OCPBUGS-95615: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints

[dpateriya]

What this PR does / why we need it:

Since CAPK PR kubernetes-sigs/cluster-api-provider-kubevirt#366 began exposing all VMI interface IPs for dual-stack CSR approval, Machine.Status.Addresses includes ovn-k8s-mp0 management port IPs from the guest cluster's OVN overlay alongside the VM's routable pod network IP.

The HCCO machine controller was putting all MachineInternalIP addresses into EndpointSlice.Endpoint.Addresses, causing MetalLB/kube-proxy to round-robin traffic to non-routable ovn-k8s-mp0 IPs and producing ~50% connection timeouts on LoadBalancer services exposed via MetalLB.

The existing link-local filter (OCPBUGS-83711, PR #8264) does not catch these IPs because they are regular RFC1918 addresses (e.g. 10.8.x.2), not link-local.

This PR uses only the first MachineInternalIP per IP family, which is the VM's primary pod network IP on the management cluster. This matches the convention already used in e2e tests (firstMachineAddress in nodepool_kv_advanced_multinet_test.go).

Which issue(s) this PR fixes:

Related to OCPBUGS-83711 (link-local filter) and OCPBUGS-84269 / PR #8230 (CIDR conflict false positive) — same root cause (CAPK PR #366), different symptom.

Customer cases: 04485238, 04485252

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Fixed internal IP selection for endpoint generation when machines report multiple IPv4/IPv6 addresses, so only the first IPv4 and the first IPv6 per machine are used.
  • Prevents additional same-family addresses from being included in KubeVirt-related endpoint-slice generation.
  • Added test coverage to verify endpoint slices ignore extra InternalIP entries beyond the first per IP family.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 4c1bc1d0-43a7-41fa-98fb-dfbc1bf41540

📥 Commits

Reviewing files that changed from the base of the PR and between 9b87317 and 0082479.

📒 Files selected for processing (2)

• control-plane-operator/hostedclusterconfigoperator/controllers/machine/machine.go
• control-plane-operator/hostedclusterconfigoperator/controllers/machine/machine_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• control-plane-operator/hostedclusterconfigoperator/controllers/machine/machine.go
• control-plane-operator/hostedclusterconfigoperator/controllers/machine/machine_test.go

---

📝 Walkthrough

Walkthrough

This change updates KubeVirt passthrough endpoint-slice address collection so each machine contributes only the first IPv4 InternalIP and the first IPv6 InternalIP. The test suite adds machines with multiple same-family InternalIPs and verifies both default ingress passthrough and KCCM endpoint slices keep only the first address from each family.

Changes

Area	Change
Address selection	Filters MachineInternalIP collection to one IPv4 and one IPv6 address per machine
Test coverage	Adds fixture data with extra same-family InternalIPs and a test case for the selection result

Estimated code review effort: Medium

Suggested labels: bug, tests

Suggested reviewers: Not enough information available from the summary.

🐰 Poem

One IPv4, one IPv6,
The extras now are set adrift.
Tests confirm the chosen pair,
For endpoint slices kept with care.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: limiting EndpointSlice addresses to the first MachineInternalIP per family.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	machine_test.go’s test names are static strings; the new case name contains no dynamic values, IPs, or generated identifiers.
Test Structure And Quality	✅ Passed	PASS: The PR adds a focused table-driven unit test using fake clients; no Ginkgo waits or cluster resources/timeouts are involved, and the case targets one behavior.
Topology-Aware Scheduling Compatibility	✅ Passed	The change only alters Machine InternalIP selection for EndpointSlices; no pod affinity, topology spread, node selectors, replicas, or topology-dependent scheduling logic was added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; machine_test.go uses testing.T/Gomega unit tests, so this IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	Touched code only filters MachineInternalIP addresses; no weak ciphers, custom crypto, or non-constant-time secret comparisons found.
Container-Privileges	✅ Passed	Only machine.go and machine_test.go changed; no container/K8s manifests or privileged/securityContext fields were added.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only changes address selection logic and adds tests/comments; no new log statements or sensitive-data logging were introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dpateriya]

/jira refresh

[openshift-ci-robot]

@dpateriya: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[dpateriya]

/jira refresh

[openshift-ci-robot]

@dpateriya: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[dpateriya]

/jira refresh

[openshift-ci-robot]

@dpateriya: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@dpateriya: This pull request references Jira Issue OCPBUGS-95615, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Since CAPK PR kubernetes-sigs/cluster-api-provider-kubevirt#366 began exposing all VMI interface IPs for dual-stack CSR approval, Machine.Status.Addresses includes ovn-k8s-mp0 management port IPs from the guest cluster's OVN overlay alongside the VM's routable pod network IP.

The HCCO machine controller was putting all MachineInternalIP addresses into EndpointSlice.Endpoint.Addresses, causing MetalLB/kube-proxy to round-robin traffic to non-routable ovn-k8s-mp0 IPs and producing ~50% connection timeouts on LoadBalancer services exposed via MetalLB.

The existing link-local filter (OCPBUGS-83711, PR #8264) does not catch these IPs because they are regular RFC1918 addresses (e.g. 10.8.x.2), not link-local.

This PR uses only the first MachineInternalIP per IP family, which is the VM's primary pod network IP on the management cluster. This matches the convention already used in e2e tests (firstMachineAddress in nodepool_kv_advanced_multinet_test.go).

Which issue(s) this PR fixes:

Related to OCPBUGS-83711 (link-local filter) and OCPBUGS-84269 / PR #8230 (CIDR conflict false positive) — same root cause (CAPK PR #366), different symptom.

Customer cases: 04485238, 04485252

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
• Improved handling of machines with multiple internal IPs so endpoint generation now uses only the first IPv4 and first IPv6 address per machine.
• Prevents extra same-family addresses from being included when building KubeVirt-related service endpoints.
• Added test coverage for machines reporting multiple IPv4 and IPv6 internal addresses.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.45%. Comparing base (ce9dd2c) to head (0082479).
⚠️ Report is 90 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8892      +/-   ##
==========================================
+ Coverage   43.28%   43.45%   +0.17%     
==========================================
  Files         771      771              
  Lines       95503    95721     +218     
==========================================
+ Hits        41335    41600     +265     
+ Misses      51284    51234      -50     
- Partials     2884     2887       +3     

Files with missing lines	Coverage Δ
...usterconfigoperator/controllers/machine/machine.go	67.48% <100.00%> (+0.48%)	⬆️

... and 14 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	37.12% <ø> (+0.45%)	⬆️
cpo-hostedcontrolplane	45.21% <ø> (-0.11%)	⬇️
cpo-other	45.11% <100.00%> (+0.01%)	⬆️
hypershift-operator	53.65% <ø> (+0.06%)	⬆️
other	32.08% <ø> (+0.38%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dpateriya]

/Verified by me

Env: OCP 4.21.21 Management Cluster
Patched Image: quay.io/rhn_support_dpateriy/hypershift:OCPBUGS-95615-cpo

Machine addresses (before fix)

Machine kubevirt-test-vh8dr-4t9bh reports two non-link-local IPv4 InternalIPs:

InternalIP: 10.130.2.8     ← routable VM pod IP
InternalIP: 10.132.0.2     ← ovn-k8s-mp0 management port IP (non-routable)

BEFORE (unpatched HCCO)

EndpointSlice contains both addresses — traffic round-robins to the non-routable IP:

# oc get endpointslice a74e87e10acbc4a4cabb0d67d79efe20-kubevirt-test-vh8dr-4t9bh-ipv4 -n clusters-kubevirt-test -o yaml
endpoints:
- addresses:
  - 10.130.2.8
  - 10.132.0.2    # ← non-routable, causes ~50% connection timeouts
  conditions:
    ready: true
    serving: true
    terminating: false

AFTER (patched HCCO)

Patched the HCCO deployment with the fix image, deleted EndpointSlices, and they were recreated with only the first address per family:

# oc get endpointslice -n clusters-kubevirt-test -l endpointslice.kubernetes.io/managed-by=control-plane-operator.hypershift.openshift.io
NAME                                                                            ADDRESSTYPE   PORTS         ENDPOINTS    AGE
a74e87e10acbc4a4cabb0d67d79efe20-kubevirt-test-vh8dr-4t9bh-ipv4                 IPv4          31797,32158   10.130.2.8   4s
default-ingress-passthrough-service-p4j29k9h2m-kubevirt-test-vh8dr-4t9bh-ipv4   IPv4          32707         10.130.2.8   4s

Only 10.130.2.8 (the routable VM pod IP) is present. The 10.132.0.2 (ovn-k8s-mp0) is correctly filtered.

[openshift-ci-robot]

@dpateriya: This PR has been marked as verified by me.

Details

In response to this:

/Verified by me

Env: OCP 4.21.21 Management Cluster
Patched Image: quay.io/rhn_support_dpateriy/hypershift:OCPBUGS-95615-cpo

Machine addresses (before fix)

Machine kubevirt-test-vh8dr-4t9bh reports two non-link-local IPv4 InternalIPs:

InternalIP: 10.130.2.8     ← routable VM pod IP
InternalIP: 10.132.0.2     ← ovn-k8s-mp0 management port IP (non-routable)

BEFORE (unpatched HCCO)

EndpointSlice contains both addresses — traffic round-robins to the non-routable IP:

# oc get endpointslice a74e87e10acbc4a4cabb0d67d79efe20-kubevirt-test-vh8dr-4t9bh-ipv4 -n clusters-kubevirt-test -o yaml
endpoints:
- addresses:
 - 10.130.2.8
 - 10.132.0.2    # ← non-routable, causes ~50% connection timeouts
 conditions:
   ready: true
   serving: true
   terminating: false

AFTER (patched HCCO)

Patched the HCCO deployment with the fix image, deleted EndpointSlices, and they were recreated with only the first address per family:

# oc get endpointslice -n clusters-kubevirt-test -l endpointslice.kubernetes.io/managed-by=control-plane-operator.hypershift.openshift.io
NAME                                                                            ADDRESSTYPE   PORTS         ENDPOINTS    AGE
a74e87e10acbc4a4cabb0d67d79efe20-kubevirt-test-vh8dr-4t9bh-ipv4                 IPv4          31797,32158   10.130.2.8   4s
default-ingress-passthrough-service-p4j29k9h2m-kubevirt-test-vh8dr-4t9bh-ipv4   IPv4          32707         10.130.2.8   4s

Only 10.130.2.8 (the routable VM pod IP) is present. The 10.132.0.2 (ovn-k8s-mp0) is correctly filtered.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[csrwng]

/jira refresh

[openshift-ci-robot]

@csrwng: This pull request references Jira Issue OCPBUGS-95615, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jparrill]

Dropped some comments. Thanks!

[dpateriya]

Suggested changes have been made. Thanks @jparrill for the review

[dpateriya]

/verified by me

[openshift-ci-robot]

@dpateriya: This PR has been marked as verified by me.

Details

In response to this:

/verified by me

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@dpateriya: This pull request references Jira Issue OCPBUGS-95615, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

What this PR does / why we need it:

Since CAPK PR kubernetes-sigs/cluster-api-provider-kubevirt#366 began exposing all VMI interface IPs for dual-stack CSR approval, Machine.Status.Addresses includes ovn-k8s-mp0 management port IPs from the guest cluster's OVN overlay alongside the VM's routable pod network IP.

The HCCO machine controller was putting all MachineInternalIP addresses into EndpointSlice.Endpoint.Addresses, causing MetalLB/kube-proxy to round-robin traffic to non-routable ovn-k8s-mp0 IPs and producing ~50% connection timeouts on LoadBalancer services exposed via MetalLB.

The existing link-local filter (OCPBUGS-83711, PR #8264) does not catch these IPs because they are regular RFC1918 addresses (e.g. 10.8.x.2), not link-local.

This PR uses only the first MachineInternalIP per IP family, which is the VM's primary pod network IP on the management cluster. This matches the convention already used in e2e tests (firstMachineAddress in nodepool_kv_advanced_multinet_test.go).

Which issue(s) this PR fixes:

Related to OCPBUGS-83711 (link-local filter) and OCPBUGS-84269 / PR #8230 (CIDR conflict false positive) — same root cause (CAPK PR #366), different symptom.

Customer cases: 04485238, 04485252

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
• Fixed internal IP selection for endpoint generation when machines report multiple IPv4/IPv6 addresses, so only the first IPv4 and the first IPv6 per machine are used.
• Prevents additional same-family addresses from being included in KubeVirt-related endpoint-slice generation.
• Added test coverage to verify endpoint slices ignore extra InternalIP entries beyond the first per IP family.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jparrill]

Re-reviewed: both comments addressed. LGTM.

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dpateriya, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dpateriya]

/test e2e-v2-gke

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 1f2811f and 2 for PR HEAD 0082479 in total

[dpateriya]

/test e2e-aws
/test e2e-azure-v2-self-managed
/test e2e-aws-upgrade-hypershift-operator

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 54d2400 and 1 for PR HEAD 0082479 in total

[hypershift-jira-solve-ci]

I now have all the evidence needed. Let me produce the final report.

Test Failure Analysis: e2e-azure-v2-self-managed

Job: pull-ci-openshift-hypershift-main-e2e-azure-v2-self-managed
Build ID: 2075279554284359680
PR: #8892 — OCPBUGS-95615: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints
Release: 4.22.0-ec.5

Error

error: timed out waiting for the condition on hostedclusters/aa855b2a7a-mgmt

The create-management-cluster pre-phase step timed out after ~30 minutes waiting for the self-managed HostedCluster to become Available.

Root Cause

The cluster-network-operator (CNO) pod in the hosted control plane namespace clusters-aa855b2a7a-mgmt never started. Every container in the CNO pod — including all init containers (init-client-token-minter, remove-old-cno), the main cluster-network-operator container, and all sidecars (client-token-minter, konnectivity-proxy-socks5, availability-prober) — produced zero log lines in both current and previous rotations. This means the pod was stuck in a pre-running state (Pending or ContainerCreating) for the entire ~30-minute window.

Failure chain:

1. CNO pod never started → no OVN/CNI network plugin configuration was deployed to any worker node
2. All 18 worker nodes across 3 NodePools reported NetworkPluginNotReady: no CNI configuration file in /etc/kubernetes/cni/net.d/ continuously from 18:53:35Z onward
3. All nodes remained NotReady, making all 3 NodePools report AllNodesHealthy: False (0 of 6 available per pool)
4. The CVO confirmed Cluster operator network is not available starting at 18:30:16Z — it never recovered
5. 13 dependent cluster operators (console, dns, image-registry, ingress, insights, monitoring, network, node-tuning, openshift-samples, service-ca, storage, csi-snapshot-controller, kube-storage-version-migrator) never became available
6. HostedCluster stuck in Available: False (ComponentsNotAvailable) / Degraded: True (UnavailableReplicas)
7. The create-management-cluster step timed out

Additionally, the konnectivity-server logged repeated "Receive channel from agent is full" warnings (17 occurrences) for agent 4452d3f1-edf5-425d-b9a8-e7f131aee517 starting at 18:30:32Z, and the CAPI provider lost its leader election lease at 18:48:41Z due to management cluster API server timeout (Client.Timeout exceeded while awaiting headers). This indicates management cluster API pressure that may have contributed to the CNO pod failing to schedule or start.

This is an infrastructure/platform issue, NOT related to the PR's code changes. PR #8892 modifies kubevirt EndpointSlice handling (use only first MachineInternalIP per family), which is entirely unrelated to Azure CNO deployment or pod scheduling. The Azure self-managed HyperShift test creates a fresh HostedCluster from the 4.22.0-ec.5 release payload, and the CNO from that payload failed to start — this is a pre-existing issue in the release or a transient infrastructure failure.

Recommendations

1. Retry the job — This appears to be a transient infrastructure failure where the CNO pod could not start. A retry on fresh infrastructure will likely succeed.
2. Check 4.22.0-ec.5 release health — Verify whether other jobs using this release payload are also experiencing CNO startup failures on Azure. If so, the release payload itself may have a broken CNO image or configuration.
3. Check Azure CI infrastructure capacity — The management cluster API server timeout (CAPI provider lease loss at 18:48:41Z) and konnectivity channel backpressure suggest possible resource pressure on the management cluster nodes that could prevent pod scheduling.
4. No code changes needed in PR OCPBUGS-95615: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints #8892 — The PR's kubevirt EndpointSlice changes are completely unrelated to this failure.

Evidence

Timeline:

Time (UTC)	Event
18:19:50	Azure resource creation begins
18:21:26	HostedCluster + 3 NodePools applied
18:22:03	CPO begins reconciling CNO component
18:29:27	Konnectivity-server container starts (in kube-apiserver pod)
18:30:06	HostedCluster enters Partial state
18:30:16	CVO first reports: Cluster operator network is not available
18:30:32	Konnectivity: "Receive channel from agent is full" warnings begin
18:34:42–18:35:44	Konnectivity agents connect (18 agents), but CNO still empty
18:48:41	CAPI provider: Client.Timeout exceeded while awaiting headers — loses leader lease
18:53:35+	All 18 worker nodes report NetworkPluginNotReady
~18:51:26	create-management-cluster step times out

CNO Pod Container Logs (ALL EMPTY):

• cluster-network-operator (current + previous): 0 lines
• init-client-token-minter (current + previous): 0 lines
• remove-old-cno (current + previous): 0 lines
• client-token-minter (current + previous): 0 lines
• konnectivity-proxy-socks5 (current + previous): 0 lines
• availability-prober (current + previous): 0 lines

Worker Node Condition (all 18 nodes, 3 pools × 6 nodes):

KubeletNotReady: container runtime network not ready: NetworkReady=false reason:NetworkPluginNotReady message:Network plugin returns error: No CNI configuration file in /etc/kubernetes/cni/net.d/. Has your network provider started?

HostedCluster Status:

Available: False (ComponentsNotAvailable)
  Missing: cluster-image-registry-operator, cluster-policy-controller,
           cluster-network-operator, csi-snapshot-controller-operator,
           ingress-operator, certified-operators-catalog
Degraded: True (UnavailableReplicas)
  cluster-network-operator deployment has 1 unavailable replicas
ClusterVersionSucceeding: False (ClusterOperatorsNotAvailable)
  13 operators not available: console, csi-snapshot-controller, dns,
  image-registry, ingress, insights, kube-storage-version-migrator,
  monitoring, network, node-tuning, openshift-samples, service-ca, storage

Cascading post-phase failures (consequences, not causes):

• destroy-guests: Failed to destroy clusters (HostedCluster was in bad state)
• hypershift-k8sgpt: the server doesn't have a resource type "hostedcluster" (expected when cluster never fully started)

Artifacts: .work/prow-job-analyze-test-failure/2075279554284359680/logs/

---

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 48bbb56 and 0 for PR HEAD 0082479 in total

[openshift-ci]

@dpateriya: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@dpateriya: Jira Issue Verification Checks: Jira Issue OCPBUGS-95615
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-95615 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

What this PR does / why we need it:

Since CAPK PR kubernetes-sigs/cluster-api-provider-kubevirt#366 began exposing all VMI interface IPs for dual-stack CSR approval, Machine.Status.Addresses includes ovn-k8s-mp0 management port IPs from the guest cluster's OVN overlay alongside the VM's routable pod network IP.

The HCCO machine controller was putting all MachineInternalIP addresses into EndpointSlice.Endpoint.Addresses, causing MetalLB/kube-proxy to round-robin traffic to non-routable ovn-k8s-mp0 IPs and producing ~50% connection timeouts on LoadBalancer services exposed via MetalLB.

The existing link-local filter (OCPBUGS-83711, PR #8264) does not catch these IPs because they are regular RFC1918 addresses (e.g. 10.8.x.2), not link-local.

This PR uses only the first MachineInternalIP per IP family, which is the VM's primary pod network IP on the management cluster. This matches the convention already used in e2e tests (firstMachineAddress in nodepool_kv_advanced_multinet_test.go).

Which issue(s) this PR fixes:

Related to OCPBUGS-83711 (link-local filter) and OCPBUGS-84269 / PR #8230 (CIDR conflict false positive) — same root cause (CAPK PR #366), different symptom.

Customer cases: 04485238, 04485252

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
• Fixed internal IP selection for endpoint generation when machines report multiple IPv4/IPv6 addresses, so only the first IPv4 and the first IPv6 per machine are used.
• Prevents additional same-family addresses from being included in KubeVirt-related endpoint-slice generation.
• Added test coverage to verify endpoint slices ignore extra InternalIP entries beyond the first per IP family.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[dpateriya]

/cherrypick release-4.22
/cherrypick release-4.21

[openshift-cherrypick-robot]

@dpateriya: new pull request created: #8978

Details

In response to this:

/cherrypick release-4.22
/cherrypick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@dpateriya: new pull request created: #8979

Details

In response to this:

/cherrypick release-4.22
/cherrypick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-robot]

Fix included in release 5.0.0-0.nightly-2026-07-10-112516