OCPBUGS-105865: fix(nodepool): include only TLSSecurityProfile in config hash instead of full APIServer by csrwng · Pull Request #9287 · openshift/hypershift

csrwng · 2026-08-12T08:56:00Z

Summary

Only serialize TLSSecurityProfile (via json.Marshal) into the NodePool config hash for >= 4.23 clusters, instead of the full reconciled APIServer object (via api.CompatibleJSONEncode).
Other APIServer fields (ServingCerts, ClientCA, CORS, Encryption, Audit) are control-plane-only and no longer trigger unnecessary NodePool rollouts.
Adds a test case verifying that a non-TLS field (Encryption) alongside a TLS profile does not appear in the config string.

Fixes: https://issues.redhat.com/browse/OCPBUGS-105865

Rollout impact

This changes the config hash for all existing NodePools on >= 4.23. A one-time rollout will occur when this operator version is deployed, because the hash input shrinks from the full APIServer blob to just the TLS profile. After that, non-TLS APIServer changes will no longer trigger rollouts.

Test plan

TestNewConfigGenerator — all hash expectations updated, all pass
TestGlobalConfigString — expected strings updated, new test case for TLS profile set alongside Encryption
Full nodepool package test suite passes
e2e-aws-upgrade-hypershift-operator — must pass to validate the one-time hash change rollout is safe

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Improved node pool configuration tracking for release versions 4.23.0 and newer.
- Changes to the API server TLS security profile are now detected reliably, triggering appropriate node pool updates.
- Unrelated API server configuration changes, including encryption settings, no longer unnecessarily affect node pool rollout behavior.
Compatibility
- Preserved existing configuration-tracking behavior for release versions earlier than 4.23.0.

openshift-merge-bot · 2026-08-12T08:56:03Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-08-12T08:56:23Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 38cec4d1-a380-485b-824b-f52c1c22b0d4

📥 Commits

Reviewing files that changed from the base of the PR and between 1c90cf2 and 3e81689.

📒 Files selected for processing (2)

hypershift-operator/controllers/nodepool/config.go
hypershift-operator/controllers/nodepool/config_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

hypershift-operator/controllers/nodepool/config.go
hypershift-operator/controllers/nodepool/config_test.go

📝 Walkthrough

Walkthrough

For release versions 4.23.0 and newer, global configuration hashing serializes only HostedCluster.Spec.Configuration.APIServer.TLSSecurityProfile. The generator handles an unset profile and returns JSON serialization errors. Tests cover null and custom profiles, exclude API server encryption, and update affected hash expectations.

Suggested reviewers: enxebre, devguyio

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: hashing only TLSSecurityProfile instead of the full APIServer configuration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Changed tests use static t.Run titles; no pod, namespace, node, IP, timestamp, UUID, or generated value appears in any added or modified title.
Test Structure And Quality	✅ Passed	The changed tests use Go testing.T/t.Run with fake clients, not Ginkgo It/BeforeEach/AfterEach or cluster waits; the Ginkgo-specific requirements do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff only changes NodePool global-config hash serialization and tests. It adds no replicas, affinity, topology spread, node selectors, tolerations, or disruption budgets.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only controller code and standard Go unit tests; no new Ginkgo It/Describe/Context tests or IPv4/external-network connectivity assumptions were added.
No-Weak-Crypto	✅ Passed	The diff adds JSON serialization of TLSSecurityProfile and a TLS_AES_128_GCM_SHA256 test fixture; it adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparison.
Container-Privileges	✅ Passed	The diff changes only two Go files and adds no container or Kubernetes manifests; no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation setting was introduced.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds JSON serialization only for TLS profile hashing; it adds no logging calls or sensitive values, and the new errors contain static text without serialized configuration.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-08-12T08:56:37Z

@csrwng: This pull request references Jira Issue OCPBUGS-105865, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Only serialize TLSSecurityProfile (via json.Marshal) into the NodePool config hash for >= 4.23 clusters, instead of the full reconciled APIServer object (via api.CompatibleJSONEncode).

Other APIServer fields (ServingCerts, ClientCA, CORS, Encryption, Audit) are control-plane-only and no longer trigger unnecessary NodePool rollouts.

Adds a test case verifying that a non-TLS field (Encryption) alongside a TLS profile does not appear in the config string.

Fixes: https://issues.redhat.com/browse/OCPBUGS-105865

Rollout impact

This changes the config hash for all existing NodePools on >= 4.23. A one-time rollout will occur when this operator version is deployed, because the hash input shrinks from the full APIServer blob to just the TLS profile. After that, non-TLS APIServer changes will no longer trigger rollouts.

Test plan

TestNewConfigGenerator — all hash expectations updated, all pass

TestGlobalConfigString — expected strings updated, new test case for TLS profile set alongside Encryption

Full nodepool package test suite passes

e2e-aws-upgrade-hypershift-operator — must pass to validate the one-time hash change rollout is safe

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-08-12T08:57:03Z

@csrwng: This pull request references Jira Issue OCPBUGS-105865, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

Only serialize TLSSecurityProfile (via json.Marshal) into the NodePool config hash for >= 4.23 clusters, instead of the full reconciled APIServer object (via api.CompatibleJSONEncode).

Other APIServer fields (ServingCerts, ClientCA, CORS, Encryption, Audit) are control-plane-only and no longer trigger unnecessary NodePool rollouts.

Adds a test case verifying that a non-TLS field (Encryption) alongside a TLS profile does not appear in the config string.

Fixes: https://issues.redhat.com/browse/OCPBUGS-105865

Rollout impact

This changes the config hash for all existing NodePools on >= 4.23. A one-time rollout will occur when this operator version is deployed, because the hash input shrinks from the full APIServer blob to just the TLS profile. After that, non-TLS APIServer changes will no longer trigger rollouts.

Test plan

TestNewConfigGenerator — all hash expectations updated, all pass

TestGlobalConfigString — expected strings updated, new test case for TLS profile set alongside Encryption

Full nodepool package test suite passes

e2e-aws-upgrade-hypershift-operator — must pass to validate the one-time hash change rollout is safe

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes

Improved node pool configuration tracking for release versions 4.23.0 and newer.

Changes to the API server TLS security profile are now detected reliably, triggering the appropriate node pool updates.

Prevented unrelated API server configuration changes from unnecessarily affecting node pool rollout behavior.

Compatibility

Preserved existing behavior for earlier release versions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

codecov · 2026-08-12T09:05:19Z

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 45.68%. Comparing base (7927588) to head (3e81689).
⚠️ Report is 15 commits behind head on main.

Files with missing lines	Patch %	Lines
hypershift-operator/controllers/nodepool/config.go	91.66%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9287   +/-   ##
=======================================
  Coverage   45.68%   45.68%           
=======================================
  Files         781      781           
  Lines       97730    97737    +7     
=======================================
+ Hits        44646    44656   +10     
+ Misses      50015    50013    -2     
+ Partials     3069     3068    -1

Files with missing lines	Coverage Δ
hypershift-operator/controllers/nodepool/config.go	`82.26% <91.66%> (+1.54%)`	⬆️

Flag	Coverage Δ
cmd-support	`38.79% <ø> (ø)`
cpo-hostedcontrolplane	`47.83% <ø> (ø)`
cpo-other	`45.93% <ø> (ø)`
hypershift-operator	`56.99% <91.66%> (+0.02%)`	⬆️
other	`34.38% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ricardomaraschini · 2026-08-12T09:17:43Z

/lgtm

openshift-merge-bot · 2026-08-12T09:18:13Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-22
/test e2e-aws-4-22
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

openshift-ci · 2026-08-12T09:18:19Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csrwng, ricardomaraschini

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [csrwng]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

… of full APIServer The conditionallyAddToGlobalConfigString function was serializing the entire reconciled APIServer object into the NodePool config hash for clusters on version >= 4.23. However, only TLSSecurityProfile actually affects worker node configuration. Changes to other APIServer fields (ServingCerts, ClientCA, CORS, Encryption, Audit) are control-plane-only and were triggering unnecessary NodePool rollouts. Serialize only TLSSecurityProfile via json.Marshal instead of the full APIServer object via api.CompatibleJSONEncode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cwbotbot · 2026-08-12T10:35:04Z

Test Results

e2e-aws

Status: ✅ PASS
Started: 2026-08-12T16:27:51Z
View Job
View Job History

e2e-aks

Status: ❌ FAIL
Started: 2026-08-12T14:21:17Z
View Job
View Job History

Failed Tests

Total failed tests: 4

TestNodePool
TestNodePool/HostedCluster0
TestNodePool/HostedCluster0/Main
TestNodePool/HostedCluster0/Main/TestNodePoolInPlaceUpgrade

csrwng · 2026-08-12T11:37:47Z

/verified by @csrwng
Test plan and execution log: https://gist.github.com/csrwng/f819c6e54df13df5f260b3a3777c2bd6

openshift-ci-robot · 2026-08-12T11:38:01Z

@csrwng: This PR has been marked as verified by @csrwng.

Details

In response to this:

/verified by @csrwng
Test plan and execution log: https://gist.github.com/csrwng/f819c6e54df13df5f260b3a3777c2bd6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

csrwng · 2026-08-12T11:39:07Z

/verified by @csrwng
Test plan and execution log: https://gist.github.com/csrwng/f819c6e54df13df5f260b3a3777c2bd6

openshift-ci-robot · 2026-08-12T11:39:22Z

@csrwng: This PR has been marked as verified by @csrwng.

Details

In response to this:

/verified by @csrwng
Test plan and execution log: https://gist.github.com/csrwng/f819c6e54df13df5f260b3a3777c2bd6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-08-12T11:40:16Z

@csrwng: This pull request references Jira Issue OCPBUGS-105865, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

Only serialize TLSSecurityProfile (via json.Marshal) into the NodePool config hash for >= 4.23 clusters, instead of the full reconciled APIServer object (via api.CompatibleJSONEncode).

Other APIServer fields (ServingCerts, ClientCA, CORS, Encryption, Audit) are control-plane-only and no longer trigger unnecessary NodePool rollouts.

Adds a test case verifying that a non-TLS field (Encryption) alongside a TLS profile does not appear in the config string.

Fixes: https://issues.redhat.com/browse/OCPBUGS-105865

Rollout impact

This changes the config hash for all existing NodePools on >= 4.23. A one-time rollout will occur when this operator version is deployed, because the hash input shrinks from the full APIServer blob to just the TLS profile. After that, non-TLS APIServer changes will no longer trigger rollouts.

Test plan

TestNewConfigGenerator — all hash expectations updated, all pass

TestGlobalConfigString — expected strings updated, new test case for TLS profile set alongside Encryption

Full nodepool package test suite passes

e2e-aws-upgrade-hypershift-operator — must pass to validate the one-time hash change rollout is safe

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes

Improved node pool configuration tracking for release versions 4.23.0 and newer.

Changes to the API server TLS security profile are now detected reliably, triggering appropriate node pool updates.

Unrelated API server configuration changes, including encryption settings, no longer unnecessarily affect node pool rollout behavior.

Compatibility

Preserved existing configuration-tracking behavior for release versions earlier than 4.23.0.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

csrwng · 2026-08-12T11:43:29Z

/override-sticky ci/prow/e2e-aws-upgrade-hypershift-operator
The HO upgrade test is expected to fail with this PR since we're changing how we calculate the nodepool hash for newer releases (>= 4.23).

openshift-ci · 2026-08-12T11:43:37Z

@csrwng: Overrode contexts on behalf of csrwng: ci/prow/e2e-aws-upgrade-hypershift-operator

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

/override-sticky ci/prow/e2e-aws-upgrade-hypershift-operator
The HO upgrade test is expected to fail with this PR since we're changing how we calculate the nodepool hash for newer releases (>= 4.23).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ricardomaraschini · 2026-08-12T11:53:03Z

/lgtm

openshift-merge-bot · 2026-08-12T11:53:16Z

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

csrwng · 2026-08-12T13:55:13Z

/pipeline required

openshift-merge-bot · 2026-08-12T13:55:16Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-22
/test e2e-aws-4-22
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

csrwng · 2026-08-12T16:09:20Z

/test e2e-aks

msg: "failed to extract release metadata: failed to obtain image layers for registry.build01.ci.openshift.org/ci-op-8t64w8rp/release@sha256:be62cc631a0da42c74e659824cd2e91560bdba31f4a4310d30f3e835737d0286: cannot retrieve image configuration for manifest sha256:c8d48c150c17a4943d78ff8cb8504afbb6bef95b01ad2b098a613cc80e428d56 in manifest list sha256:be62cc631a0da42c74e659824cd2e91560bdba31f4a4310d30f3e835737d0286: received unexpected HTTP status: 500 Internal Server Error",

openshift-merge-bot · 2026-08-12T16:25:26Z

/retest-required

Remaining retests: 0 against base HEAD 4a590fe and 2 for PR HEAD 3e81689 in total

openshift-merge-bot · 2026-08-12T17:27:15Z

/retest-required

Remaining retests: 0 against base HEAD 611e3b2 and 1 for PR HEAD 3e81689 in total

openshift-merge-bot · 2026-08-12T20:25:28Z

/retest-required

Remaining retests: 0 against base HEAD 7f0cef9 and 0 for PR HEAD 3e81689 in total

openshift-merge-bot · 2026-08-12T21:21:05Z

/hold

Revision 3e81689 was retested 3 times: holding

csrwng · 2026-08-13T10:39:02Z

/override-sticky ci/prow/e2e-aws-upgrade-hypershift-operator

openshift-ci · 2026-08-13T10:39:08Z

@csrwng: Overrode contexts on behalf of csrwng: ci/prow/e2e-aws-upgrade-hypershift-operator

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

/override-sticky ci/prow/e2e-aws-upgrade-hypershift-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

csrwng · 2026-08-13T10:42:26Z

The kubevirt e2e passed but failed in the must-gather step:

INFO[2026-08-12T20:26:03Z] Step e2e-kubevirt-aws-ovn-reduced-hypershift-kubevirt-install-create-external-infra-kubeconfig succeeded after 11s. 
INFO[2026-08-12T20:26:03Z] Running step e2e-kubevirt-aws-ovn-reduced-run-e2e-external. 
INFO[2026-08-12T20:26:43Z] Step e2e-kubevirt-aws-ovn-reduced-run-e2e-external succeeded after 39s. 
INFO[2026-08-12T20:26:43Z] Step phase test succeeded after 1h21m4s.     
INFO[2026-08-12T20:26:43Z] Running multi-stage phase post               
INFO[2026-08-12T20:26:43Z] Running step e2e-kubevirt-aws-ovn-reduced-dump. 
INFO[2026-08-12T20:32:26Z] Step e2e-kubevirt-aws-ovn-reduced-dump succeeded after 5m43s. 
INFO[2026-08-12T20:32:26Z] Running step e2e-kubevirt-aws-ovn-reduced-hypershift-debug. 
INFO[2026-08-12T20:32:34Z] Step e2e-kubevirt-aws-ovn-reduced-hypershift-debug succeeded after 7s. 
INFO[2026-08-12T20:32:34Z] Running step e2e-kubevirt-aws-ovn-reduced-hypershift-k8sgpt. 
INFO[2026-08-12T20:33:08Z] Step e2e-kubevirt-aws-ovn-reduced-hypershift-k8sgpt succeeded after 33s. 
INFO[2026-08-12T20:33:08Z] Running step e2e-kubevirt-aws-ovn-reduced-gather-core-dump. 
INFO[2026-08-12T20:33:26Z] Step e2e-kubevirt-aws-ovn-reduced-gather-core-dump succeeded after 18s. 
INFO[2026-08-12T20:33:26Z] Running step e2e-kubevirt-aws-ovn-reduced-gather-aws-console. 
INFO[2026-08-12T20:33:43Z] Step e2e-kubevirt-aws-ovn-reduced-gather-aws-console succeeded after 16s. 
INFO[2026-08-12T20:33:43Z] Running step e2e-kubevirt-aws-ovn-reduced-gather-must-gather. 
WARN[2026-08-12T20:34:19Z] Failed to update lease "aws-2--us-west-2--quota-slice-296"  error=status 502 Bad Gateway, status code 502 updating aws-2--us-west-2--quota-slice-296
INFO[2026-08-12T20:35:18Z] Logs for container test in pod e2e-kubevirt-aws-ovn-reduced-gather-must-gather:

/override-sticky ci/prow/e2e-kubevirt-aws-ovn-reduced

openshift-ci · 2026-08-13T10:42:38Z

@csrwng: Overrode contexts on behalf of csrwng: ci/prow/e2e-kubevirt-aws-ovn-reduced

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

The kubevirt e2e passed but failed in the must-gather step:

INFO[2026-08-12T20:26:03Z] Step e2e-kubevirt-aws-ovn-reduced-hypershift-kubevirt-install-create-external-infra-kubeconfig succeeded after 11s. 
INFO[2026-08-12T20:26:03Z] Running step e2e-kubevirt-aws-ovn-reduced-run-e2e-external. 
INFO[2026-08-12T20:26:43Z] Step e2e-kubevirt-aws-ovn-reduced-run-e2e-external succeeded after 39s. 
INFO[2026-08-12T20:26:43Z] Step phase test succeeded after 1h21m4s.     
INFO[2026-08-12T20:26:43Z] Running multi-stage phase post               
INFO[2026-08-12T20:26:43Z] Running step e2e-kubevirt-aws-ovn-reduced-dump. 
INFO[2026-08-12T20:32:26Z] Step e2e-kubevirt-aws-ovn-reduced-dump succeeded after 5m43s. 
INFO[2026-08-12T20:32:26Z] Running step e2e-kubevirt-aws-ovn-reduced-hypershift-debug. 
INFO[2026-08-12T20:32:34Z] Step e2e-kubevirt-aws-ovn-reduced-hypershift-debug succeeded after 7s. 
INFO[2026-08-12T20:32:34Z] Running step e2e-kubevirt-aws-ovn-reduced-hypershift-k8sgpt. 
INFO[2026-08-12T20:33:08Z] Step e2e-kubevirt-aws-ovn-reduced-hypershift-k8sgpt succeeded after 33s. 
INFO[2026-08-12T20:33:08Z] Running step e2e-kubevirt-aws-ovn-reduced-gather-core-dump. 
INFO[2026-08-12T20:33:26Z] Step e2e-kubevirt-aws-ovn-reduced-gather-core-dump succeeded after 18s. 
INFO[2026-08-12T20:33:26Z] Running step e2e-kubevirt-aws-ovn-reduced-gather-aws-console. 
INFO[2026-08-12T20:33:43Z] Step e2e-kubevirt-aws-ovn-reduced-gather-aws-console succeeded after 16s. 
INFO[2026-08-12T20:33:43Z] Running step e2e-kubevirt-aws-ovn-reduced-gather-must-gather. 
WARN[2026-08-12T20:34:19Z] Failed to update lease "aws-2--us-west-2--quota-slice-296"  error=status 502 Bad Gateway, status code 502 updating aws-2--us-west-2--quota-slice-296
INFO[2026-08-12T20:35:18Z] Logs for container test in pod e2e-kubevirt-aws-ovn-reduced-gather-must-gather:

/override-sticky ci/prow/e2e-kubevirt-aws-ovn-reduced

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-08-13T10:42:41Z

@csrwng: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

csrwng · 2026-08-13T10:48:02Z

/hold cancel

openshift-ci-robot · 2026-08-13T11:15:45Z

@csrwng: Jira Issue Verification Checks: Jira Issue OCPBUGS-105865
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-105865 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

Only serialize TLSSecurityProfile (via json.Marshal) into the NodePool config hash for >= 4.23 clusters, instead of the full reconciled APIServer object (via api.CompatibleJSONEncode).

Other APIServer fields (ServingCerts, ClientCA, CORS, Encryption, Audit) are control-plane-only and no longer trigger unnecessary NodePool rollouts.

Adds a test case verifying that a non-TLS field (Encryption) alongside a TLS profile does not appear in the config string.

Fixes: https://issues.redhat.com/browse/OCPBUGS-105865

Rollout impact

This changes the config hash for all existing NodePools on >= 4.23. A one-time rollout will occur when this operator version is deployed, because the hash input shrinks from the full APIServer blob to just the TLS profile. After that, non-TLS APIServer changes will no longer trigger rollouts.

Test plan

TestNewConfigGenerator — all hash expectations updated, all pass

TestGlobalConfigString — expected strings updated, new test case for TLS profile set alongside Encryption

Full nodepool package test suite passes

e2e-aws-upgrade-hypershift-operator — must pass to validate the one-time hash change rollout is safe

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes

Improved node pool configuration tracking for release versions 4.23.0 and newer.

Changes to the API server TLS security profile are now detected reliably, triggering appropriate node pool updates.

Unrelated API server configuration changes, including encryption settings, no longer unnecessarily affect node pool rollout behavior.

Compatibility

Preserved existing configuration-tracking behavior for release versions earlier than 4.23.0.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot added the do-not-merge/needs-area label Aug 12, 2026

csrwng changed the title ~~fix(nodepool): include only TLSSecurityProfile in config hash instead of full APIServer~~ OCPBUGS-105865: fix(nodepool): include only TLSSecurityProfile in config hash instead of full APIServer Aug 12, 2026

openshift-ci Bot added the area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release label Aug 12, 2026

openshift-ci Bot requested a review from devguyio August 12, 2026 08:56

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 12, 2026

openshift-ci Bot requested a review from enxebre August 12, 2026 08:56

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Aug 12, 2026

openshift-ci Bot removed the do-not-merge/needs-area label Aug 12, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 12, 2026

ricardomaraschini approved these changes Aug 12, 2026

View reviewed changes

openshift-ci Bot assigned ricardomaraschini Aug 12, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 12, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 12, 2026

csrwng force-pushed the fix-nodepool-apiserver-config-hash branch from 1c90cf2 to 3e81689 Compare August 12, 2026 11:38

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Aug 12, 2026

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 12, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 12, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 12, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 12, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 13, 2026

openshift-merge-bot Bot merged commit 7963a73 into openshift:main Aug 13, 2026
43 checks passed

Uh oh!

Conversation

csrwng commented Aug 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Rollout impact

Test plan

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Summary

Rollout impact

Test plan

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Summary

Rollout impact

Test plan

Summary by CodeRabbit

Uh oh!

codecov Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ricardomaraschini commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

openshift-ci Bot commented Aug 12, 2026

Uh oh!

cwbotbot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

e2e-aws

e2e-aks

Uh oh!

csrwng commented Aug 12, 2026

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Uh oh!

csrwng commented Aug 12, 2026

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Uh oh!

openshift-ci-robot commented Aug 12, 2026

Summary

Rollout impact

Test plan

Summary by CodeRabbit

Uh oh!

csrwng commented Aug 12, 2026

Uh oh!

openshift-ci Bot commented Aug 12, 2026

Uh oh!

ricardomaraschini commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

csrwng commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

csrwng commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

csrwng commented Aug 13, 2026

csrwng commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

codecov Bot commented Aug 12, 2026 •

edited

Loading

cwbotbot commented Aug 12, 2026 •

edited

Loading

csrwng commented Aug 12, 2026 •

edited

Loading