From f2dc006534332b36bb484caf95c52ab36b70f69b Mon Sep 17 00:00:00 2001
From: Chai Bot <chai-bot@redhat.com>
Date: Tue, 1 Sep 2026 16:35:09 +0000
Subject: [PATCH] OCPNODE: cover graceful shutdown kubelet config validation

---
 .coderabbit.yaml                              |  6 +++
 .../kubelet_config_controller_test.go         | 37 +++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 .coderabbit.yaml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000000..2df3d8702e
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,6 @@
+inheritance: true
+reviews:
+  path_instructions:
+    - path: "pkg/controller/kubelet-config/**"
+      instructions: |
+        Treat KubeletConfig override changes as platform-safety changes. Flag user overrides of platform-owned fields or feature gates, unaccounted MachineConfigPool rollout and reboot impact, and changes lacking Node-team review or focused validation coverage.
diff --git a/pkg/controller/kubelet-config/kubelet_config_controller_test.go b/pkg/controller/kubelet-config/kubelet_config_controller_test.go
index 8043498647..4273d629b9 100644
--- a/pkg/controller/kubelet-config/kubelet_config_controller_test.go
+++ b/pkg/controller/kubelet-config/kubelet_config_controller_test.go
@@ -7,6 +7,7 @@ import (
 	"sort"
 	"strings"
 	"testing"
+	"time"
 
 	ign3types "github.com/coreos/ignition/v2/config/v3_5/types"
 	"github.com/stretchr/testify/assert"
@@ -1018,6 +1019,42 @@ func TestKubeletConfigDenylistedOptions(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "user cannot configure shutdownGracePeriod through GracefulNodeShutdown",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				ShutdownGracePeriod: metav1.Duration{Duration: 30 * time.Second},
+				FeatureGates:        map[string]bool{"GracefulNodeShutdown": true},
+			},
+		},
+		{
+			name: "user cannot configure shutdownGracePeriodCriticalPods through GracefulNodeShutdown",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				ShutdownGracePeriodCriticalPods: metav1.Duration{Duration: 10 * time.Second},
+				FeatureGates:                    map[string]bool{"GracefulNodeShutdown": true},
+			},
+		},
+		{
+			name: "user cannot configure shutdownGracePeriodByPodPriority through GracefulNodeShutdownBasedOnPodPriority",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				ShutdownGracePeriodByPodPriority: []kubeletconfigv1beta1.ShutdownGracePeriodByPodPriority{{
+					Priority:                   0,
+					ShutdownGracePeriodSeconds: 30,
+				}},
+				FeatureGates: map[string]bool{"GracefulNodeShutdownBasedOnPodPriority": true},
+			},
+		},
+		{
+			name: "user cannot supply GracefulNodeShutdown feature gate",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				FeatureGates: map[string]bool{"GracefulNodeShutdown": true},
+			},
+		},
+		{
+			name: "user cannot supply GracefulNodeShutdownBasedOnPodPriority feature gate",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				FeatureGates: map[string]bool{"GracefulNodeShutdownBasedOnPodPriority": true},
+			},
+		},
 		{
 			name: "test banned failSwapOn",
 			config: &kubeletconfigv1beta1.KubeletConfiguration{