[redhat-chai-bot]

Summary

• Update both root and API modules to openshift/api v0.0.0-20261028095540-9af1f7b4730c and remove the obsolete API exclusion.
• Update openshift/client-go to v0.0.0-20261026141621-1f34fe8dc069 so generated clients no longer reference the removed config/v1alpha1 CRIOCredentialProviderConfig type. Regenerate dependency, vendor, API and documentation artifacts.

Explicit opt-in KMS contract transition

The embedded API server KMS configuration in HostedCluster and HostedControlPlane v1beta1 CustomNoUpgrade schemas now requires pluginConfig instead of the old inline type/vault representation. Default and TechPreviewNoUpgrade schemas do not expose this KMS member; cloud spec.secretEncryption is unchanged.

A fail-closed schema-check acknowledgment is limited to the exact old/new KMS schema fingerprints, these two CRDs, version, feature set and field path, and the specific required-field transition. Global required-field errors and unrelated diagnostics remain enforced. Negative controls cover mismatched schemas and unrelated changes. This intentionally rejects the old inline representation; it does not implement legacy migration, conversion or rollback compatibility.

Validation

• Full make verify, make verify-ci, make pre-commit, root/API race tests, lint, dependency verification, PKI and all six binary builds passed.
• All 15 fresh, full, unfiltered OCP/Kubernetes envtest matrix entries passed with race testing.
• PluginConfig create/update, typed round trips, invalid/legacy rejection, gate inventory and checker negative controls passed.
• Schema verification passed for 14 CRDs, retaining 122 warnings including the two explicit transition acknowledgments. Canonical regeneration twice was idempotent; committed tree is clean.

Existing diagnostics

Three auxiliary schema-checker assertions also fail on the unchanged base because of existing warning-versus-error expectations; the actual mandatory schema-check consumer passes. A supplemental whole-diff whitespace probe reports an EOF blank line in an upstream-generated vendor manifest that is byte-identical to upstream; repository formatting hooks exclude vendor, and the remaining scoped whitespace check passes. No vendor normalization or broad checker bypass was introduced.

---

AI-generated. Review for accuracy.

@muraee requested from Slack

Summary by CodeRabbit

• Bug Fixes

  • KMS plugin configuration references now retain their values and wire format when API configurations are serialized and deserialized.
  • CRD schema checks recognize the specific reviewed KMS schema transition while continuing to report unrelated schema changes.

• Documentation

  • Added guidance on CRD schema verification and the scope of the KMS transition check.

• Tests

  • Added coverage for KMS serialization and CRD schemas across feature sets.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[openshift-ci-robot]

@redhat-chai-bot: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Update both root and API modules to openshift/api v0.0.0-20261028095540-9af1f7b4730c and remove the obsolete API exclusion.
• Update openshift/client-go to v0.0.0-20261026141621-1f34fe8dc069 so generated clients no longer reference the removed config/v1alpha1 CRIOCredentialProviderConfig type. Regenerate dependency, vendor, API and documentation artifacts.

Explicit opt-in KMS contract transition

The embedded API server KMS configuration in HostedCluster and HostedControlPlane v1beta1 CustomNoUpgrade schemas now requires pluginConfig instead of the old inline type/vault representation. Default and TechPreviewNoUpgrade schemas do not expose this KMS member; cloud spec.secretEncryption is unchanged.

A fail-closed schema-check acknowledgment is limited to the exact old/new KMS schema fingerprints, these two CRDs, version, feature set and field path, and the specific required-field transition. Global required-field errors and unrelated diagnostics remain enforced. Negative controls cover mismatched schemas and unrelated changes. This intentionally rejects the old inline representation; it does not implement legacy migration, conversion or rollback compatibility.

Validation

• Full make verify, make verify-ci, make pre-commit, root/API race tests, lint, dependency verification, PKI and all six binary builds passed.
• All 15 fresh, full, unfiltered OCP/Kubernetes envtest matrix entries passed with race testing.
• PluginConfig create/update, typed round trips, invalid/legacy rejection, gate inventory and checker negative controls passed.
• Schema verification passed for 14 CRDs, retaining 122 warnings including the two explicit transition acknowledgments. Canonical regeneration twice was idempotent; committed tree is clean.

Existing diagnostics

Three auxiliary schema-checker assertions also fail on the unchanged base because of existing warning-versus-error expectations; the actual mandatory schema-check consumer passes. A supplemental whole-diff whitespace probe reports an EOF blank line in an upstream-generated vendor manifest that is byte-identical to upstream; repository formatting hooks exclude vendor, and the remaining scoped whitespace check passes. No vendor normalization or broad checker bypass was introduced.

---

AI-generated. Review for accuracy.

@muraee requested from Slack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: openshift/hypershift
• Branch: main
• File: .coderabbit.yaml
• Commit: 364a78f
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: ce01f25e-46ca-4ef2-a853-e65120429a98

Commits

Reviewing files that changed from the base of the PR and between 364a78f and 5c15b47.

Files ignored due to path filters: 113

• api/go.sum is excluded by !**/*.sum
• api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
• api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
• api/vendor/github.com/openshift/api/config/v1/types_cluster_version.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !**/zz_generated*
• api/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• api/vendor/github.com/openshift/api/operator/v1/register.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/operator/v1/types_console.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/operator/v1/types_ingress.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go is excluded by !**/vendor/**
• api/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !**/zz_generated*
• api/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• api/vendor/modules.txt is excluded by !**/vendor/**
• cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.kms-encryption.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml
• cmd/install/assets/crds/hypershift-operator/tests/hostedcontrolplanes.hypershift.openshift.io/featuregated.hostedcontrolplanes.kms-encryption.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml
• cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
• cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
• go.sum is excluded by !**/*.sum
• hack/tools/crd-schema-check/testdata/kms-transition-0.json is excluded by !**/testdata/**
• hack/tools/crd-schema-check/testdata/kms-transition-1.json is excluded by !**/testdata/**
• vendor/github.com/openshift/api/.gitignore is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/.golangci.yaml is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/Dockerfile.ocp is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/Makefile is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/apiextensions/install.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/apiextensions/v1/Makefile is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/apiextensions/v1/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/apiextensions/v1/register.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/apiextensions/v1/types_compatibilityrequirement.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/apiextensions/v1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/apiextensions/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/apiextensions/v1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/apiextensions/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• vendor/github.com/openshift/api/authentication/install.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/authentication/v1alpha1/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/authentication/v1alpha1/register.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/authentication/v1alpha1/types_authentication_configuration.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/types_cluster_version.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1/types_kmsencryption.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/register.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1alpha1/types_controllermanager.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1alpha1/types_crio_credential_provider_config.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• vendor/github.com/openshift/api/envtest-releases.yaml is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/features.md is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/install.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/register.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/types_console.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/types_ingress.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/route/v1/generated.proto is excluded by !vendor/**, !**/vendor/**, !**/generated.proto
• vendor/github.com/openshift/api/route/v1/types.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated.swagger_doc_generated.go, !**/zz_generated*
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurespec.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologystate.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransition.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransitionstatus.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanager.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanagerspec.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigspec.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigstatus.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/controllermanager.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/criocredentialproviderconfig.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/controllermanager.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/criocredentialproviderconfig.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxyconfig.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxytrustedcaconfigmapreference.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleingress.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consolespec.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/gatewayapiingressconfig.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingress.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerspec.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerstatus.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressspec.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressstatus.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightresult.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/machinemanagerselector.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

Files selected for processing: 10

• .codespellignore
• Makefile
• api/go.mod
• api/hypershift/v1beta1/kms_serialization_test.go
• go.mod
• hack/tools/crd-schema-check/README.md
• hack/tools/crd-schema-check/kms_transition.go
• hack/tools/crd-schema-check/kms_transition_test.go
• hack/tools/crd-schema-check/main.go
• test/envtest/kms_featuregate_test.go

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

Walkthrough

The API dependency versions change. New tests check KMS pluginConfig serialization and KMS schema behavior across feature sets. The CRD checker now acknowledges a specific CustomNoUpgrade KMS required-field diagnostic when the CRD identities, comparison result, and schema fingerprints match the expected transition. Other diagnostics remain unchanged.

Sequence Diagram(s)

sequenceDiagram
  participant Checker as crd-schema-check
  participant Compare as compareCRDs
  participant Acknowledge as acknowledgeKMSTransition
  participant Results as comparison results
  Checker->>Compare: compare existing CRDs
  Compare-->>Checker: comparison results
  Checker->>Acknowledge: pass CRD path, CRDs, and results
  Acknowledge->>Results: convert exact matching error to warning

Loading

Suggested reviewers: csrwng, bryan-cox

Priority: Normal

Merge Risk: Minimal · up to 5c15b

No identified issue blocks merging. The CustomNoUpgrade KMS schema transition remains an intentional, opt-in compatibility change.

Pre-merge checks: 10 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Ipv6 And Disconnected Network Test Compatibility		The PR adds generated Ginkgo API tests through the new KMS test-suite YAML. The HostedCluster fixture hardcodes IPv4-only networking values 10.132.0.0/14 and 172.31.0.0/16 (the generator creates `…	Replace the hardcoded IPv4 CIDRs with IPv6-compatible or dynamically selected values, then verify the test in an IPv6-only disconnected job. IPv6 and disconnected network compatibility notice: This test may contain IPv4 assumptions or exter…

Passed checks: 10 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "NO-JIRA: Bump OpenShift API to October 28" describes the main change. The raw summary shows the PR updates the github.com/openshift/api dependency in api/go.mod and go.mod to a versio…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		No changed Ginkgo test titles contain generated names, timestamps, UUIDs, IPs, random namespaces, node names, or legacy metadata tokens. The added YAML test names and Go subtest labels describe fixed …
Test Structure And Quality		The pull request adds no Ginkgo test code. The new Go tests use the standard testing package and t.Run; the changed CRD test suites are declarative YAML. No new It blocks, Ginkgo/Gomega assertio…
Topology-Aware Scheduling Compatibility		The pull request changes API dependencies, generated API/CRD artifacts, KMS schema tests, and the CRD schema checker. It does not add or modify deployments, controllers, operator workload logic, pod s…
No-Weak-Crypto		No weak crypto usage was introduced. The changed code has no MD5, SHA-1, DES, RC4, 3DES, Blowfish, or ECB usage, and no custom crypto implementation. The only crypto import is Go's standard `crypto/sh…
Container-Privileges		The pull request changes dependencies, generated API artifacts, CRD schemas, tests, and schema-check tooling. The reviewed diff introduces no container or Kubernetes manifest settings for privileged m…
No-Sensitive-Data-In-Logs		No changed code logs passwords, tokens, API keys, PII, session IDs, hostnames, or customer data. New test diagnostics print only errors, schema comparison diagnostics, booleans, fixed KMS reference fi…

Full details: Title check

Explanation

The title "NO-JIRA: Bump OpenShift API to October 28" describes the main change. The raw summary shows the PR updates the github.com/openshift/api dependency in api/go.mod and go.mod to a version dated 2026-10-28, and updates openshift/client-go. The PR objectives describe that dependency bump as the core change. The title omits the KMS pluginConfig schema transition and the schema-check acknowledgment, but it does not describe anything absent from the changeset. The title is a real part of the change but is not the full main point, so it passes as partially related.

Full details: Stable And Deterministic Test Names

Explanation

No changed Ginkgo test titles contain generated names, timestamps, UUIDs, IPs, random namespaces, node names, or legacy metadata tokens. The added YAML test names and Go subtest labels describe fixed KMS cases and stable feature-set/CRD-version dimensions; they do not use per-run generated values.

Full details: Test Structure And Quality

Explanation

The pull request adds no Ginkgo test code. The new Go tests use the standard testing package and t.Run; the changed CRD test suites are declarative YAML. No new It blocks, Ginkgo/Gomega assertions, cluster waits, or resource-setup patterns require review under this check.

Full details: Topology-Aware Scheduling Compatibility

Explanation

The pull request changes API dependencies, generated API/CRD artifacts, KMS schema tests, and the CRD schema checker. It does not add or modify deployments, controllers, operator workload logic, pod scheduling fields, replica strategies, node selectors, affinity, topology spread constraints, tolerations, or PDBs. The CRD changes only replace the KMS schema fields with pluginConfig, so no topology scheduling constraint is introduced.

Full details: No-Weak-Crypto

Explanation

No weak crypto usage was introduced. The changed code has no MD5, SHA-1, DES, RC4, 3DES, Blowfish, or ECB usage, and no custom crypto implementation. The only crypto import is Go's standard crypto/sha256 in hack/tools/crd-schema-check/kms_transition.go, used for schema fingerprints. Comparisons in the new tests and checker concern schema data and KMS references, not secrets or tokens.

Full details: Container-Privileges

Explanation

The pull request changes dependencies, generated API artifacts, CRD schemas, tests, and schema-check tooling. The reviewed diff introduces no container or Kubernetes manifest settings for privileged mode, host PID, host network, host IPC, SYS_ADMIN, root execution, or allowPrivilegeEscalation.

Full details: No-Sensitive-Data-In-Logs

Explanation

No changed code logs passwords, tokens, API keys, PII, session IDs, hostnames, or customer data. New test diagnostics print only errors, schema comparison diagnostics, booleans, fixed KMS reference fields, and a fixed wire-format string. The checker adds a static acknowledgment warning and retains existing stderr diagnostics; dependency and generated-artifact changes add no sensitive logging.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

The PR adds generated Ginkgo API tests through the new KMS test-suite YAML. The HostedCluster fixture hardcodes IPv4-only networking values 10.132.0.0/14 and 172.31.0.0/16 (the generator creates DescribeTable tests and submits these objects through the Kubernetes client). The tests do not dynamically select an IP family. No external connection is established by the image or URL fields.

Resolution

Replace the hardcoded IPv4 CIDRs with IPv6-compatible or dynamically selected values, then verify the test in an IPv6-only disconnected job. IPv6 and disconnected network compatibility notice: This test may contain IPv4 assumptions or external connectivity requirements that will fail in IPv6-only disconnected environments. Please verify your test works on IPv6 by running an additional CI job: /payload-job periodic-ci-openshift-release-master-nightly-4.22-e2e-metal-ipi-ovn-ipv6.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

Warning

Some tools did not complete. Review the errors below.

golangci-lint (2.14.0)

golangci-lint (2.14.0) skipped for .golangci.yml: configuration contains disallowed or uninspectable plugin or linter settings. Use supported built-in linters.

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign csrwng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS
• api/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.31%. Comparing base (364a78f) to head (5c15b47).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10137   +/-   ##
=======================================
  Coverage   52.31%   52.31%           
=======================================
  Files         826      826           
  Lines      105380   105380           
=======================================
  Hits        55130    55130           
  Misses      46728    46728           
  Partials     3522     3522           

Flag	Coverage Δ
cmd-support	46.67% <ø> (ø)
cpo-hostedcontrolplane	54.69% <ø> (ø)
cpo-other	56.94% <ø> (ø)
hypershift-operator	60.47% <ø> (ø)
other	39.40% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.