CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift by jparrill · Pull Request #2950 · openshift/api

jparrill · 2026-07-23T23:34:43Z

Summary

Promote the OSStreams feature gate from TechPreviewNoUpgrade to Default for the Hypershift cluster profile. This enables RHEL 9/10 dual-stream support for hosted control planes by default.

What changed

features/features.go: Added inDefault(), inOKD() to the Hypershift profile enable line for FeatureGateOSStreams

Dependency chain

openshift/release#82438 → temporary CI job with TechPreview on hosted cluster (merged first to validate)
openshift/hypershift#9099 → removes StreamRHEL9 hardcode, dynamic resolution
This PR → graduates OSStreams FG to Default for Hypershift (after E2E validation)
After this merges → remove temporary CI job and lifecycle label from osimagestream tests

Already merged

openshift/machine-config-operator#6308 — remove ExternalTopologyMode guard from OSImageStream bootstrap

Fixes

https://issues.redhat.com/browse/CNTRLPLANE-3871

🤖 Generated with Claude Code

…Hypershift With the MCO ExternalTopologyMode guard removed (openshift/machine-config-operator#6308), HyperShift clusters can now process OSImageStream during bootstrap. This graduates the OSStreams feature gate from TechPreviewNoUpgrade to Default for the Hypershift cluster profile, enabling RHEL 9/10 dual-stream support for hosted control planes by default. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> Signed-off-by: Juan Manuel Parrilla Madrid <[email protected]>

openshift-merge-bot · 2026-07-23T23:34:45Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-23T23:34:47Z

@jparrill: This pull request references CNTRLPLANE-3871 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Promote the OSStreams feature gate from TechPreviewNoUpgrade to Default for the Hypershift cluster profile. This enables RHEL 9/10 dual-stream support for hosted control planes by default.

What changed

features/features.go: Added inDefault(), inOKD() to the Hypershift profile enable line for FeatureGateOSStreams

CRD manifests consolidated: per-profile CRDs (-Hypershift-*, -SelfManagedHA) merged into single profile-less CRDs since OSStreams is now enabled across all profiles

Feature gate payload manifests updated: featureGate-4-10-Hypershift-Default.yaml and featureGate-4-10-Hypershift-OKD.yaml now list OSStreams as enabled

Why now

The MCO ExternalTopologyMode guard that previously excluded HyperShift from OSImageStream processing was removed in openshift/machine-config-operator#6308. HyperShift now writes 99_osimagestream.yaml into the MCC template directory (openshift/hypershift#8792), allowing MCO bootstrap to discover and serve the correct OS stream. The prerequisite conversations mentioned in #2849 have been resolved.

Fixes

https://issues.redhat.com/browse/CNTRLPLANE-3871

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-23T23:34:59Z

Hello @jparrill! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

coderabbitai · 2026-07-23T23:35:06Z

📝 Walkthrough

Walkthrough

OSStreams enablement was updated to include the Hypershift cluster profile, and its state was changed from disabled to enabled in the Hypershift Default and OKD feature-gate manifests. Its feature listing position was also changed. MachineConfigPool and OSImageStream CRDs received IBM Cloud Managed release annotations. Hypershift-specific MachineConfigPool and OSImageStream CRD manifests were removed.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles were added or changed; the PR only touches feature flags, docs, and generated manifests.
Test Structure And Quality	✅ Passed	No Ginkgo test files were changed; this PR only updates feature-gate/CRD manifests, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo/e2e test files were added; the commit only changes feature-gate code and manifests, so MicroShift compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new *_test.go or Ginkgo e2e files were added; the diff only changes feature-gate config and CRD/manifest YAML.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only changes OSStreams feature-gate enablement and CRD/payload manifests; no node selectors, affinity, spread constraints, replicas, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	Only features/features.go changed; it adds an OSStreams enablement clause and no main/init/TestMain/suite code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the diff only changes feature gates, CRDs, and manifest/docs files, with no IPv4 or external-network test code.
No-Weak-Crypto	✅ Passed	Diff only changes OSStreams feature-gate lists and CRD manifests; no weak crypto APIs, constants, or secret/token comparisons appear.
Container-Privileges	✅ Passed	Changed files are FeatureGate/CRD manifests only, and scans found no privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation/runAsUser:0 fields.
No-Sensitive-Data-In-Logs	✅ Passed	Touched files are feature-gate/CRD YAML and one feature definition; no new log calls or sensitive strings (tokens, passwords, PII, hostnames) were introduced.
Title check	✅ Passed	The title matches the main change: promoting OSStreams to Default for the Hypershift profile.
Description check	✅ Passed	The description is directly related and accurately describes the feature-gate promotion for Hypershift.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-23T23:35:32Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign everettraven for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

qodo-for-rh-openshift · 2026-07-23T23:36:38Z

PR Summary by Qodo

Promote OSStreams feature gate to Default/OKD for HyperShift and consolidate CRDs

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 40+ Minutes

AI Description

• Enable OSStreams by default for HyperShift Default/OKD feature sets (RHEL 9/10 dual-stream).
• Consolidate per-profile MachineConfigPool/OSImageStream CRDs into shared, profile-less manifests.
• Update HyperShift feature gate payload manifests and feature gate documentation accordingly.

Diagram

graph TD
  A["features/features.go"] --> B["HyperShift profile"] --> C["FeatureGate payload"] --> D["OSStreams enabled"] --> E["Shared CRDs"] --> F["MCO bootstrap"]
  C --> C1["featureGate-4-10-HS-Default"]
  C --> C2["featureGate-4-10-HS-OKD"]
  E --> E1["OSImageStream CRD"]
  E --> E2["MachineConfigPool CRD"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep per-profile CRD variants (no consolidation)

➕ Lower risk if any downstream tooling implicitly depends on the per-profile CRD filenames or release annotations
➖ Continues duplication/maintenance burden across Hypershift feature sets
➖ Makes future schema changes more error-prone due to multiple generated copies

2. Gate CRD inclusion instead of consolidating (retain shared CRD but conditional release annotations)

➕ Preserves a single CRD source while still allowing differentiated payload composition if needed later
➖ Adds complexity to release annotation logic and testing matrix
➖ Still requires careful reasoning about which profiles receive which CRDs

Recommendation: The PR’s approach (promote OSStreams for HyperShift Default/OKD and remove redundant per-profile CRD copies) is the best long-term maintenance choice, assuming no consumers depend on the removed per-profile CRD filenames. Review should focus on verifying payload composition remains correct for all feature sets and that the shared CRDs include the required release annotations (e.g., ibm-cloud-managed/self-managed-ha) previously covered by the profile-specific copies.

Files changed (9) +13 / -8

Enhancement (1) +1 / -1

features.goEnable OSStreams for HyperShift Default/OKD feature sets +1/-1

Enable OSStreams for HyperShift Default/OKD feature sets

• Extends the HyperShift profile enablement for FeatureGateOSStreams to include Default and OKD feature sets (in addition to preview/no-upgrade sets). This promotes OSStreams to be on-by-default for hosted control planes in those feature sets.

features/features.go

Documentation (1) +1 / -1

features.mdRefresh OSStreams feature gate documentation entry +1/-1

Refresh OSStreams feature gate documentation entry

• Adjusts the OSStreams row placement in the generated feature-gate table while keeping its enabled status reflected across relevant sets. This aligns docs with the promotion of OSStreams for HyperShift Default/OKD.

features.md

Other (7) +11 / -6

0000_80_machine-config_01_machineconfigpools.crd.yamlAdd ibm-cloud-managed inclusion annotation to shared MachineConfigPool CRD +1/-0

Add ibm-cloud-managed inclusion annotation to shared MachineConfigPool CRD
• Updates the shared MachineConfigPool CRD manifest annotations to include ibm-cloud-managed release inclusion. This supports consolidating away per-profile MachineConfigPool CRD variants.
machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigpools.crd.yaml

0000_80_machine-config_01_osimagestreams.crd.yamlAdd ibm-cloud-managed inclusion annotation to shared OSImageStream v1 CRD +1/-0

Add ibm-cloud-managed inclusion annotation to shared OSImageStream v1 CRD
• Updates the shared OSImageStream (v1) CRD manifest annotations to include ibm-cloud-managed release inclusion. This accompanies removal of the HyperShift-specific OSImageStream CRD copy.
machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_osimagestreams.crd.yaml

0000_80_machine-config_01_osimagestreams.crd.yamlAdd ibm-cloud-managed inclusion annotation to shared OSImageStream v1alpha1 CRD +1/-0

Add ibm-cloud-managed inclusion annotation to shared OSImageStream v1alpha1 CRD
• Updates the shared OSImageStream (v1alpha1) CRD manifest annotations to include ibm-cloud-managed release inclusion. This aligns v1alpha1 packaging with the consolidated CRD strategy.
machineconfiguration/v1alpha1/zz_generated.crd-manifests/0000_80_machine-config_01_osimagestreams.crd.yaml

0000_80_machine-config_01_machineconfigpools.crd.yamlAdd ibm-cloud-managed inclusion annotation to payload MachineConfigPool CRD +1/-0

Add ibm-cloud-managed inclusion annotation to payload MachineConfigPool CRD
• Mirrors the CRD-manifest change in the release payload copy of the MachineConfigPool CRD by adding ibm-cloud-managed inclusion. Ensures payload CRDs are profile-less and included where expected.
payload-manifests/crds/0000_80_machine-config_01_machineconfigpools.crd.yaml

0000_80_machine-config_01_osimagestreams.crd.yamlAdd ibm-cloud-managed inclusion annotation to payload OSImageStream CRD +1/-0

Add ibm-cloud-managed inclusion annotation to payload OSImageStream CRD
• Mirrors the CRD-manifest change in the release payload copy of the OSImageStream CRD by adding ibm-cloud-managed inclusion. Supports removing the HyperShift-specific payload CRD file.
payload-manifests/crds/0000_80_machine-config_01_osimagestreams.crd.yaml

featureGate-4-10-Hypershift-Default.yamlList OSStreams as enabled in HyperShift Default FeatureGate payload +3/-3

List OSStreams as enabled in HyperShift Default FeatureGate payload
• Moves OSStreams into the enabled features list position consistent with other Default-enabled gates. Ensures HyperShift Default payload explicitly enables OSStreams.
payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

featureGate-4-10-Hypershift-OKD.yamlList OSStreams as enabled in HyperShift OKD FeatureGate payload +3/-3

List OSStreams as enabled in HyperShift OKD FeatureGate payload
• Moves OSStreams into the enabled features list position consistent with other OKD-enabled gates. Ensures HyperShift OKD payload explicitly enables OSStreams.
payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

qodo-for-rh-openshift · 2026-07-23T23:40:44Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

jparrill · 2026-07-23T23:45:38Z

/test verify-hypershift-integration

qodo-for-rh-openshift · 2026-07-23T23:46:04Z

PR-Agent: could not find a component named verify-hypershift-integration in a supported language in this PR.

openshift-ci · 2026-07-24T00:26:08Z

@jparrill: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-hypershift-integration	`c802f2d`	link	true	`/test verify-hypershift-integration`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

…boot images Replace hardcoded StreamRHEL9 with dynamic resolution via getRHELStreamForBootImage across all platform controllers (AWS, OpenStack, KubeVirt) and the central ConfigGenerator. With MCO PR openshift/machine-config-operator#6308 merged and the OSStreams feature gate promoted to Default for Hypershift (openshift/api#2950), the MCO can now process OSImageStream during bootstrap. NodePools can resolve the correct RHEL stream (9 or 10) based on release version, explicit spec.osImageStream, and container runtime configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> Signed-off-by: Juan Manuel Parrilla Madrid <[email protected]>

JoelSpeed · 2026-07-24T10:41:22Z

 				enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()).
-				enable(inClusterProfile(Hypershift), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
+				enable(inClusterProfile(Hypershift), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()).


We can condense this

Suggested change

enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()).

enable(inClusterProfile(Hypershift), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).

enable(inClusterProfile(Hypershift), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()).

enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()).

JoelSpeed · 2026-07-24T10:53:09Z

@jparrill I'm trying to find any testing of the osstreams feature on hypershift, I may be holding sippy wrong but filtering to toplogy:external gives me no results, any idea?

jparrill · 2026-07-24T11:03:50Z

Hey @JoelSpeed Yes they are, but it's not testing the feature properly, let me explain:

Until now we've hardcoded the output of the E2E in order to not break our pipelines
Yesterday a PR was merged on MCO to serve the right RHEL Version to hypershift
I have another PR which removes that hardcoded part from the code and E2E (CNTRLPLANE-3871: resolve RHEL stream dynamically for boot images hypershift#9099)

From your question and the email about stabilization I assume we need at least 14 consistent runs of the e2e (without things hardcoded), am I right?

If that so, we will need the other PR merged before this move ahead. If you know any other way to move on, please let me know.

JoelSpeed · 2026-07-24T11:09:00Z

From your question and the email about stabilization I assume we need at least 14 consistent runs of the e2e (without things hardcoded), am I right?

This is the general expectation yes. We want to see data that shows that the feature is stable before we consider it promoted. Is the dynamic resolution of the boot image gated behind this feature gate?

enxebre · 2026-07-24T11:19:55Z

  annotations:
    api-approved.openshift.io: https://github.com/openshift/api/pull/2555
    api.openshift.io/merged-by-featuregates: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"


don't think we want this

This resource has been shipped on HCP TP the whole time, this PR is consolidating the files now they no longer carry a diff

Was it a mistake to be shipping this on HCP?

… on hosted clusters in e2e-v2-aws Set GUEST_FEATURE_SET=TechPreviewNoUpgrade so the hosted cluster MCO processes OSImageStream manifests. This is needed to validate the dual-stream RHEL 9/10 feature (OSStreams) in HyperShift E2E tests. This is a temporary measure: once the E2E tests pass consistently, we can graduate the OSStreams feature gate to Default for Hypershift (openshift/api#2950), after which GUEST_FEATURE_SET can be reverted back to Default since OSStreams will be active without TechPreview. The management cluster HO already runs with TechPreview via TECH_PREVIEW_NO_UPGRADE, but the hosted cluster was using Default, causing the MCO to ignore the 99_osimagestream.yaml manifest written by the ignition-server. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> Signed-off-by: Juan Manuel Parrilla Madrid <[email protected]>

…gestream job Add a dedicated CI job that creates the hosted cluster with TechPreviewNoUpgrade feature set to validate OSImageStream (dual-stream RHEL 9/10) in HyperShift E2E tests. The e2e-v2-aws job creates hosted clusters with Default feature set, where the MCO ignores 99_osimagestream.yaml because OSStreams FG is not active. This new job runs only the nodepool-osimagestream tests against a TechPreview hosted cluster. TODO(CNTRLPLANE-3871): Remove this job after the OSStreams feature gate is graduated to Default for the Hypershift cluster profile (openshift/api#2950). After graduation, the osimagestream tests can move back to the standard e2e-v2-aws workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> Signed-off-by: Juan Manuel Parrilla Madrid <[email protected]>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 23, 2026

openshift-ci Bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jul 23, 2026

jparrill changed the title ~~feat: CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift~~ CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift Jul 23, 2026

openshift-ci Bot requested review from everettraven and yuqi-zhang July 23, 2026 23:35

jparrill mentioned this pull request Jul 24, 2026

CNTRLPLANE-3871: resolve RHEL stream dynamically for boot images openshift/hypershift#9099

Open

JoelSpeed reviewed Jul 24, 2026

View reviewed changes

enxebre reviewed Jul 24, 2026

View reviewed changes

jparrill mentioned this pull request Jul 25, 2026

CNTRLPLANE-3871: add temporary e2e-v2-aws-techpreview-osimagestream job openshift/release#82438

Open

Uh oh!

Conversation

jparrill commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Dependency chain

Already merged

Fixes

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

openshift-ci-robot commented Jul 23, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Why now

Fixes

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026

PR Summary by Qodo

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026

Code Review by Qodo

Great, no issues found!

Uh oh!

jparrill commented Jul 23, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Jul 24, 2026

Uh oh!

JoelSpeed Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

JoelSpeed commented Jul 24, 2026

Uh oh!

jparrill commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JoelSpeed commented Jul 24, 2026

Uh oh!

enxebre Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

JoelSpeed Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jparrill commented Jul 23, 2026 •

edited

Loading

openshift-ci-robot commented Jul 23, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 23, 2026 •

edited

Loading

jparrill commented Jul 24, 2026 •

edited

Loading