✨ Rosa roles config implementations by serngawy · Pull Request #5667 · kubernetes-sigs/cluster-api-provider-aws

serngawy · 2025-09-15T19:20:26Z

This PR is based on PR 5499 fixing all the comments

Based on proposal #5451
Adding RosaRoleConfig API with implementation. that should create account roles, operator roles, OIDC config and OIDC provider necessary to create ROSA HCP cluster.

Moving RosaMachinePoolAutoScaling definition to ROSAControlPlane to avoid circular dependency.

What type of PR is this?
/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

Release note:

Adding Rosa Role Config API and implementation

PanSpagetka

Looks good

serngawy · 2025-09-18T18:44:13Z

/test pull-cluster-api-provider-aws-test

damdo · 2025-09-22T08:11:40Z

/assign @damdo @nrb @richardcase

damdo · 2025-09-23T14:56:11Z

+	rosaRoleConfig := &expinfrav1.ROSARoleConfig{}
+	// Get role configuration from either RosaRoleConfig or direct fields
+	if rosaScope.ControlPlane.Spec.RosaRoleConfigRef != nil {
+		// Get configuration from RosaRoleConfig
+
+		key := client.ObjectKey{
+			Name:      rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name,
+			Namespace: rosaScope.ControlPlane.Namespace,
+		}
+
+		if err := r.Client.Get(ctx, key, rosaRoleConfig); err != nil {
+			if apierrors.IsNotFound(err) {
+				conditions.MarkFalse(rosaScope.ControlPlane,
+					rosacontrolplanev1.ROSARoleConfigReadyCondition,
+					rosacontrolplanev1.ROSARoleConfigNotFoundReason,
+					clusterv1.ConditionSeverityError,
+					"RosaRoleConfig %s/%s not found", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name)
+				rosaScope.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s not found: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
+				return ctrl.Result{RequeueAfter: time.Second * 60}, nil
+			}
+			rosaScope.Error(err, fmt.Sprintf("failed to get RosaRoleConfig %s/%s: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
+			return ctrl.Result{RequeueAfter: time.Second * 60}, nil
+		}
+
+		// Check if RosaRoleConfig is ready
+		if !conditions.IsTrue(rosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition) {
+			conditions.MarkFalse(rosaScope.ControlPlane,
+				rosacontrolplanev1.ROSARoleConfigReadyCondition,
+				rosacontrolplanev1.ROSARoleConfigNotReadyReason,
+				clusterv1.ConditionSeverityWarning,
+				"RosaRoleConfig %s/%s is not ready", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name)
+			rosaScope.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s is not ready", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name))
+
+			return ctrl.Result{RequeueAfter: time.Second * 60}, nil
+		}
+
+		conditions.MarkTrue(rosaScope.ControlPlane, rosacontrolplanev1.ROSARoleConfigReadyCondition)
+	} else {
+		rosaRoleConfig.Status.OIDCID = rosaScope.ControlPlane.Spec.OIDCID
+		rosaRoleConfig.Status.AccountRolesRef.InstallerRoleARN = rosaScope.ControlPlane.Spec.InstallerRoleARN
+		rosaRoleConfig.Status.AccountRolesRef.SupportRoleARN = rosaScope.ControlPlane.Spec.SupportRoleARN
+		rosaRoleConfig.Status.AccountRolesRef.WorkerRoleARN = rosaScope.ControlPlane.Spec.WorkerRoleARN
+		rosaRoleConfig.Status.OperatorRolesRef = rosaScope.ControlPlane.Spec.RolesRef
+	}
+


I think we could maybe extract this into a specific reconcileRosaRoleConfig function.

damdo · 2025-09-23T14:57:24Z

+					clusterv1.ConditionSeverityError,
+					"RosaRoleConfig %s/%s not found", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name)
+				rosaScope.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s not found: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
+				return ctrl.Result{RequeueAfter: time.Second * 60}, nil


Why do we have these RequeueAfter 60s functions all over the place?
Wouldn't erroring normally and retry soon after be ok?

@serngawy These ones are still here I see, any thoughts?

damdo · 2025-09-23T14:58:17Z

+	// UnManaged OIDC Provider type
+	UnManaged OidcProviderType = "UnManaged"


I think Unmanaged might be better.

damdo · 2025-09-23T15:04:08Z

+  credentialsSecretRef:
+    name: rosa-creds-secret
+  rosaRoleConfigRef:
+    name: "${CLUSTER_NAME}-role-config"


There is a missing EndOfFile here

damdo · 2025-09-23T15:05:36Z

+	err = r.setUpRuntime(ctx, scope)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to set up runtime: %w", err)
+	}


I think it would be cleaner to have all these invocations that only return errors as inlined err checks

Suggested change

err = r.setUpRuntime(ctx, scope)

if err != nil {

return ctrl.Result{}, fmt.Errorf("failed to set up runtime: %w", err)

}

if err := r.setUpRuntime(ctx, scope); err != nil {

return ctrl.Result{}, fmt.Errorf("failed to set up runtime: %w", err)

}

damdo · 2025-09-25T07:43:20Z

/label tide/merge-method-squash

damdo

Thanks for addressing some of my comments, still some things left to be addressed but we are looking good! TY

damdo · 2025-09-25T07:48:20Z

+					clusterv1.ConditionSeverityError,
+					"RosaRoleConfig %s/%s not found", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name)
+				rosaScope.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s not found: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
+				return ctrl.Result{RequeueAfter: time.Second * 60}, nil


@serngawy These ones are still here I see, any thoughts?

Signed-off-by: serngawy <serngawy@gmail.com>

serngawy · 2025-09-25T18:19:15Z

Thanks @damdo , fixed all the err inline nil check AND removed the RequeueAfter 60 (just forget remove it with others)

damdo

Thanks for addressing my comments

damdo

/lgtm

Let's see what others think

k8s-ci-robot · 2025-09-25T18:23:54Z

LGTM label has been added.

Details

Git tree hash: d89f75256d7de8148a3dccb2b6a17b1083baef51

richardcase · 2025-09-30T10:53:38Z

/approve

k8s-ci-robot · 2025-09-30T10:53:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: richardcase

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [richardcase]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

* Add RosaRoleConfig API and CRD. * Enable partial reconcile of Rosa Operator Roles * Review fixes * Add integration tests * Add more tests * Fix comments Signed-off-by: serngawy <serngawy@gmail.com> --------- Signed-off-by: serngawy <serngawy@gmail.com> Co-authored-by: rknaur <rknaur@redhat.com>

serngawy · 2025-10-06T11:35:10Z

/cherry-pick release-2.9

k8s-infra-cherrypick-robot · 2025-10-06T11:35:58Z

@serngawy: #5667 failed to apply on top of branch "release-2.9":

Applying: Add RosaRoleConfig API and CRD.
Using index info to reconstruct a base tree...
M	config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml
M	config/rbac/role.yaml
M	controlplane/rosa/controllers/rosacontrolplane_controller.go
M	go.mod
M	go.sum
M	pkg/rosa/ocmclient.go
M	test/mocks/ocm_client_mock.go
Falling back to patching base and 3-way merge...
Auto-merging test/mocks/ocm_client_mock.go
CONFLICT (content): Merge conflict in test/mocks/ocm_client_mock.go
Auto-merging pkg/rosa/ocmclient.go
CONFLICT (content): Merge conflict in pkg/rosa/ocmclient.go
Auto-merging go.sum
Auto-merging go.mod
Auto-merging controlplane/rosa/controllers/rosacontrolplane_controller.go
Auto-merging config/rbac/role.yaml
CONFLICT (content): Merge conflict in config/rbac/role.yaml
Auto-merging config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Add RosaRoleConfig API and CRD.

Details

In response to this:

/cherry-pick release-2.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

serngawy · 2025-10-07T14:42:19Z

/cherry-pick release-2.9

k8s-infra-cherrypick-robot · 2025-10-07T14:42:57Z

@serngawy: new pull request created: #5696

Details

In response to this:

/cherry-pick release-2.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

* Add RosaRoleConfig API and CRD. * Enable partial reconcile of Rosa Operator Roles * Review fixes * Add integration tests * Add more tests * Fix comments Signed-off-by: serngawy <serngawy@gmail.com> --------- Signed-off-by: serngawy <serngawy@gmail.com> Co-authored-by: rknaur <rknaur@redhat.com>

* ✨ Rosa roles config implementations (kubernetes-sigs#5667) * Add RosaRoleConfig API and CRD. * Enable partial reconcile of Rosa Operator Roles * Review fixes * Add integration tests * Add more tests * Fix comments Signed-off-by: serngawy <serngawy@gmail.com> --------- Signed-off-by: serngawy <serngawy@gmail.com> Co-authored-by: rknaur <rknaur@redhat.com> * ROSAMachinePool: support for capacity reservations (kubernetes-sigs#5649) * bump ginkgo timeout to 5h The overall job timeout in prow is 5h, let's use all of the available time. * ✨ feat: Support setting EKS authentication mode (kubernetes-sigs#5578) * feat: support setting EKS AuthenticationMode * feat: support setting EKS AuthenticationMode * Update controlplane/eks/api/v1beta2/awsmanagedcontrolplane_webhook_test.go Co-authored-by: Damiano Donati <damiano.donati@gmail.com> * add EOF to new files --------- Co-authored-by: Adam Malcontenti-Wilson <amalcontenti-wilson@zendesk.com> Co-authored-by: Damiano Donati <damiano.donati@gmail.com> * 🐛 fix: use cluster tag key to list managed egress-only internet gateway The API for DescribeEgressOnlyInternetGateways does not support attachment.vpc-id filter. Thus, the call will return all available eigw. Consequences: - CAPA incorrectly selects an unintended eigw for use. Leading to route creation failure since the eigw belongs to a different VPC. - CAPA incorrectly destroys all eigw of all VPCs. This is very catastrophic as it can break other workloads. This commit changes the filter to use cluster tag instead. Additional safeguard is also included to check if the eigw is truly attached the VPC. * Add ROSA-HCP AutoNode for karpenter auto scale (kubernetes-sigs#5686) Signed-off-by: serngawy <serngawy@gmail.com> * ✨ ROSANetwork: new CRD & reconciler to provision network infrastructure for ROSA-HCP (kubernetes-sigs#5464) * RosaNetwork: new CRD & reconciler to provision net infra for ROSA-HCP * ROSANetwork: tests * kep: adds nodedm proposal * docs: refine wording around updates Co-authored-by: Daniel Lipovetsky <daniel.lipovetsky@gmail.com> * docs: fixes minor issues in nodeadm kep * ✨ Support EKS upgrade policy (kubernetes-sigs#5471) * Support EKS upgrade policy * Apply suggestions from code review Co-authored-by: Damiano Donati <damiano.donati@gmail.com> * regenerate * Apply suggestions from code review Co-authored-by: Damiano Donati <damiano.donati@gmail.com> * Update pkg/cloud/services/eks/cluster.go Co-authored-by: Damiano Donati <damiano.donati@gmail.com> * remove log * Update config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml Co-authored-by: Faiq <faiq.raza@nutanix.com> * docstring typo * set NotReady if cluster was automatically upgraded * Update pkg/cloud/services/eks/cluster.go Co-authored-by: Faiq <faiq.raza@nutanix.com> * fix version compare logic * e2e * Apply suggestions from code review Co-authored-by: Damiano Donati <damiano.donati@gmail.com> * syntax * WaitForEKSClusterUpgradePolicy fail early on NotFound --------- Co-authored-by: Damiano Donati <damiano.donati@gmail.com> Co-authored-by: Faiq <faiq.raza@nutanix.com> * Update releasing.md * bump cloud build timeout to 2h * Update ROSA docs Update Red Hat documentation links. * 🌱 Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.0.2 to 4.0.5. - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.0.2...v4.0.5) --- updated-dependencies: - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.0.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Log desired AMI architecture and owner ID on errors * 🌱 Bump github/codeql-action from 3 to 4 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Cancel instance refresh on any relevant change to ASG instead of blocking until previous one is finished (which may have led to failing nodes due to outdated join token) * test: Add dedicated unit tests for getInstanceCPUOptionsRequest The unit tests for `getInstanceCPUOptionsRequest` are more lightweight and faster than testing various CPU option configurations through the larger `CreateInstance` function. This commit refactors the existing tests by moving the specific CPU option test cases from `TestCreateInstance` into a new, more focused `TestGetInstanceCPUOptionsRequest` function. A single test case remains in `TestCreateInstance` to ensure the integration between the functions is correct. Signed-off-by: Fangge Jin <fjin@redhat.com> * Fix rosaNetwork set availabilityZones Signed-off-by: serngawy <serngawy@gmail.com> * 🌱 Bump github.com/mikefarah/yq/v4 Bumps the dependencies group in /hack/tools with 1 update: [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq). Updates `github.com/mikefarah/yq/v4` from 4.47.2 to 4.48.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@v4.47.2...v4.48.1) --- updated-dependencies: - dependency-name: github.com/mikefarah/yq/v4 dependency-version: 4.48.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * add verify-go-directive check from core CAPI * Allocate dedicated host when a dedicated host doesn't exist * ci: updates devbox.lock file * Fix delete rosa-hcp Signed-off-by: serngawy <serngawy@gmail.com> * Add update permission for `AWSMachinePool` finalizers as needed by `OwnerReferencesPermissionEnforcement` for setting `BlockOwnerDeletion: true` on AWSMachinePool Machines * OIDC identity provider description matches field name * 🌱 Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 8.0.0 to 9.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@4afd733...0a35821) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * 🌱 Bump sigs.k8s.io/kustomize/kustomize/v5 Bumps the dependencies group in /hack/tools with 1 update: [sigs.k8s.io/kustomize/kustomize/v5](https://github.com/kubernetes-sigs/kustomize). Updates `sigs.k8s.io/kustomize/kustomize/v5` from 5.7.1 to 5.8.0 - [Release notes](https://github.com/kubernetes-sigs/kustomize/releases) - [Commits](kubernetes-sigs/kustomize@kustomize/v5.7.1...kustomize/v5.8.0) --- updated-dependencies: - dependency-name: sigs.k8s.io/kustomize/kustomize/v5 dependency-version: 5.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Drop unused conversion functions * hack/tools: use mainstream conversion-gen * rerun: make generate * e2e: fix panic when dumping CloudTrail logs * feat: add node auto repair configuration for EKS managed node groups * 🌱 Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /hack/tools Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.43.0 to 0.45.0. - [Commits](golang/crypto@v0.43.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * 🌱 Bump CAPI to v1.11 and k8s to v1.33 (kubernetes-sigs#5720) * deps: upgrade Kubernetes dependencies to v0.33.4 - Update core Kubernetes dependencies from v0.32.3 to v0.33.4: - k8s.io/api, k8s.io/apimachinery, k8s.io/client-go - k8s.io/apiserver, k8s.io/cli-runtime, k8s.io/kubectl - k8s.io/apiextensions-apiserver, k8s.io/component-base - Upgrade prometheus/client_golang from v1.19.1 to v1.22.0 - Update cel.dev/expr from v0.18.0 to v0.19.1 - Upgrade google/cel-go from v0.22.0 to v0.23.2 - Update golang.org/x/time from v0.8.0 to v0.9.0 - Upgrade gRPC from v1.67.3 to v1.68.1 - Update OpenTelemetry packages to v1.33.0 - Refresh k8s.io/utils and other indirect dependencies - Update kube-openapi and structured-merge-diff versions * deps: update cluster-api to v1.11.1 and controller-runtime to v0.21.0 - Upgrade cluster-api from v1.10.2 to v1.11.1 - Upgrade controller-runtime from v0.20.4 to v0.21.0 - Update various golang.org/x/* packages - Update testing dependencies (ginkgo, gomega) - Update OpenTelemetry and other indirect dependencies * WIP no IDE errors * WIP IDE Errors * Fix go dependencies Signed-off-by: Borja Clemente <bclement@redhat.com> * Update imports, code and generations to CAPI 1.11 - Update all imports to v1beta2 types except for conditions staying in v1beta1. - Adapt source code to work with v1beta2 and deprecated conditions. - Manually update conversions. Signed-off-by: Borja Clemente <bclement@redhat.com> * Update linting pkg alias and fix broken imports blocks Signed-off-by: Borja Clemente <bclement@redhat.com> * Remove unnecessary Paused constants Signed-off-by: Borja Clemente <bclement@redhat.com> * Fix import aliases Signed-off-by: Borja Clemente <bclement@redhat.com> * Fix broken imports Signed-off-by: Borja Clemente <bclement@redhat.com> * Revert public APIS back to v1beta1 while internally using v1beta2 Introducing v1beta2 on public types is a breaking change so they have to stay in v1beta1. Internally though, migration to v1beta2 is happening (except for conditions). Signed-off-by: Borja Clemente <bclement@redhat.com> * Revert infrav1 conditions to v1beta1 and consolidate imports Signed-off-by: Borja Clemente <bclement@redhat.com> * Consolidate conditions imports and fix linting Signed-off-by: Borja Clemente <bclement@redhat.com> * Fix regression in machine deployments without failure domain set Signed-off-by: Borja Clemente <bclement@redhat.com> * Revert missing public APIs to v1beta1 Signed-off-by: Borja Clemente <bclement@redhat.com> * Consolidate infrav1beta1 imports into infrav1 Signed-off-by: Borja Clemente <bclement@redhat.com> * Remove unused conditions constants Signed-off-by: Borja Clemente <bclement@redhat.com> * Fix setting wrong condition type Signed-off-by: Borja Clemente <bclement@redhat.com> * Cast v1beta1 conditions instead of creating a new constant Signed-off-by: Borja Clemente <bclement@redhat.com> * Revert changed public APIs and adapt internally to v1beta2 Signed-off-by: Borja Clemente <bclement@redhat.com> * Resolve conflicts with main Signed-off-by: Borja Clemente <bclement@redhat.com> * Add deprecated CAPI imports linter rule Add rule to allow using deprecated v1beta1 CAPI APIs and removed linter comments everywhere. Signed-off-by: Borja Clemente <bclement@redhat.com> * Apply review corrections Signed-off-by: Borja Clemente <bclement@redhat.com> * Adjust e2e and metadata versions Signed-off-by: Borja Clemente <bclement@redhat.com> * Apply review feedback on awscluster_webhook Signed-off-by: Borja Clemente <bclement@redhat.com> * FIx unit tests Signed-off-by: Borja Clemente <bclement@redhat.com> * Review feedback Signed-off-by: Borja Clemente <bclement@redhat.com> * Apply review feedback Signed-off-by: Borja Clemente <bclement@redhat.com> * Add CRD RBAC to the awsmachine controller Signed-off-by: Borja Clemente <bclement@redhat.com> * e2e: add v1beta1 CAPI scheme to clients and adjust modifyFunc test to use the new field name * Fix linting issues Signed-off-by: Borja Clemente <bclement@redhat.com> * Fix nodeDrainTimeoutSeconds field in clusterclass test Signed-off-by: Borja Clemente <bclement@redhat.com> * e2e: fix contract for CAPI * fix path again * e2e: fix contract for capa 9.99.99 (#3) * e2e: use correct type for setting field (#4) * rosa: deflake unit test (#5) * rosa: deflake unit test * fixup * e2e: fix config metadata and contract version pinning (#6) * e2e: fix config metadata file path Signed-off-by: Borja Clemente <bclement@redhat.com> * Bump KCP Template for clusterclass changes (#7) --------- Signed-off-by: Borja Clemente <bclement@redhat.com> Co-authored-by: Bryan Cox <brcox@redhat.com> Co-authored-by: Christian Schlotter <christi.schlotter@gmail.com> * ✨ feat: Implement autoscaling from zero by auto-populating AWSMachineTemplate capacity (kubernetes-sigs#5711) * feat: implement auto-population of AWSMachineTemplate capacity and nodeInfo Add AWSMachineTemplateReconciler to automatically populate capacity and node info fields by querying AWS EC2 API. This completes the autoscaling from zero implementation by ensuring the required metadata is available without manual configuration. Changes include: - Add NodeInfo struct with Architecture and OperatingSystem fields to AWSMachineTemplate status - Implement controller that queries EC2 API for instance type specifications - Auto-populate CPU, memory, pods, and ephemeral storage capacity - Auto-detect architecture (amd64/arm64) and OS (linux/windows) from AMI - Add conversion logic for backward compatibility with v1beta1 - Enable status subresource on AWSMachineTemplate CRD - Add comprehensive unit tests (351 lines) covering various scenarios - Add RBAC permissions for controller operations The controller automatically populates these fields when an AWSMachineTemplate is created or updated, eliminating the need for manual configuration and enabling Cluster Autoscaler to make informed scaling decisions from zero nodes. Related: https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/proposals/20210310-opt-in-autoscaling-from-zero.md Squashed from 5 commits: - 9a92a43 Implement autoscaling from zero by auto-populating AWSMachineTemplate capacity - 86fe072 add AWSMachineTemplate NodeInfo - ddaf62c Fix review comments - 4ea52c8 Fix review comments 2 - b398ffc Fix review comments 3 * feat(api): add Conditions field and update for CAPI v1.11 Add Conditions to AWSMachineTemplateStatus and update controller for CAPI v1.11 API changes. Squashed from 2 commits: - ffdf7db Fix review comments 4 - 6493363 rebase kubernetes-sigs#5720 * Remove invalid kustomizeconfig from config/webhook This change has no effect on the output of this kustomization because the removed configuration was redundant. However, it fixes a bug which can be triggered when using this kustomization as a base for another kustomization. kustomizeconfig contained 3 directives: * nameReference * namespace * varReference varReference remains required until vars are removed from this kustomization. nameReference is redundant because the specified configuration is already in kustomize's defaults. However, nameReference is the important transformation here. namespace is incorrect. It directs the namespace transformer to update webhooks/clientConfig/service/namespace. However, this is not the intended function of the namespace transformer: it should only set the namespace directly on objects and allow references to be updated automatically by nameReference. Configuring it to update a reference directly leaves kustomize with inconsistent internal state. Depending on execution order this can cause a subsequent transformation to fail to update the reference when it makes further changes to the Service object. * Only try to delete AWSMachine bootstrap data for non-machine pool machines * Fix lifecycle hooks being updated constantly, consider changes to `RoleARN` field as well * Deflake ROSA test * Bump sigs.k8s.io/cluster-api/test to release-1.11 commit for e2e fixes * fix linting error * fix(controllers): add watches to resolve AWSMachineTemplate e2e race condition Add MachineDeployment and KubeadmControlPlane watchers to trigger AWSMachineTemplate reconciliation, ensuring nodeInfo is populated before cache sync completes. Related: kubernetes-sigs#5711 * e2e: adjust templates to use AWSClusterRoleIdentities per Cluster * autoscaling: try to gather the version information from MachineSets and e2e test improvements * write_files: nil is invalid cloud-config skip this field entirely if no files are given * chore: update owners and aliases This updates the owners and aliases with the latest maintainers. It also performs housekeeping on maintainers and reviewers and removes those that haven't contributed for a while. Signed-off-by: Richard Case <richard.case@outlook.com> * metadata: prepare main for next release * docs: update releasing.md with steps post-release * Fix constant re-applying of tags if `.metadata.annotations` is nil (kubernetes-sigs#645) * fix: e2e: validate inputData during log postprocessing to avoid panic * fix: bump golangci-lint to work with go 1.24+ to v2.7.0 * test: Add test of DescribeDhcpOptions API call that returns an error * fix: Fix nil dereference when DescribeDhcpOptions call returns an error * fix: change HostAffinity default 'host'->'default', improve API doc and tests This PR updates the default value for HostAffinity from `host` to `default` as that's also the AWS platform default, and potentially a more sensible value to set if the user does not have a preference. It also improves the API's go doc comments to further explain the effects of the settings and adds a bunch more units to pinpoint the exact behaviour described in the updated doc. * ✨ feat: Support Access Entries (kubernetes-sigs#5583) * Add Access Entry support Co-authored-by: Adam Malcontenti-Wilson <amalcontenti-wilson@zendesk.com> * return early to avoid indentation * add new permissions to cloudformation template * lint fix updated access entry descriptions taken from latest AWS CDK * update access entry tests * only manage access entries created by the controller when auth mode is api or api_and_configmap, EKS will create a service-linked access entry. there may also be manual or other access entries. when reconciling access entries, only manage those originally created by this controller. * replace access entries when username changes the AWS API doesn't provide a way to nil out an existing username, so just replace the access entry whenever the username changes regardless of value. * fix access entries tests --------- Co-authored-by: Adam Malcontenti-Wilson <amalcontenti-wilson@zendesk.com> * fix(docs): add Disabling EKS Support page to the book The book now lists the Disabling EKS Support page, and the links to that page are no longer broken. * 🌱 Bump golangci/golangci-lint-action from 9.0.0 to 9.2.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.0.0 to 9.2.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@0a35821...1e7e51e) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * 🌱 Bump actions/cache from 4 to 5 Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Changed dedicated host validation logic to require tenancy = host * refactor: drop obsolete pending e2e tests Signed-off-by: arpit529srivastava <arpitsrivastava529@gmail.com> * Allow ROSA NodePool autoscaling MinReplicas to be 0 Relaxes the validation for ROSA NodePool autoscaling to allow users to specify a minimum of 0 replicas, enabling scale-to-zero scenarios. MaxReplicas remains with a minimum of 1. Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> * Add logForward config AND imageTypes Signed-off-by: serngawy <serngawy@gmail.com> * Fix flaky test TestROSARoleConfigReconcileExist Signed-off-by: serngawy <serngawy@gmail.com> * webhook server: use tlsconfig from the manager options the webhook server should use the tlsconfig specified in the manager options, so users setting tls fields in the manager see their preference honoured not only for the metrics server but also for the webhook server. * test: enable clusterctl upgrade test Signed-off-by: arpit529srivastava <arpitsrivastava529@gmail.com> * fix: Enable GPU-enabled cluster e2e test Signed-off-by: arpit529srivastava <arpitsrivastava529@gmail.com> * chore: bump image-builder * 🌱 Bump aws-actions/configure-aws-credentials from 5 to 6 Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 5 to 6. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@v5...v6) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * feat: adds nodeadm type * e2e: increase eks parallelsim to 2 for e2e tests * e2e: adds flavor and e2e test for nodeadm clusterclass * docs: adds documentation about nodeadm * feat: rebase to v1.11 cluster api core * fix: addresses review comment * fix: set nodeadm status apis to be v1beta2 compatible This also addresses minor review comments --------- Signed-off-by: serngawy <serngawy@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Fangge Jin <fjin@redhat.com> Signed-off-by: Borja Clemente <bclement@redhat.com> Signed-off-by: Richard Case <richard.case@outlook.com> Signed-off-by: arpit529srivastava <arpitsrivastava529@gmail.com> Co-authored-by: Mohamed ElSerngawy <serngawy@gmail.com> Co-authored-by: rknaur <rknaur@redhat.com> Co-authored-by: Milan Zázrivec <mzazrivec@redhat.com> Co-authored-by: Damiano Donati <damiano.donati@gmail.com> Co-authored-by: Josh French <joshfrench@gmail.com> Co-authored-by: Adam Malcontenti-Wilson <amalcontenti-wilson@zendesk.com> Co-authored-by: Thuan Vo <thvo@redhat.com> Co-authored-by: Daniel Lipovetsky <daniel.lipovetsky@gmail.com> Co-authored-by: Hung Tran <40334379+phuhung273@users.noreply.github.com> Co-authored-by: Andrea Decorte <adecorte@redhat.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Andreas Sommer <andreas.sommer87@googlemail.com> Co-authored-by: Fangge Jin <fjin@redhat.com> Co-authored-by: Richard Vanderpool <49568690+rvanderp3@users.noreply.github.com> Co-authored-by: Andreas Sommer <andreas@giantswarm.io> Co-authored-by: Josh French <josh.french@posit.co> Co-authored-by: Christian Schlotter <christi.schlotter@gmail.com> Co-authored-by: Arnaud Farbos <afarbos@nvidia.com> Co-authored-by: Borja Clemente <clebs@users.noreply.github.com> Co-authored-by: Bryan Cox <brcox@redhat.com> Co-authored-by: Liangquan Li <liangli@redhat.com> Co-authored-by: Matthew Booth <mbooth@redhat.com> Co-authored-by: Richard Case <richard.case@outlook.com> Co-authored-by: Daniel Lipovetsky <daniel.lipovetsky@nutanix.com> Co-authored-by: vitorfloriano <107767584+vitorfloriano@users.noreply.github.com> Co-authored-by: vr4manta <vr4manta@gmail.com> Co-authored-by: arpit529srivastava <arpitsrivastava529@gmail.com> Co-authored-by: Jesse Jaggars <jjaggars@redhat.com> Co-authored-by: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. labels Sep 15, 2025

k8s-ci-robot requested review from Ankitasw and dlipovetsky September 15, 2025 19:20

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-priority size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 15, 2025

serngawy mentioned this pull request Sep 15, 2025

✨ Rosa Config implementaiton #5499

Closed

4 tasks

serngawy force-pushed the rosa-roles-implementations branch 3 times, most recently from d9ab817 to ae8dbe6 Compare September 16, 2025 12:59

PanSpagetka approved these changes Sep 16, 2025

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 18, 2025

serngawy force-pushed the rosa-roles-implementations branch from ae8dbe6 to 1fa491b Compare September 18, 2025 18:02

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 18, 2025

serngawy force-pushed the rosa-roles-implementations branch 2 times, most recently from bf7d5c6 to 4ae9bc3 Compare September 18, 2025 18:17

k8s-ci-robot assigned damdo, nrb and richardcase Sep 22, 2025

damdo reviewed Sep 23, 2025

View reviewed changes

serngawy force-pushed the rosa-roles-implementations branch 2 times, most recently from 63d8809 to 658a1d2 Compare September 23, 2025 21:25

PanSpagetka added 5 commits September 23, 2025 17:25

Add RosaRoleConfig API and CRD.

11f26ed

Enable partial reconcile of Rosa Operator Roles

d187bc0

Review fixes

38d8117

Add integration tests

8b720d1

Add more tests

34546fb

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Sep 25, 2025

damdo reviewed Sep 25, 2025

View reviewed changes

serngawy force-pushed the rosa-roles-implementations branch from 658a1d2 to c1c0047 Compare September 25, 2025 18:14

Fix comments

c1c0047

Signed-off-by: serngawy <serngawy@gmail.com>

damdo reviewed Sep 25, 2025

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 25, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 30, 2025

k8s-ci-robot merged commit 8607e3a into kubernetes-sigs:main Sep 30, 2025
18 checks passed

serngawy mentioned this pull request Oct 6, 2025

[release-2.9] ✨ Rosa roles config implementations #5692

Closed

5 tasks

k8s-infra-cherrypick-robot mentioned this pull request Oct 7, 2025

[release-2.9] ✨ Rosa roles config implementations #5696

Closed

serngawy mentioned this pull request Oct 7, 2025

[release-2.9] ✨ Rosa roles config implementations #5697

Merged

5 tasks

serngawy deleted the rosa-roles-implementations branch November 28, 2025 15:52

		// UnManaged OIDC Provider type
		UnManaged OidcProviderType = "UnManaged"

Uh oh!

Conversation

serngawy commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PanSpagetka left a comment

Choose a reason for hiding this comment

Uh oh!

serngawy commented Sep 18, 2025

Uh oh!

damdo commented Sep 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

damdo commented Sep 25, 2025

Uh oh!

damdo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

serngawy commented Sep 25, 2025

Uh oh!

damdo left a comment

Choose a reason for hiding this comment

Uh oh!

damdo left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

richardcase commented Sep 30, 2025

Uh oh!

k8s-ci-robot commented Sep 30, 2025

Uh oh!

Uh oh!

serngawy commented Oct 6, 2025

Uh oh!

k8s-infra-cherrypick-robot commented Oct 6, 2025

Uh oh!

serngawy commented Oct 7, 2025

Uh oh!

k8s-infra-cherrypick-robot commented Oct 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

serngawy commented Sep 15, 2025 •

edited

Loading