OCPBUGS-94057: UPSTREAM: 3265: 🐛 allow unconditional providerID updates in OpenStackMachine

[simkam]

cherry-picking kubernetes-sigs#3265

Remove conditional immutability check that only allowed providerID and instanceID to be set when the old value was nil. This created a race condition where controller reconciliation retries would be rejected by the webhook, causing IPI installation failures.

The fix aligns CAPO with upstream CAPI patterns used by AWS, GCP, and VSphere providers, which all allow providerID to be updated unconditionally. This prevents webhook rejections during normal controller operation while maintaining the same practical behavior since the controller only sets these fields once.

Provider	File	Restriction
AWS (CAPA)	awsmachine_webhook.go	Unconditional
GCP (CAPG)	gcpmachine_webhook.go	Unconditional
VSphere (CAPV)	vspheremachine.go	Allowlist
Azure (CAPZ)	azuremachine_webhook.go	No restriction

/hold

Summary by CodeRabbit

• Bug Fixes
  • OpenStackMachine updates now handle changes to providerID consistently during validation.
  • Updates to providerID are now accepted as expected, while other protected specification changes remain restricted.
• Tests
  • Updated end-to-end validation coverage to confirm that providerID can be modified successfully.

[openshift-ci-robot]

@simkam: This pull request references Jira Issue OCPBUGS-94057, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (tjadhav@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

cherry-picking kubernetes-sigs#3265

Remove conditional immutability check that only allowed providerID and instanceID to be set when the old value was nil. This created a race condition where controller reconciliation retries would be rejected by the webhook, causing IPI installation failures.

The fix aligns CAPO with upstream CAPI patterns used by AWS, GCP, and VSphere providers, which all allow providerID to be updated unconditionally. This prevents webhook rejections during normal controller operation while maintaining the same practical behavior since the controller only sets these fields once.

Provider	File	Restriction
AWS (CAPA)	awsmachine_webhook.go	Unconditional
GCP (CAPG)	gcpmachine_webhook.go	Unconditional
VSphere (CAPV)	vspheremachine.go	Allowlist
Azure (CAPZ)	azuremachine_webhook.go	No restriction

/hold

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign gryf for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• hack/tools/vendor/sigs.k8s.io/cluster-api-provider-openstack/pkg/webhooks/openstackmachine_webhook.go is excluded by !**/vendor/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3bc37028-73b0-4c37-910f-9a8c5f2fef3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

OpenStackMachine update validation now ignores spec.providerID and spec.instanceID when comparing specifications. The e2e validation test now expects subsequent providerID updates to succeed.

Changes

OpenStackMachine providerID validation

Layer / File(s)	Summary
Allow providerID updates pkg/webhooks/openstackmachine_webhook.go, test/e2e/suites/apivalidations/openstackmachine_test.go	ValidateUpdate removes providerID and instanceID from both specs before comparison, and the e2e test verifies that providerID can be updated.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: making OpenStackMachine providerID updates unconditional.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed Ginkgo title is static and deterministic: 'should allow the providerID to be updated'; no dynamic suffixes or runtime values appear in test titles.
Test Structure And Quality	✅ Passed	The new Ginkgo test uses suite cleanup via createNamespace/DeferCleanup, has no indefinite waits, and each It stays focused on one validation behavior.
Microshift Test Compatibility	✅ Passed	The added providerID update test only uses Namespaces and OpenStackMachine CRs; no MicroShift-excluded APIs, tags, or unsupported cluster assumptions were found.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The added e2e case only creates/updates an OpenStackMachine CR; it makes no node/HA assumptions and has no SNO skip guard.
Topology-Aware Scheduling Compatibility	✅ Passed	Only webhook immutability and API-validation test logic changed; no manifests, replicas, affinities, node selectors, or topology-based scheduling were added.
Ote Binary Stdout Contract	✅ Passed	Touched files add no stdout writes; suite setup uses Ginkgo/manager setup only, with no fmt.Print, klog, or os.Stdout calls.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The modified e2e test only updates OpenStackMachine spec fields; it has no IP literals, ParseIP/CIDR, host formatting, or external network calls.
No-Weak-Crypto	✅ Passed	Touched files only relax providerID/instanceID webhook validation and update an e2e test; no weak crypto, custom crypto, or secret/token comparisons were added.
Container-Privileges	✅ Passed	PR only changes webhook validation logic and e2e tests; no container/K8s manifests or privilege settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	No logging statements were added in the touched files; only error returns and test literals appear, with no sensitive data exposure.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

test/e2e/suites/apivalidations/openstackmachine_test.go (1)

63-75: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add e2e coverage for instanceID updates.

The webhook now exempts both providerID and instanceID from immutability checks, but this test only verifies providerID. Add an analogous set-and-update assertion for instanceID to prevent regressions in the second behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/suites/apivalidations/openstackmachine_test.go` around lines 63 -
75, Add analogous e2e coverage for instanceID in the “should allow the
providerID to be updated” test: set machine.Spec.InstanceID after creation,
update successfully, then change it to a different value and verify the second
update succeeds, matching the existing providerID assertions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/e2e/suites/apivalidations/openstackmachine_test.go`:
- Around line 63-75: Add analogous e2e coverage for instanceID in the “should
allow the providerID to be updated” test: set machine.Spec.InstanceID after
creation, update successfully, then change it to a different value and verify
the second update succeeds, matching the existing providerID assertions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9824cfec-ef8b-4342-b557-1d2e363e3e03

📥 Commits

Reviewing files that changed from the base of the PR and between 51bafa8 and 257bb46.

📒 Files selected for processing (2)

• pkg/webhooks/openstackmachine_webhook.go
• test/e2e/suites/apivalidations/openstackmachine_test.go

[simkam]

/test e2e-hypershift

[openshift-ci]

@simkam: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[eshulman2]

/lgtm /approve