CNTRLPLANE-3532: migrate CPO status patches to statuspatching helpers

[vsolanki12]

What this PR does / why we need it:

Migrates 9 status patch call sites in the CPO to use statuspatching.PatchStatus / PatchStatusCondition, adding retry-on-conflict and consistent optimistic locking.

• hostedcontrolplane_controller.go: 7 sites migrated (reconcileDeletion, update, reconcileValidIDPConfigurationCondition, removeCloudResources, reconcileDefaultSecurityGroup)
• reencryption.go: 1 site migrated (HCCO re-encryption controller)
• 2 batch-patch sites deferred — they accumulate status across the full reconcile loop and require restructuring

Part of the broader CNTRLPLANE-3532 migration. Depends on PR #8782 (merged).

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3532

Special notes for your reviewer:

• 2 batch-patch sites (lines 686, 869 in hostedcontrolplane_controller.go) are intentionally skipped — they accumulate status changes from the entire reconcile loop and migrating them requires restructuring the reconcile flow.
• The originalHostedControlPlane parameter was removed from reconcileDeletion since the migrated helpers handle re-fetching internally.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Bug Fixes
  • Improved HostedControlPlane condition and lifecycle status updates (including deletion, release/IDP validation, cloud resource teardown, and AWS default security group handling) with more reliable, atomic condition patching.
  • Enhanced HostedControlPlane secret encryption status/conditions so updates occur only when the encryption state changes, keeping EtcdDataEncryptionUpToDate accurate.
• Chores
  • Refined reconciliation logic to perform more targeted status writes, reducing unnecessary updates.
• Tests
  • Updated deletion reconciliation test to align with the updated reconciliation flow.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@vsolanki12: This pull request references CNTRLPLANE-3532 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Migrates 9 status patch call sites in the CPO to use statuspatching.PatchStatus / PatchStatusCondition, adding retry-on-conflict and consistent optimistic locking.

• hostedcontrolplane_controller.go: 7 sites migrated (reconcileDeletion, update, reconcileValidIDPConfigurationCondition, removeCloudResources, reconcileDefaultSecurityGroup)
• reencryption.go: 1 site migrated (HCCO re-encryption controller)
• 2 batch-patch sites deferred — they accumulate status across the full reconcile loop and require restructuring

Part of the broader CNTRLPLANE-3532 migration. Depends on PR #8782 (merged).

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3532

Special notes for your reviewer:

• 2 batch-patch sites (lines 686, 869 in hostedcontrolplane_controller.go) are intentionally skipped — they accumulate status changes from the entire reconcile loop and migrating them requires restructuring the reconcile flow.
• The originalHostedControlPlane parameter was removed from reconcileDeletion since the migrated helpers handle re-fetching internally.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR replaces several HostedControlPlane status updates and the reencryption controller’s status persistence with statuspatching helper calls. HostedControlPlane reconciliation now patches specific conditions for deletion, release info validation, IDP validation, cloud resource teardown, and default security group status, and the deletion test matches the updated signature. The reencryption reconciler now patches SecretEncryption and EtcdDataEncryptionUpToDate directly and records migration metrics from the previous and desired encryption state.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The modified TestReconcileDeletion uses static, descriptive titles; no Ginkgo/It/Context names in the PR are dynamic or unstable.
Test Structure And Quality	✅ Passed	The changed test is a small table-driven unit test, not Ginkgo; it uses only a fake client and gomock, no waits or cluster resources, and fits repo patterns.
Topology-Aware Scheduling Compatibility	✅ Passed	Only status-patching/refetch logic changed in controller code and tests; no pod specs, affinities, nodeSelectors, PDBs, or replica logic were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR only refactors controller/unit-test code; no new Ginkgo e2e tests or IPv4/public-network assumptions were added.
No-Weak-Crypto	✅ Passed	Diffs only migrate status patching; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token compares were introduced.
Container-Privileges	✅ Passed	The PR changes only three .go files; no container/K8s manifests or privilege fields were added, and the security scan found nothing.
No-Sensitive-Data-In-Logs	✅ Passed	No new log calls were added in the diff; touched code only changes status patching and existing logs don’t expose secrets or PII.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: migrating CPO status patching to statuspatching helpers.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vsolanki12
Once this PR has been reviewed and has the lgtm label, please assign enxebre for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 46.47887% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.18%. Comparing base (1f2811f) to head (7848ce8).
⚠️ Report is 35 commits behind head on main.

Files with missing lines	Patch %	Lines
...ostedcontrolplane/hostedcontrolplane_controller.go	25.53%	29 Missing and 6 partials ⚠️
...goperator/controllers/reencryption/reencryption.go	87.50%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8966      +/-   ##
==========================================
+ Coverage   43.53%   44.18%   +0.64%     
==========================================
  Files         771      772       +1     
  Lines       95798    96771     +973     
==========================================
+ Hits        41707    42755    +1048     
+ Misses      51192    51090     -102     
- Partials     2899     2926      +27     

Files with missing lines	Coverage Δ
...goperator/controllers/reencryption/reencryption.go	70.02% <87.50%> (+0.98%)	⬆️
...ostedcontrolplane/hostedcontrolplane_controller.go	45.70% <25.53%> (-0.03%)	⬇️

... and 20 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	37.65% <ø> (+0.42%)	⬆️
cpo-hostedcontrolplane	45.91% <25.53%> (+0.39%)	⬆️
cpo-other	45.39% <87.50%> (+0.28%)	⬆️
hypershift-operator	54.88% <ø> (+1.22%)	⬆️
other	32.08% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go`:
- Around line 1117-1139: The status patch in hostedcontrolplane_controller.go is
using a stale copy of HostedControlPlane and will overwrite earlier updates made
in update() and reconcileCPOV2. Fix the PatchStatus call to patch the current
in-memory hostedControlPlane state, or explicitly merge the existing status
fields back before setting ValidReleaseInfo. Keep the existing status mutations
such as Ready, KubeConfig, KubeadminPassword, ControlPlaneVersion, Initialized,
and prior conditions intact when applying the patch.

In
`@control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go`:
- Around line 76-89: The `desiredCondition` in `reconcile` is a pointer into
`hcp.Status.Conditions`, so `statuspatching.PatchStatus` may re-fetch and
overwrite the backing slice before the callback uses it. Capture the condition
by value before calling `PatchStatus` (for example, copy the result of
`meta.FindStatusCondition` into a standalone variable) and then use that copied
value inside the patch callback when setting `hcp.Status.Conditions`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ddb9d783-3baf-45e9-a217-5ed2a8755bb9

📥 Commits

Reviewing files that changed from the base of the PR and between 1f2811f and fb8a23c.

📒 Files selected for processing (3)

• control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
• control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
• control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go

[hypershift-jira-solve-ci]

Both failures are now fully analyzed. Let me produce the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: verify / Verify (GitHub Actions)
• Build ID: Run 29027278423 / Job 86150258275
• PR: CNTRLPLANE-3532: migrate CPO status patches to statuspatching helpers #8966 — CNTRLPLANE-3532: migrate CPO status patches to statuspatching helpers
• Repository: openshift/hypershift

---

• Konflux Job: Red Hat Konflux / control-plane-operator-main-on-pull-request
• Check Run ID: 86150298660
• PipelineRun: control-plane-operator-main-on-pull-request-gkspc

Test Failure Analysis

Error

# Job 1: verify / Verify — make deps failure
golang.org/x/net@v0.53.0: read "https://proxy.golang.org/golang.org/x/net/@v/v0.53.0.zip": stream error: stream ID 773; INTERNAL_ERROR; received from peer
github.com/alecthomas/chroma/v2@v2.23.1: read "https://proxy.golang.org/github.com/alecthomas/chroma/v2/@v/v2.23.1.zip": stream error: stream ID 787; INTERNAL_ERROR; received from peer
make: *** [Makefile:552: deps] Error 1

# Job 2: Red Hat Konflux / control-plane-operator — rpms-signature-scan image pull failure
the step "rpms-signature-scan" in TaskRun failed to pull the image "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168":
Back-off pulling image: ErrImagePull: copying system image from manifest list: parsing image configuration: fetching blob: received unexpected HTTP status: 503 Service Unavailable.

Summary

Both failures are transient infrastructure flakes completely unrelated to the code changes in PR #8966. The verify / Verify job failed because the Go module proxy (proxy.golang.org) returned HTTP/2 INTERNAL_ERROR stream errors while downloading dependency zip files during make deps. The Konflux / control-plane-operator job failed because Quay.io returned 503 Service Unavailable when the rpms-signature-scan Tekton task attempted to pull its tooling image. All 16 other Konflux pipeline tasks (including build, security scans, and SBOM generation) succeeded. Retrying both jobs should resolve these failures.

Root Cause

Job 1 — verify / Verify:
The make generate update target invokes make deps, which builds tools from hack/tools. During go build -tags=tools, the Go module proxy at proxy.golang.org returned HTTP/2 stream-level INTERNAL_ERROR responses for two module zip downloads:

1. golang.org/x/net@v0.53.0 — cascading across 7+ import chains (html/charset, proxy, http2, grpc, etc.)
2. github.com/alecthomas/chroma/v2@v2.23.1 — via golangci-lint → goformat → chroma/quick

These are server-side errors from the Go module proxy CDN, not local network issues or code problems.

Job 2 — Red Hat Konflux / control-plane-operator-main-on-pull-request:
The pipeline completed 16 of 17 tasks successfully. The sole failing task was rpms-signature-scan, which has status TaskRunImagePullFailed. The Tekton pod could not pull quay.io/konflux-ci/tools@sha256:cdab2b... because Quay.io returned HTTP 503 during blob fetch. This also caused the downstream enterprise-contract check to be cancelled (it never ran since it depends on this pipeline).

Neither failure is related to the PR's code changes (migrating CPO status patches to statuspatching helpers).

Recommendations

1. Rerun both jobs — these are transient infrastructure failures that will resolve on retry.
2. For the Verify job: Use the GitHub Actions "Re-run failed jobs" button or push an empty commit to re-trigger.
3. For the Konflux job: Re-trigger via the Konflux UI or add a /retest comment if supported. The downstream enterprise-contract check will automatically run once the pipeline succeeds.
4. No code changes are needed in PR CNTRLPLANE-3532: migrate CPO status patches to statuspatching helpers #8966.

Evidence

Evidence	Detail
Verify failed step	Step 4 — "Run make generate update" at Makefile:552 (deps target)
Go proxy error 1	golang.org/x/net@v0.53.0 — HTTP/2 stream ID 773 INTERNAL_ERROR from proxy.golang.org
Go proxy error 2	github.com/alecthomas/chroma/v2@v2.23.1 — HTTP/2 stream ID 787 INTERNAL_ERROR from proxy.golang.org
Konflux failed task	rpms-signature-scan — status TaskRunImagePullFailed (8s duration)
Konflux image pull error	quay.io/konflux-ci/tools@sha256:cdab2b... — HTTP 503 Service Unavailable from Quay.io
Konflux passing tasks	16/17 tasks passed (init, clone, build-images, clair-scan, sast-snyk, etc.)
Konflux cancelled downstream	enterprise-contract check cancelled due to pipeline failure
Other Konflux pipelines	hypershift-operator-main-on-pull-request ✅ passed
PR HEAD SHA	7848ce80b2b3931be0f1cf2fecb7582cb036fc0c

---

[openshift-ci]

@vsolanki12: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.