Skip to content

render: Remove install-config feature gate fallback#1649

Open
sanchezl wants to merge 2 commits into
openshift:mainfrom
sanchezl:render-featuregate-cr-cleanup
Open

render: Remove install-config feature gate fallback#1649
sanchezl wants to merge 2 commits into
openshift:mainfrom
sanchezl:render-featuregate-cr-cleanup

Conversation

@sanchezl

@sanchezl sanchezl commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Remove the install-config feature gate parsing fallback now that openshift/installer#10679 passes --rendered-manifest-files and --payload-version to the etcd-render invocation.

This makes both flags required and removes getFeatureGatesFromInstallConfig() and the getFeatureGates() dispatcher, leaving only the standard FeatureGate CR path via getFeatureGatesFromManifests().

Depends on

  • #1648 — render: Read FeatureGate CR from rendered manifests
  • openshift/installer#10679 — bootstrap: Pass rendered manifests and payload version to etcd render

This PR should merge after both dependencies have landed.

Test plan

  • go test ./pkg/cmd/render/ — all tests pass
  • go vet ./pkg/cmd/render/ — clean

Summary by CodeRabbit

  • New Features
    • Rendering now determines enabled and disabled feature gates from rendered manifest files.
    • Added command-line options for rendered manifest paths and payload version.
  • Bug Fixes
    • Improved feature-gate detection by reading FeatureGate resources directly, supporting both files and directories.
    • Rendering now reports errors when feature-gate information cannot be determined.

sanchezl added 2 commits July 9, 2026 23:14
Replace manual install-config feature gate parsing with the standard
operator render pattern: read the pre-resolved FeatureGate CR from
rendered manifests via --rendered-manifest-files and --payload-version.

The api-render step in bootkube.sh already resolves featureSet (e.g.
TechPreviewNoUpgrade) into individual gates and writes the result into
the FeatureGate CR status. Every other operator render (CKASO, CKCMO,
MCO) reads this CR; the CEO was the only outlier that parsed feature
gates directly from install-config, which led to bugs like missing
featureSet resolution.

When the new flags are provided, the FeatureGate CR is used as the
authoritative source. When they are not yet available (before the
coordinated installer change lands), a fallback resolves featureSet
and featureGates from the install-config directly.

Requires a coordinated installer change to pass the new flags to the
etcd-render invocation in bootkube.sh.
Now that the installer passes --rendered-manifest-files and
--payload-version to the etcd-render invocation, remove the
install-config feature gate parsing fallback and make both flags
required.

This removes getFeatureGatesFromInstallConfig and the getFeatureGates
dispatcher, leaving only the standard FeatureGate CR path.
@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ac999167-dcfb-4fee-b730-bdd3861f6cbb

📥 Commits

Reviewing files that changed from the base of the PR and between 831d5e6 and ef85c95.

📒 Files selected for processing (2)
  • pkg/cmd/render/render.go
  • pkg/cmd/render/render_test.go

Walkthrough

Rendering now requires rendered manifest paths and a payload version, reads FeatureGate resources from manifests, and derives enabled or disabled features through a payload-versioned accessor. Tests generate and pass corresponding FeatureGate manifests, including custom PKI coverage.

Changes

Manifest-based FeatureGate rendering

Layer / File(s) Summary
Render input contract
pkg/cmd/render/render.go
Adds rendered-manifest and payload-version options, CLI flags, and validation requirements.
Manifest FeatureGate resolution
pkg/cmd/render/render.go
newTemplateData obtains feature-gate status from scanned YAML or JSON FeatureGate manifests and propagates lookup errors.
Manifest-backed render tests
pkg/cmd/render/render_test.go
Test helpers generate payload-versioned FeatureGate manifests and pass them through rendering and template-data tests, including custom PKI behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant renderOpts
  participant readFeatureGate
  participant getFeatureGatesFromManifests
  participant newTemplateData
  renderOpts->>getFeatureGatesFromManifests: resolve FeatureGate status
  getFeatureGatesFromManifests->>readFeatureGate: scan rendered manifest paths
  readFeatureGate-->>getFeatureGatesFromManifests: return FeatureGate object
  getFeatureGatesFromManifests-->>newTemplateData: return enabled and disabled feature sets
Loading
🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately captures the main change: removing the install-config feature gate fallback from render.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No dynamic Ginkgo titles were added; render_test.go uses static literal subtest names only.
Test Structure And Quality ✅ Passed No Ginkgo/cluster-interaction tests were added; the new unit tests use t.TempDir setup and mostly explicit want/got assertions.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; render_test.go is plain testing-based and contains no It/Describe/Context or MicroShift skip tags.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the changed render tests use standard testing only and make no SNO-sensitive node assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only changes render-time feature-gate parsing and tests; no deployment manifests, controllers, affinities, tolerations, node selectors, or replica logic were added or modified.
Ote Binary Stdout Contract ✅ Passed Touched render code only logs with klog.Infof and writes errors to errOut; no init/TestMain/main stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the touched tests are standard unit tests (Test*) with no public-internet calls or e2e networking setup.
No-Weak-Crypto ✅ Passed No weak algorithms, custom crypto, or secret/token comparisons appear in the touched code; only standard ECDSA/X509 test imports and feature-gate parsing.
Container-Privileges ✅ Passed PR only changes render Go/test code; no touched manifest or container spec contains privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed No new logging of secrets/PII/internal hostnames was added; the new feature-gate code only returns errors and reads manifests, without emitting sensitive values.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions


Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot requested review from flavianmissi and rh-roman July 10, 2026 03:18
@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign atiratree for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@sanchezl: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-gcp-operator-disruptive ef85c95 link true /test e2e-gcp-operator-disruptive
ci/prow/e2e-gcp-operator ef85c95 link true /test e2e-gcp-operator
ci/prow/e2e-aws-ovn-serial-2of2 ef85c95 link true /test e2e-aws-ovn-serial-2of2
ci/prow/e2e-operator ef85c95 link true /test e2e-operator
ci/prow/e2e-aws-ovn-single-node ef85c95 link true /test e2e-aws-ovn-single-node
ci/prow/e2e-aws-ovn-serial-1of2 ef85c95 link true /test e2e-aws-ovn-serial-1of2
ci/prow/e2e-agnostic-ovn ef85c95 link true /test e2e-agnostic-ovn
ci/prow/e2e-metal-ipi-ovn-ipv6 ef85c95 link true /test e2e-metal-ipi-ovn-ipv6
ci/prow/configmap-scale ef85c95 link false /test configmap-scale

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant