Skip to content

OCPBUGS-86770: Fix OpenStack identityRef conversion and add e2e test#575

Open
simkam wants to merge 1 commit into
openshift:mainfrom
simkam:openstack-sync-issue
Open

OCPBUGS-86770: Fix OpenStack identityRef conversion and add e2e test#575
simkam wants to merge 1 commit into
openshift:mainfrom
simkam:openstack-sync-issue

Conversation

@simkam

@simkam simkam commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

https://redhat.atlassian.net/browse/OCPBUGS-86770

The MAPI-to-CAPI conversion for OpenStack was not setting the Type field on OpenStackIdentityReference. While the CRD has a kubebuilder default of "Secret", this only applies at the API server level. Programmatic struct construction yields a zero-value empty string, which differs from the stored value. This caused the differ to detect a spec change on every reconciliation, triggering an infinite delete/recreate loop of the OpenStackMachine (infra machines are immutable, so spec changes require delete+recreate). The symptom was the Synchronized condition oscillating between True and False.

The fix explicitly sets Type: "Secret" in the conversion function.

Add a platform-agnostic e2e test (machine_sync_test.go) that verifies the Synchronized condition reaches True and stays stable via Consistently, catching the oscillation without needing platform-specific assertions.

Summary by CodeRabbit

  • Tests

    • Added an end-to-end test suite covering machine synchronization between MAPI and CAPI, verifying machines report synchronized state and linked infrastructure resources remain stable over time.
  • Bug Fixes

    • Corrected OpenStack cloud provider identity reference so secret-based identity payloads include the proper type field.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@coderabbitai

coderabbitai Bot commented Jun 3, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c62ee3ca-c08a-4297-be61-d3cc8ac68dfa

📥 Commits

Reviewing files that changed from the base of the PR and between 1bfa838 and 277ee44.

📒 Files selected for processing (2)
  • e2e/machine_sync_test.go
  • pkg/conversion/mapi2capi/openstack.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • pkg/conversion/mapi2capi/openstack.go

Walkthrough

Adds an ordered e2e test that verifies MAPI-to-CAPI machine synchronization and infra UID stability, and updates the MAPO->CAPO OpenStack conversion to set OpenStackIdentityReference.Type to "Secret".

Changes

Machine Synchronization E2E Test

Layer / File(s) Summary
E2E Machine Synchronization Test
e2e/machine_sync_test.go
New Ginkgo ordered test suite that creates a MAPI Machine when MachineAPIMigration feature gate is enabled, verifies the MAPI Machine’s Synchronized condition becomes True, retrieves the corresponding CAPI Machine and referenced infrastructure object, and consistently asserts that synchronization remains true and the infrastructure UID is stable.

OpenStack Identity Reference Enhancement

Layer / File(s) Summary
OpenStack Identity Reference Type Field
pkg/conversion/mapi2capi/openstack.go
convertMAPOCloudNameSecretToCAPO now sets the Type field to "Secret" on the generated OpenStackIdentityReference for providerSpec.CloudsSecret.

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 11 | ❌ 4

❌ Failed checks (4 warnings)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality ⚠️ Warning Test has meaningful assertions with appropriate timeouts and proper cleanup via DeferCleanup, but 4 assertions (lines 64, 68, 73, 80) lack failure messages required by the check specification. Add meaningful failure messages to assertions at lines 64, 68, 73, 80, e.g., 'Expect(capiMachine).NotTo(BeNil(), "CAPI machine should have been created for the test")' and similar messages for error checks.
Microshift Test Compatibility ⚠️ Warning Test uses Machine API (machine.openshift.io) and feature gates without MicroShift protection mechanism ([Skipped:MicroShift], [apigroup:], or IsMicroShiftCluster check). Add [apigroup:machine.openshift.io] tag to test name, or add [Skipped:MicroShift] label, or guard with exutil.IsMicroShiftCluster() check using g.Skip().
Single Node Openshift (Sno) Test Compatibility ⚠️ Warning Test lacks SNO compatibility protection despite being functionally compatible; no [Skipped:SingleReplicaTopology] label or topology check present. Add [Skipped:SingleReplicaTopology] to test name or add topology skip check in BeforeAll block to explicitly handle SNO clusters.
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly addresses the main changes: fixing OpenStack identityRef conversion and adding an e2e test, both of which are present in the changeset.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Test titles are static and deterministic with no dynamic values. Dynamic names from generateName() are confined to test bodies, not titles.
Topology-Aware Scheduling Compatibility ✅ Passed PR adds an e2e test and fixes OpenStack conversion logic—neither introduces scheduling constraints or deployment manifests that assume standard HA topology.
Ote Binary Stdout Contract ✅ Passed No OTE Binary Stdout Contract violations found. Modified files lack process-level code and contain no process-level stdout writes, klog initialization, or logger setup.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed New test contains no IPv4 hardcoded addresses, IPv4-specific parsing, or external connectivity requirements—only cluster-internal Kubernetes API operations via client and Gomega matchers.
No-Weak-Crypto ✅ Passed No weak cryptography usage found. PR adds an e2e test and modifies OpenStack identity reference conversion—both contain no crypto algorithms, implementations, or unsafe secret comparisons.
Container-Privileges ✅ Passed PR contains only Go source code files (e2e test and conversion function). No container or Kubernetes manifest files are modified; therefore the container privilege check is not applicable.
No-Sensitive-Data-In-Logs ✅ Passed PR adds e2e test and OpenStack conversion function with no logging of sensitive data. Code only accesses secret metadata (names) and field validation paths, not actual secret content.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from damdo and mdbooth June 3, 2026 12:57
Comment thread e2e/machine_sync_test.go
g.Expect(err).NotTo(HaveOccurred())
g.Expect(freshInfraMachine.GetUID()).To(Equal(infraMachineUID),
"infrastructure machine UID changed — was deleted and recreated")
}, "30s", "5s").Should(Succeed())

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't have a 30s wait here. These add up so fast in a test suite.

Let me think about this...

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Locally, without the fix, it actually fails on the first check of the synchronized condition on line 50. It might be enough to detect a problem, and we might drop the rest.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it'll flap, though, so it's non-deterministic. I didn't come up with a better idea, so lets do this.

@simkam simkam changed the title [OCPBUGS-86770] Fix OpenStack identityRef conversion and add e2e test OCPBUGS-86770: Fix OpenStack identityRef conversion and add e2e test Jun 4, 2026
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 4, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@simkam: This pull request references Jira Issue OCPBUGS-86770, which is invalid:

  • expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-86770

The MAPI-to-CAPI conversion for OpenStack was not setting the Type field on OpenStackIdentityReference. While the CRD has a kubebuilder default of "Secret", this only applies at the API server level. Programmatic struct construction yields a zero-value empty string, which differs from the stored value. This caused the differ to detect a spec change on every reconciliation, triggering an infinite delete/recreate loop of the OpenStackMachine (infra machines are immutable, so spec changes require delete+recreate). The symptom was the Synchronized condition oscillating between True and False.

The fix explicitly sets Type: "Secret" in the conversion function.

Add a platform-agnostic e2e test (machine_sync_test.go) that verifies the Synchronized condition reaches True and stays stable via Consistently, catching the oscillation without needing platform-specific assertions.

Summary by CodeRabbit

Release Notes

  • Tests

  • Added comprehensive end-to-end test suite for machine synchronization between MAPI and CAPI systems, verifying that infrastructure resources remain properly synchronized and stable across operations.

  • Bug Fixes

  • Fixed OpenStack cloud provider identity reference handling to ensure proper type field configuration during secret conversions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@simkam

simkam commented Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 4, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@simkam: This pull request references Jira Issue OCPBUGS-86770, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@mdbooth

mdbooth commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

/lgtm
/approve

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 9, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-disconnected-techpreview
/test e2e-aws-capi-techpreview
/test e2e-aws-capi-techpreview-post-install
/test e2e-aws-ovn
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-openstack-ovn-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

@openshift-ci

openshift-ci Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mdbooth

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 9, 2026
https://redhat.atlassian.net/browse/OCPBUGS-86770

The MAPI-to-CAPI conversion for OpenStack was not setting the Type field
on OpenStackIdentityReference. While the CRD has a kubebuilder default of
"Secret", this only applies at the API server level. Programmatic struct
construction yields a zero-value empty string, which differs from the
stored value. This caused the differ to detect a spec change on every
reconciliation, triggering an infinite delete/recreate loop of the
OpenStackMachine (infra machines are immutable, so spec changes require
delete+recreate). The symptom was the Synchronized condition oscillating
between True and False.

The fix explicitly sets Type: "Secret" in the conversion function.

Add a platform-agnostic e2e test (machine_sync_test.go) that verifies the
Synchronized condition reaches True and stays stable via Consistently,
catching the oscillation without needing platform-specific assertions.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@simkam simkam force-pushed the openstack-sync-issue branch from 1bfa838 to 277ee44 Compare June 9, 2026 11:12
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jun 9, 2026
@openshift-ci

openshift-ci Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

New changes are detected. LGTM label has been removed.

@simkam

simkam commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Rebased and the new test skipped on platforms where MachineAPIMigration isn't supported.

@mdbooth

mdbooth commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

/pipeline auto

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification

The pipeline-auto label has been added to this PR. Second-stage tests will be triggered automatically when all first-stage tests pass.

@mdbooth

mdbooth commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-disconnected-techpreview
/test e2e-aws-capi-techpreview
/test e2e-aws-capi-techpreview-post-install
/test e2e-aws-ovn
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-openstack-ovn-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

@simkam

simkam commented Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

/retest-required

  1. e2e-openstack-ovn-techpreview: Missing openstack-tests binary (test environment issue)
  2. e2e-aws-ovn-techpreview: Flaky timeouts in router/network/build tests (unrelated to CAPI)
  3. e2e-azure-ovn-techpreview: Flaky timeouts in deployment tests (unrelated to CAPI)
  4. e2e-aws-capi-disconnected-techpreview: Cleanup failures during deprovision (infrastructure leak issue)

@openshift-ci

openshift-ci Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

@simkam: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-capi-disconnected-techpreview 277ee44 link false /test e2e-aws-capi-disconnected-techpreview
ci/prow/e2e-azure-ovn-techpreview 277ee44 link false /test e2e-azure-ovn-techpreview
ci/prow/e2e-openstack-ovn-techpreview 277ee44 link false /test e2e-openstack-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@simkam

simkam commented Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

/retest-required

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. pipeline-auto

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants