✨ feat: add support for OCM role creation by andclt · Pull Request #6055 · kubernetes-sigs/cluster-api-provider-aws

andclt · 2026-06-16T17:42:55Z

What type of PR is this?
/kind feature

What this PR does / why we need it:

This PR adds support for managing OCM roles in AWS through a new ROSAOCMRoleConfig controller. This controller automates the creation, validation, and lifecycle management of OCM roles required for ROSA cluster operations.

Key additions:

New ROSAOCMRoleConfig CRD with validation rules (role prefix patterns, profile immutability, max lengths)
Controller that reconciles OCM role resources and links them to OCM organizations
Support for multiple role profiles (Admin, Standard, NoConsole)
Self-healing capabilities for role tags and policies

The core GetOrCreateOCMRole logic and related helper methods are adapted from the ROSA CLI (openshift/rosa#3262). We could not update the ROSA dependency directly due to Go directive version incompatibility between ROSA and CAPA, so the logic was ported and adapted to work within CAPA's architecture.

Manual Testing:
Comprehensive manual testing was performed against real AWS and OCM infrastructure.

Test Environment:

Kind cluster v1.35.0 (capa-test)
CAPA controller built with Go 1.24 and ROSA feature gate enabled

tests:

Standard & Admin profile creation with OCM linking
Idempotency (role reuse across multiple ROSAOCMRoleConfigs)
Self-healing (auto-restoration of missing admin tags)
Permissions boundary attachment validation
Custom IAM path support
Field immutability enforcement (profile, rolePrefix)
Singleton constraint (one OCM role per AWS account)
Auto-reconciliation with exponential backoff
Deletion flow with proper OCM unlink → AWS role delete sequence
Deletion flow with deletePolicy=Retain
Credential secret validation and error handling

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):

Fixes
https://redhat.atlassian.net/browse/ROSAENG-8292

Special notes for your reviewer:

The GetOrCreateOCMRole implementation is adapted from ROSA CLI PR #3262 rather than using the ROSA dependency directly due to Go version incompatibility. The logic has been adapted to fit CAPA's controller pattern and error handling conventions.

AI Usage:

Claude code was used for test infrastructure refactoring and boilerplate elimination in test files.

Checklist:

Release note:

Add ROSAOCMRoleConfig controller for automated OCM role management in AWS, supporting Admin, Standard, and NoConsole role profiles.

k8s-ci-robot · 2026-06-16T17:43:05Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign fabriziopandini for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-06-16T17:43:06Z

Hi @andclt. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

andclt · 2026-06-16T17:47:08Z

/ok-to-test

k8s-ci-robot · 2026-06-16T17:47:24Z

@andclt: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

serngawy

few comments

serngawy · 2026-06-16T21:24:52Z

/ok-to-test

andclt · 2026-06-17T07:20:51Z

+				//nolint:staticcheck // SA1019: MachinePhaseFailed is deprecated but still needed for v1beta1 compatibility
+				statusChecks := []framework.MachineStatusCheck{framework.MachinePhaseCheck(string(clusterv1.MachinePhaseFailed))}


unrelated to our changes but make lint was failing

andclt · 2026-06-17T16:47:19Z

/retest

andclt · 2026-06-24T10:09:52Z

/retest

andclt · 2026-06-29T16:50:07Z

Looks good in general, just few small comments but most important is we need to test the rosaocmrole creation with aws cross account creation. As we discussed, users will have 4-5 aws accounts to work with. Most likely using AWSClusterRoleIdentity with IAM role arn setup to authorize capa with different aws accounts. Below is doc for how to setup CAPA with IAM roles and cross account creation, let me know if you need help. https://github.com/stolostron/cluster-api-installer/blob/main/doc/Enable_iam_roles_capa.md

https://github.com/stolostron/cluster-api-installer/blob/main/doc/multi-account-rosa-hcp.md

tested and the identityPermission field was introduced to allow cross role account creation

serngawy

looks good, I have comment to clarify self healing

serngawy

looks good to me

nrb

/lgtm
/approve

kubernetes-prow · 2026-07-08T18:56:20Z

LGTM label has been added.

Details

Git tree hash: d6ec9ce18abebb5034e3737e2c7f2bbd68651951

kubernetes-prow · 2026-07-08T18:56:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nrb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [nrb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

serngawy · 2026-07-09T14:02:51Z

/cherry-pick release-2.11

k8s-infra-cherrypick-robot · 2026-07-09T14:03:30Z

@serngawy: new pull request created: #6117

Details

In response to this:

/cherry-pick release-2.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot requested a review from damdo June 16, 2026 17:43

k8s-ci-robot requested a review from serngawy June 16, 2026 17:43

andclt force-pushed the ocm-role-deps branch from c6420a9 to 2da7aa3 Compare June 16, 2026 17:43

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jun 16, 2026

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jun 16, 2026

andclt mentioned this pull request Jun 16, 2026

feat: add support for OCM role creation #6046

Closed

6 tasks

andclt marked this pull request as ready for review June 16, 2026 17:46

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 16, 2026

k8s-ci-robot requested a review from nrb June 16, 2026 17:46

serngawy reviewed Jun 16, 2026

View reviewed changes

Comment thread pkg/rosa/awshelpers/constants.go Outdated

Comment thread exp/controllers/rosaocmroleconfig_controller.go

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 16, 2026

andclt force-pushed the ocm-role-deps branch from 2da7aa3 to a31bff3 Compare June 17, 2026 07:20

andclt commented Jun 17, 2026

View reviewed changes

andclt force-pushed the ocm-role-deps branch from a31bff3 to 404b0a8 Compare June 17, 2026 16:35

andclt force-pushed the ocm-role-deps branch 2 times, most recently from 2c15e75 to 69e626d Compare June 17, 2026 17:56

robpblake reviewed Jun 18, 2026

View reviewed changes

Comment thread exp/api/v1beta2/rosaocmroleconfig_types.go Outdated

andclt force-pushed the ocm-role-deps branch 2 times, most recently from 03cde2c to dd36e95 Compare June 24, 2026 10:04

andclt force-pushed the ocm-role-deps branch 3 times, most recently from 6c12c5c to 715f05a Compare June 26, 2026 17:14

serngawy reviewed Jun 29, 2026

View reviewed changes

Comment thread exp/api/v1beta2/types.go Outdated

Comment thread exp/controllers/rosaocmroleconfig_controller.go

andclt force-pushed the ocm-role-deps branch from 715f05a to 64d6554 Compare June 30, 2026 07:02

andclt requested a review from serngawy June 30, 2026 07:06

andclt force-pushed the ocm-role-deps branch 3 times, most recently from a6dcf9c to d5b8372 Compare July 1, 2026 15:36

serngawy reviewed Jul 2, 2026

View reviewed changes

Comment thread exp/controllers/rosaocmroleconfig_controller.go Outdated

andclt requested a review from serngawy July 2, 2026 17:32

feat: add support for OCM role creation

af101a6

andclt force-pushed the ocm-role-deps branch from 378d7a9 to af101a6 Compare July 3, 2026 16:55

andclt mentioned this pull request Jul 7, 2026

ROSAENG-61403 | refactor: remove unused OCM-role API openshift/rosa#3337

Merged

23 tasks

serngawy approved these changes Jul 7, 2026

View reviewed changes

nrb approved these changes Jul 8, 2026

View reviewed changes

kubernetes-prow Bot assigned nrb Jul 8, 2026

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 8, 2026

kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 8, 2026

kubernetes-prow Bot merged commit 667a7ef into kubernetes-sigs:main Jul 8, 2026
18 checks passed

andclt deleted the ocm-role-deps branch July 8, 2026 22:28

k8s-infra-cherrypick-robot mentioned this pull request Jul 9, 2026

[release-2.11] ✨ feat: add support for OCM role creation #6117

Merged

		//nolint:staticcheck // SA1019: MachinePhaseFailed is deprecated but still needed for v1beta1 compatibility
		statusChecks := []framework.MachineStatusCheck{framework.MachinePhaseCheck(string(clusterv1.MachinePhaseFailed))}

Uh oh!

Conversation

andclt commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jun 16, 2026

Uh oh!

k8s-ci-robot commented Jun 16, 2026

Uh oh!

andclt commented Jun 16, 2026

Uh oh!

k8s-ci-robot commented Jun 16, 2026

Uh oh!

serngawy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

serngawy commented Jun 16, 2026

Uh oh!

andclt Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

andclt commented Jun 17, 2026

Uh oh!

Uh oh!

andclt commented Jun 24, 2026

Uh oh!

Uh oh!

Uh oh!

andclt commented Jun 29, 2026

Uh oh!

serngawy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

serngawy left a comment

Choose a reason for hiding this comment

Uh oh!

nrb left a comment

Choose a reason for hiding this comment

Uh oh!

kubernetes-prow Bot commented Jul 8, 2026

Uh oh!

kubernetes-prow Bot commented Jul 8, 2026

Uh oh!

Uh oh!

serngawy commented Jul 9, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

andclt commented Jun 16, 2026 •

edited

Loading