WIP: [release-4.20] SPLAT-2867: Added multi vCenter Day 2 Support

cmd/vsphere/main.go

@@ -173,7 +173,7 @@ func main() {
 		EventRecorder:            mgr.GetEventRecorderFor("vspherecontroller"),
 		TaskIDCache:              taskIDCache,
 		FeatureGates:             defaultMutableGate,
-		OpenshiftConfigNamespace: vsphere.OpenshiftConfigNamespace,
+		OpenshiftConfigNamespace: vsphere.OpenshiftConfigManagedNamespace,
 	})
 
 	if err := configv1.Install(mgr.GetScheme()); err != nil {

go.mod

@@ -369,3 +369,5 @@ require (
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
 )
+
+replace github.com/openshift/api => github.com/vr4manta/api v0.0.0-20260914125654-86c3aa9e7ae5

go.sum

@@ -457,8 +457,6 @@ github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jD
 github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
 github.com/openshift-eng/openshift-tests-extension v0.0.0-20250711173707-dc2a20e5a5f8 h1:D+Qga9nujuIcrAjcAuKPukoUcVBl6ZDEbtgNLgKKlgY=
 github.com/openshift-eng/openshift-tests-extension v0.0.0-20250711173707-dc2a20e5a5f8/go.mod h1:6gkP5f2HL0meusT0Aim8icAspcD1cG055xxBZ9yC68M=
-github.com/openshift/api v0.0.0-20260605122244-2c1c5b39566d h1:Djz4aG2W0ypAHQEtubqbXpxeWGwdCds05w6dfz1GVWk=
-github.com/openshift/api v0.0.0-20260605122244-2c1c5b39566d/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
 github.com/openshift/client-go v0.0.0-20250710075018-396b36f983ee h1:tOtrrxfDEW8hK3eEsHqxsXurq/D6LcINGfprkQC3hqY=
 github.com/openshift/client-go v0.0.0-20250710075018-396b36f983ee/go.mod h1:zhRiYyNMk89llof2qEuGPWPD+joQPhCRUc2IK0SB510=
 github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20250718085303-e712b1ebf374 h1:ldUi0e64kdYJC2+ucB24GRXIXfMnI3NpSkcnalPqBGo=
@@ -625,6 +623,8 @@ github.com/uudashr/iface v1.3.1 h1:bA51vmVx1UIhiIsQFSNq6GZ6VPTk3WNMZgRiCe9R29U=
 github.com/uudashr/iface v1.3.1/go.mod h1:4QvspiRd3JLPAEXBQ9AiZpLbJlrWWgRChOKDJEuQTdg=
 github.com/vmware/govmomi v0.46.3 h1:zBn42Rl0WZBFhGao8Dy0MFRkbE4YNPqOu0OBd+ww6VM=
 github.com/vmware/govmomi v0.46.3/go.mod h1:uoLVU9zlXC4p4GmLVG+ZJmBC0Gn3Q7mytOJvi39OhxA=
+github.com/vr4manta/api v0.0.0-20260914125654-86c3aa9e7ae5 h1:C+HzTIb9DqFgnJwZ7ax8zq3WAyFGaRrEKPwk19HHGDo=
+github.com/vr4manta/api v0.0.0-20260914125654-86c3aa9e7ae5/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xen0n/gosmopolitan v1.2.2 h1:/p2KTnMzwRexIW8GlKawsTWOxn7UHA+jCMF/V8HHtvU=

install/0000_30_machine-api-operator_09_rbac.yaml

@@ -450,13 +450,29 @@ rules:
     resources:
       - validatingwebhookconfigurations
       - mutatingwebhookconfigurations
+      - validatingadmissionpolicies
+      - validatingadmissionpolicybindings
     verbs:
       - get
       - list
       - watch
       - create
       - update
 
+  # The machine-api-operator service account must be able to read Machines,
+  # ControlPlaneMachineSets, and MachineSets so the kube-apiserver can resolve
+  # them as VAP params when validating Infrastructure/cluster updates.
+  - apiGroups:
+      - machine.openshift.io
+    resources:
+      - machines
+      - controlplanemachinesets
+      - machinesets
+    verbs:
+      - get
+      - list
+      - watch
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

pkg/controller/vsphere/actuator_test.go

@@ -137,11 +137,11 @@ func TestMachineEvents(t *testing.T) {
 	testConfig := fmt.Sprintf(testConfigFmt, port, credentialsSecretName, testNamespaceName)
 	configMap := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "testname",
+			Name:      OpenshiftConfigManagedConfigMap,
 			Namespace: openshiftConfigNamespaceForTest,
 		},
 		Data: map[string]string{
-			"testkey": testConfig,
+			OpenshiftConfigManagedCloudConfigKey: testConfig,
 		},
 	}
 
@@ -150,22 +150,6 @@ func TestMachineEvents(t *testing.T) {
 		g.Expect(k8sClient.Delete(context.Background(), configMap)).To(Succeed())
 	}()
 
-	infra := &configv1.Infrastructure{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: globalInfrastuctureName,
-		},
-		Spec: configv1.InfrastructureSpec{
-			CloudConfig: configv1.ConfigMapFileReference{
-				Name: "testname",
-				Key:  "testkey",
-			},
-		},
-	}
-	g.Expect(k8sClient.Create(context.Background(), infra)).To(Succeed())
-	defer func() {
-		g.Expect(k8sClient.Delete(context.Background(), infra)).To(Succeed())
-	}()
-
 	userDataSecretName := "vsphere-ignition"
 	userDataSecret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{

pkg/controller/vsphere/machine_scope_test.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	. "github.com/onsi/gomega"
-	configv1 "github.com/openshift/api/config/v1"
 	machinev1 "github.com/openshift/api/machine/v1beta1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -355,34 +354,18 @@ func TestPatchMachine(t *testing.T) {
 	testConfig := fmt.Sprintf(testConfigFmt, port, credentialsSecretName, testNamespaceName)
 	configMap := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "testname",
+			Name:      OpenshiftConfigManagedConfigMap,
 			Namespace: openshiftConfigNamespaceForTest,
 		},
 		Data: map[string]string{
-			"testkey": testConfig,
+			OpenshiftConfigManagedCloudConfigKey: testConfig,
 		},
 	}
 	g.Expect(k8sClient.Create(ctx, configMap)).To(Succeed())
 	defer func() {
 		g.Expect(k8sClient.Delete(ctx, configMap)).To(Succeed())
 	}()
 
-	infra := &configv1.Infrastructure{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: globalInfrastuctureName,
-		},
-		Spec: configv1.InfrastructureSpec{
-			CloudConfig: configv1.ConfigMapFileReference{
-				Name: "testname",
-				Key:  "testkey",
-			},
-		},
-	}
-	g.Expect(k8sClient.Create(ctx, infra)).To(Succeed())
-	defer func() {
-		g.Expect(k8sClient.Delete(ctx, infra)).To(Succeed())
-	}()
-
 	failedPhase := "Failed"
 
 	providerStatus := &machinev1.VSphereMachineProviderStatus{}

pkg/controller/vsphere/reconciler_test.go

@@ -1948,7 +1948,6 @@ func TestConvertUUIDToProviderID(t *testing.T) {
 
 func TestDelete(t *testing.T) {
 	type vCenterSimConfig struct {
-		infra       *configv1.Infrastructure
 		secret      *corev1.Secret
 		configMap   *corev1.ConfigMap
 		featureGate *configv1.FeatureGate
@@ -2000,23 +1999,11 @@ func TestDelete(t *testing.T) {
 		testConfig := fmt.Sprintf(testConfigFmt, port, credentialsSecretName, ns)
 		configMap := &corev1.ConfigMap{
 			ObjectMeta: metav1.ObjectMeta{
-				Name:      "testName",
+				Name:      OpenshiftConfigManagedConfigMap,
 				Namespace: openshiftConfigNamespaceForTest,
 			},
 			Data: map[string]string{
-				"testKey": testConfig,
-			},
-		}
-
-		infra := &configv1.Infrastructure{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: globalInfrastuctureName,
-			},
-			Spec: configv1.InfrastructureSpec{
-				CloudConfig: configv1.ConfigMapFileReference{
-					Name: "testName",
-					Key:  "testKey",
-				},
+				OpenshiftConfigManagedCloudConfigKey: testConfig,
 			},
 		}
 
@@ -2027,7 +2014,6 @@ func TestDelete(t *testing.T) {
 		}
 
 		return &vCenterSimConfig{
-			infra:       infra,
 			secret:      secret,
 			configMap:   configMap,
 			host:        host,
@@ -2179,7 +2165,6 @@ func TestDelete(t *testing.T) {
 				simParams.secret,
 				tc.machine(t, simParams.host),
 				simParams.configMap,
-				simParams.infra,
 				tc.node(t)).Build()
 			machineScope, err := newMachineScope(machineScopeParams{
 				client:                   client,
@@ -2459,7 +2444,6 @@ func TestDelete(t *testing.T) {
 				simParams.secret,
 				tc.machine(t, simParams.host),
 				simParams.configMap,
-				simParams.infra,
 				tc.node(t),
 			).Build()
 			mScope, err := newMachineScope(machineScopeParams{
@@ -2529,23 +2513,11 @@ func TestCreate(t *testing.T) {
 	testConfig := fmt.Sprintf(testConfigFmt, port, credentialsSecretName, namespace)
 	configMap := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "testName",
+			Name:      OpenshiftConfigManagedConfigMap,
 			Namespace: openshiftConfigNamespaceForTest,
 		},
 		Data: map[string]string{
-			"testKey": testConfig,
-		},
-	}
-
-	infra := &configv1.Infrastructure{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: globalInfrastuctureName,
-		},
-		Spec: configv1.InfrastructureSpec{
-			CloudConfig: configv1.ConfigMapFileReference{
-				Name: "testName",
-				Key:  "testKey",
-			},
+			OpenshiftConfigManagedCloudConfigKey: testConfig,
 		},
 	}
 
@@ -2888,7 +2860,6 @@ func TestCreate(t *testing.T) {
 			builder := fake.NewClientBuilder().WithScheme(scheme.Scheme).WithRuntimeObjects(
 				credentialsSecret,
 				configMap,
-				infra,
 				userDataSecret,
 				machine)
 			if tc.ipAddressClaim != nil {
@@ -3025,23 +2996,11 @@ func TestUpdate(t *testing.T) {
 	testConfig := fmt.Sprintf(testConfigFmt, port, credentialsSecretName, namespace)
 	configMap := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "testName",
+			Name:      OpenshiftConfigManagedConfigMap,
 			Namespace: openshiftConfigNamespaceForTest,
 		},
 		Data: map[string]string{
-			"testKey": testConfig,
-		},
-	}
-
-	infra := &configv1.Infrastructure{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: globalInfrastuctureName,
-		},
-		Spec: configv1.InfrastructureSpec{
-			CloudConfig: configv1.ConfigMapFileReference{
-				Name: "testName",
-				Key:  "testKey",
-			},
+			OpenshiftConfigManagedCloudConfigKey: testConfig,
 		},
 	}
 
@@ -3111,8 +3070,7 @@ func TestUpdate(t *testing.T) {
 
 			client := fake.NewClientBuilder().WithScheme(scheme.Scheme).WithRuntimeObjects(
 				credentialsSecret,
-				configMap,
-				infra).Build()
+				configMap).Build()
 
 			rawProviderSpec, err := RawExtensionFromProviderSpec(&tc.providerSpec)
 			if err != nil {

pkg/controller/vsphere/util.go

@@ -20,8 +20,10 @@ import (
 )
 
 const (
-	globalInfrastuctureName  = "cluster"
-	OpenshiftConfigNamespace = "openshift-config"
+	globalInfrastuctureName              = "cluster"
+	OpenshiftConfigManagedNamespace      = "openshift-config-managed"
+	OpenshiftConfigManagedConfigMap      = "kube-cloud-config"
+	OpenshiftConfigManagedCloudConfigKey = "cloud.conf"
 )
 
 // GetInfrastructure retrieves the Infrastructure object from the provided API reader.
@@ -46,33 +48,24 @@ func getVSphereConfig(c runtimeclient.Reader, configNamespace string) (*vsphere.
 		return nil, errors.New("no API reader -- will not fetch vSphere config")
 	}
 
-	infra, err := GetInfrastructure(c)
-	if err != nil {
-		return nil, err
-	}
-
-	if infra.Spec.CloudConfig.Name == "" {
-		return nil, fmt.Errorf("cluster infrastructure CloudConfig has empty name")
-	}
-
-	if infra.Spec.CloudConfig.Key == "" {
-		return nil, fmt.Errorf("cluster infrastructure CloudConfig has empty key")
+	if configNamespace == "" {
+		configNamespace = OpenshiftConfigManagedNamespace
 	}
 
 	cm := &corev1.ConfigMap{}
 	cmName := runtimeclient.ObjectKey{
-		Name:      infra.Spec.CloudConfig.Name,
+		Name:      OpenshiftConfigManagedConfigMap,
 		Namespace: configNamespace,
 	}
 
 	if err := c.Get(context.Background(), cmName, cm); err != nil {
 		return nil, err
 	}
 
-	cloudConfig, found := cm.Data[infra.Spec.CloudConfig.Key]
+	cloudConfig, found := cm.Data[OpenshiftConfigManagedCloudConfigKey]
 	if !found {
 		return nil, fmt.Errorf("cloud-config ConfigMap has no %q key",
-			infra.Spec.CloudConfig.Key,
+			OpenshiftConfigManagedCloudConfigKey,
 		)
 	}
 

pkg/controller/vsphere/util_test.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"testing"
 
-	configv1 "github.com/openshift/api/config/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes/scheme"
@@ -34,27 +33,15 @@ func TestGetVSphereConfig(t *testing.T) {
 	testConfig := fmt.Sprintf(testConfigFmt, "443", "test", "test-namespace")
 	configMap := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "testName",
+			Name:      OpenshiftConfigManagedConfigMap,
 			Namespace: openshiftConfigNamespaceForTest,
 		},
 		Data: map[string]string{
-			"testKey": testConfig,
+			OpenshiftConfigManagedCloudConfigKey: testConfig,
 		},
 	}
 
-	infra := &configv1.Infrastructure{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: globalInfrastuctureName,
-		},
-		Spec: configv1.InfrastructureSpec{
-			CloudConfig: configv1.ConfigMapFileReference{
-				Name: "testName",
-				Key:  "testKey",
-			},
-		},
-	}
-
-	client := fake.NewClientBuilder().WithScheme(scheme.Scheme).WithRuntimeObjects(infra, configMap).Build()
+	client := fake.NewClientBuilder().WithScheme(scheme.Scheme).WithRuntimeObjects(configMap).Build()
 
 	vSphereConfig, err := getVSphereConfig(client, openshiftConfigNamespaceForTest)
 	if err != nil {

pkg/operator/operator.go

@@ -79,6 +79,7 @@ type Operator struct {
 	mutatingWebhookListerSynced   cache.InformerSynced
 
 	featureGateAccessor featuregates.FeatureGateAccess
+	featureGates        featuregates.FeatureGate
 
 	// queue only ever has one item, but it has nice error handling backoff/retry semantics
 	queue           workqueue.TypedRateLimitingInterface[string]
@@ -166,6 +167,7 @@ func New(
 		recorder,
 	)
 	featureGateAccessor.SetChangeHandler(func(featureChange featuregates.FeatureChange) {
+		optr.featureGates = featuregates.NewFeatureGate(featureChange.New.Enabled, featureChange.New.Disabled)
 		if featureChange.Previous == nil {
 			// When the initial featuregate is set, the previous version is nil.
 			// Nothing to do in this case, it's handled by the 1st sync, which only runs after the initial feature set was received.
@@ -175,7 +177,7 @@ func New(
 		klog.V(4).InfoS("FeatureGates changed", "enabled", featureChange.New.Enabled, "disabled", featureChange.New.Disabled)
 		prevDisableMHC := featuregates.NewFeatureGate(featureChange.Previous.Enabled, featureChange.Previous.Disabled).
 			Enabled(apifeatures.FeatureGateMachineAPIOperatorDisableMachineHealthCheckController)
-		newDisableMHC := featuregates.NewFeatureGate(featureChange.New.Enabled, featureChange.New.Disabled).
+		newDisableMHC := optr.featureGates.
 			Enabled(apifeatures.FeatureGateMachineAPIOperatorDisableMachineHealthCheckController)
 
 		if prevDisableMHC != newDisableMHC {