CNTRLPLANE-2740: Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs by enxebre · Pull Request #7721 · openshift/hypershift

enxebre · 2026-02-13T01:25:08Z

Summary

Set unhealthyPodEvictionPolicy: AlwaysAllow on all PDBs managed by the HCP operator (etcd, kube-apiserver, openshift-apiserver, openshift-oauth-apiserver, oauth-openshift, HCP private router, shared ingress router)
Remove unused support/util/pdb.go (zero production callers)
Add unit tests with idempotency coverage

What this PR does / why we need it

Sets unhealthyPodEvictionPolicy: AlwaysAllow on every PodDisruptionBudget managed by the HostedControlPlane operator.

This allows running-but-unhealthy hosted control-plane pods to be evicted during management cluster node drains. Unready pods are unlikely to be contributing to service availability, so blocking drains on their behalf adds risk without meaningful availability benefit.

The unhealthyPodEvictionPolicy field is GA since Kubernetes 1.31 / OpenShift 4.18.

Components affected

All PDBs managed by the HCP operator:

etcd
kube-apiserver
openshift-apiserver
openshift-oauth-apiserver
oauth-openshift
HCP private router
Shared ingress router

Changes

support/controlplane-component/common.go – AdaptPodDisruptionBudget() now sets UnhealthyPodEvictionPolicy to AlwaysAllow (covers the 6 v2 control-plane components)
hypershift-operator/controllers/sharedingress/router.go – ReconcileRouterPodDisruptionBudget() updated for the shared ingress router PDB
support/util/pdb.go – removed (zero production callers)

Which issue(s) this PR fixes

Fixes CNTRLPLANE-2740

Special notes for your reviewer

The unhealthyPodEvictionPolicy field is set programmatically in the Go adapter function that already mutates PDB specs at reconciliation time. No YAML asset changes are needed. The second commit contains only regenerated fixture files.

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

🤖 Generated with Claude Code

…PDBs Set the PodDisruptionBudget unhealthyPodEvictionPolicy property to AlwaysAllow for all PDBs managed by the HostedControlPlane operator. This allows running-but-unhealthy pods to be evicted during node drains on the management cluster, without reducing hosted service availability since unready pods are not contributing to service availability. Remove unused support/util/pdb.go as ReconcilePodDisruptionBudget had zero production callers. This addresses WRKLDS-1490 which asks all PDB maintainers to adopt the unhealthyPodEvictionPolicy property (GA in Kubernetes 1.31 / OCP 4.18). Ref: CNTRLPLANE-2740 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Regenerated by: UPDATE=true go test ./control-plane-operator/controllers/hostedcontrolplane/ -run TestControlPlaneComponents Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot · 2026-02-13T01:25:10Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-02-13T01:25:12Z

@enxebre: This pull request references CNTRLPLANE-2740 which is a valid jira issue.

Details

In response to this:

Summary

Set unhealthyPodEvictionPolicy: AlwaysAllow on all PDBs managed by the HCP operator (etcd, kube-apiserver, openshift-apiserver, openshift-oauth-apiserver, oauth-openshift, HCP private router, shared ingress router)

Remove unused support/util/pdb.go (zero production callers)

Add unit tests with idempotency coverage

What this PR does / why we need it

Sets unhealthyPodEvictionPolicy: AlwaysAllow on every PodDisruptionBudget managed by the HostedControlPlane operator.

This allows running-but-unhealthy hosted control-plane pods to be evicted during management cluster node drains. Unready pods are unlikely to be contributing to service availability, so blocking drains on their behalf adds risk without meaningful availability benefit.

The unhealthyPodEvictionPolicy field is GA since Kubernetes 1.31 / OpenShift 4.18.

Components affected

All PDBs managed by the HCP operator:

etcd

kube-apiserver

openshift-apiserver

openshift-oauth-apiserver

oauth-openshift

HCP private router

Shared ingress router

Changes

support/controlplane-component/common.go – AdaptPodDisruptionBudget() now sets UnhealthyPodEvictionPolicy to AlwaysAllow (covers the 6 v2 control-plane components)

hypershift-operator/controllers/sharedingress/router.go – ReconcileRouterPodDisruptionBudget() updated for the shared ingress router PDB

support/util/pdb.go – removed (zero production callers)

Which issue(s) this PR fixes

Fixes CNTRLPLANE-2740

Special notes for your reviewer

The unhealthyPodEvictionPolicy field is set programmatically in the Go adapter function that already mutates PDB specs at reconciliation time. No YAML asset changes are needed. The second commit contains only regenerated fixture files.

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-02-13T01:25:28Z

Walkthrough

This pull request updates PodDisruptionBudget specifications across multiple control plane components and cloud provider variants to include unhealthyPodEvictionPolicy: AlwaysAllow. Changes span test fixture files, implementation code, and tests to consistently apply this eviction policy. A utility function is refactored with its functionality moved to a new common implementation.

Changes

Cohort / File(s)	Summary
PodDisruptionBudget Test Fixtures - etcd `control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/*/zz_fixture_TestControlPlaneComponents_etcd_poddisruptionbudget.yaml`	Added `unhealthyPodEvictionPolicy: AlwaysAllow` to PodDisruptionBudget spec across all cloud provider variants (AROSwift, GCP, IBMCloud, TechPreviewNoUpgrade).
PodDisruptionBudget Test Fixtures - kube-apiserver `control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/*/zz_fixture_TestControlPlaneComponents_kube_apiserver_poddisruptionbudget.yaml`	Added `unhealthyPodEvictionPolicy: AlwaysAllow` to PodDisruptionBudget spec across all cloud provider variants.
PodDisruptionBudget Test Fixtures - oauth-openshift `control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/*/zz_fixture_TestControlPlaneComponents_oauth_openshift_poddisruptionbudget.yaml`	Added `unhealthyPodEvictionPolicy: AlwaysAllow` to PodDisruptionBudget spec across all cloud provider variants.
PodDisruptionBudget Test Fixtures - openshift-apiserver `control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/*/zz_fixture_TestControlPlaneComponents_openshift_apiserver_poddisruptionbudget.yaml`	Added `unhealthyPodEvictionPolicy: AlwaysAllow` to PodDisruptionBudget spec across all cloud provider variants.
PodDisruptionBudget Test Fixtures - openshift-oauth-apiserver `control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/*/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_poddisruptionbudget.yaml`	Added `unhealthyPodEvictionPolicy: AlwaysAllow` to PodDisruptionBudget spec across all cloud provider variants.
PodDisruptionBudget Test Fixtures - router `control-plane-operator/controllers/hostedcontrolplane/testdata/router/*/zz_fixture_TestControlPlaneComponents_router_poddisruptionbudget.yaml`	Added `unhealthyPodEvictionPolicy: AlwaysAllow` to PodDisruptionBudget spec across all cloud provider variants.
HyperShift Router Controller `hypershift-operator/controllers/sharedingress/router.go`, `hypershift-operator/controllers/sharedingress/router_test.go`	Implemented `UnhealthyPodEvictionPolicy: AlwaysAllow` in router PodDisruptionBudget reconciliation with comprehensive unit tests validating policy application and overwrite behavior.
Control Plane Component Support `support/controlplane-component/common.go`, `support/controlplane-component/common_test.go`	Implemented `AdaptPodDisruptionBudget` function setting `UnhealthyPodEvictionPolicy` to `AlwaysAllow` with unit tests covering SingleReplica and HighlyAvailable scenarios.
Utility Removal `support/util/pdb.go`	Removed exported `ReconcilePodDisruptionBudget` function; functionality consolidated into `AdaptPodDisruptionBudget` in common support module.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

No actionable comments were generated in the recent review. 🎉

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

enxebre · 2026-02-13T07:39:35Z

/test verify
/test unit

enxebre · 2026-02-13T09:50:18Z

/test images
/test security
/test okd-scos-images

bryan-cox

/lgtm

/hold
Holding for others general consensus, feel free to remove it when you want

openshift-ci-robot · 2026-02-13T10:49:50Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-21
/test e2e-aws-4-21
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

openshift-ci · 2026-02-13T10:50:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox,enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

csrwng · 2026-02-16T18:14:46Z

/lgtm
/retest-required

I don't see a negative to making this the default even if it doesn't fix the problem entirely.

enxebre · 2026-02-18T16:56:56Z

/hold cancel

enxebre · 2026-02-18T17:15:17Z

/test e2e-aks

enxebre · 2026-02-19T13:54:17Z

/retest

enxebre · 2026-02-19T17:04:44Z

/retest

enxebre · 2026-02-24T08:15:23Z

/verified by @jiezhao16

openshift-ci-robot · 2026-02-24T08:15:35Z

@enxebre: This PR has been marked as verified by @jiezhao16.

Details

In response to this:

/verified by @jiezhao16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-02-24T08:54:59Z

@enxebre: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

enxebre and others added 2 commits February 13, 2026 02:16

chore(fixtures): regenerate PDB fixtures with unhealthyPodEvictionPolicy

af53200

Regenerated by: UPDATE=true go test ./control-plane-operator/controllers/hostedcontrolplane/ -run TestControlPlaneComponents Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 13, 2026

openshift-ci bot added the do-not-merge/needs-area label Feb 13, 2026

openshift-ci bot requested review from devguyio and muraee February 13, 2026 01:25

enxebre marked this pull request as draft February 13, 2026 01:30

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 13, 2026

bryan-cox approved these changes Feb 13, 2026

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 13, 2026

openshift-ci bot assigned bryan-cox Feb 13, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 13, 2026

openshift-ci bot assigned csrwng Feb 16, 2026

enxebre marked this pull request as ready for review February 18, 2026 16:57

openshift-ci bot removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Feb 18, 2026

openshift-ci bot requested a review from jparrill February 18, 2026 17:05

openshift-ci bot requested a review from sjenning February 18, 2026 17:05

enxebre added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Feb 19, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Feb 24, 2026

openshift-merge-bot bot merged commit 34e30ac into openshift:main Feb 24, 2026
24 checks passed

Comments

Conversation

enxebre commented Feb 13, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What this PR does / why we need it

Components affected

Changes

Which issue(s) this PR fixes

Special notes for your reviewer

Checklist

Uh oh!

openshift-ci-robot commented Feb 13, 2026

Uh oh!

openshift-ci-robot commented Feb 13, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What this PR does / why we need it

Components affected

Changes

Which issue(s) this PR fixes

Special notes for your reviewer

Checklist

Uh oh!

coderabbitai bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

enxebre commented Feb 13, 2026

Uh oh!

enxebre commented Feb 13, 2026

Uh oh!

bryan-cox left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Feb 13, 2026

Uh oh!

openshift-ci bot commented Feb 13, 2026

Uh oh!

csrwng commented Feb 16, 2026

Uh oh!

enxebre commented Feb 18, 2026

Uh oh!

enxebre commented Feb 18, 2026

Uh oh!

enxebre commented Feb 19, 2026

Uh oh!

enxebre commented Feb 19, 2026

Uh oh!

enxebre commented Feb 24, 2026

Uh oh!

openshift-ci-robot commented Feb 24, 2026

Uh oh!

openshift-ci bot commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

enxebre commented Feb 13, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Feb 13, 2026 •

edited by openshift-ci bot

Loading

coderabbitai bot commented Feb 13, 2026 •

edited

Loading