / WIP: Removing hypershift gates for AWSServiceLBNetworkSecurityGroupMay 7, 2026

openshift-ci-robot removed the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 7, 2026

mtulio force-pushed the SPLAT-2588-ccm-nlb-hcp-ga branch from 879a92c to c5a5725Compare May 12, 2026 13:43

openshift-ciBot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 12, 2026

mtulio force-pushed the SPLAT-2588-ccm-nlb-hcp-ga branch from c5a5725 to c12aee7Compare May 12, 2026 14:56

mtulio mentioned this pull request May 14, 2026
SPLAT-2668: hypershift/aws/ccm: enable optional managed security group conformance job openshift/release#77567
Merged

mtulio force-pushed the SPLAT-2588-ccm-nlb-hcp-ga branch from c12aee7 to 381c126Compare June 10, 2026 22:03

redhat-chai-bot mentioned this pull request Jun 22, 2026
SPLAT-2588: fix hypershift topology variant to match Sippy classification #2897
Closed

chore: SPLAT-2588: enable feature on Hypershift
fd7d48b
Hypershift feature has been implemente without gate validation as it is already GA on self-managed by PR openshift/hypershift#7460

mtulio changed the title ~~SPLAT-2588 / WIP: Removing hypershift gates for AWSServiceLBNetworkSecurityGroup~~SPLAT-2588 / WIP: Promoting AWSServiceLBNetworkSecurityGroup on hypershiftJun 23, 2026

openshift-ciBot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 25, 2026

mtulio mentioned this pull request Jun 25, 2026
SPLAT-2588: hcp/aws returning TPNU job to weekly openshift/release#81080
Merged

openshift-ciBot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 26, 2026

openshift-ciBot assigned everettraven Jun 26, 2026

openshift-ciBot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 26, 2026

openshift-merge-botBot merged commit 3d22ba1 into openshift:masterJun 27, 2026
29 checks passed

mtulio deleted the SPLAT-2588-ccm-nlb-hcp-ga branch June 29, 2026 15:01

mkowalski mentioned this pull request Jul 6, 2026
OCPBUGS-97822: test/router: retry http2 test when response comes from wrong router openshift/origin#31367
Open

Uh oh!

Conversation

mtulio commented May 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-botBot commented May 7, 2026

Uh oh!

openshift-ci-robot commented May 7, 2026• edited by openshift-ci BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ciBot commented May 7, 2026

Uh oh!

openshift-ciBot commented May 7, 2026

Uh oh!

mtulio commented May 7, 2026

Uh oh!

coderabbitaiBot commented May 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Suggested reviewers

❌ Failed checks (1 warning)

Uh oh!

openshift-ci-robot commented May 7, 2026

Uh oh!

mtulio commented May 7, 2026

Uh oh!

mtulio commented May 7, 2026

Uh oh!

mtulio commented May 11, 2026

Uh oh!

mtulio commented May 11, 2026

Uh oh!

mtulio commented May 11, 2026

Uh oh!

mtulio commented May 12, 2026

Uh oh!

mtulio commented May 13, 2026

Uh oh!

mtulio commented Jun 5, 2026

Uh oh!

mtulio commented Jun 10, 2026

Uh oh!

openshift-merge-botBot commented Jun 25, 2026

Uh oh!

mtulio commented Jun 25, 2026

Uh oh!

mtulio commented Jun 25, 2026

Uh oh!

openshift-merge-botBot commented Jun 25, 2026

Uh oh!

mtulio commented Jun 25, 2026

Uh oh!

mtulio commented Jun 26, 2026

Test Failure Summary for PR #2838

Job 1: pull-ci-openshift-api-master-e2e-aws-ovn (Prow link)

Job 2: pull-ci-openshift-api-master-e2e-aws-ovn-hypershift-conformance (Prow link)

Uh oh!

mtulio commented Jun 26, 2026

Uh oh!

openshift-merge-botBot commented Jun 26, 2026

Uh oh!

mtulio commented Jun 26, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtulio commented Jun 26, 2026

Uh oh!

mtulio commented Jun 26, 2026

Uh oh!

openshift-merge-botBot commented Jun 26, 2026

Uh oh!

mtulio commented Jun 26, 2026

Uh oh!

mtulio commented Jun 26, 2026

Uh oh!

openshift-merge-botBot commented Jun 27, 2026

Uh oh!

openshift-ciBot commented Jun 27, 2026

Uh oh!

Uh oh!

mtulio commented May 7, 2026•
edited
Loading

openshift-ci-robot commented May 7, 2026•
edited by openshift-ci Bot
Loading

coderabbitaiBot commented May 7, 2026•
edited
Loading

Job 1: `pull-ci-openshift-api-master-e2e-aws-ovn` (Prow link)

Job 2: `pull-ci-openshift-api-master-e2e-aws-ovn-hypershift-conformance` (Prow link)

mtulio commented Jun 26, 2026•
edited
Loading