OCPBUGS-58038: Clear defaultNodeSelector to run on any node

[ardaguclu]

oc adm copy-to-node and oc adm restart-kubelet commands can run on any node type (either control-plane or worker) by creating a pod in its dedicated namespace. If defaultNodeSelector is configured within the cluster, its dedicated namespace is not allowed to run pods in excluded node types.

Therefore, we intentionally clear openshift.io/node-selector annotation to disable defaultNodeSelector for this namespace.

[openshift-ci-robot]

@ardaguclu: This pull request references Jira Issue OCPBUGS-58038, which is invalid:

• expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

oc adm copy-to-node and oc adm restart-kubelet commands can run on any node type (either control-plane or worker) by creating a pod in its dedicated namespace. If defaultNodeSelector is configured within the cluster, its dedicated namespace is not allowed to run pods in excluded node types.

Therefore, we intentionally clear openshift.io/node-selector annotation to disable defaultNodeSelector for this namespace.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

Modifies the temporary namespace creation in PerNodePodRuntime to set an OpenShift node-selector annotation to an empty value, allowing the namespace to run on any node type. No changes to error handling, control flow, or public interfaces.

Changes

Cohort / File(s)	Summary
Node Selector Clearing for Temporary Namespace pkg/cli/admin/pernodepod/runtime.go	Adds namespace annotation setting openshift.io/node-selector to empty string during temporary namespace creation to override default node-selector constraints

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5–10 minutes

• Verify the annotation key and empty string value are the correct OpenShift mechanism for clearing node-selector constraints
• Confirm this annotation doesn't conflict with or override other namespace-level configurations
• Check if any related tests or documentation need updates to reflect this behavior change

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 0c09391 and 887e3ff.

📒 Files selected for processing (1)

• pkg/cli/admin/pernodepod/runtime.go (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

• pkg/cli/admin/pernodepod/runtime.go

🔇 Additional comments (1)

pkg/cli/admin/pernodepod/runtime.go (1)

77-81: The original review comment is incorrect and should be ignored.

The embedded per-node-namespace.yaml contains no annotations field—only Kubernetes security policy labels. The code at lines 79-81 creates a new annotations map for the first time; there are no pre-existing annotations to overwrite or discard. The implementation is correct as written.

Likely an incorrect or invalid review comment.

Tip

📝 Customizable high-level summaries are now available in beta!

You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.

• Provide your own instructions using the high_level_summary_instructions setting.
• Format the summary however you like (bullet lists, tables, multi-section layouts, contributor stats, etc.).
• Use high_level_summary_in_walkthrough to move the summary from the description to the walkthrough section.

Example instruction:

"Divide the high-level summary into five sections:

1. 📝 Description — Summarize the main change in 50–60 words, explaining what was done.
2. 📓 References — List relevant issues, discussions, documentation, or related PRs.
3. 📦 Dependencies & Requirements — Mention any new/updated dependencies, environment variable changes, or configuration updates.
4. 📊 Contributor Summary — Include a Markdown table showing contributions:
   | Contributor | Lines Added | Lines Removed | Files Changed |
5. ✔️ Additional Notes — Add any extra reviewer context.
   Keep each section concise (under 200 words) and use bullet or numbered lists for clarity."

Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ardaguclu]

/jira refresh

[openshift-ci-robot]

@ardaguclu: This pull request references Jira Issue OCPBUGS-58038, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.0) matches configured target version for branch (4.21.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @zhouying7780

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ardaguclu]

/hold
until per-merge tests are performed.

[ardaguclu]

/retest

[zhouying7780]

/label qe-approved

[openshift-ci-robot]

@ardaguclu: This pull request references Jira Issue OCPBUGS-58038, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.0) matches configured target version for branch (4.21.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @zhouying7780

In response to this:

oc adm copy-to-node and oc adm restart-kubelet commands can run on any node type (either control-plane or worker) by creating a pod in its dedicated namespace. If defaultNodeSelector is configured within the cluster, its dedicated namespace is not allowed to run pods in excluded node types.

Therefore, we intentionally clear openshift.io/node-selector annotation to disable defaultNodeSelector for this namespace.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tchap]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, tchap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ardaguclu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ardaguclu]

/verified by @zhouying7780
/hold cancel

[openshift-ci-robot]

@ardaguclu: This PR has been marked as verified by @zhouying7780.

In response to this:

/verified by @zhouying7780
/hold cancel

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 477520a and 2 for PR HEAD 887e3ff in total

[zhouying7780]

/test e2e-agnostic-ovn-cmd

[openshift-ci]

@ardaguclu: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@ardaguclu: Jira Issue Verification Checks: Jira Issue OCPBUGS-58038
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-58038 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

In response to this:

oc adm copy-to-node and oc adm restart-kubelet commands can run on any node type (either control-plane or worker) by creating a pod in its dedicated namespace. If defaultNodeSelector is configured within the cluster, its dedicated namespace is not allowed to run pods in excluded node types.

Therefore, we intentionally clear openshift.io/node-selector annotation to disable defaultNodeSelector for this namespace.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.