Skip to content

runtime transformers - #629

Draft
mdbooth wants to merge 12 commits into
openshift:mainfrom
openshift-cloud-team:runtime-transformers
Draft

runtime transformers#629
mdbooth wants to merge 12 commits into
openshift:mainfrom
openshift-cloud-team:runtime-transformers

Conversation

@mdbooth

@mdbooth mdbooth commented Jul 20, 2026

Copy link
Copy Markdown
Contributor
  • toBoxcutterRevision returns pre-computed Revision
  • Integrate RuntimeTransformers into phase creation
  • Validate RuntimeTransformers during Revision creation
  • Convert adopt-existing to use a RuntimeTransformer
  • RuntimeTransformer can take context from Revision/Component
  • Move hardcoded EXP_BOOTSTRAP_FORMAT_IGNITION to manifest substitutions
  • Move envsubst to RuntimeTransformer
  • Rename Rendered(Revision|Component) to Parsed(Revision|Component)
  • Move TLS substitution variables out of the Revision

Summary by CodeRabbit

  • New Features

    • Added install-time transformation support for environment substitutions, managed-by labeling, and adoption of existing resources.
    • TLS settings are now derived and applied consistently during both installation and revision processing.
    • Revision generation now preserves parsed resources and manifest substitutions to improve installation tracking.
  • Bug Fixes

    • Transformation validation failures now surface as clear, non-retryable status errors.
    • Installation/teardown now consistently report transformation failures (including aggregated object-level errors).
    • Adoption behavior is applied safely according to the configured policy.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 20, 2026
@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stephenfin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown

Walkthrough

The revision generator now produces parsed revisions with stored manifest substitutions. Runtime transformers handle envsubst expansion, managed-by labels, and adopt-existing behavior across revision validation and installer phase construction.

Changes

Parsed revision model

Layer / File(s) Summary
Parsed revision model and content identity
pkg/revisiongenerator/revision.go, pkg/revisiongenerator/revision_test.go, pkg/revisiongenerator/helpers_test.go, pkg/controllers/installer/helpers_test.go
ParsedRevision stores parsed objects and substitutions, includes CRDs in component objects, and computes content IDs from parsed objects and normalized substitutions.

Runtime transformation and controller integration

Layer / File(s) Summary
Runtime transformer contracts and implementations
pkg/runtimetransformer/*, pkg/revisiongenerator/validate.go
Adds transformer interfaces, aggregated validation, envsubst expansion, managed-by labeling, and adopt-existing annotation processing with tests.
Controller transformer wiring
cmd/capi-installer/main.go, pkg/controllers/revision/*, pkg/controllers/installer/installer_controller.go, pkg/controllers/installer/suite_test.go
Builds and shares the TLS-aware transformer pipeline, validates generated revisions, and tracks runtime-managed objects.
Boxcutter transformation and reconciliation
pkg/controllers/installer/boxcutter.go, pkg/controllers/installer/boxcutter_test.go, pkg/controllers/installer/revision_reconciler.go
Applies ordered transformers while constructing phases, combines reconcile options, aggregates errors, and handles construction failures during reconcile and teardown.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OperatorConfig
  participant RevisionController
  participant RuntimeTransformers
  participant InstallerController
  participant Boxcutter
  OperatorConfig->>RevisionController: provide transformer pipeline
  RevisionController->>RuntimeTransformers: validate parsed revision objects
  OperatorConfig->>InstallerController: provide transformer pipeline
  InstallerController->>Boxcutter: construct transformed phases
  Boxcutter->>RuntimeTransformers: apply object transformers
  RuntimeTransformers->>Boxcutter: return object changes and reconcile options
  Boxcutter->>InstallerController: reconcile transformed phases
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 11 | ❌ 4

❌ Failed checks (3 warnings, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 40.54% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality ⚠️ Warning Changed Ginkgo cleanup waits (Eventually(mgrDone).Should(BeClosed()), Eventually(m.done).Should(BeClosed())) have no explicit timeout, so a stuck manager can hang the suite. Add explicit timeouts (or suite-wide defaults) for shutdown waits, and add failure messages to new bare Expect/Eventually assertions where helpful.
Microshift Test Compatibility ⚠️ Warning The new Ginkgo controller tests in pkg/controllers/revision/revision_controller_test.go use config.openshift.io/operator.openshift.io types without any MicroShift skip or apigroup tag. Add a [Skipped:MicroShift] or [apigroup:...] tag, or guard the suite with exutil.IsMicroShiftCluster() before using OpenShift APIs.
Title check ❓ Inconclusive The title is related to the change but too generic to convey the main update or scope. Use a more specific title such as "Add runtime transformer support for revision and installer controllers".
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed All added Ginkgo titles are static literals; no dynamic names, timestamps, UUIDs, nodes, namespaces, or interpolated values appear in the changed test files.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The added Ginkgo specs are envtest controller tests that only exercise ConfigMap/annotation drift; no node, topology, drain, or HA assumptions were found.
Topology-Aware Scheduling Compatibility ✅ Passed HEAD diff only adds tests; the modified controller code adds runtime transformers but no nodeSelector, affinity, tolerations, replica, or PDB scheduling logic.
Ote Binary Stdout Contract ✅ Passed No process-level stdout writes found; main uses structured logging, suite logger writes to GinkgoWriter, and InitOperatorConfig routes klog to stderr.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS: The new Ginkgo tests are envtest/unit-style; no IPv4 literals, IP parsing, URL host building, or external connectivity were added. Public image refs are fixture data.
No-Weak-Crypto ✅ Passed No weak crypto or secret comparisons were added; changed files only use sha256 and TLS config serialization, with no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB.
Container-Privileges ✅ Passed PR is Go-only; project manifest searches found no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed The PR adds no new logs of secrets; touched logs are metadata-only, and runtime-transformer code has no sensitive-value logging.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
pkg/controllers/revision/helpers_test.go (1)

206-209: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Stale RenderedRevision references in doc comments. The RenderedRevision type was replaced by ParsedRevision; the rename wasn't propagated to these comments.

  • pkg/controllers/revision/helpers_test.go#L206-L209: update to "fakeRevision implements revisiongenerator.ParsedRevision for unit tests."
  • pkg/revisiongenerator/helpers_test.go#L57-L58: update the forInstall comment to say "from a ParsedRevision".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controllers/revision/helpers_test.go` around lines 206 - 209, Update the
stale documentation references to the renamed ParsedRevision type: in
pkg/controllers/revision/helpers_test.go lines 206-209, change the fakeRevision
comment to identify revisiongenerator.ParsedRevision; in
pkg/revisiongenerator/helpers_test.go lines 57-58, update the forInstall comment
to say it operates from a ParsedRevision. No code behavior changes are needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/controllers/installer/revision_reconciler.go`:
- Around line 366-370: Update the error return in the toBoxcutterRevision
failure path within the revision teardown reconciliation flow to wrap err with
reconcile.TerminalError(...). Keep complete=true and the existing empty message
unchanged, ensuring this deterministic construction failure is treated as
terminal rather than retryable.

In `@pkg/runtimetransformer/envsubst_transformer.go`:
- Around line 54-65: Update EnvsubstTransformer.WithRevision to ensure the map
returned by revision.ManifestSubstitutions() is initialized before maps.Copy
writes staticSubs into it. Preserve the existing precedence and returned
staticSubs/mergedSubs behavior for both nil and non-nil revision substitutions.

---

Nitpick comments:
In `@pkg/controllers/revision/helpers_test.go`:
- Around line 206-209: Update the stale documentation references to the renamed
ParsedRevision type: in pkg/controllers/revision/helpers_test.go lines 206-209,
change the fakeRevision comment to identify revisiongenerator.ParsedRevision; in
pkg/revisiongenerator/helpers_test.go lines 57-58, update the forInstall comment
to say it operates from a ParsedRevision. No code behavior changes are needed.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d74a5a62-0e25-41c0-b063-8ccbe760058c

📥 Commits

Reviewing files that changed from the base of the PR and between f01957c and fe23908.

📒 Files selected for processing (26)
  • cmd/capi-installer/main.go
  • pkg/controllers/installer/boxcutter.go
  • pkg/controllers/installer/boxcutter_test.go
  • pkg/controllers/installer/helpers_test.go
  • pkg/controllers/installer/installer_controller.go
  • pkg/controllers/installer/revision_reconciler.go
  • pkg/controllers/installer/suite_test.go
  • pkg/controllers/revision/helpers_test.go
  • pkg/controllers/revision/revision_controller.go
  • pkg/controllers/revision/revision_controller_test.go
  • pkg/revisiongenerator/helpers_test.go
  • pkg/revisiongenerator/revision.go
  • pkg/revisiongenerator/revision_test.go
  • pkg/revisiongenerator/transform.go
  • pkg/revisiongenerator/transform_test.go
  • pkg/revisiongenerator/validate.go
  • pkg/revisiongenerator/validate_test.go
  • pkg/runtimetransformer/adopt_existing_transformer.go
  • pkg/runtimetransformer/adopt_existing_transformer_test.go
  • pkg/runtimetransformer/envsubst_transformer.go
  • pkg/runtimetransformer/envsubst_transformer_test.go
  • pkg/runtimetransformer/managed_by_transformer.go
  • pkg/runtimetransformer/managed_by_transformer_test.go
  • pkg/runtimetransformer/runtime_transformer.go
  • pkg/runtimetransformer/validate.go
  • pkg/runtimetransformer/validate_test.go
💤 Files with no reviewable changes (3)
  • pkg/revisiongenerator/transform_test.go
  • pkg/revisiongenerator/validate_test.go
  • pkg/revisiongenerator/transform.go

Comment on lines +366 to +370
bcRevision, err := toBoxcutterRevision(ctx, revision, r.transformers)
if err != nil {
// Cannot tear down a revision that cannot be constructed — treat as complete.
return true, "", err
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -nP 'teardownRevision\(' pkg/controllers/installer -C4

Repository: openshift/cluster-capi-operator

Length of output: 1610


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '330,430p' pkg/controllers/installer/revision_reconciler.go
printf '\n---\n'
rg -n 'mergeWithTail|teardownRevisions|teardownRevision\(' pkg/controllers/installer -n -C3

Repository: openshift/cluster-capi-operator

Length of output: 7024


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '440,520p' pkg/controllers/installer/revision_reconciler.go
printf '\n---\n'
sed -n '140,210p' pkg/controllers/installer/revision_reconciler.go

Repository: openshift/cluster-capi-operator

Length of output: 5734


🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n 'TerminalError|IsTerminal|errors\.As|errors\.Is|[]error|[]string|requeue|Retry' pkg/controllers/installer/revision_reconciler.go pkg/controllers/installer -C3

Repository: openshift/cluster-capi-operator

Length of output: 364


🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n 'TerminalError|IsTerminal|errors\.As|errors\.Is|requeue|Retry|terminal' pkg/controllers/installer -C3

Repository: openshift/cluster-capi-operator

Length of output: 24083


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,140p' pkg/controllers/installer/installer_controller.go
printf '\n---\n'
sed -n '140,240p' pkg/controllers/installer/installer_controller.go

Repository: openshift/cluster-capi-operator

Length of output: 8616


Wrap this teardown error as terminal. complete=true is fine here, but a bare error is treated as retryable by the controller, so this deterministic construction failure will keep requeueing. Use reconcile.TerminalError(...) instead of returning a plain error. (pkg/controllers/installer/revision_reconciler.go:366-370)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controllers/installer/revision_reconciler.go` around lines 366 - 370,
Update the error return in the toBoxcutterRevision failure path within the
revision teardown reconciliation flow to wrap err with
reconcile.TerminalError(...). Keep complete=true and the existing empty message
unchanged, ensuring this deterministic construction failure is treated as
terminal rather than retryable.

Comment thread pkg/runtimetransformer/envsubst_transformer.go
@mdbooth
mdbooth force-pushed the runtime-transformers branch from fe23908 to 6f9d77d Compare July 21, 2026 14:31

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
pkg/runtimetransformer/envsubst_transformer_test.go (1)

59-217: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff

Uses plain testing.T tables instead of Ginkgo DescribeTable/Entry.

As per coding guidelines, **/*_test.go files should "Use Ginkgo/Gomega framework and prefer built-in features: use DescribeTable with Entry for table-driven tests... and MatchError for error checking." This file only imports Gomega and uses standard t.Run() tables instead.

Also applies to: 229-311

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/runtimetransformer/envsubst_transformer_test.go` around lines 59 - 217,
The table-driven tests in TestEnvsubstTransformerTransformObject and
TestEnvsubstTransformerTransformObjectErrors should use Ginkgo/Gomega
conventions instead of testing.T subtests. Convert both tables to DescribeTable
with Entry, replace t.Run and per-case NewWithT usage with Gomega assertions in
the table bodies, and use MatchError where exact error matching is appropriate
while preserving the existing cases and assertions.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/runtimetransformer/envsubst_transformer_test.go`:
- Around line 59-217: The table-driven tests in
TestEnvsubstTransformerTransformObject and
TestEnvsubstTransformerTransformObjectErrors should use Ginkgo/Gomega
conventions instead of testing.T subtests. Convert both tables to DescribeTable
with Entry, replace t.Run and per-case NewWithT usage with Gomega assertions in
the table bodies, and use MatchError where exact error matching is appropriate
while preserving the existing cases and assertions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bbbf8647-2323-434c-b9ad-b5f5414a3087

📥 Commits

Reviewing files that changed from the base of the PR and between fe23908 and 6f9d77d.

📒 Files selected for processing (28)
  • cmd/capi-installer/main.go
  • pkg/controllers/installer/boxcutter.go
  • pkg/controllers/installer/boxcutter_test.go
  • pkg/controllers/installer/helpers_test.go
  • pkg/controllers/installer/installer_controller.go
  • pkg/controllers/installer/installer_controller_test.go
  • pkg/controllers/installer/revision_reconciler.go
  • pkg/controllers/installer/suite_test.go
  • pkg/controllers/installer/testvalue_transformer_test.go
  • pkg/controllers/revision/helpers_test.go
  • pkg/controllers/revision/revision_controller.go
  • pkg/controllers/revision/revision_controller_test.go
  • pkg/revisiongenerator/helpers_test.go
  • pkg/revisiongenerator/revision.go
  • pkg/revisiongenerator/revision_test.go
  • pkg/revisiongenerator/transform.go
  • pkg/revisiongenerator/transform_test.go
  • pkg/revisiongenerator/validate.go
  • pkg/revisiongenerator/validate_test.go
  • pkg/runtimetransformer/adopt_existing_transformer.go
  • pkg/runtimetransformer/adopt_existing_transformer_test.go
  • pkg/runtimetransformer/envsubst_transformer.go
  • pkg/runtimetransformer/envsubst_transformer_test.go
  • pkg/runtimetransformer/managed_by_transformer.go
  • pkg/runtimetransformer/managed_by_transformer_test.go
  • pkg/runtimetransformer/runtime_transformer.go
  • pkg/runtimetransformer/validate.go
  • pkg/runtimetransformer/validate_test.go
💤 Files with no reviewable changes (3)
  • pkg/revisiongenerator/transform_test.go
  • pkg/revisiongenerator/validate_test.go
  • pkg/revisiongenerator/transform.go
🚧 Files skipped from review as they are similar to previous changes (19)
  • pkg/runtimetransformer/validate.go
  • pkg/revisiongenerator/helpers_test.go
  • pkg/runtimetransformer/managed_by_transformer.go
  • pkg/controllers/revision/helpers_test.go
  • pkg/controllers/installer/installer_controller.go
  • pkg/revisiongenerator/validate.go
  • pkg/runtimetransformer/runtime_transformer.go
  • pkg/runtimetransformer/managed_by_transformer_test.go
  • pkg/controllers/installer/boxcutter.go
  • pkg/controllers/installer/helpers_test.go
  • cmd/capi-installer/main.go
  • pkg/runtimetransformer/validate_test.go
  • pkg/runtimetransformer/adopt_existing_transformer.go
  • pkg/controllers/revision/revision_controller.go
  • pkg/runtimetransformer/adopt_existing_transformer_test.go
  • pkg/controllers/revision/revision_controller_test.go
  • pkg/controllers/installer/revision_reconciler.go
  • pkg/revisiongenerator/revision.go
  • pkg/revisiongenerator/revision_test.go

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant