OCPBUGS-88531: Remove CPO-side restart logic for CNO operands

[bryan-cox]

Summary

• Remove redundant CPO-side restart-date annotation propagation for multus-admission-controller, network-node-identity, and ovnkube-control-plane
• CNO handles restart-date propagation to all its operands directly, making the CPO-side logic redundant

The cleanupClusterNetworkOperatorResources function previously contained logic to read hypershift.openshift.io/restart-date from the HCP and patch it onto CNO-managed deployments. CNO reads the annotation from HCP itself and sets it as a pod template annotation on all rendered workloads, so the CPO-side logic is unnecessary duplication.

Test plan

• Verify make build passes (confirmed locally)
• Deploy and confirm all CNO operands restart when restart-date annotation is set on HostedCluster
• CI: e2e-aws-ovn-hypershift-conformance, hypershift-e2e-aks

Summary by CodeRabbit

• Refactor
  • Simplified cluster network operator resource cleanup by removing restart-annotation handling for CNO-managed components.
  • Cleanup now focuses directly on removing the ovnkube-sbdb Route when applicable, and deleting the ovnkube-master-external and ovnkube-master-internal Services.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@bryan-cox: This pull request references Jira Issue OCPBUGS-88531, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove redundant CPO-side restart-date annotation propagation for multus-admission-controller, network-node-identity, and ovnkube-control-plane
• CNO now handles restart-date propagation to all its operands directly via OCPBUGS-88531: Propagate restart-date annotation to CNO operand pod templates cluster-network-operator#3030

The cleanupClusterNetworkOperatorResources function previously contained logic to read hypershift.openshift.io/restart-date from the HCP and patch it onto CNO-managed deployments. With the CNO fix, CNO reads the annotation from HCP itself and sets it as a pod template annotation on all rendered workloads, making the CPO-side logic redundant.

Test plan

• Verify make build passes (confirmed locally)
• Deploy with CNO PR HOSTEDCP-1205: Move network policies reconciliation to the CPO #3030 and confirm all CNO operands restart when restart-date annotation is set on HostedCluster
• CI: e2e-aws-ovn-hypershift-conformance, hypershift-e2e-aks

Co-Authored-By: Claude Opus 4.6 [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5495f9db-7cdf-40b4-8d41-853a82484354

📥 Commits

Reviewing files that changed from the base of the PR and between 923dc8e and 5682e1f.

📒 Files selected for processing (1)

• control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go

💤 Files with no reviewable changes (1)

• control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go

---

📝 Walkthrough

Walkthrough

In cleanupClusterNetworkOperatorResources on HostedControlPlaneReconciler, the 24-line block that read hyperv1.RestartDateAnnotation from the HostedControlPlane annotations and patched it onto the multus-admission-controller, network-node-identity, and ovnkube-control-plane deployments has been deleted. The function now proceeds directly to its remaining tasks: conditionally deleting the ovnkube-sbdb Route when hasRouteCap is true, and unconditionally deleting the ovnkube-master-external and ovnkube-master-internal Services.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: removing CPO-side restart logic for CNO operands, which aligns directly with the changeset that removes restart-date annotation propagation logic.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only controller code (hostedcontrolplane_controller.go), not test files. No Ginkgo tests to verify, so check is not applicable.
Test Structure And Quality	✅ Passed	The PR does not contain Ginkgo test code. The test file added uses standard Go unit testing with Gomega assertions, not Ginkgo BDD patterns (Describe, It, BeforeEach, Eventually, etc.), so the Gink...
Topology-Aware Scheduling Compatibility	✅ Passed	PR removes annotation propagation code from cleanupClusterNetworkOperatorResources; no new deployment manifests, scheduling constraints, affinity rules, topology spread constraints, nodeSelectors,...
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. The changes only remove 24 lines of annotation propagation logic from hostedcontrolplane_controller.go, making this check not applicable.
No-Weak-Crypto	✅ Passed	No weak cryptography detected. The PR removes annotation propagation logic, not crypto code. The file uses only standard Go crypto/rand for secure randomness.
Container-Privileges	✅ Passed	PR modifies Go controller code only (hostedcontrolplane_controller.go), removing restart annotation logic. No Kubernetes manifests, container specs, or security configurations present.
No-Sensitive-Data-In-Logs	✅ Passed	The modified cleanupClusterNetworkOperatorResources function contains no logging statements that expose passwords, tokens, API keys, PII, session IDs, internal hostnames, or customer data. Logging...

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hypershift-jira-solve-ci]

I now have all the evidence needed. The root cause is clear from the logs. Let me compile the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: gitlint / Gitlint (GitHub Actions workflow gitlint.yaml, run OCPBUGS-28576: backport API moves #3481)
• Build ID: 27681649294 / job 81870311607
• PR: OCPBUGS-88531: Remove CPO-side restart logic for CNO operands #8751 — OCPBUGS-88531: Remove CPO-side restart logic for CNO operands
• Author: bryan-cox
• Commit: 923dc8e604445b204e4a28a300789a68667134b7

Test Failure Analysis

Error

1: CT1 Title does not start with one of fix, feat, chore, docs, style, refactor, perf, test, revert, ci, build: "OCPBUGS-88531: Remove CPO-side restart logic for CNO operands"

Summary

The gitlint CI check failed because the commit message title "OCPBUGS-88531: Remove CPO-side restart logic for CNO operands" does not follow the Conventional Commits format required by the repository. The .gitlint configuration enforces rule CT1 (contrib-title-conventional-commits), which requires the title to begin with one of the allowed type prefixes (fix, feat, chore, docs, style, refactor, perf, test, revert, ci, build) followed by a colon. The current title starts with a JIRA key (OCPBUGS-88531:) instead.

Root Cause

The hypershift repository enforces Conventional Commits format via gitlint (v0.19.1) with the contrib-title-conventional-commits rule enabled in .gitlint. This rule requires commit message titles to match the pattern <type>: <description> or <type>(scope): <description>, where <type> must be one of: fix, feat, chore, docs, style, refactor, perf, test, revert, ci, build.

The commit title OCPBUGS-88531: Remove CPO-side restart logic for CNO operands starts with a JIRA issue key instead of a Conventional Commit type prefix, causing the CT1 rule violation. The gitlint Makefile target runs gitlint --commits <base>...<head> and checks every commit in the PR range against these rules.

This is purely a commit message formatting issue — there is no code or test problem.

Recommendations

Amend the commit message to include a Conventional Commit type prefix before the JIRA key. The most appropriate type for this change is refactor (since it removes redundant logic without changing external behavior). Example:

refactor: OCPBUGS-88531: Remove CPO-side restart logic for CNO operands

To fix:

git commit --amend -m "refactor: OCPBUGS-88531: Remove CPO-side restart logic for CNO operands" \
  -m "CNO now handles restart-date annotation propagation to all its operands
(multus-admission-controller, network-node-identity, ovnkube-control-plane,
cloud-network-config-controller) directly via the fix in CNO PR #3030.

The CPO-side restart logic for these deployments is now redundant and
can be removed.

Co-Authored-By: Claude Opus 4.6 <[email protected]>"
git push --force-with-lease

Evidence

Evidence	Detail
Failing step	Run make run-gitlint (exit code 2)
Gitlint rule violated	CT1 (contrib-title-conventional-commits)
Commit title	OCPBUGS-88531: Remove CPO-side restart logic for CNO operands
Required prefix	One of: fix, feat, chore, docs, style, refactor, perf, test, revert, ci, build
Config file	.gitlint at repo root — enables contrib-title-conventional-commits with standard types
Gitlint version	0.19.1
Commit SHA	923dc8e604445b204e4a28a300789a68667134b7
Log line	1: CT1 Title does not start with one of fix, feat, chore, docs, style, refactor, perf, test, revert, ci, build

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.80%. Comparing base (392fd5a) to head (5682e1f).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8751      +/-   ##
==========================================
+ Coverage   41.75%   41.80%   +0.05%     
==========================================
  Files         758      759       +1     
  Lines       93981    94021      +40     
==========================================
+ Hits        39240    39305      +65     
+ Misses      51988    51967      -21     
+ Partials     2753     2749       -4     

Files with missing lines	Coverage Δ
...ostedcontrolplane/hostedcontrolplane_controller.go	46.04% <ø> (+0.33%)	⬆️

... and 5 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	35.11% <ø> (+0.09%)	⬆️
cpo-hostedcontrolplane	44.15% <ø> (+0.04%)	⬆️
cpo-other	43.45% <ø> (ø)
hypershift-operator	51.87% <ø> (+0.04%)	⬆️
other	31.56% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.