Skip to content

hypershift: skip readyz conformance test on shared management clusters#80883

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
csrwng:skip-hypershift-readyz-test
Jun 23, 2026
Merged

hypershift: skip readyz conformance test on shared management clusters#80883
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
csrwng:skip-hypershift-readyz-test

Conversation

@csrwng

@csrwng csrwng commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Skip the test [sig-api-machinery][Feature:APIServer][Late] API LBs follow /readyz of kube-apiserver and stop sending requests before server shutdowns for external clients in the hypershift-aws-conformance workflow
  • The test lists KAS pods across all namespaces on the management cluster (Pods("").List(...)) and fails if any pod from any HostedCluster is not fully running (PodInitializing, ImagePullBackOff, etc.)
  • On shared management clusters (e.g. hypershift-ci-2) this causes 100% failure whenever another HostedCluster has an unhealthy KAS pod
  • The periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn-conformance job has been failing since 2026-06-19 due to a leaked HostedCluster with a stuck KAS pod

Related bugs

  • OCPBUGS-91633: Test should scope KAS pod listing to the cluster under test's namespace (origin fix needed to re-enable)
  • OCPBUGS-91511: CPO health check skips credential validation during deletion, allowing HostedClusters to leak

Test plan

  • Verify the skip regex matches the test name in openshift-tests run --dry-run
  • Confirm the conformance job passes with the skip in place
  • Re-enable after the origin fix lands for OCPBUGS-91633

🤖 Generated with Claude Code

Summary by CodeRabbit

This PR updates the HyperShift AWS conformance workflow configuration to skip a specific Kubernetes API server readiness test that causes cascading failures on shared management clusters.

What changed:
The workflow's test-skip configuration in ci-operator/step-registry/hypershift/aws/conformance/hypershift-aws-conformance-workflow.yaml now includes:

  • A new test skip for [sig-api-machinery][Feature:APIServer][Late] API LBs follow /readyz of kube-apiserver and stop sending requests before server shutdowns for external clients
  • An explanatory comment referencing OCPBUGS-91633, which tracks the root cause
  • The IGNORE_EMPTY_TEST_SKIPS flag set to true

Why:
The skipped test enumerates KAS (Kubernetes API Server) pods across all namespaces on the management cluster without scoping to a specific HostedCluster. This causes the test to fail if any KAS pod from any HostedCluster on the shared management cluster is in a problematic state (e.g., stuck in initialization). On shared management clusters like hypershift-ci-2, this results in 100% test failures for unrelated clusters. A leaked HostedCluster with a stuck KAS pod has been causing the periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn-conformance job to fail since mid-June.

This is a temporary workaround pending an upstream fix (OCPBUGS-91633) that will scope the test's pod listing to only the cluster under test's namespace.

@coderabbitai

coderabbitai Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 68a4ca8a-b005-4406-9c2c-3bf0ebe4b7b8

📥 Commits

Reviewing files that changed from the base of the PR and between b88ca26 and d82df27.

📒 Files selected for processing (1)
  • ci-operator/step-registry/hypershift/aws/conformance/hypershift-aws-conformance-workflow.yaml

Walkthrough

The HyperShift AWS conformance workflow YAML adds a comment referencing a readyz-related test skip issue and appends a new TEST_SKIPS rule covering API load balancer behavior with kube-apiserver /readyz and pre-shutdown request cessation, alongside the existing load balancer reachability and hairpinning skip rules.

Changes

HyperShift AWS Conformance Workflow

Layer / File(s) Summary
TEST_SKIPS readyz rule addition
ci-operator/step-registry/hypershift/aws/conformance/hypershift-aws-conformance-workflow.yaml
Adds a comment anchoring the readyz skip issue and extends TEST_SKIPS with a rule for API load balancers to track kube-apiserver /readyz and stop sending requests before server shutdowns, retaining IGNORE_EMPTY_TEST_SKIPS: true.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

lgtm, approved, rehearsals-ack

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly describes the main change: skipping a readyz conformance test on shared management clusters for HyperShift, which is the core objective of this PR.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The test name "[sig-api-machinery][Feature:APIServer][Late] API LBs follow /readyz of kube-apiserver and stop sending requests before server shutdowns for external clients" contains no dynamic elem...
Test Structure And Quality ✅ Passed The custom check for Ginkgo test code quality is not applicable to this PR, which modifies only a YAML workflow configuration file, not test implementations.
Microshift Test Compatibility ✅ Passed This PR only modifies a CI workflow YAML configuration file to skip an existing test; it does not add any new Ginkgo e2e test definitions. The custom check is not applicable since it targets newly...
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR does not add new Ginkgo e2e tests; it only modifies test skip configuration for an existing conformance test in a workflow file. SNO compatibility check applies only to new tests.
Topology-Aware Scheduling Compatibility ✅ Passed This change is a CI workflow configuration file that adds test skip patterns. It contains no scheduling constraints, node selectors, affinity rules, or topology configurations. The check applies on...
Ote Binary Stdout Contract ✅ Passed PR modifies only YAML CI workflow configuration files, not OTE binary source code. OTE stdout contract check is inapplicable to workflow configuration changes.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed This PR modifies a CI workflow configuration file, not adding new Ginkgo e2e tests. The check only applies when new tests are added, making it inapplicable here.
No-Weak-Crypto ✅ Passed PR modifies only a CI/CD YAML configuration file with test skip settings. No cryptographic code, weak crypto algorithms, custom implementations, or secret comparisons are present.
Container-Privileges ✅ Passed The PR modifies a workflow YAML file that only contains test configuration and environment variables. No container specifications, security contexts, or privilege-related configurations are present...
No-Sensitive-Data-In-Logs ✅ Passed PR modifies test skip configuration in workflow YAML with no passwords, tokens, API keys, PII, SSNs, or customer data exposed. Email addresses and URLs present are pre-existing documentation elements.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from bryan-cox and sjenning June 23, 2026 00:53
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 23, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@csrwng: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-origin-main-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-main-e2e-aws-tls-observed-config-hypershift openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-5.1-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-5.1-e2e-aws-tls-observed-config-hypershift openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-5.0-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-5.0-e2e-aws-tls-observed-config-hypershift openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-4.23-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-4.23-e2e-aws-tls-observed-config-hypershift openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-4.22-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-4.21-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-4.20-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-origin-release-4.19-e2e-hypershift-conformance openshift/origin presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-main-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-5.1-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-5.0-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.23-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.22-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.21-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.20-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.19-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.18-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.17-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.16-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.15-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed
pull-ci-openshift-cluster-version-operator-release-4.14-e2e-hypershift-conformance openshift/cluster-version-operator presubmit Registry content changed

A total of 228 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@csrwng

csrwng commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn-conformance

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@csrwng: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 23, 2026
@csrwng

csrwng commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn-conformance

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@csrwng: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

The test "[sig-api-machinery][Feature:APIServer][Late] API LBs follow
/readyz of kube-apiserver and stop sending requests before server
shutdowns for external clients" lists KAS pods across all namespaces
on the management cluster, then fails if any pod from any HostedCluster
is not fully running. On shared management clusters this causes 100%
failure when any other HostedCluster has a KAS pod in PodInitializing
or ImagePullBackOff state.

Skip the test until the origin fix scopes pod listing to the cluster
under test's namespace.

Tracks: https://redhat.atlassian.net/browse/OCPBUGS-91633

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@csrwng
csrwng force-pushed the skip-hypershift-readyz-test branch 2 times, most recently from d82df27 to 3978592 Compare June 23, 2026 15:37
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jun 23, 2026
@csrwng

csrwng commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn-conformance

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@csrwng: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci

openshift-ci Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, csrwng

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 23, 2026
@csrwng

csrwng commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@csrwng: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jun 23, 2026
@openshift-ci

openshift-ci Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

@csrwng: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit dbf4fab into openshift:main Jun 23, 2026
12 checks passed
kasturinarra pushed a commit to kasturinarra/release that referenced this pull request Jun 26, 2026
openshift#80883)

The test "[sig-api-machinery][Feature:APIServer][Late] API LBs follow
/readyz of kube-apiserver and stop sending requests before server
shutdowns for external clients" lists KAS pods across all namespaces
on the management cluster, then fails if any pod from any HostedCluster
is not fully running. On shared management clusters this causes 100%
failure when any other HostedCluster has a KAS pod in PodInitializing
or ImagePullBackOff state.

Skip the test until the origin fix scopes pod listing to the cluster
under test's namespace.

Tracks: https://redhat.atlassian.net/browse/OCPBUGS-91633

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
krisnababu pushed a commit to oharan2/release that referenced this pull request Jul 3, 2026
openshift#80883)

The test "[sig-api-machinery][Feature:APIServer][Late] API LBs follow
/readyz of kube-apiserver and stop sending requests before server
shutdowns for external clients" lists KAS pods across all namespaces
on the management cluster, then fails if any pod from any HostedCluster
is not fully running. On shared management clusters this causes 100%
failure when any other HostedCluster has a KAS pod in PodInitializing
or ImagePullBackOff state.

Skip the test until the origin fix scopes pod listing to the cluster
under test's namespace.

Tracks: https://redhat.atlassian.net/browse/OCPBUGS-91633

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
andrej1991 pushed a commit to andrej1991/release that referenced this pull request Jul 6, 2026
openshift#80883)

The test "[sig-api-machinery][Feature:APIServer][Late] API LBs follow
/readyz of kube-apiserver and stop sending requests before server
shutdowns for external clients" lists KAS pods across all namespaces
on the management cluster, then fails if any pod from any HostedCluster
is not fully running. On shared management clusters this causes 100%
failure when any other HostedCluster has a KAS pod in PodInitializing
or ImagePullBackOff state.

Skip the test until the origin fix scopes pod listing to the cluster
under test's namespace.

Tracks: https://redhat.atlassian.net/browse/OCPBUGS-91633

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
TimurMP pushed a commit to TimurMP/release that referenced this pull request Jul 8, 2026
openshift#80883)

The test "[sig-api-machinery][Feature:APIServer][Late] API LBs follow
/readyz of kube-apiserver and stop sending requests before server
shutdowns for external clients" lists KAS pods across all namespaces
on the management cluster, then fails if any pod from any HostedCluster
is not fully running. On shared management clusters this causes 100%
failure when any other HostedCluster has a KAS pod in PodInitializing
or ImagePullBackOff state.

Skip the test until the origin fix scopes pod listing to the cluster
under test's namespace.

Tracks: https://redhat.atlassian.net/browse/OCPBUGS-91633

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
SachinNinganure pushed a commit to SachinNinganure/release that referenced this pull request Jul 20, 2026
openshift#80883)

The test "[sig-api-machinery][Feature:APIServer][Late] API LBs follow
/readyz of kube-apiserver and stop sending requests before server
shutdowns for external clients" lists KAS pods across all namespaces
on the management cluster, then fails if any pod from any HostedCluster
is not fully running. On shared management clusters this causes 100%
failure when any other HostedCluster has a KAS pod in PodInitializing
or ImagePullBackOff state.

Skip the test until the origin fix scopes pod listing to the cluster
under test's namespace.

Tracks: https://redhat.atlassian.net/browse/OCPBUGS-91633

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants