Skip to content

OCPBUGS-105409: chore: remove AWSServiceLBNetworkSecurityGroup feature gate references - #500

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
damdo:chore-remove-aws-service-lb-network-security-group-featuregate
Aug 11, 2026
Merged

OCPBUGS-105409: chore: remove AWSServiceLBNetworkSecurityGroup feature gate references#500
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
damdo:chore-remove-aws-service-lb-network-security-group-featuregate

Conversation

@damdo

@damdo damdo commented Aug 10, 2026

Copy link
Copy Markdown
Member

Summary

  • Remove the AWSServiceLBNetworkSecurityGroup feature gate check from the AWS cloud config transformer — NLBSecurityGroupMode=Managed is now set unconditionally
  • Remove the isFeatureGateEnabled helper function (no longer used)
  • Clean up tests: remove feature-gate-specific test cases, skip logic, and hardcoded feature gate references
  • Update docs and README to remove feature gate references
  • Test names containing [OCPFeatureGate:AWSServiceLBNetworkSecurityGroup] are preserved for component readiness reporting stability

Test plan

  • go test ./pkg/cloud/aws/... passes
  • go build ./pkg/... compiles successfully
  • No functional references to AWSServiceLBNetworkSecurityGroup remain (only test names and their constant)

Related

Summary by CodeRabbit

  • New Features

    • Network Load Balancer security groups are now consistently managed automatically.
  • Bug Fixes

    • Improved cloud configuration handling to apply managed NLB security groups across supported scenarios.
    • Simplified NLB security-group test behavior by removing outdated availability checks.
  • Documentation

    • Updated test instructions and feature references to reflect that NLB security-group management is generally available.

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 10, 2026
@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown

Walkthrough

Managed NLB security groups are now always configured in Managed mode. NLB tests no longer depend on the related feature gate. Test helpers, controller fixtures, README content, and developer instructions were updated.

Changes

Managed NLB security groups

Layer / File(s) Summary
Unconditional NLB mode enforcement
pkg/cloud/aws/aws_config_transformer.go, pkg/cloud/aws/aws_config_transformer_test.go
Configuration defaults now enforce NLBSecurityGroupMode = Managed. Transformer tests remove feature-gate cases and update expected configurations.
NLB test and helper cleanup
openshift-tests/ccm-aws-tests/e2e/*, openshift-tests/ccm-aws-tests/e2e/common/helper.go
NLB security-group tests no longer check the feature gate. The deprecated helper and related prerequisites are removed.
Controller fixtures and documentation
pkg/controllers/cloud_config_sync_controller_test.go, docs/dev/e2e-ote-ccm-aws.md, openshift-tests/README.md
Controller fixtures no longer enable the feature gate. Test commands and documented feature-gate content now use the NLB test naming.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: mfbonfigli, theobarberbany

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Test Structure And Quality ⚠️ Warning The cleanup test creates an NLB service but registers no DeferCleanup; an earlier failed assertion can leave the namespaced Service and AWS load balancer behind. Register DeferCleanup immediately after service creation, with an idempotent fallback, while retaining the explicit deletion and security-group cleanup assertions.
✅ Passed checks (14 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Changed Ginkgo titles are literal, except Describe uses fmt.Sprintf with two fixed constants; no runtime pod, node, namespace, IP, UUID, or time data appears in titles.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the patch only removes feature-gate skip calls and updates comments, so this check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR adds no new Ginkgo It, Describe, Context, When, or Specify declarations; it only edits existing tests and removes feature-gate skip calls.
Topology-Aware Scheduling Compatibility ✅ Passed The patch changes AWS cloud-config defaults, feature-gate tests, documentation, and test fixtures; no affinity, topology spread, selectors, tolerations, replicas, or PDB constraints were added.
Ote Binary Stdout Contract ✅ Passed Changed Go code adds no process-level stdout writes; OTE config sends GinkgoWriter to os.Stderr, and logrus defaults to os.Stderr.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e declarations were added; the existing NLB tests only lost feature-gate skip calls and documentation changed, so this check is not applicable.
No-Weak-Crypto ✅ Passed The PR only changes feature-gate handling, tests, and documentation; scans found no added weak-crypto APIs, imports, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed The PR adds no privileged container settings, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation; the existing LevelPrivileged test namespace line is unchanged.
No-Sensitive-Data-In-Logs ✅ Passed The patch adds only a fixed informational log for NLBSecurityGroupMode; it does not log passwords, tokens, IDs, hostnames, PII, or customer data.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the removal of AWSServiceLBNetworkSecurityGroup feature-gate references, which is the main change in the pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@damdo

damdo commented Aug 10, 2026

Copy link
Copy Markdown
Member Author

/hold

@damdo
damdo marked this pull request as ready for review August 10, 2026 22:13
@openshift-ci openshift-ci Bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Aug 10, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
pkg/cloud/aws/aws_config_transformer_test.go (1)

53-54: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for an existing non-Managed mode.

All current inputs omit NLBSecurityGroupMode, so these cases exercise only the empty-value path. Add a fixture with a non-Managed value and assert that the serialized output is NLBSecurityGroupMode = Managed.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/cloud/aws/aws_config_transformer_test.go` around lines 53 - 54, Extend
the AWS CloudConfig transformation test fixtures to include an explicit
non-Managed NLBSecurityGroupMode input, and assert that serialization outputs
NLBSecurityGroupMode = Managed. Preserve the existing empty-value cases while
adding coverage for this normalization behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@openshift-tests/ccm-aws-tests/e2e/aws/loadbalancer.go`:
- Around line 48-51: Update the assertion description for the
NLBSecurityGroupMode test to remove the outdated feature-gate condition and
state only that NLBSecurityGroupMode must be set to “Managed” in cloud-config.
Keep the test behavior unchanged.

---

Nitpick comments:
In `@pkg/cloud/aws/aws_config_transformer_test.go`:
- Around line 53-54: Extend the AWS CloudConfig transformation test fixtures to
include an explicit non-Managed NLBSecurityGroupMode input, and assert that
serialization outputs NLBSecurityGroupMode = Managed. Preserve the existing
empty-value cases while adding coverage for this normalization behavior.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6acfa20b-1be5-4ea8-b293-308346418160

📥 Commits

Reviewing files that changed from the base of the PR and between bc52198 and 93759df.

📒 Files selected for processing (8)
  • docs/dev/e2e-ote-ccm-aws.md
  • openshift-tests/README.md
  • openshift-tests/ccm-aws-tests/e2e/aws/helper.go
  • openshift-tests/ccm-aws-tests/e2e/aws/loadbalancer.go
  • openshift-tests/ccm-aws-tests/e2e/common/helper.go
  • pkg/cloud/aws/aws_config_transformer.go
  • pkg/cloud/aws/aws_config_transformer_test.go
  • pkg/controllers/cloud_config_sync_controller_test.go
💤 Files with no reviewable changes (2)
  • openshift-tests/README.md
  • openshift-tests/ccm-aws-tests/e2e/aws/helper.go

Comment thread openshift-tests/ccm-aws-tests/e2e/aws/loadbalancer.go
The AWSServiceLBNetworkSecurityGroup feature gate has been promoted to
GA and is always enabled. Remove the feature gate check from the AWS
cloud config transformer so NLBSecurityGroupMode=Managed is set
unconditionally, and clean up related tests and docs.

Test names containing the feature gate are preserved for component
readiness reporting stability.
@damdo
damdo force-pushed the chore-remove-aws-service-lb-network-security-group-featuregate branch from 93759df to efdc348 Compare August 11, 2026 08:48
@damdo

damdo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

/assign @mtulio @mfbonfigli

@mfbonfigli

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2026
@mfbonfigli

Copy link
Copy Markdown
Contributor

/approve

@damdo

damdo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

/retest

@mtulio

mtulio commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Thanks for handling that, @damdo .
/lgtm
/approve

@openshift-ci

openshift-ci Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@damdo damdo left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

based on @mtulio and @mfbonfigli 's feedback

@damdo

damdo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

/verified by ci

@openshift-ci

openshift-ci Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: damdo, mfbonfigli, mtulio

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 11, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 11, 2026
@damdo damdo changed the title chore: remove AWSServiceLBNetworkSecurityGroup feature gate references OCPBUGS-105409: chore: remove AWSServiceLBNetworkSecurityGroup feature gate references Aug 11, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 11, 2026
@openshift-ci-robot openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Aug 11, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This pull request references Jira Issue OCPBUGS-105409, which is invalid:

  • expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

  • Remove the AWSServiceLBNetworkSecurityGroup feature gate check from the AWS cloud config transformer — NLBSecurityGroupMode=Managed is now set unconditionally
  • Remove the isFeatureGateEnabled helper function (no longer used)
  • Clean up tests: remove feature-gate-specific test cases, skip logic, and hardcoded feature gate references
  • Update docs and README to remove feature gate references
  • Test names containing [OCPFeatureGate:AWSServiceLBNetworkSecurityGroup] are preserved for component readiness reporting stability

Test plan

  • go test ./pkg/cloud/aws/... passes
  • go build ./pkg/... compiles successfully
  • No functional references to AWSServiceLBNetworkSecurityGroup remain (only test names and their constant)

Related

Summary by CodeRabbit

  • New Features

  • Network Load Balancer security groups are now consistently managed automatically.

  • Bug Fixes

  • Improved cloud configuration handling to apply managed NLB security groups across supported scenarios.

  • Simplified NLB security-group test behavior by removing outdated availability checks.

  • Documentation

  • Updated test instructions and feature references to reflect that NLB security-group management is generally available.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@damdo

damdo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

/unhold

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 11, 2026
@damdo

damdo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

/jira refresh

@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This pull request references Jira Issue OCPBUGS-105409, which is invalid:

  • expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@damdo

damdo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 11, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This pull request references Jira Issue OCPBUGS-105409, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 59523bb into openshift:main Aug 11, 2026
14 checks passed
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: Jira Issue OCPBUGS-105409: Some pull requests linked via external trackers have merged:

The following pull request, linked via external tracker, has not merged:

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-105409 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

Summary

  • Remove the AWSServiceLBNetworkSecurityGroup feature gate check from the AWS cloud config transformer — NLBSecurityGroupMode=Managed is now set unconditionally
  • Remove the isFeatureGateEnabled helper function (no longer used)
  • Clean up tests: remove feature-gate-specific test cases, skip logic, and hardcoded feature gate references
  • Update docs and README to remove feature gate references
  • Test names containing [OCPFeatureGate:AWSServiceLBNetworkSecurityGroup] are preserved for component readiness reporting stability

Test plan

  • go test ./pkg/cloud/aws/... passes
  • go build ./pkg/... compiles successfully
  • No functional references to AWSServiceLBNetworkSecurityGroup remain (only test names and their constant)

Related

Summary by CodeRabbit

  • New Features

  • Network Load Balancer security groups are now consistently managed automatically.

  • Bug Fixes

  • Improved cloud configuration handling to apply managed NLB security groups across supported scenarios.

  • Simplified NLB security-group test behavior by removing outdated availability checks.

  • Documentation

  • Updated test instructions and feature references to reflect that NLB security-group management is generally available.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants