OPRUN-4705: Remove NewOLMPreflightPermissionChecks FeatureGate by pedjak · Pull Request #2957 · openshift/api

pedjak · 2026-07-27T11:01:05Z

Summary

Remove the FeatureGateNewOLMPreflightPermissionChecks definition from features/features.go
Regenerate features.md and all payload-manifests/featuregates/ YAML files

Context

The upstream PreflightPermissions feature gate was removed from operator-controller (operator-framework/operator-controller#767) and the downstream mapping was removed from cluster-olm-operator (cluster-olm-operator#222). The gate definition in openshift/api is now dead weight — it is listed as enabled in TechPreview/DevPreview profiles but nothing acts on it.

The upstream PreflightPermissions feature gate was removed from operator-controller and the downstream mapping was removed from cluster-olm-operator. The gate definition in openshift/api is now dead weight — nothing acts on it. Co-Authored-By: Claude <noreply@anthropic.com>

openshift-merge-bot · 2026-07-27T11:01:07Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci · 2026-07-27T11:01:09Z

Hello @pedjak! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

coderabbitai · 2026-07-27T11:01:28Z

📝 Walkthrough

Walkthrough

Removed the NewOLMPreflightPermissionChecks feature gate declaration and feature matrix row. Updated Hypershift and SelfManagedHA feature gate manifests to remove the gate from disabled or enabled lists, replacing it with NewOLMOwnSingleNamespace in the specified DevPreviewNoUpgrade and TechPreviewNoUpgrade configurations.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff only touches feature metadata/docs and YAML manifests; no Ginkgo test files or test titles were changed.
Test Structure And Quality	✅ Passed	No Ginkgo/spec test files were changed; this PR only removes a feature gate and regenerates docs/manifests, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: The commit only removes a feature-gate definition and regenerates docs/manifests; no Ginkgo tests or runtime checks were added or changed.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the diff only removes a feature gate and updates docs/manifests.
Topology-Aware Scheduling Compatibility	✅ Passed	Touched files only remove a dead feature gate and update feature-gate lists; no nodeSelector, affinity, spread, PDB, or replica scheduling logic was added.
Ote Binary Stdout Contract	✅ Passed	Removal-only PR; no stdout/logging writes were added in process-level code, and the touched Go file only deletes the feature gate.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only removes a feature gate and updates docs/manifests; no Ginkgo e2e tests or network/IP assumptions were added.
No-Weak-Crypto	✅ Passed	Diff only removes a feature-gate definition and regenerates docs/manifests; no weak crypto, custom crypto, or secret comparisons were added.
Container-Privileges	✅ Passed	Touched files only update feature-gate lists; scans found no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit only removes a feature gate and updates generated manifests/docs; no log statements or sensitive-data additions appear in the diff.
Title check	✅ Passed	The title clearly matches the main change: removing the NewOLMPreflightPermissionChecks feature gate.
Description check	✅ Passed	The description accurately summarizes the feature gate removal and manifest regeneration, matching the changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-27T11:02:28Z

@pedjak: This pull request references OPRUN-4705 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Remove the FeatureGateNewOLMPreflightPermissionChecks definition from features/features.go

Regenerate features.md and all payload-manifests/featuregates/ YAML files

Context

The upstream PreflightPermissions feature gate was removed from operator-controller (operator-framework/operator-controller#767) and the downstream mapping was removed from cluster-olm-operator (cluster-olm-operator#222). The gate definition in openshift/api is now dead weight — it is listed as enabled in TechPreview/DevPreview profiles but nothing acts on it.

Resolves: https://issues.redhat.com/browse/OPRUN-4705

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

qodo-for-rh-openshift · 2026-07-27T11:02:34Z

PR Summary by Qodo

Remove NewOLMPreflightPermissionChecks feature gate definition

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Remove the dead NewOLMPreflightPermissionChecks feature gate from the registry.
• Regenerate feature gate documentation and payload featuregate manifests to drop the entry.
• Keep TechPreview/DevPreview profiles aligned with upstream operator-controller changes.

Diagram

graph TD
  A["features/features.go"] --> B["Generate feature artifacts"] --> C["features.md"]
  B --> D["payload-manifests/featuregates/*.yaml"] --> E["Cluster FeatureGate profiles"] --> F["OLM-related components"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Deprecate first, remove later

➕ Avoids breaking any downstream consumers still setting the gate name
➕ Provides a clear migration window and messaging
➖ Keeps dead configuration surface area and ongoing maintenance burden
➖ Continues to imply a supported behavior that no longer exists

2. Keep the gate but mark as ignored/no-op

➕ Preserves backward compatibility for clusters that reference the gate
➕ Makes the no-op status explicit
➖ Still expands API surface with a misleading option
➖ Requires additional documentation/logic to communicate the no-op

Recommendation: Proceed with removal as implemented: upstream and downstream consumers have already dropped the behavior, so keeping the gate only creates confusion and unused payload/profile entries. If any compatibility concern arises, handle it via release notes rather than retaining an inert gate indefinitely.

Files changed (10) +0 / -33

Refactor (1) +0 / -8

features.goRemove FeatureGateNewOLMPreflightPermissionChecks registration +0/-8

Remove FeatureGateNewOLMPreflightPermissionChecks registration
• Deletes the 'FeatureGateNewOLMPreflightPermissionChecks' definition from the feature gate registry, eliminating its metadata and profile enablement.
features/features.go

Documentation (1) +0 / -1

features.mdDrop NewOLMPreflightPermissionChecks from feature gate docs +0/-1

Drop NewOLMPreflightPermissionChecks from feature gate docs

• Removes the 'NewOLMPreflightPermissionChecks' row from the generated feature gate table so it no longer appears as enabled in TechPreview/DevPreview profiles.

features.md

Other (8) +0 / -24

featureGate-4-10-Hypershift-Default.yamlRemove gate from Hypershift Default profile manifest +0/-3

Remove gate from Hypershift Default profile manifest
• Regenerated payload manifest no longer lists 'NewOLMPreflightPermissionChecks' among enabled features for this profile.
payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yamlRemove gate from Hypershift DevPreviewNoUpgrade profile manifest +0/-3

Remove gate from Hypershift DevPreviewNoUpgrade profile manifest
• Regenerated payload manifest drops 'NewOLMPreflightPermissionChecks' from the enabled feature set.
payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml

featureGate-4-10-Hypershift-OKD.yamlRemove gate from Hypershift OKD profile manifest +0/-3

Remove gate from Hypershift OKD profile manifest
• Regenerated payload manifest removes 'NewOLMPreflightPermissionChecks' from the enabled features list.
payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yamlRemove gate from Hypershift TechPreviewNoUpgrade profile manifest +0/-3

Remove gate from Hypershift TechPreviewNoUpgrade profile manifest
• Regenerated payload manifest removes 'NewOLMPreflightPermissionChecks' from TechPreviewNoUpgrade enabled features.
payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-Default.yamlRemove gate from SelfManagedHA Default profile manifest +0/-3

Remove gate from SelfManagedHA Default profile manifest
• Regenerated payload manifest no longer includes 'NewOLMPreflightPermissionChecks' as an enabled feature.
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yamlRemove gate from SelfManagedHA DevPreviewNoUpgrade profile manifest +0/-3

Remove gate from SelfManagedHA DevPreviewNoUpgrade profile manifest
• Regenerated payload manifest drops 'NewOLMPreflightPermissionChecks' from the enabled feature list for this profile.
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-OKD.yamlRemove gate from SelfManagedHA OKD profile manifest +0/-3

Remove gate from SelfManagedHA OKD profile manifest
• Regenerated payload manifest removes 'NewOLMPreflightPermissionChecks' from the OKD profile enabled features.
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yamlRemove gate from SelfManagedHA TechPreviewNoUpgrade profile manifest +0/-3

Remove gate from SelfManagedHA TechPreviewNoUpgrade profile manifest
• Regenerated payload manifest no longer lists 'NewOLMPreflightPermissionChecks' in TechPreviewNoUpgrade enabled features.
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

pedjak · 2026-07-27T11:02:38Z

/jira refresh

openshift-ci-robot · 2026-07-27T11:02:41Z

@pedjak: This pull request references OPRUN-4705 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

qodo-for-rh-openshift · 2026-07-27T11:02:44Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

pedjak · 2026-07-27T11:04:24Z

/jira refresh

openshift-ci-robot · 2026-07-27T11:04:27Z

@pedjak: This pull request references OPRUN-4705 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tmshort · 2026-07-27T12:54:26Z

/lgtm
Although I don't know why It's failing the hypershift check?

tmshort · 2026-07-27T12:54:39Z

/test verify-hypershift-integration

qodo-for-rh-openshift · 2026-07-27T12:55:14Z

PR-Agent: could not find a component named verify-hypershift-integration in a supported language in this PR.

openshift-merge-bot · 2026-07-27T12:55:17Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

tmshort · 2026-07-27T13:08:17Z

This isn't working?

/test verify-hypershift-integration

JoelSpeed · 2026-07-27T13:42:04Z

/override-sticky ci/prow/verify-hypershift-integration

This is broken presently until HyperShift bump their deps

/lgtm

This is walking back a feature that was never promoted and has since been reverted from the product

openshift-ci · 2026-07-27T13:42:31Z

@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-hypershift-integration

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

/override-sticky ci/prow/verify-hypershift-integration

This is broken presently until HyperShift bump their deps

/lgtm

This is walking back a feature that was never promoted and has since been reverted from the product

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-07-27T13:43:03Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed, tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

pedjak · 2026-07-27T17:38:37Z

Both CI failures are unrelated to this change (pure feature gate deletion):

e2e-aws-ovn-techpreview: Two blocking flakes — a kubeconfig context lookup failure in [sig-arch] ... pods use downstream images (100% pass rate on Sippy/520 runs) and a pod readiness timeout in [sig-node] ... Allow dev fuse by default in CRI-O.
e2e-azure: One blocking flake — transient EOF in [sig-auth] [Token Expiration] ... token authorization flow (97.95% pass rate on Sippy/4250 runs).

/retest

pedjak · 2026-07-27T21:47:31Z

/retest

tmshort · 2026-07-28T01:24:56Z

/verified by CI

This is a removal, and since the CI passed, it means that nothing ought to be trying to use that feature-gate.

openshift-ci-robot · 2026-07-28T01:25:07Z

@tmshort: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

This is a removal, and since the CI passed, it means that nothing ought to be trying to use that feature-gate.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tmshort · 2026-07-28T02:21:32Z

/retest

tmshort · 2026-07-28T02:23:47Z

/override-sticky ci/prow/verify-hypershift-integration

openshift-ci · 2026-07-28T02:23:59Z

@tmshort: tmshort unauthorized: /override-sticky is restricted to Repo administrators, approvers in top level OWNERS file, and the following github teams:openshift: openshift-release-oversight openshift-staff-engineers openshift-sustaining-engineers.

Details

In response to this:

/override-sticky ci/prow/verify-hypershift-integration

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-07-28T02:24:34Z

@pedjak: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-hypershift-integration	`217ca8c`	link	true	`/test verify-hypershift-integration`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tmshort · 2026-07-28T02:25:10Z

@JoelSpeed the sticky override was not sticky when tide tried to merge and wanted to retest...

openshift-ci Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 27, 2026

openshift-ci Bot requested a review from everettraven July 27, 2026 11:01

openshift-ci Bot requested a review from JoelSpeed July 27, 2026 11:01

pedjak changed the title ~~Remove NewOLMPreflightPermissionChecks FeatureGate~~ OPRUN-4705: Remove NewOLMPreflightPermissionChecks FeatureGate Jul 27, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 27, 2026

openshift-ci Bot assigned tmshort Jul 27, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 27, 2026

openshift-ci Bot assigned JoelSpeed Jul 27, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 27, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 28, 2026

Uh oh!

Conversation

pedjak commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

openshift-ci-robot commented Jul 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Uh oh!

qodo-for-rh-openshift Bot commented Jul 27, 2026

PR Summary by Qodo

Uh oh!

pedjak commented Jul 27, 2026

Uh oh!

openshift-ci-robot commented Jul 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-rh-openshift Bot commented Jul 27, 2026

Code Review by Qodo

Great, no issues found!

Uh oh!

pedjak commented Jul 27, 2026

Uh oh!

openshift-ci-robot commented Jul 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tmshort commented Jul 27, 2026

Uh oh!

tmshort commented Jul 27, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

tmshort commented Jul 27, 2026

Uh oh!

JoelSpeed commented Jul 27, 2026

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

pedjak commented Jul 27, 2026

Uh oh!

pedjak commented Jul 27, 2026

Uh oh!

tmshort commented Jul 28, 2026

Uh oh!

openshift-ci-robot commented Jul 28, 2026

Uh oh!

tmshort commented Jul 28, 2026

Uh oh!

tmshort commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 28, 2026

Uh oh!

tmshort commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pedjak commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

openshift-ci-robot commented Jul 27, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jul 27, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jul 27, 2026 •

edited by openshift-ci Bot

Loading

qodo-for-rh-openshift Bot commented Jul 27, 2026 •

edited

Loading