Configure CVP pools to use existing VPCs

[nmars]

Let CVP clusterpools use pre-existing, managed VPCs as was done in #71769 for Konflux

Closes: CVP-4591

Summary by CodeRabbit

Configures CVP cluster pools across nine AWS regions to deploy into pre-existing managed VPCs by explicitly specifying the approved subnet IDs in both standard and FIPS install configurations.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@nmars: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

Walkthrough

The embedded AWS install configurations for 18 CVP cluster-pool Secret manifests now include explicit regional subnet lists, with four to eight subnet IDs specified per region.

Changes

AWS subnet configuration

Layer / File(s)	Summary
Regional subnet lists clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-*_secret.yaml, clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-*_secret.yaml	Adds platform.aws.subnets to the embedded install configurations across nine AWS regions. Most regions specify five subnet IDs; us-east-1 specifies seven, and us-west-1 and us-west-2 specify four and eight respectively.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: gdbranco

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only YAML secret manifests changed; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality	✅ Passed	PR only changes 18 YAML secret manifests; no Ginkgo/test code was modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes YAML install-config secrets; no new Ginkgo tests or MicroShift-sensitive APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Diff only updates YAML install-config secrets; no Go/Ginkgo e2e tests or SNO-sensitive test logic were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only install-config Secret YAMLs changed, adding AWS subnet lists; no new affinity, selectors, tolerations, spread, or replica logic was introduced.
Ote Binary Stdout Contract	✅ Passed	Only YAML manifests changed; no main/TestMain/suite setup or stdout-using process code was modified, so the stdout contract is unaffected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only updates YAML install-config secrets; no It/Describe/Context/When or test code was added.
No-Weak-Crypto	✅ Passed	Diffs only add AWS subnet lists in YAML secrets; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges	✅ Passed	Changed manifests only add AWS subnet lists to install-config Secrets; no privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation fields were present.
No-Sensitive-Data-In-Logs	✅ Passed	Touched files are YAML Secrets that only add AWS subnet lists; no logging statements or log output exposing sensitive data was introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: CVP pools are being configured to use existing VPCs via subnet settings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-central-1_secret.yaml (1)

43-49: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Use the non-deprecated VPC subnet schema in every regional Secret.

The embedded configurations currently rely on the installer’s deprecated-field conversion. Change each subnets block to nest under platform.aws.vpc directly.

• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-central-1_secret.yaml#L43-L49: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-north-1_secret.yaml#L43-L49: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-west-1_secret.yaml#L43-L49: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-west-2_secret.yaml#L43-L49: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-eu-west-3_secret.yaml#L42-L48: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-east-1_secret.yaml#L42-L50: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-east-2_secret.yaml#L42-L48: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-west-1_secret.yaml#L42-L46: nest the subnet list under vpc.
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-west-2_secret.yaml#L42-L50: nest the subnet list under vpc.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-central-1_secret.yaml`
around lines 43 - 49, Update the subnets blocks in all nine listed regional
Secret files and nest each subnet list directly under platform.aws.vpc,
preserving the existing subnet values and indentation. Apply this schema change
to every anchor and sibling site:
fips-install-config-aws-eu-central-1_secret.yaml (43-49),
fips-install-config-aws-eu-north-1_secret.yaml (43-49),
fips-install-config-aws-eu-west-1_secret.yaml (43-49),
fips-install-config-aws-eu-west-2_secret.yaml (43-49),
install-config-aws-eu-west-3_secret.yaml (42-48),
install-config-aws-us-east-1_secret.yaml (42-50),
install-config-aws-us-east-2_secret.yaml (42-48),
install-config-aws-us-west-1_secret.yaml (42-46), and
install-config-aws-us-west-2_secret.yaml (42-50).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-central-1_secret.yaml`:
- Around line 43-49: Update the subnets blocks in all nine listed regional
Secret files and nest each subnet list directly under platform.aws.vpc,
preserving the existing subnet values and indentation. Apply this schema change
to every anchor and sibling site:
fips-install-config-aws-eu-central-1_secret.yaml (43-49),
fips-install-config-aws-eu-north-1_secret.yaml (43-49),
fips-install-config-aws-eu-west-1_secret.yaml (43-49),
fips-install-config-aws-eu-west-2_secret.yaml (43-49),
install-config-aws-eu-west-3_secret.yaml (42-48),
install-config-aws-us-east-1_secret.yaml (42-50),
install-config-aws-us-east-2_secret.yaml (42-48),
install-config-aws-us-west-1_secret.yaml (42-46), and
install-config-aws-us-west-2_secret.yaml (42-50).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: bf1bac71-1347-46e2-b691-cfc292be89dc

📥 Commits

Reviewing files that changed from the base of the PR and between 64e7ba1 and 3520a96.

📒 Files selected for processing (18)

• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-central-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-north-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-west-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-west-2_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-eu-west-3_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-us-east-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-us-east-2_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-us-west-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/fips-install-config-aws-us-west-2_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-eu-central-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-eu-north-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-eu-west-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-eu-west-2_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-eu-west-3_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-east-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-east-2_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-west-1_secret.yaml
• clusters/hosted-mgmt/hive/pools/cvp/install-config-aws-us-west-2_secret.yaml

[openshift-ci]

@nmars: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: asergienk, maneeshmehra, nmars

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/hosted-mgmt/hive/pools/cvp/OWNERS [asergienk,maneeshmehra,nmars]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment