Skip to content

Updating contents of block-runc-on-rhcos10-upgrade - #2071

Open
asahay19 wants to merge 1 commit into
openshift:masterfrom
asahay19:4624
Open

Updating contents of block-runc-on-rhcos10-upgrade#2071
asahay19 wants to merge 1 commit into
openshift:masterfrom
asahay19:4624

Conversation

@asahay19

@asahay19 asahay19 commented Jul 31, 2026

Copy link
Copy Markdown

This PR is regarding Updating/Adding contents to the enhancement proposal for a guard in the MCO render controller that blocks MachineConfigPool rendering when the pool targets RHEL 10 and runc is still configured as the default runtime.

What changed

  • E2E Test Scenarios: added explicit "Succeed"/"Blocked" definitions in
    terms of observable MachineConfigPool/ClusterOperator/ClusterVersion
    conditions, a "What is validated" column per scenario, and a note
    explaining the OSImageURL vs OSImageStream guard-selection precondition
    (isOSImageURLOverridden).
  • Release Testing Strategy (new): documents how the guard was validated
    end-to-end across machine-config-operator (unit tests + manual
    validation) and origin (e2e automation + cross-repository payload
    validation) prior to merge.
  • Skip Environment (new): documents why/when the e2e suite skips
    automatically (MicroShift, Hypershift, SNO, missing dual OS image
    streams) instead of failing on environments where its preconditions don't
    hold.
  • User Personas (new, under Motivation): outlines the stakeholders
    affected by this guard and their concerns.

Summary by CodeRabbit

  • Documentation
    • Updated the machine configuration enhancement metadata and date.
    • Expanded end-to-end testing guidance with success and blocked outcomes, OS-target mechanisms, detailed scenarios, prerequisites, skip conditions, release and cross-repository validation, merge sequencing, and infrastructure requirements.
    • Clarified that integration testing is not applicable.
    • Removed duplicate infrastructure guidance and documented the rejected alternative for reporting status on the runtime configuration.

@openshift-ci
openshift-ci Bot requested review from derekwaynecarr and zaneb July 31, 2026 08:44
@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign spadgett for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown

Walkthrough

The enhancement document updates its metadata, adds user personas, records the status-reporting decision, and expands E2E, release, and support-testing guidance for RHCOS 10 upgrades.

Changes

RHCOS 10 upgrade validation

Layer / File(s) Summary
Enhancement context and status reporting
enhancements/machine-config/block-runc-on-rhcos10-upgrade.md
The document updates its date, adds user personas, and documents the rejected ContainerRuntimeConfig status option.
E2E criteria and environment handling
enhancements/machine-config/block-runc-on-rhcos10-upgrade.md
The test plan marks integration testing as N/A and defines E2E outcomes, runtime-configuration methods, OS image prerequisites, migration and rollback scenarios, last-wins checks, and automatic skip conditions.
Release and support validation
enhancements/machine-config/block-runc-on-rhcos10-upgrade.md
The plan adds implementation, manual, disruptive, payload, cross-repository, merge-sequencing, and existing-infrastructure validation details. It removes duplicate infrastructure text.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: zaneb, derekwaynecarr

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only one Markdown enhancement file. It adds no Ginkgo test declarations or dynamic test titles; the documented scenario labels are static.
Test Structure And Quality ✅ Passed The pull request changes only one Markdown enhancement document; it adds no Ginkgo test code, so the listed test-structure requirements do not apply.
Microshift Test Compatibility ✅ Passed The PR changes only one Markdown enhancement file; no Ginkgo e2e test code or new test declarations were added, so MicroShift API compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The pull request changes only one Markdown enhancement file; no Ginkgo e2e tests or test source files were added, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes only one Markdown enhancement file; it adds documentation and no manifests, operator code, controllers, replicas, affinities, selectors, tolerations, or topology constraints.
Ote Binary Stdout Contract ✅ Passed The patch changes only one Markdown enhancement file (+147/-18); it adds no OTE binary, test setup, or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The patch changes only an enhancement Markdown file; it adds no Ginkgo e2e test code, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto ✅ Passed The only changed file is a Markdown enhancement; exact scans found no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB, secret comparison, or custom crypto code.
Container-Privileges ✅ Passed The PR changes only one Markdown enhancement document; no Kubernetes manifest or privilege setting appears, including privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs ✅ Passed The PR changes only an enhancement Markdown document; it adds no logging code or sensitive values, and credential-like scanning found only a public issue URL.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately identifies the enhancement proposal being updated and reflects the main documentation change.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@asahay19

Copy link
Copy Markdown
Author

PTAL @cpmeadors @bitoku

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@enhancements/machine-config/block-runc-on-rhcos10-upgrade.md`:
- Around line 400-402: Update the “Infrastructure Needed [optional]” section to
align with the release strategy: state that no new cluster infrastructure is
required, while explicitly noting that custom payload jobs are still needed;
alternatively remove the stale section.
- Around line 297-302: Update the “Blocked” definition and corresponding
rollback text to state that the blocked condition clears when the target RHCOS
version is no longer RHEL 10 or when runc is no longer effective. Keep the
existing behavior for RHEL 10 with effective runc, including the
Upgradeable=False condition and DegradedPool reason.
- Around line 285-289: Update the RHEL 10 OSImageURL scenarios in the scenario
table to require an OSImageURL value whose effective OSImageStream differs from
the default stream, ensuring the URL-specific validator runs. Apply this
precondition to all URL variants, including the scenarios around the referenced
alternatives, or explicitly identify the validator exercised by each scenario.
- Line 313: Update the mixed drop-in scenario in the table to define observable
outcomes for each alphabetical ordering: when the final effective runtime is
runc, expect the RHEL 10 guard to block and RenderDegraded to be set; when the
final effective runtime is crun, expect the configuration to be accepted and
RenderDegraded not to be set. Retain the coverage of CRI-O’s last-file-wins
semantics.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ea9438d-e766-4c0a-a6aa-39b90cb1aff9

📥 Commits

Reviewing files that changed from the base of the PR and between c79913a and 8ea018d.

📒 Files selected for processing (1)
  • enhancements/machine-config/block-runc-on-rhcos10-upgrade.md

Comment thread enhancements/machine-config/block-runc-on-rhcos10-upgrade.md Outdated
Comment thread enhancements/machine-config/block-runc-on-rhcos10-upgrade.md Outdated
Comment thread enhancements/machine-config/block-runc-on-rhcos10-upgrade.md Outdated
Comment thread enhancements/machine-config/block-runc-on-rhcos10-upgrade.md Outdated
@asahay19
asahay19 force-pushed the 4624 branch 2 times, most recently from 45fc620 to f4fc53d Compare July 31, 2026 08:53

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@enhancements/machine-config/block-runc-on-rhcos10-upgrade.md`:
- Around line 335-338: Resolve the contradictory skip policy in the e2e suite
description: make clusters missing either the rhel-9 or rhel-10 stream
automatically skip, consistent with the stated dual-stream precondition, or
explicitly define this as a hard validation and remove it from the documented
skip behavior. Update the affected skip-policy text together.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c09567e4-8464-4224-b569-1b8032b254d9

📥 Commits

Reviewing files that changed from the base of the PR and between 8ea018d and 45fc620.

📒 Files selected for processing (1)
  • enhancements/machine-config/block-runc-on-rhcos10-upgrade.md

Comment thread enhancements/machine-config/block-runc-on-rhcos10-upgrade.md

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (2)
enhancements/machine-config/block-runc-on-rhcos10-upgrade.md (2)

326-326: 🎯 Functional Correctness | 🟡 Minor

Define observable outcomes for each last-wins ordering.

Last wins does not define an E2E acceptance result. Specify the final effective runtime and expected outcome for each ordering: on RHEL 10, final runc must block with RenderDegraded=True, while final crun must succeed with RenderDegraded=False. On RHCOS 9, both runtimes should succeed.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@enhancements/machine-config/block-runc-on-rhcos10-upgrade.md` at line 326,
Update the “Multiple drop-ins, last wins” acceptance criteria to specify
outcomes for each ordering: on RHEL 10, an effective final runc must block and
set RenderDegraded=True, while an effective final crun must succeed with
RenderDegraded=False; on RHCOS 9, both effective runtimes must succeed. Keep the
coverage tied to DetectRuncInMachineConfig() and CRI-O’s alphabetical
last-file-wins behavior.

310-315: 🎯 Functional Correctness | 🟠 Major

Make the blocked-state exit condition consistent with rollback.

The definition says Upgradeable=False persists until the runc configuration is removed. The rollback scenario allows RHCOS 9 with any runtime. State that the block clears when the target is no longer RHEL 10 or when runc is no longer effective.

Also applies to: 325-337

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@enhancements/machine-config/block-runc-on-rhcos10-upgrade.md` around lines
310 - 315, Update the “Blocked” definition and rollback scenario to state that
the block clears when the upgrade target is no longer RHEL 10 or when runc is no
longer effective, including when the runc configuration is removed. Preserve the
existing RHCOS 9 behavior allowing any runtime and keep the Upgradeable=False
condition while both blocking conditions remain.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@enhancements/machine-config/block-runc-on-rhcos10-upgrade.md`:
- Line 326: Update the “Multiple drop-ins, last wins” acceptance criteria to
specify outcomes for each ordering: on RHEL 10, an effective final runc must
block and set RenderDegraded=True, while an effective final crun must succeed
with RenderDegraded=False; on RHCOS 9, both effective runtimes must succeed.
Keep the coverage tied to DetectRuncInMachineConfig() and CRI-O’s alphabetical
last-file-wins behavior.
- Around line 310-315: Update the “Blocked” definition and rollback scenario to
state that the block clears when the upgrade target is no longer RHEL 10 or when
runc is no longer effective, including when the runc configuration is removed.
Preserve the existing RHCOS 9 behavior allowing any runtime and keep the
Upgradeable=False condition while both blocking conditions remain.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d4f01eb-ed21-4cda-a845-41861ecc3438

📥 Commits

Reviewing files that changed from the base of the PR and between 45fc620 and 8a6ccfb.

📒 Files selected for processing (1)
  • enhancements/machine-config/block-runc-on-rhcos10-upgrade.md

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@enhancements/machine-config/block-runc-on-rhcos10-upgrade.md`:
- Around line 314-328: Update the blocked-state definition in the
“Succeed”/“Blocked” criteria to remove the requirement that ClusterVersion
reports Upgradeable=False. Keep the MachineConfigPool degradation and
co/machine-config behavior, while explicitly preserving that this guard must not
block the OCP version upgrade.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4ec2b97e-0cf9-41a2-a699-1a24662b504c

📥 Commits

Reviewing files that changed from the base of the PR and between 8a6ccfb and e14b5cc.

📒 Files selected for processing (1)
  • enhancements/machine-config/block-runc-on-rhcos10-upgrade.md

Comment thread enhancements/machine-config/block-runc-on-rhcos10-upgrade.md
Co-authored-by: Cursor <cursoragent@cursor.com>
@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@asahay19: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant