CNTRLPLANE-3026: Decouple AWS AMI resolution for dual-stream support by jparrill · Pull Request #8699 · openshift/hypershift

jparrill · 2026-06-09T10:12:12Z

What this PR does / why we need it

Phase 1 step 3 (AWS) of the Dual-Stream RHEL 9/10 NodePool enhancement (OCPSTRAT-3014). Decouples defaultNodePoolAMI() from ReleaseImage so it accepts *stream.Stream directly, enabling stream-aware boot image resolution.

Changes:

defaultNodePoolAMI() — accepts *stream.Stream instead of *releaseinfo.ReleaseImage (core decoupling)
ResolveAWSAMI() — exported (was resolveAWSAMI), resolves stream internally via StreamForName("")
setAWSConditions() — resolves stream internally via StreamForName("")
setKarpenterAMILabels() — resolves stream internally via StreamForName("")
All callers pass "" for now (backward compatible). When CNTRLPLANE-3553 wires the NodePool API field, only the "" arguments change.

Integration tests:

TestBootImageStreamResolution/AWS — 7 test cases covering multi-stream resolution, user AMI override, legacy 4.x backward compat, missing region, unsupported arch, nil metadata

This establishes the pattern for other platform resolvers (GCP, Azure, KubeVirt) in CNTRLPLANE-3027.

Which issue(s) this PR fixes

Fixes CNTRLPLANE-3026

Dependencies (must merge first)

CNTRLPLANE-3020: Adopt coreos/stream-metadata-go upstream library #8673 — CNTRLPLANE-3020: Adopt coreos/stream-metadata-go upstream library (@sdminonne)
CNTRLPLANE-3022: Add osImageStream to NodePool spec and status #8675 — CNTRLPLANE-3022: Add osImageStream to NodePool spec and status (@sdminonne)
CNTRLPLANE-3552: Multi-stream CoreOS metadata parsing and stream resolution #8669 — CNTRLPLANE-3552: Multi-stream CoreOS metadata parsing and stream resolution (@jparrill)

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.
This change includes integration tests.

Test plan

go build ./hypershift-operator/... — compiles
go test ./hypershift-operator/controllers/nodepool/... -count=1 — unit tests pass
go test -tags=integration ./test/integration/osstreams/... -count=1 — integration tests pass
make verify — lint and generation pass (only verify-git-clean expected to fail pre-merge)

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added support for multiple OS streams (RHEL-9 and RHEL-10) in node pool configurations.
- Added stream selection logic to automatically determine the appropriate stream based on release version and workload configuration.
Improvements
- Refactored cloud provider image resolution to use improved metadata handling.
- Enhanced validation and error messages for missing or invalid platform-specific image data across AWS, Azure, GCP, OpenStack, PowerVS, and KubeVirt providers.

Replace 18 custom CoreOS stream metadata Go types with canonical equivalents from github.com/coreos/stream-metadata-go v0.4.11. This eliminates duplicated type definitions and gains upstream helper methods (e.g. GetAMI(), URN()), laying groundwork for the dual-stream RHEL NodePool feature. Key type mappings: - CoreOSStreamMetadata -> stream.Stream - CoreOSArchitecture -> stream.Arch - CoreRHCOSImage -> *rhcos.Extensions (pointer) - CoreOSAWSImages -> *stream.AwsImage (pointer) - CoreOSGCPImage -> *stream.GcpImage (pointer) - CoreOSPowerVSImage -> *stream.SingleObject - CoreOSKubevirtImages -> *stream.ContainerImage (pointer) - HyperVGen1/HyperVGen2 -> Gen1/Gen2 - SHA256 -> Sha256, URL -> Url (PowerVS) Pure refactor with no behavioral changes. All platform controllers updated with nil checks for pointer-typed upstream fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…m resolution Add support for parsing the new multi-stream boot image ConfigMap format introduced in OCP 5.0 payloads. The ConfigMap now carries a "streams" key alongside the legacy "stream" key, mapping stream names (rhel-9, rhel-10) to per-architecture boot image metadata. - Update DeserializeImageMetadata to parse both "streams" and "stream" keys, returning the parsed OSStreams map alongside the default metadata - Add OSStreams field to ReleaseImage for holding per-stream metadata - Add StreamForName convenience method on ReleaseImage for stream lookup - Add GetRHELStream pure function implementing the stream resolution table from the dual-stream RHEL enhancement - Add 5.0 boot image fixture extracted from 5.0.0-ec.2 release payload Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

Integration test that validates the complete flow from real 5.0 EC payload parsing through stream resolution to boot image lookup: - Parse multi-stream ConfigMap from 5.0.0-ec.2 payload fixture - Resolve RHEL stream via GetRHELStream for each scenario - Look up stream-specific boot images via StreamForName - Verify correct AWS AMI, GCP image, aarch64 AMI, and KubeVirt digest-ref for the resolved stream Covers realistic 5.0+ scenarios only (implicit default, explicit rhel-9/rhel-10, runc fallback, error cases) plus legacy 4.10 backward compatibility with real fixture data. Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

Refactor defaultNodePoolAMI() to accept *stream.Stream instead of *releaseinfo.ReleaseImage, decoupling the AWS boot image resolver from the global StreamMetadata. Callers (resolveAWSAMI, setAWSConditions, setKarpenterAMILabels) resolve the stream internally via StreamForName(""), preserving backward compatibility. This is Phase 1 step 3 (AWS) of the dual-stream RHEL enhancement (OCPSTRAT-3014). The same pattern will be applied to other platform resolvers in CNTRLPLANE-3027. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

Add TestBootImageStreamResolution with AWS subtests covering the end-to-end flow from HostedCluster + NodePool + ReleaseImage through ResolveAWSAMI. Tests multi-stream payload resolution, user AMI override precedence, legacy 4.x backward compatibility, unsupported architecture and missing region error paths. Structured with t.Run("AWS", ...) so future providers (GCP, KubeVirt, etc.) are added as new subtests in CNTRLPLANE-3027. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

openshift-merge-bot · 2026-06-09T10:12:14Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci · 2026-06-09T10:12:16Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2026-06-09T10:12:16Z

@jparrill: This pull request references CNTRLPLANE-3026 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it

Phase 1 step 3 (AWS) of the Dual-Stream RHEL 9/10 NodePool enhancement (OCPSTRAT-3014). Decouples defaultNodePoolAMI() from ReleaseImage so it accepts *stream.Stream directly, enabling stream-aware boot image resolution.

Changes:

defaultNodePoolAMI() — accepts *stream.Stream instead of *releaseinfo.ReleaseImage (core decoupling)

ResolveAWSAMI() — exported (was resolveAWSAMI), resolves stream internally via StreamForName("")

setAWSConditions() — resolves stream internally via StreamForName("")

setKarpenterAMILabels() — resolves stream internally via StreamForName("")

All callers pass "" for now (backward compatible). When CNTRLPLANE-3553 wires the NodePool API field, only the "" arguments change.

Integration tests:

TestBootImageStreamResolution/AWS — 7 test cases covering multi-stream resolution, user AMI override, legacy 4.x backward compat, missing region, unsupported arch, nil metadata

This establishes the pattern for other platform resolvers (GCP, Azure, KubeVirt) in CNTRLPLANE-3027.

Which issue(s) this PR fixes

Fixes CNTRLPLANE-3026

Dependencies

Depends on #8692 (CNTRLPLANE-3552: multi-stream metadata parsing)

Depends on #8675 (CNTRLPLANE-3022: NodePool API types from Dario)

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

This change includes integration tests.

Test plan

go build ./hypershift-operator/... — compiles

go test ./hypershift-operator/controllers/nodepool/... -count=1 — unit tests pass

go test -tags=integration ./test/integration/osstreams/... -count=1 — integration tests pass

make verify — lint and generation pass (only verify-git-clean expected to fail pre-merge)

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-06-09T10:12:29Z

📝 Walkthrough

Walkthrough

This PR migrates HyperShift's internal release image metadata model to use the external github.com/coreos/stream-metadata-go package. The ReleaseImage struct now embeds *stream.Stream for StreamMetadata and adds an OSStreams map for multi-stream payloads. A new StreamForName method enables querying either the default stream or named OS streams. DeserializeImageMetadata now handles both single and multi-stream ConfigMaps. The GetRHELStream helper determines the appropriate RHEL CoreOS stream (rhel-9 or rhel-10) based on release version and runc enablement. All platform-specific image resolvers (AWS, Azure, GCP, OpenStack, PowerVS, KubeVirt) and their tests are updated to use the new metadata structure. Test fixtures include a new 5.0 CoreOS boot images fixture with multi-stream metadata, and comprehensive integration tests validate stream resolution across OCP versions.

Suggested reviewers

sdminonne

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Structure And Quality	⚠️ Warning	Tests lack meaningful assertion failure messages; 188+ naked Expect() calls across 7 test files have no diagnostic text to help debug failures.	Add meaningful failure messages to all Expect() assertions using Gomega's second parameter (e.g., Expect(err).ToNot(HaveOccurred(), "failed to resolve stream metadata"))

✅ Passed checks (10 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: decoupling AWS AMI resolution to enable dual-stream (RHEL 9/10) support, which is the primary objective of this PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	All test names in the PR are static and deterministic. No dynamic values (fmt.Sprintf, string concatenation, timestamps, UUIDs, pod names, namespaces) were found in test titles across all test files.
Topology-Aware Scheduling Compatibility	✅ Passed	PR refactors release metadata structures and AMI resolution logic only; no Deployments, Pods, or scheduling constraints are added or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	New test file uses standard Go tests, not Ginkgo e2e tests. Tests use embedded fixtures with no IPv4 assumptions or external connectivity requirements.
No-Weak-Crypto	✅ Passed	No weak crypto detected: PR modifies boot image metadata and nodepool controllers without using MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, or unsafe secret comparisons.
Container-Privileges	✅ Passed	No container/pod specifications with privileged configurations found. PR contains 27 Go source files, 1 go.mod, and 1 K8s ConfigMap fixture (metadata only, not a pod/container spec).
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data is logged. All new logging contains only public metadata: release images, AMI IDs, stream names, configuration values, and generic operational errors.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-06-09T10:13:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2026-06-09T10:20:59Z

Codecov Report

❌ Patch coverage is 70.62937% with 42 lines in your changes missing coverage. Please review.
✅ Project coverage is 41.51%. Comparing base (ad3da77) to head (b59120e).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
hypershift-operator/controllers/nodepool/aws.go	38.09%	13 Missing ⚠️
support/releaseinfo/testutils/testutils.go	0.00%	10 Missing ⚠️
...ypershift-operator/controllers/nodepool/powervs.go	0.00%	7 Missing ⚠️
...operator/controllers/nodepool/kubevirt/kubevirt.go	25.00%	2 Missing and 1 partial ⚠️
...erator/controllers/nodepool/nodepool_controller.go	70.00%	2 Missing and 1 partial ⚠️
hypershift-operator/controllers/nodepool/token.go	40.00%	2 Missing and 1 partial ⚠️
support/releaseinfo/registryclient_provider.go	0.00%	2 Missing ⚠️
hypershift-operator/controllers/nodepool/azure.go	94.44%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8699      +/-   ##
==========================================
+ Coverage   41.49%   41.51%   +0.02%     
==========================================
  Files         756      757       +1     
  Lines       93648    93732      +84     
==========================================
+ Hits        38855    38917      +62     
- Misses      52057    52078      +21     
- Partials     2736     2737       +1

Files with missing lines	Coverage Δ
...erator/controllers/nodepool/openstack/openstack.go	`76.22% <100.00%> (-0.20%)`	⬇️
hypershift-operator/controllers/nodepool/stream.go	`100.00% <100.00%> (ø)`
support/releaseinfo/deserialize.go	`90.00% <100.00%> (+50.00%)`	⬆️
support/releaseinfo/registry_mirror_provider.go	`45.83% <100.00%> (+2.35%)`	⬆️
support/releaseinfo/releaseinfo.go	`51.00% <100.00%> (+5.14%)`	⬆️
hypershift-operator/controllers/nodepool/azure.go	`89.17% <94.44%> (-1.41%)`	⬇️
support/releaseinfo/registryclient_provider.go	`0.00% <0.00%> (ø)`
...operator/controllers/nodepool/kubevirt/kubevirt.go	`68.70% <25.00%> (-0.53%)`	⬇️
...erator/controllers/nodepool/nodepool_controller.go	`42.98% <70.00%> (-0.15%)`	⬇️
hypershift-operator/controllers/nodepool/token.go	`81.81% <40.00%> (-0.73%)`	⬇️
... and 3 more

Flag	Coverage Δ
cmd-support	`34.97% <76.92%> (+0.09%)`	⬆️
cpo-hostedcontrolplane	`43.50% <ø> (ø)`
cpo-other	`43.17% <ø> (ø)`
hypershift-operator	`51.55% <67.03%> (-0.02%)`	⬇️
other	`31.64% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jparrill · 2026-06-09T13:37:13Z

/test e2e-aws

jparrill · 2026-06-09T13:37:20Z

/test verify

openshift-ci · 2026-06-09T13:37:23Z

@jparrill: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test e2e-aks

/test e2e-aks-4-22

/test e2e-aks-override

/test e2e-aws

/test e2e-aws-4-22

/test e2e-aws-override

/test e2e-aws-upgrade-hypershift-operator

/test e2e-azure-self-managed

/test e2e-kubevirt-aws-ovn-reduced

/test e2e-v2-aws

/test e2e-v2-gke

/test images

/test okd-scos-images

/test security

/test verify-deps

The following commands are available to trigger optional jobs:

/test address-review-comments

/test agentic-qe-aws

/test e2e-agent-connected-ovn-ipv4-metal-backuprestore

/test e2e-aws-autonode

/test e2e-aws-external-oidc-techpreview

/test e2e-aws-metrics

/test e2e-aws-minimal

/test e2e-aws-techpreview

/test e2e-azure-aks-external-oidc-techpreview

/test e2e-azure-aks-ovn-conformance

/test e2e-azure-kubevirt-ovn

/test e2e-azure-v2-self-managed

/test e2e-conformance

/test e2e-kubevirt-aws-ovn

/test e2e-kubevirt-azure-ovn

/test e2e-kubevirt-metal-ovn-backuprestore

/test e2e-openstack-aws

/test e2e-openstack-aws-conformance

/test e2e-openstack-aws-csi-cinder

/test e2e-openstack-aws-csi-manila

/test e2e-openstack-aws-nfv

/test e2e-v2-aws-backuprestore

/test okd-scos-e2e-aws-ovn

/test reqserving-e2e-aws

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-hypershift-main-images

pull-ci-openshift-hypershift-main-okd-scos-images

pull-ci-openshift-hypershift-main-security

pull-ci-openshift-hypershift-main-verify-deps

Details

In response to this:

/test verify

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-06-09T15:41:56Z

@jparrill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

cwbotbot · 2026-06-09T15:50:03Z

Test Results

e2e-aws

Status: ✅ PASS
Started: 2026-06-09T13:37:26Z
View Job
View Job History

sdminonne and others added 5 commits June 8, 2026 13:03

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 9, 2026

openshift-ci Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/needs-area labels Jun 9, 2026

jparrill mentioned this pull request Jun 10, 2026

CNTRLPLANE-3027: Decouple all platform boot image resolvers for dual-stream support #8709

Draft

9 tasks

Conversation

jparrill commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Which issue(s) this PR fixes

Dependencies (must merge first)

Checklist

Test plan

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jun 9, 2026

Uh oh!

openshift-ci Bot commented Jun 9, 2026

Uh oh!

openshift-ci-robot commented Jun 9, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Which issue(s) this PR fixes

Dependencies

Checklist

Test plan

Uh oh!

coderabbitai Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Suggested reviewers

❌ Failed checks (1 warning)

Uh oh!

openshift-ci Bot commented Jun 9, 2026

Uh oh!

codecov Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jparrill commented Jun 9, 2026

Uh oh!

jparrill commented Jun 9, 2026

Uh oh!

openshift-ci Bot commented Jun 9, 2026

Uh oh!

openshift-ci Bot commented Jun 9, 2026

Uh oh!

cwbotbot commented Jun 9, 2026

Test Results

e2e-aws

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jparrill commented Jun 9, 2026 •

edited

Loading

openshift-ci-robot commented Jun 9, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading

codecov Bot commented Jun 9, 2026 •

edited

Loading