[WIP] OCPCLOUD-3557: split capi-controllers and machine-api-migration - #622
[WIP] OCPCLOUD-3557: split capi-controllers and machine-api-migration#622stefanonardo wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
@stefanonardo: This pull request references OCPCLOUD-3557 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe change separates ChangesMachine API migration workload split
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant machine-api-migration
participant machine-api-migration-metrics
participant ServiceMonitor
machine-api-migration->>machine-api-migration-metrics: Expose HTTPS metrics on port 8443
ServiceMonitor->>machine-api-migration-metrics: Select migration metrics service
ServiceMonitor->>machine-api-migration: Scrape metrics using TLS configuration
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/test e2e-aws-capi-techpreview |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/rbac.md`:
- Around line 41-43: The RBAC summary for the `machine-api-migration` Role in
`openshift-cluster-api` is mislabeled as “(read)” even though the manifest
grants both read and write verbs. Update the description in `docs/rbac.md` to
reflect the actual permissions from
`0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml`, using the
`machine-api-migration` Role entry and its Machine/MachineSet permissions as the
reference point.
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`:
- Around line 26-69: The machine-api-migration Deployment container spec is
missing required hardening and health settings. Update the machine-api-migration
pod/container spec to add an explicit securityContext with
readOnlyRootFilesystem, allowPrivilegeEscalation disabled, and capabilities
dropping all, and set automountServiceAccountToken to false if the controller
does not need the token. Also add resource limits alongside the existing
requests, and define livenessProbe and readinessProbe for the healthz endpoint
exposed by the machine-api-migration container on port 9440.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: af553a64-1e21-4c5f-92f4-9de4822110af
📒 Files selected for processing (12)
docs/rbac.mdmanifests/0000_30_cluster-api_02_machine-api-migration-service-account.yamlmanifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yamlmanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yamlmanifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yamlmanifests/0000_30_cluster-api_10_metrics-service.yamlmanifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yamlmanifests/0000_30_cluster-api_17_deployment.yamlmanifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml
💤 Files with no reviewable changes (1)
- manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml
| spec: | ||
| serviceAccountName: machine-api-migration | ||
| containers: | ||
| - name: machine-api-migration | ||
| image: registry.ci.openshift.org/openshift:cluster-capi-operator | ||
| command: | ||
| - /machine-api-migration | ||
| args: | ||
| - --diagnostics-address=:8443 | ||
| env: | ||
| - name: RELEASE_VERSION | ||
| value: "0.0.1-snapshot" | ||
| ports: | ||
| - containerPort: 8443 | ||
| name: diagnostics | ||
| protocol: TCP | ||
| - containerPort: 9440 | ||
| name: healthz | ||
| protocol: TCP | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| memory: 50Mi | ||
| terminationMessagePolicy: FallbackToLogsOnError | ||
| volumeMounts: | ||
| - name: metrics-cert | ||
| mountPath: /tmp/k8s-metrics-server/serving-certs | ||
| readOnly: true | ||
| nodeSelector: | ||
| node-role.kubernetes.io/control-plane: "" | ||
| priorityClassName: system-cluster-critical | ||
| restartPolicy: Always | ||
| tolerations: | ||
| - key: "node-role.kubernetes.io/master" | ||
| operator: "Exists" | ||
| effect: "NoSchedule" | ||
| - key: "node-role.kubernetes.io/control-plane" | ||
| operator: "Exists" | ||
| effect: "NoSchedule" | ||
| volumes: | ||
| - name: metrics-cert | ||
| secret: | ||
| defaultMode: 420 | ||
| secretName: machine-api-migration-metrics-tls |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Add explicit securityContext, resource limits, and probes to the container spec.
This new Deployment lacks:
- Pod/container
securityContext(readOnlyRootFilesystem: true,allowPrivilegeEscalation: false,capabilities.drop: ["ALL"]). Noterestricted-v2SCC (referenced via theopenshift.io/required-scc: restricted-v2annotation) already drops all capabilities and disallows privilege escalation by default, but it does not enforcereadOnlyRootFilesystem, so this must be set explicitly. resources.limits(onlyrequestsare set).livenessProbe/readinessProbe, despite exposing ahealthzport on 9440.automountServiceAccountToken: false(unless the controller genuinely needs the projected SA token via the pod itself rather than client libraries).
Static analysis flags the missing root-fs/security-context settings (Checkov CKV_K8S_20/CKV_K8S_23, Trivy KSV-0014/KSV-0118).
As per path instructions: "securityContext: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false", "Drop ALL capabilities, add only what is required", "Resource limits (cpu, memory) on every container", "Liveness + readiness probes defined", "automountServiceAccountToken: false unless needed".
🛡️ Proposed fix
spec:
serviceAccountName: machine-api-migration
+ automountServiceAccountToken: false
containers:
- name: machine-api-migration
image: registry.ci.openshift.org/openshift:cluster-capi-operator
command:
- /machine-api-migration
args:
- --diagnostics-address=:8443
env:
- name: RELEASE_VERSION
value: "0.0.1-snapshot"
ports:
- containerPort: 8443
name: diagnostics
protocol: TCP
- containerPort: 9440
name: healthz
protocol: TCP
resources:
requests:
cpu: 10m
memory: 50Mi
+ limits:
+ cpu: 100m
+ memory: 100Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ capabilities:
+ drop:
+ - ALL
+ livenessProbe:
+ httpGet:
+ path: /healthz
+ port: healthz
+ readinessProbe:
+ httpGet:
+ path: /readyz
+ port: healthz
terminationMessagePolicy: FallbackToLogsOnError🧰 Tools
🪛 Checkov (3.3.2)
[medium] 2-69: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 2-69: Minimize the admission of root containers
(CKV_K8S_23)
🪛 Trivy (0.69.3)
[error] 29-53: Root file system is not read-only
Container 'machine-api-migration' of Deployment 'machine-api-migration' should set 'securityContext.readOnlyRootFilesystem' to true
Rule: KSV-0014
(IaC/Kubernetes)
[error] 29-53: Default security context configured
container machine-api-migration in openshift-cluster-api namespace is using the default security context
Rule: KSV-0118
(IaC/Kubernetes)
[error] 26-69: Default security context configured
deployment machine-api-migration in openshift-cluster-api namespace is using the default security context, which allows root privileges
Rule: KSV-0118
(IaC/Kubernetes)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`
around lines 26 - 69, The machine-api-migration Deployment container spec is
missing required hardening and health settings. Update the machine-api-migration
pod/container spec to add an explicit securityContext with
readOnlyRootFilesystem, allowPrivilegeEscalation disabled, and capabilities
dropping all, and set automountServiceAccountToken to false if the controller
does not need the token. Also add resource limits alongside the existing
requests, and define livenessProbe and readinessProbe for the healthz endpoint
exposed by the machine-api-migration container on port 9440.
Sources: Path instructions, Linters/SAST tools
|
/retest |
|
@stefanonardo: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Separate the two binaries into independent Deployments with dedicated ServiceAccounts and least-privilege RBAC. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml (1)
12-20: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winRemove the ineffective
targetPortmapping for this headless Service.With
clusterIP: None, Kubernetes ignorestargetPort; the Service port must already match the pod’s listening port. Keep the migration listener on8443and omittargetPort, or use a non-headless Service if named port remapping is required. (kubernetes.io)Suggested cleanup
- name: machine-api-migration-metrics port: 8443 - targetPort: diagnostics🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml` around lines 12 - 20, Update the Service definition for machine-api-migration-metrics by removing the targetPort mapping while retaining port 8443 and clusterIP: None, so the headless Service uses the pod’s listening port directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`:
- Around line 54-55: Remove the control-plane nodeSelector entry from the
Deployment manifest, leaving only topology-neutral scheduling rules so the
workload can schedule on HyperShift.
In `@ocp-manifests-input/default/capi-controllers-deployment.yaml`:
- Around line 39-42: Update the generated capi-operator manifests.yaml to
replace the outdated diagnostics-o and healthz-o port references with the
renamed diagnostics and healthz names, matching the source deployment manifest
while preserving the existing port configuration.
---
Nitpick comments:
In `@manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml`:
- Around line 12-20: Update the Service definition for
machine-api-migration-metrics by removing the targetPort mapping while retaining
port 8443 and clusterIP: None, so the headless Service uses the pod’s listening
port directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 128a92f8-b856-4904-bd2c-21119a1479de
📒 Files selected for processing (12)
docs/rbac.mdmanifests/0000_30_cluster-api_02_machine-api-migration-service-account.yamlmanifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yamlmanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yamlmanifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yamlmanifests/0000_30_cluster-api_10_metrics-service.yamlmanifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yamlmanifests/0000_30_cluster-api_17_machine-api-migration-deployment.yamlocp-manifests-input/default/capi-controllers-deployment.yaml
🚧 Files skipped from review as they are similar to previous changes (8)
- manifests/0000_30_cluster-api_02_machine-api-migration-service-account.yaml
- manifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yaml
- manifests/0000_30_cluster-api_10_metrics-service.yaml
- manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml
- manifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yaml
- docs/rbac.md
- manifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml
- manifests/0000_30_cluster-api_03_rbac_roles.yaml
| nodeSelector: | ||
| node-role.kubernetes.io/control-plane: "" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Remove the control-plane node selector.
This hard requirement prevents the Deployment from scheduling on HyperShift, where these nodes are not available to this workload. Keep only topology-neutral scheduling rules unless this manifest is conditionally excluded for HyperShift.
Proposed fix
- nodeSelector:
- node-role.kubernetes.io/control-plane: ""As per coding guidelines: “nodeSelector/affinity targeting control-plane nodes (breaks on HyperShift).”
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| nodeSelector: | |
| node-role.kubernetes.io/control-plane: "" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`
around lines 54 - 55, Remove the control-plane nodeSelector entry from the
Deployment manifest, leaving only topology-neutral scheduling rules so the
workload can schedule on HyperShift.
Source: Coding guidelines
| name: diagnostics | ||
| protocol: TCP | ||
| - containerPort: 9440 | ||
| name: healthz-o | ||
| name: healthz |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
rg -n 'diagnostics-o|healthz-o|targetPort: (diagnostics|healthz)|port: (diagnostics|healthz)' .Repository: openshift/cluster-capi-operator
Length of output: 1564
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target file context =="
nl -ba ocp-manifests-input/default/capi-controllers-deployment.yaml | sed -n '30,50p'
echo
echo "== stale port-name references =="
rg -n 'diagnostics-o|healthz-o' \
capi-operator-manifests/default/manifests.yaml \
manifests \
ocp-manifests-input \
pkg \
--glob '!**/*.sum' || true
echo
echo "== nearby context in generated manifest =="
nl -ba capi-operator-manifests/default/manifests.yaml | sed -n '980,995p'Repository: openshift/cluster-capi-operator
Length of output: 235
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== exact consumer references to renamed ports =="
rg -n 'targetPort: (diagnostics|healthz)|port: (diagnostics|healthz)|diagnostics-o|healthz-o' . \
--glob '!**/node_modules/**' \
--glob '!**/dist/**' \
--glob '!**/build/**'Repository: openshift/cluster-capi-operator
Length of output: 1613
Update the generated manifest capi-operator-manifests/default/manifests.yaml still references diagnostics-o/healthz-o; regenerate or patch it to match the renamed ports.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ocp-manifests-input/default/capi-controllers-deployment.yaml` around lines 39
- 42, Update the generated capi-operator manifests.yaml to replace the outdated
diagnostics-o and healthz-o port references with the renamed diagnostics and
healthz names, matching the source deployment manifest while preserving the
existing port configuration.
2 participants
Summary
capi-controllersDeployment (two containers sharing one SA) into two independent Deployments with dedicated ServiceAccounts and least-privilege RBAC:8443(matching all other binaries)Test plan
make buildpassesmake lintpasses (0 issues)make unitpasses (pre-existing crdcompatibility failures excluded)audit2rbacon CI job audit logs to confirm zero 403s for both SAs🤖 Generated with Claude Code
Summary by CodeRabbit