[Draft] - Adding cabilities for crdcompatibilitychecker and capi CRs#2884
Open
miyadav wants to merge 5 commits into
Open
[Draft] - Adding cabilities for crdcompatibilitychecker and capi CRs#2884miyadav wants to merge 5 commits into
miyadav wants to merge 5 commits into
Conversation
Contributor
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
do-not-merge/hold
Contributor
|
Hello @miyadav! Some important instructions when contributing to openshift/api: |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR introduces two new optional cluster capabilities to the ClusterVersion API: CompatibilityRequirements and ClusterAPI. It defines exported constants documenting that ClusterAPI depends on CompatibilityRequirements, extends the CRD schema enumeration to include both capabilities under feature gates (CRDCompatibilityRequirementOperator and ClusterAPIMachineManagement), registers them in the public KnownClusterVersionCapabilities list and the current capability set, and adds an XValidation rule that prevents enabling ClusterAPI without also enabling CompatibilityRequirements (either explicitly in spec.additionalEnabledCapabilities or implicitly in status.capabilities.enabledCapabilities). 🚥 Pre-merge checks | ✅ 13 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (13 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented Comment |
openshift-ci
Bot
added
the
size/S
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
config/v1/types_cluster_version.go (1)
22-22: ⚡ Quick winAdd/extend CRD validation tests for the new dependency rule.
Please add explicit create/update tests for
ClusterAPIrequiringCompatibilityRequirements(both failing and passing paths), mirroring the existing marketplace dependency test style.As per coding guidelines, “Add validation tests in
<group>/<version>/tests/<crd-name>/” for API validation changes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@config/v1/types_cluster_version.go` at line 22, Add CRD validation tests for the new XValidation rule in types_cluster_version.go that enforces ClusterAPI requires CompatibilityRequirements: create tests under the API group/version tests directory (following the pattern in existing marketplace dependency tests) that cover both failing and passing paths for create and update operations; name tests clearly (e.g., TestCreateClusterVersion_ClusterAPIWithoutCompatibilityRequirements_Fails and TestUpdateClusterVersion_EnableCompatibilityRequirements_Passes) and construct ClusterVersion objects toggling spec.capabilities.additionalEnabledCapabilities and status.capabilities.enabledCapabilities to assert validation rejection when ClusterAPI is present without CompatibilityRequirements and acceptance when CompatibilityRequirements is present either in spec or in status.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/v1/types_cluster_version.go`:
- Line 22: The XValidation rule currently only applies when
spec.capabilities.baselineCapabilitySet == 'None', letting configs with a
non-None baseline (e.g., baselineCapabilitySet: v4.18) enable ClusterAPI without
CompatibilityRequirements; remove the baselineCapabilitySet check so the rule
always enforces the dependency: update the kubebuilder XValidation expression in
types_cluster_version.go to check for the presence of spec.capabilities and
spec.capabilities.additionalEnabledCapabilities, and if 'ClusterAPI' is in
spec.capabilities.additionalEnabledCapabilities require
'CompatibilityRequirements' to be either in
spec.capabilities.additionalEnabledCapabilities or (if present) in
status.capabilities.enabledCapabilities; keep the existing has(...) guards and
the same error message.
---
Nitpick comments:
In `@config/v1/types_cluster_version.go`:
- Line 22: Add CRD validation tests for the new XValidation rule in
types_cluster_version.go that enforces ClusterAPI requires
CompatibilityRequirements: create tests under the API group/version tests
directory (following the pattern in existing marketplace dependency tests) that
cover both failing and passing paths for create and update operations; name
tests clearly (e.g.,
TestCreateClusterVersion_ClusterAPIWithoutCompatibilityRequirements_Fails and
TestUpdateClusterVersion_EnableCompatibilityRequirements_Passes) and construct
ClusterVersion objects toggling spec.capabilities.additionalEnabledCapabilities
and status.capabilities.enabledCapabilities to assert validation rejection when
ClusterAPI is present without CompatibilityRequirements and acceptance when
CompatibilityRequirements is present either in spec or in status.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: afefc07d-7be7-4bb8-a2e8-90622698cd31
📒 Files selected for processing (1)
config/v1/types_cluster_version.go
openshift-ci
Bot
added
size/L
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
JoelSpeed
reviewed
Jun 17, 2026
| // +kubebuilder:subresource:status | ||
| // +kubebuilder:resource:path=clusterversions,scope=Cluster | ||
| // +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability" | ||
| // +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" |
Contributor
There was a problem hiding this comment.
The changes here look fine, but we should make this a feature gated validation based on the presence of the two gates
Contributor
There was a problem hiding this comment.
You need this rule to only apply when both gates are enabled, so you need to use requiredFeatureGate and add both gate names
Suggested change
| // +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" | |
| // +// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" |
|
|
||
| // ClusterVersionCapability enumerates optional, core cluster components. | ||
| // +kubebuilder:validation:Enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1 | ||
| // +kubebuilder:validation:Enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI |
Contributor
There was a problem hiding this comment.
Make these feature gated enum validations instead
That way we only ship the capabilities when the feature gates are promoted
|
according to this guide, we should add a capability set for the current version |
Member
Author
Thanks @stefanonardo for review , it is already here |
…patibilityRequirements dependency XValidation behind the CRDCompatibilityRequirementOperator feature gate so they only ship in TechPreview/DevPreview CRDs until the gate is promoted.
openshift-ci
Bot
added
size/XXL
… which is also ungated , FeatureGateAwareXValidation causing test failure
JoelSpeed
reviewed
Jun 18, 2026
JoelSpeed
left a comment
JoelSpeed
left a comment
Contributor
There was a problem hiding this comment.
Please try the two suggestions. What I am explaining about gating these is possible and is a requirement for merging this. If you have issues getting it working post what you've got here and we can work this out
Comment on lines
+308
to
+309
| // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1 | ||
| // +openshift:validation:FeatureGateAwareEnum:featureGate=CRDCompatibilityRequirementOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI |
Contributor
There was a problem hiding this comment.
You need to demonstrate all combinations here
Suggested change
| // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1 | |
| // +openshift:validation:FeatureGateAwareEnum:featureGate=CRDCompatibilityRequirementOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI | |
| // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1 | |
| // +openshift:validation:FeatureGateAwareEnum:featureGate=CRDCompatibilityRequirementOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements | |
| // +openshift:validation:FeatureGateAwareEnum:featureGate=ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI | |
| // +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI |
| // +kubebuilder:subresource:status | ||
| // +kubebuilder:resource:path=clusterversions,scope=Cluster | ||
| // +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability" | ||
| // +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" |
Contributor
There was a problem hiding this comment.
You need this rule to only apply when both gates are enabled, so you need to use requiredFeatureGate and add both gate names
Suggested change
| // +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" | |
| // +// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" |
…atureGates per review feedback: CompatibilityRequirements behind CRDCompatibilityRequirementOperator, ClusterAPI behind ClusterAPIMachineManagement, and the ClusterAPI→CompatibilityRequirements dependency XValidation behind both gates using requiredFeatureGate.
Contributor
|
For some reason the merging behaviour is not merging the CEL rule added to the combined gated manifest 🤔 Will need to take a look and check why that is |
Contributor
|
@miyadav: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adding new capability constants
WIP - OCPCLOUD-3368
/hold
Generated by - claude-opus-4-6(2.1.169)