Skip to content

Adjusting manifests for gitops on hypershift-konflux#82118

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
hector-vido:hypershift-konflux-gitops
Jul 19, 2026
Merged

Adjusting manifests for gitops on hypershift-konflux#82118
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
hector-vido:hypershift-konflux-gitops

Conversation

@hector-vido

@hector-vido hector-vido commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

This PR updates the hypershift-konflux GitOps AWS machine manifests for us-east-2, affecting infra (clusters/hypershift-konflux/machinesets/infra-arm64.yaml) and worker nodes (worker-amd64.yaml + worker-arm64.yaml).

Key changes:

  • infra-arm64: refreshes per-AZ MachineSet AWS settings (new AMIs/instance sizing), adds capacity.cluster-autoscaler arch labeling plus GPU/memory/vCPU annotations, rewrites EBS block device settings to standardize kmsKey.arn: "" and ebs.iops: 0, updates security group selection to two tag filters (node + lb), and changes the us-east-2b subnet ID. Also normalizes embedded provider/template fields (removes creationTimestamp: null and related provider metadata/service options).
  • worker-amd64: keeps only the three zone-scoped MachineSets (us-east-2{a,b,c}) and removes per-zone MachineAutoscaler resources. Updates AWS provider settings (AMI refresh, instance type change, reduced EBS volume size), switches security group selection to node + lb tag filters, adds sizing annotations (including cluster-autoscaler arch label), sets spec.replicas: 1, and adds empty lifecycleHooks/metadata stubs while normalizing embedded provider/template fields.
  • worker-arm64: standardizes AMI/instance type, sets kmsKey.arn: "" and capacityReservationId: "", updates security group selection to node + lb tag filters, removes provider-side metadata blocks (creationTimestamp: null, metadataServiceOptions), adds empty template lifecycleHooks/metadata, and sets sizing annotations + spec.replicas: 1.

Comment: requested retest via /retest.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 18, 2026
@coderabbitai

coderabbitai Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: fb6f8a49-6c7c-4261-8bf7-580532d90721

📥 Commits

Reviewing files that changed from the base of the PR and between 4f7aaf4 and 9796e75.

📒 Files selected for processing (3)
  • clusters/hypershift-konflux/machinesets/infra-arm64.yaml
  • clusters/hypershift-konflux/machinesets/worker-amd64.yaml
  • clusters/hypershift-konflux/machinesets/worker-arm64.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
  • clusters/hypershift-konflux/machinesets/worker-arm64.yaml
  • clusters/hypershift-konflux/machinesets/worker-amd64.yaml

Walkthrough

The manifests update infra and worker MachineSets across three AWS zones with revised AMIs, instance types, storage, security groups, subnets, metadata, annotations, and replicas. AMD64 worker manifests also remove the existing MachineAutoscaler resources.

Changes

Hypershift MachineSet configuration

Layer / File(s) Summary
Infra ARM64 provider configuration
clusters/hypershift-konflux/machinesets/infra-arm64.yaml
Infra MachineSets gain capacity annotations and updated AWS AMIs, EBS settings, security-group filters, and zone-specific subnet configuration.
Worker AMD64 scaling and provider configuration
clusters/hypershift-konflux/machinesets/worker-amd64.yaml
AMD64 worker MachineSets use updated instances, volumes, provider metadata, and security-group filters, set one replica per zone, and remove MachineAutoscaler resources.
Worker ARM64 scaling and provider configuration
clusters/hypershift-konflux/machinesets/worker-arm64.yaml
ARM64 worker MachineSets gain capacity annotations and one replica per zone, and use updated AMIs, m6g.4xlarge instances, normalized provider fields, and revised security groups.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: prucek, jmguzik

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is broadly aligned with the manifest updates for hypershift-konflux GitOps, though it is a bit generic.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No test files or Ginkgo titles were changed; the diff only updates MachineSet YAML manifests, so the stable-name check is not applicable.
Test Structure And Quality ✅ Passed The PR only changes three YAML MachineSet manifests; no Ginkgo or other test files are touched, so the test-quality check is not applicable.
Microshift Test Compatibility ✅ Passed The PR changes only MachineSet YAML manifests; no new Ginkgo e2e tests or test code were added, so the MicroShift test check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR only changes three MachineSet YAML manifests; no Go/Ginkgo tests were added or modified, so the SNO test check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed Only MachineSet manifests changed; no affinity, topology spread, node selectors, PDBs, or control-plane assumptions were added.
Ote Binary Stdout Contract ✅ Passed PR only changes MachineSet YAML manifests; no main/init/TestMain/suite setup code or stdout logging was added, so the stdout contract isn't affected.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PR only changes MachineSet YAML manifests; no Ginkgo tests or network code were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto ✅ Passed The PR only changes MachineSet YAML; diff search found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code.
Container-Privileges ✅ Passed The only changed YAMLs are MachineSets, and none contain privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed Only YAML MachineSet manifests changed; no log statements or sensitive-data patterns were found.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 18, 2026
@openshift-ci
openshift-ci Bot requested review from Prucek and jmguzik July 18, 2026 19:56

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@clusters/hypershift-konflux/machinesets/infra-arm64.yaml`:
- Line 9: Remove the server-managed metadata fields generation and
creationTimestamp from the MachineSet manifest, including the entries near the
metadata section and the later referenced location. Leave all declarative
metadata and resource configuration unchanged.
- Line 41: Remove the explicit iops value from the infra-arm64 MachineSet
storage configuration so it uses the gp3 default, matching the other zones and
avoiding an invalid value below AWS’s minimum.

In `@clusters/hypershift-konflux/machinesets/worker-amd64.yaml`:
- Around line 32-49: Update the ami.id values in all six listed MachineSet
sites: use an x86_64-compatible AMI for
clusters/hypershift-konflux/machinesets/worker-amd64.yaml at lines 32-49,
106-123, and 179-196, and an arm64-compatible AMI for
clusters/hypershift-konflux/machinesets/worker-arm64.yaml at lines 32-49,
106-123, and 180-197. Keep each worker pool consistently matched to its
architecture.
- Around line 5-8: Update the capacity annotations for the MachineSets using
m6a.4xlarge or m6g.4xlarge to advertise 16 vCPU and 65536 MiB instead of 8 vCPU
and 32768 MiB. Apply this in
clusters/hypershift-konflux/machinesets/worker-amd64.yaml at lines 5-8, 79-82,
and 153-156, and clusters/hypershift-konflux/machinesets/worker-arm64.yaml at
lines 5-8, 79-82, and 154-157, matching each annotation to its instance type.
- Around line 12-15: Add matching MachineAutoscaler resources under the
hypershift-konflux cluster configuration for the AMD64 worker MachineSets,
including hypershift-konflux-nt7sd-worker-us-east-2a and each renamed worker
pool. Configure each autoscaler to target its corresponding MachineSet and
preserve the expected per-zone scaling behavior instead of leaving replicas
capped at one.
- Around line 12-26: Give the AMD64 and ARM64 MachineSets distinct names across
clusters/hypershift-konflux/machinesets/worker-amd64.yaml sites 12-26, 86-100,
and 159-173 and clusters/hypershift-konflux/machinesets/worker-arm64.yaml sites
12-26, 86-100, and 160-174. Rename one architecture’s MachineSet resources so
the us-east-2a/b/c objects do not collide, and update every corresponding
machine.openshift.io/cluster-api-machineset value in each spec.selector and
template.metadata.labels to match its resource name.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 18cb271e-79f4-418f-b09c-237a776cc9d6

📥 Commits

Reviewing files that changed from the base of the PR and between 7048642 and c8c4732.

📒 Files selected for processing (3)
  • clusters/hypershift-konflux/machinesets/infra-arm64.yaml
  • clusters/hypershift-konflux/machinesets/worker-amd64.yaml
  • clusters/hypershift-konflux/machinesets/worker-arm64.yaml

Comment thread clusters/hypershift-konflux/machinesets/infra-arm64.yaml Outdated
Comment thread clusters/hypershift-konflux/machinesets/infra-arm64.yaml Outdated
Comment thread clusters/hypershift-konflux/machinesets/worker-amd64.yaml Outdated
Comment thread clusters/hypershift-konflux/machinesets/worker-amd64.yaml Outdated
Comment thread clusters/hypershift-konflux/machinesets/worker-amd64.yaml Outdated
Comment thread clusters/hypershift-konflux/machinesets/worker-amd64.yaml
@hector-vido
hector-vido force-pushed the hypershift-konflux-gitops branch from c8c4732 to 85e58e7 Compare July 18, 2026 20:23
@hector-vido

Copy link
Copy Markdown
Contributor Author

/retest

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@clusters/hypershift-konflux/machinesets/worker-amd64.yaml`:
- Line 9: Remove both top-level metadata.creationTimestamp entries from
clusters/hypershift-konflux/machinesets/worker-amd64.yaml at lines 9 and 83, and
from clusters/hypershift-konflux/machinesets/worker-arm64.yaml at lines 9 and
83. Leave all other MachineSet metadata unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 28efea4a-6d33-43de-8da5-c3075ddb3b6b

📥 Commits

Reviewing files that changed from the base of the PR and between c8c4732 and 85e58e7.

📒 Files selected for processing (3)
  • clusters/hypershift-konflux/machinesets/infra-arm64.yaml
  • clusters/hypershift-konflux/machinesets/worker-amd64.yaml
  • clusters/hypershift-konflux/machinesets/worker-arm64.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • clusters/hypershift-konflux/machinesets/infra-arm64.yaml

Comment thread clusters/hypershift-konflux/machinesets/worker-amd64.yaml Outdated
@hector-vido
hector-vido force-pushed the hypershift-konflux-gitops branch from 85e58e7 to 4f7aaf4 Compare July 18, 2026 20:34
@hector-vido
hector-vido force-pushed the hypershift-konflux-gitops branch from 4f7aaf4 to 9796e75 Compare July 18, 2026 20:52
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@hector-vido: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@deepsm007

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 18, 2026
@openshift-ci

openshift-ci Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007, hector-vido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@hector-vido

Copy link
Copy Markdown
Contributor Author

/retest

1 similar comment
@hector-vido

Copy link
Copy Markdown
Contributor Author

/retest

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 7048642 and 2 for PR HEAD 9796e75 in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 4b842bc and 1 for PR HEAD 9796e75 in total

@hector-vido

Copy link
Copy Markdown
Contributor Author

/retest

@openshift-ci

openshift-ci Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

@hector-vido: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit abe17c3 into openshift:main Jul 19, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants