SPLAT-2890: Add VSphereScopedCredentials feature gate by rvanderp3 · Pull Request #2988 · openshift/api

rvanderp3 · 2026-08-17T19:17:01Z

No description provided.

openshift-merge-bot · 2026-08-17T19:17:03Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-08-17T19:17:05Z

@rvanderp3: This pull request references SPLAT-2890 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-17T19:17:05Z

Hello @rvanderp3! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

rvanderp3 · 2026-08-17T19:17:10Z

/hold

coderabbitai · 2026-08-17T19:17:21Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 07bd0796-55b4-489d-9acc-315ebe9eeb7c

📥 Commits

Reviewing files that changed from the base of the PR and between ac0a2e4 and 1fdf621.

📒 Files selected for processing (10)

features.md
features/features.go
payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

Walkthrough

The change adds and registers FeatureGateVSpherePerComponentScopedCreds with SPLAT ownership, enhancement metadata, and DevPreview availability. It adds the feature to the matrix. It enables the feature for DevPreviewNoUpgrade and disables it for Default, OKD, and TechPreviewNoUpgrade manifests across HyperShift and SelfManagedHA.

Suggested reviewers: joelspeed, vr4manta, jsafrane

Merge Risk: ⚪ Minimal · up to 1fdf6

The feature-gate change is merge-ready after normal checks and review, with no actionable merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The pull request has no description. The changeset is understandable from the title and file changes, but the author did not provide descriptive context.	Add a short description that explains the addition of VSpherePerComponentScopedCreds, its DevPreviewNoUpgrade availability, and the affected Hypershift and SelfManagedHA configurations.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the addition of a vSphere scoped credentials feature gate, which is the primary change. The title uses a slightly different name from the implementation identifier, VSpher…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The check passes. The pull request changes one Go feature-gate declaration, documentation, and YAML manifests. It changes no test files and adds no Ginkgo title calls such as `It()`, `Describe()`, `Co…
Test Structure And Quality	✅ Passed	PASS: The PR changes only feature metadata, the exported feature-gate declaration, and YAML feature-gate manifests. The diff contains no Ginkgo test code, resource setup or cleanup, cluster waits, Eve…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds only feature metadata, one exported feature-gate declaration, and YAML feature-gate manifest entries. The diff contains no new or modified Ginkgo tests and no test declarat…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The exact diff against the parent changes only feature metadata, the exported feature-gate declaration, and YAML feature-gate manifests. No added Descr…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only feature metadata and FeatureGate status lists. The diff adds `FeatureGateVSpherePerComponentScopedCreds` and its name to `FeatureGate` manifests. It adds no Deploym…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request adds only feature metadata, YAML manifest entries, and one top-level feature-gate registration. The added Go initializer calls builder methods and `mustRegister`; the inspected …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only feature metadata and feature-gate YAML manifests. The exact commit diff adds no Ginkgo test files or It/Describe/Context/When declarations. It adds no IPv4 networki…
No-Weak-Crypto	✅ Passed	The pull request adds a new feature gate `VSpherePerComponentScopedCreds` for vSphere credential management in OpenShift. The changes are limited to: 1. Feature gate declaration in `features/features.…
Container-Privileges	✅ Passed	The pull request changes one Go feature-gate declaration, a feature matrix row, and FeatureGate status manifests. The added manifest entries only name `VSpherePerComponentScopedCreds`. No changed line…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request changes only feature-gate metadata, the feature matrix, and generated YAML lists. The added Go code registers `VSpherePerComponentScopedCreds`; it adds no logging calls or log m…

Full details: Title check

Explanation

The title clearly identifies the addition of a vSphere scoped credentials feature gate, which is the primary change. The title uses a slightly different name from the implementation identifier, VSpherePerComponentScopedCreds.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (9 skipped: 9 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The check passes. The pull request changes one Go feature-gate declaration, documentation, and YAML manifests. It changes no test files and adds no Ginkgo title calls such as It(), Describe(), Context(), or When(). Therefore, it introduces no unstable or overly specific test name.

Full details: Test Structure And Quality

Explanation

PASS: The PR changes only feature metadata, the exported feature-gate declaration, and YAML feature-gate manifests. The diff contains no Ginkgo test code, resource setup or cleanup, cluster waits, Eventually/Consistently calls, or assertions. Therefore none of the specified test-structure failure conditions apply.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request adds only feature metadata, one exported feature-gate declaration, and YAML feature-gate manifest entries. The diff contains no new or modified Ginkgo tests and no test declarations or test-like files. Therefore, the MicroShift Test Compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The exact diff against the parent changes only feature metadata, the exported feature-gate declaration, and YAML feature-gate manifests. No added Describe, Context, When, or It declarations and no test paths are present. Therefore, no SNO multi-node test assumption was introduced.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS. The pull request changes only feature metadata and FeatureGate status lists. The diff adds FeatureGateVSpherePerComponentScopedCreds and its name to FeatureGate manifests. It adds no Deployment, controller, operator, or scheduling fields. The changed diff contains no anti-affinity, topology spread, replica, node selector/affinity, toleration, or PDB constraints. Therefore, it introduces no topology-incompatible scheduling assumption.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request adds only feature metadata, YAML manifest entries, and one top-level feature-gate registration. The added Go initializer calls builder methods and mustRegister; the inspected registration path performs validation and map updates, with no stdout writes. No fmt.Print*, os.Stdout, klog, Ginkgo setup, or process entry-point code was added.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only feature metadata and feature-gate YAML manifests. The exact commit diff adds no Ginkgo test files or It/Describe/Context/When declarations. It adds no IPv4 networking logic or external connectivity from a test; the only URL is an enhancement-PR reference in metadata.

Full details: No-Weak-Crypto

Explanation

The pull request adds a new feature gate VSpherePerComponentScopedCreds for vSphere credential management in OpenShift. The changes are limited to: 1. Feature gate declaration in features/features.go - a metadata definition that references enhancement PR 2081 2. Documentation update in features.md - a table row entry 3. Feature gate configurations in 10 YAML manifest files - entries in enabled/disabled lists The investigation found no usage of weak cryptographic algorithms (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB), no custom crypto implementations, and no non-constant-time secret comparisons. The term "Credentials" in the feature name refers to cloud credential management, not cryptographic operations. The changes introduce only feature gate metadata and configuration, which do not meet any explicit failure condition in the custom check.

Full details: Container-Privileges

Explanation

The pull request changes one Go feature-gate declaration, a feature matrix row, and FeatureGate status manifests. The added manifest entries only name VSpherePerComponentScopedCreds. No changed line contains privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation, and the manifests are kind: FeatureGate objects rather than container specifications. No root execution setting is introduced.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request changes only feature-gate metadata, the feature matrix, and generated YAML lists. The added Go code registers VSpherePerComponentScopedCreds; it adds no logging calls or log message content. The added lines contain no passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-08-17T23:35:46Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

rvanderp3 · 2026-08-18T16:42:22Z

/pipeline

rvanderp3 · 2026-08-18T16:43:25Z

/pipeline required

openshift-merge-bot · 2026-08-18T16:43:27Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

rvanderp3 · 2026-08-18T19:02:42Z

/hold cancel

vr4manta · 2026-08-18T19:10:52Z

/lgtm
/assign @everettraven

openshift-merge-bot · 2026-08-18T19:12:00Z

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

rvanderp3 · 2026-08-18T19:14:17Z

/hold

vr4manta · 2026-08-18T19:15:59Z

/lgtm

openshift-merge-bot · 2026-08-18T19:17:14Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

rvanderp3 · 2026-08-18T19:27:33Z

/hold cancel

everettraven · 2026-08-20T19:39:37Z

+							reportProblemsToJiraComponent("splat").
+							contactPerson("rvanderp3").
+							productScope(ocpSpecific).
+							enhancementPR("https://github.com/openshift/enhancements/pull/2081").


This is fine as-is since you're going into DPNU, but it looks like there hasn't been any review of the EP - is there at least some kind of rough consensus from stakeholders that the proposed approach is at least in the right direction, even if there is further discovery/discussions that need to take place?

Hi Everett, i missed this feedback, yes, we have a rough consensus and we'll continue to refine the EP as we move forward.

Adds a new TechPreview feature gate for vSphere per-component credential overrides in CCO, allowing cluster administrators to provide distinct, lower-privilege credentials for each component (Machine API, CSI, Cloud Controller Manager) via annotated secrets in the openshift-config namespace. Enhancement: openshift/enhancements#2081

jcpowermac · 2026-09-01T18:46:32Z

/lgtm

openshift-merge-bot · 2026-09-01T18:46:52Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

openshift-ci · 2026-09-01T18:46:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jcpowermac, vr4manta
Once this PR has been reviewed and has the lgtm label, please ask for approval from everettraven. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rvanderp3 · 2026-09-01T19:32:11Z

/test verify

openshift-ci · 2026-09-01T23:03:06Z

@rvanderp3: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn	`1fdf621`	link	true	`/test e2e-aws-ovn`
ci/prow/e2e-gcp	`1fdf621`	link	true	`/test e2e-gcp`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

rvanderp3 · 2026-09-02T13:03:50Z

hi @everettraven , this should be ready for a review when you get a chance

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 17, 2026

openshift-ci Bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Aug 17, 2026

openshift-ci Bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Aug 17, 2026

openshift-ci Bot requested review from JoelSpeed and everettraven August 17, 2026 19:17

rvanderp3 force-pushed the add-vsphere-scoped-credentials-feature-gate branch from 00618b2 to bd2cd3c Compare August 17, 2026 23:35

openshift-ci Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 17, 2026

rvanderp3 force-pushed the add-vsphere-scoped-credentials-feature-gate branch from bd2cd3c to 4800040 Compare August 18, 2026 14:32

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 18, 2026

openshift-ci Bot assigned everettraven and vr4manta Aug 18, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 18, 2026

rvanderp3 force-pushed the add-vsphere-scoped-credentials-feature-gate branch from 4800040 to ac0a2e4 Compare August 18, 2026 19:15

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 18, 2026

everettraven reviewed Aug 20, 2026

View reviewed changes

rvanderp3 force-pushed the add-vsphere-scoped-credentials-feature-gate branch from ac0a2e4 to 1fdf621 Compare September 1, 2026 18:24

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 1, 2026

openshift-ci Bot assigned jcpowermac Sep 1, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 1, 2026

Uh oh!

Conversation

rvanderp3 commented Aug 17, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 17, 2026

Uh oh!

openshift-ci-robot commented Aug 17, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Aug 17, 2026

Uh oh!

rvanderp3 commented Aug 17, 2026

Uh oh!

coderabbitai Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai Bot commented Aug 17, 2026

Uh oh!

rvanderp3 commented Aug 18, 2026

Uh oh!

rvanderp3 commented Aug 18, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 18, 2026

Uh oh!

rvanderp3 commented Aug 18, 2026

Uh oh!

vr4manta commented Aug 18, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 18, 2026

Uh oh!

rvanderp3 commented Aug 18, 2026

Uh oh!

vr4manta commented Aug 18, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 18, 2026

Uh oh!

rvanderp3 commented Aug 18, 2026

Uh oh!

everettraven Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

rvanderp3 Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

jcpowermac commented Sep 1, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

rvanderp3 commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

rvanderp3 commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

openshift-ci-robot commented Aug 17, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 17, 2026 •

edited

Loading