Skip to content

NE-2777, NE-2778: Implement Gateway API management knob#2890

Open
rikatz wants to merge 2 commits into
openshift:masterfrom
rikatz:ingress-config-operator
Open

NE-2777, NE-2778: Implement Gateway API management knob#2890
rikatz wants to merge 2 commits into
openshift:masterfrom
rikatz:ingress-config-operator

Conversation

@rikatz

@rikatz rikatz commented Jun 15, 2026

Copy link
Copy Markdown
Member

This PR implements the feature gate and the API required for the implementation of Gateway APi management knob on OCP.

EP: openshift/enhancements#2023

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 15, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 15, 2026

Copy link
Copy Markdown

@rikatz: This pull request references NE-2777 which is a valid jira issue.

This pull request references NE-2778 which is a valid jira issue.

Details

In response to this:

This PR implements the feature gate and the API required for the implementation of Gateway APi management knob on OCP.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Hello @rikatz! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@coderabbitai

coderabbitai Bot commented Jun 15, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 70138f3a-c9d0-47d8-9a26-fd2279e1197e

📥 Commits

Reviewing files that changed from the base of the PR and between aa6d998 and 652792d.

⛔ Files ignored due to path filters (6)
  • openapi/generated_openapi/zz_generated.openapi.go is excluded by !openapi/**, !**/zz_generated*
  • operator/v1alpha1/zz_generated.crd-manifests/0000_50_ingress_02_ingresses.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1alpha1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
  • operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/zz_generated*
  • operator/v1alpha1/zz_generated.featuregated-crd-manifests/ingresses.operator.openshift.io/GatewayAPIManagementMode.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • operator/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/zz_generated*
📒 Files selected for processing (11)
  • operator/v1alpha1/register.go
  • operator/v1alpha1/tests/ingresses.operator.openshift.io/GatewayAPIManagementMode.yaml
  • operator/v1alpha1/types_ingress.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
✅ Files skipped from review due to trivial changes (3)
  • operator/v1alpha1/tests/ingresses.operator.openshift.io/GatewayAPIManagementMode.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
🚧 Files skipped from review as they are similar to previous changes (7)
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • operator/v1alpha1/register.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • operator/v1alpha1/types_ingress.go

📝 Walkthrough

Walkthrough

This PR introduces the GatewayAPIManagementMode feature gate and a new Ingress singleton CRD to control Gateway API operational behavior. A new file operator/v1alpha1/types_ingress.go defines the complete API schema, including the cluster-scoped Ingress root type with a validation rule enforcing the singleton name "cluster", an IngressSpec embedding OperatorSpec with an optional GatewayAPIIngressConfig block, an IngressStatus embedding OperatorStatus with documented condition semantics, the GatewayAPIManagementMode string enum with Managed and Unmanaged constants, and IngressList for list responses. The register.go file registers both Ingress and IngressList types with the Kubernetes scheme. In features/features.go, FeatureGateGatewayAPIManagementMode is registered as OCP-specific with Routing component scope, enabled for TechPreviewNoUpgrade and DevPreviewNoUpgrade versions. The features.md documentation matrix includes the new feature gate. Eight payload-manifest YAML files configure the gate as enabled in TechPreview and DevPreview profiles and disabled in Default and OKD profiles across both Hypershift and SelfManagedHA topologies. Comprehensive validation tests cover singleton enforcement, field defaulting, enum validation, and error messaging.

Suggested reviewers

  • everettraven
  • JoelSpeed
🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (14 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the implementation of a Gateway API management knob feature, which directly aligns with the core changes adding feature gate registration, API types, and feature gate manifests throughout the changeset.
Description check ✅ Passed The description accurately references implementing a feature gate and API for Gateway API management on OCP, which corresponds to the actual changes in the PR including feature gate definitions and API type definitions.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The single test file added (GatewayAPIManagementMode.yaml) contains 9 CRD validation test cases with stable, deterministic names free from dynamic values, timestamps, pod names, UUIDs, or node iden...
Test Structure And Quality ✅ Passed Test YAML follows established pattern in codebase with: single responsibility per test (one behavior per test case), setup/cleanup via generated BeforeEach/AfterEach, timeouts on Eventually calls (...
Microshift Test Compatibility ✅ Passed No Ginkgo e2e tests are added in this PR. The test file added is a CRD validation test suite (envtest-based), not a Ginkgo test, so the check does not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No Ginkgo e2e tests are added in this PR. The only test file is a YAML-based CRD validation manifest (GatewayAPIManagementMode.yaml) used for schema validation, not executable Ginkgo tests (It(), D...
Topology-Aware Scheduling Compatibility ✅ Passed PR adds only API types, feature gate definitions, and test files. No deployment manifests, scheduling constraints, affinity rules, nodeSelectors, or topology-aware scheduling issues are introduced.
Ote Binary Stdout Contract ✅ Passed PR contains only type definitions, feature gate registrations, and YAML configs with no main(), init(), or stdout writes at process level; no OTE Binary Stdout Contract violations.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No Ginkgo e2e tests are added in this PR. The only test file is a CRD validation YAML metadata file, not a Ginkgo test. The check does not apply.
No-Weak-Crypto ✅ Passed No weak crypto (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB), custom crypto implementations, or insecure secret comparisons found in the modified files.
Container-Privileges ✅ Passed The PR contains no container/Kubernetes deployment manifests with privileged settings. Changes are API type definitions, feature gate registrations, and feature gate configuration manifests—not con...
No-Sensitive-Data-In-Logs ✅ Passed No logging statements found in the PR changes. The added code consists only of API type definitions, feature gate registration, and YAML configuration—no logging calls that could expose sensitive d...

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jun 15, 2026
@openshift-ci openshift-ci Bot requested review from JoelSpeed and everettraven June 15, 2026 17:51
@openshift-ci

openshift-ci Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@operator/v1alpha1/types_ingress.go`:
- Around line 28-30: The Spec field at lines 28-30 and the gatewayAPI field at
lines 43-49 both have +required markers but their field comments do not
explicitly document the requiredness semantics. Update the comment for the Spec
field to explicitly state that it is required, and similarly update the comment
for the gatewayAPI field to explicitly describe its required nature, ensuring
that each marker has corresponding documentation that clearly describes the
requiredness or omitted behavior per the API marker-documentation checklist and
coding guidelines.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c8b584c2-220b-4f2c-b665-66a4d43f5e44

📥 Commits

Reviewing files that changed from the base of the PR and between 261e3a0 and 4e7027d.

⛔ Files ignored due to path filters (6)
  • openapi/generated_openapi/zz_generated.openapi.go is excluded by !openapi/**, !**/zz_generated*
  • operator/v1alpha1/zz_generated.crd-manifests/0000_50_ingress_02_ingresses.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1alpha1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
  • operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/zz_generated*
  • operator/v1alpha1/zz_generated.featuregated-crd-manifests/ingresses.operator.openshift.io/GatewayAPIManagementMode.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • operator/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/zz_generated*
📒 Files selected for processing (11)
  • features.md
  • features/features.go
  • operator/v1alpha1/types_ingress.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

Comment thread operator/v1alpha1/types_ingress.go
@rikatz rikatz force-pushed the ingress-config-operator branch 2 times, most recently from b4fe018 to aa6d998 Compare June 15, 2026 21:25
@rikatz rikatz force-pushed the ingress-config-operator branch from aa6d998 to 652792d Compare June 15, 2026 23:26
@openshift-ci

openshift-ci Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

@rikatz: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/integration 652792d link true /test integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@everettraven everettraven left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, this looks pretty good. A handful of comments.

Comment thread features/features.go
contactPerson("miciah").
productScope(ocpSpecific).
enhancementPR("https://github.com/openshift/enhancements/pull/2023").
enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a note that we are now enforcing that before a feature gate can be included in the TPNU feature set that the enhancement must be merged.

Please get the EP merged before we merge this - thanks!

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's the plan! :D

// configuration, which sets managementMode to "Managed".
//
// +optional
// +openshift:enable:FeatureGate=GatewayAPIManagementMode

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The whole API is gated, so we can drop this marker.

Comment on lines +135 to +136
// GatewayClass, Gateway resources). This is the only fully
// supported configuration.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both the current options seem like they would be considered "fully supported", so the final sentence here might be a bit misleading.

// managementMode specifies how the Cluster Ingress
// Operator manages Gateway API Custom Resource Definitions
// (CRDs) and the associated Gateway controller stack.
//

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For enum fields, we generally encourage a sentence here that explicitly states what the set of allowed values are like:

Allowed values are Managed and Unmanaged.

Comment on lines +147 to +150
// When omitted, the field defaults to "Managed".
//
// +default="Managed"
// +optional

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this default marker does anything if the parent field isn't also specified, only if this field is explicitly omitted.

The minimum properties on this type inherently makes this field required when specifying the parent field.

I'm wondering, should this be a required field regardless? I'm not sure it makes sense to explicitly specify the Gateway API configuration field without explicitly providing the management mode you'd like to be in place.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants