OCPBUGS-86052: Add Destroy Handling for AWS ISO Regions;

[rh-cbent]

• pkg/destroy/aws/aws.go
  • Switch out hardcoded region strings in error messages for their
    constants.
  • Add region tagging for AWS ISO and ISOB.
  • Add handling for US ISO East-1, West-1, and ISOB East-1 Destroy API
    Client creation.

Summary by CodeRabbit

• Bug Fixes
  • Improved hosted-zone cleanup across AWS ISO and ISOB partitions.
  • Hosted-zone tagging now uses the appropriate regional settings for supported AWS partitions, including China and GovCloud.
  • Corrected handling of ISO regions during destroy operations to ensure resources are tagged in the appropriate region.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@rh-cbent: This pull request references Jira Issue OCPBUGS-86052, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

• pkg/destroy/aws/aws.go
• Switch out hardcoded region strings in error messages for their constants.
• Add handling for US ISO East-1, West-1, and ISOB East-1 destroy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 15ff87d2-629a-495e-9f0b-ae094cbcce05

📥 Commits

Reviewing files that changed from the base of the PR and between 43ef4b6 and 1c56947.

📒 Files selected for processing (1)

• pkg/destroy/aws/aws.go

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The AWS destroyer now handles ISO and ISOB partition tagging regions. ISO regions create an additional tagging client when required. Tagging-client error messages use region constants.

Changes

AWS tagging partition handling

Layer / File(s)	Summary
Partition region selection and tagging clients pkg/destroy/aws/aws.go	The hosted-zone tagging switch maps ISO and ISOB partitions to their regions. ISO regions create a secondary us-iso-east-1 tagging client when needed. ISOB remains a no-op case. Error messages use region constants for China, GovCloud, and the default region.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 1c569

The AWS partition tagging changes do not show a concrete merge-blocking risk.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding AWS ISO region support to destroy handling. It is concise and directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only pkg/destroy/aws/aws.go. The diff contains no Ginkgo test files or test-title constructs such as It, Describe, Context, or When. Therefore, it introduces no unst…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only pkg/destroy/aws/aws.go, a production implementation file. The diff adds no Ginkgo test code, It blocks, fixtures, waits, or assertions. Therefore the listed tes…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only pkg/destroy/aws/aws.go. The diff adds AWS tagging-client logic and error-message updates; it adds no Ginkgo e2e tests (It, Describe, Context, or When). Th…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only pkg/destroy/aws/aws.go. The diff contains AWS destroyer production logic and error-message updates; it adds no Ginkgo e2e tests or other test cases. Therefore, the SNO …
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The authoritative diff changes only pkg/destroy/aws/aws.go. The changes add AWS ISO/ISOB tagging-region cases and update error-message constants in RunWithContext; they do not add or modify …
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only pkg/destroy/aws/aws.go. The added code selects AWS ISO/ISOB regions, creates tagging clients, and formats errors. It adds no fmt.Print*, os.Stdout, klog, Gink…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only pkg/destroy/aws/aws.go, which is production AWS destroyer code. The authoritative diff adds no Ginkgo tests, test files, or Ginkgo constructs such as It(), `Describe(…
No-Weak-Crypto	✅ Passed	The pull request changes only AWS region selection, tagging-client creation, and error-message formatting in pkg/destroy/aws/aws.go. The changed lines introduce no MD5, SHA1, DES, 3DES, RC4, Blowfis…
Container-Privileges	✅ Passed	The pull request changes only pkg/destroy/aws/aws.go. The patch contains no container or Kubernetes manifest changes and no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or `allowP…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only pkg/destroy/aws/aws.go. Its new error text contains fixed AWS region constants (us-iso-east-1, us-isob-east-1, us-gov-west-1, us-east-1) and does not incl…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands.}

[rh-cbent]

/jira refresh

[openshift-ci-robot]

@rh-cbent: This pull request references Jira Issue OCPBUGS-86052, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rh-cbent]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[openshift-ci-robot]

@rh-cbent: This pull request references Jira Issue OCPBUGS-86052, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

• pkg/destroy/aws/aws.go
• Switch out hardcoded region strings in error messages for their
  constants.
• Add region tagging for AWS ISO and ISOB.
• Add handling for US ISO East-1, West-1, and ISOB East-1 Destroy API
  Client creation.

Summary by CodeRabbit

• Bug Fixes
• Improved hosted-zone cleanup across AWS ISO and ISOB partitions.
• Hosted-zone tagging now uses the appropriate regional settings for supported AWS partitions, including China and GovCloud.
• Corrected handling of ISO regions during destroy operations to ensure resources are tagged in the appropriate region.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rh-cbent]

/cc @rochacbruno

[rh-cbent]

/cc @tthvo
/cc @patrickdillon

[tthvo]

/lgtm
/approve

Cross-referencing the aws-sdk-v2 endpoint specs confirms us-iso-east-1 is the region for route53 in C2S (us-iso).

Note: we don't officially support us-iso-west-1 region yet based on openshift docs, but this is a great preparation for that 👍

[openshift-ci]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tthvo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/destroy/aws/OWNERS [tthvo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tthvo]

/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn

[tthvo]

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-sc2s-ipi-disc-priv-fips-f7
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f7

[openshift-ci]

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-sc2s-ipi-disc-priv-fips-f7
• periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/11a63570-ae2e-11f1-954d-7feb9a315555-0

[openshift-ci]

@rh-cbent: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tthvo]

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-sc2s-ipi-disc-priv-fips-f7
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f7

[openshift-ci]

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-sc2s-ipi-disc-priv-fips-f7
• periodic-ci-openshift-openshift-tests-private-release-5.1-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b52ef1e0-ae52-11f1-9a20-cb9c1b7c1eb8-0