SPLAT-2588: fix hypershift topology variant to match Sippy classification

[redhat-chai-bot]

Summary

Fixes the topology variant mismatch between openshift/api's verify-feature-promotion tool and Sippy's variant classification for hypershift jobs.

Problem

The featuregate-test-analyzer defined requiredHypershiftJobVariants with Topology: "hypershift", but Sippy classifies hypershift jobs as Topology: "external" (via setTopology() in pkg/variantregistry/ocp.go). This mismatch caused verify-feature-promotion to find 0 tests when querying Sippy for hypershift variant test results, blocking feature gate promotions for hypershift.

Error observed in CI:

Query sippy for all test run results for pattern "FeatureGate:AWSServiceLBNetworkSecurityGroup]" on variant main.JobVariant{Cloud:"aws", Architecture:"amd64", Topology:"hypershift", ...}
INSUFFICIENT CI testing for "AWSServiceLBNetworkSecurityGroup".
only 0 tests found, need at least 5

Fix

1. Topology fix: Changed Topology: "hypershift" to Topology: "external" in requiredHypershiftJobVariants (in tools/codegen/cmd/featuregate-test-analyzer.go) to match Sippy's classification.

2. Validation promotion: Promotes AWSServiceLBNetworkSecurityGroup to Default on Hypershift (removes cluster-profile-specific gating) to validate the topology fix via the verify-feature-promotion CI check. This is the same promotion as PR #2838.

Verification

The verify-feature-promotion presubmit should now successfully query Sippy with Topology: "external" and find the hypershift test results. Note: sufficient test runs (>=14) from the periodic job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-techpreview are still needed for the promotion to pass.

Related:

• PR: SPLAT-2588 / WIP: Removing hypershift gates for AWSServiceLBNetworkSecurityGroup #2838
• Periodic job PR: SPLAT-2668: remove CCM test skips from Hypershift TP jobs release#79439

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @redhat-chai-bot! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[openshift-ci-robot]

@redhat-chai-bot: This pull request references SPLAT-2588 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Fixes the topology variant mismatch between openshift/api's verify-feature-promotion tool and Sippy's variant classification for hypershift jobs.

Problem

The featuregate-test-analyzer defined requiredHypershiftJobVariants with Topology: "hypershift", but Sippy classifies hypershift jobs as Topology: "external" (via setTopology() in pkg/variantregistry/ocp.go). This mismatch caused verify-feature-promotion to find 0 tests when querying Sippy for hypershift variant test results, blocking feature gate promotions for hypershift.

Error observed in CI:

Query sippy for all test run results for pattern "FeatureGate:AWSServiceLBNetworkSecurityGroup]" on variant main.JobVariant{Cloud:"aws", Architecture:"amd64", Topology:"hypershift", ...}
INSUFFICIENT CI testing for "AWSServiceLBNetworkSecurityGroup".
only 0 tests found, need at least 5

Fix

1. Topology fix: Changed Topology: "hypershift" to Topology: "external" in requiredHypershiftJobVariants (in tools/codegen/cmd/featuregate-test-analyzer.go) to match Sippy's classification.

2. Validation promotion: Promotes AWSServiceLBNetworkSecurityGroup to Default on Hypershift (removes cluster-profile-specific gating) to validate the topology fix via the verify-feature-promotion CI check. This is the same promotion as PR #2838.

Verification

The verify-feature-promotion presubmit should now successfully query Sippy with Topology: "external" and find the hypershift test results. Note: sufficient test runs (>=14) from the periodic job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-techpreview are still needed for the promotion to pass.

Related:

• PR: SPLAT-2588 / WIP: Removing hypershift gates for AWSServiceLBNetworkSecurityGroup #2838
• Periodic job PR: SPLAT-2668: remove CCM test skips from Hypershift TP jobs release#79439

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 80e29eca-4648-4857-93f6-4506ef925d72

📥 Commits

Reviewing files that changed from the base of the PR and between 5346161 and f599520.

📒 Files selected for processing (5)

• features.md
• features/features.go
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• tools/codegen/cmd/featuregate-test-analyzer.go

---

📝 Walkthrough

Walkthrough

The AWSServiceLBNetworkSecurityGroup feature gate enablement in features/features.go is consolidated from two separate profile-scoped entries (SelfManaged and Hypershift) into a single call covering inDefault, inOKD, inTechPreviewNoUpgrade, and inDevPreviewNoUpgrade. The generated payload manifests for featureGate-4-10-Hypershift-Default and featureGate-4-10-Hypershift-OKD are regenerated, moving AWSServiceLBNetworkSecurityGroup from the disabled list to the enabled list in both files. The features.md table row for this gate is updated to reflect Enabled status for the Hypershift Default and OKD columns. Separately, a Topology value in featuregate-test-analyzer.go is changed from "hypershift" to "external".

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: fixing a hypershift topology variant mismatch in the featuregate-test-analyzer tool to match Sippy's classification.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, explaining the problem, the fix, and verification steps for the topology variant mismatch between openshift/api and Sippy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	This PR does not contain any Ginkgo test files or test name definitions. All modified files are feature gate configurations, YAML manifests, and source code. The custom check for stable test names...
Test Structure And Quality	✅ Passed	No Ginkgo test files were modified in this PR. The check evaluates Ginkgo test code quality, but the PR only modifies feature gate configs, manifests, docs, and utility code—not test code.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. Changes are limited to feature gate configuration files (YAML), documentation (Markdown), and Go source code for configuration/tools—not test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR does not add any new Ginkgo e2e tests. Changes are limited to feature gate configuration, documentation, YAML manifests, and a code analysis tool fix. SNO compatibility check is not applica...
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only feature gate configurations (features.md, features/features.go, FeatureGate manifests) and test analyzer tool. No deployment manifests, operator code, or pod scheduling constraints...
Ote Binary Stdout Contract	✅ Passed	The PR changes feature gate definitions and a codegen verification tool, not OTE test binaries. The featuregate-test-analyzer is not an OTE binary and does not implement the JSON test listing proto...
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR does not add any new Ginkgo e2e tests; it only modifies feature gate configurations, manifests, documentation, and a code generation tool. The IPv6 and disconnected network compatibility ch...
No-Weak-Crypto	✅ Passed	PR contains no weak cryptography: no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB mode usage; no custom crypto implementations; no non-constant-time secret comparisons. Changes are feature gate configu...
Container-Privileges	✅ Passed	The PR modifies feature gate configuration files, Go source code, and documentation. None of the changes contain container privilege settings, Kubernetes security contexts, or privileged container...
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data exposed in logs. PR changes only configuration values (Topology: "hypershift" → "external") and feature gate enablement states; no new logging added.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joelspeed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mtulio]

Slack updated asking for review. I will remove the FG promotion once it is validated, cleaning this PR keeping only the fix.

/assign @JoelSpeed @enxebre @stephenfin
/hold

[openshift-ci]

@redhat-chai-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-feature-promotion	f599520	link	true	/test verify-feature-promotion

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[mtulio]

/verified by CI job with dummy verify-feature-promotion showing job evaluating job runs on Hypershift.

I am going to ask chai-bot to clean up this fix removing the dummy promotion which is addressed by #2838

[openshift-ci-robot]

@mtulio: This PR has been marked as verified by CI job with dummy [verify-feature-promotion](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_api/2897/pull-ci-openshift-api-master-verify-feature-promotion/2069069109932331008#1:build-log.txt%3A37-46) showing job evaluating job runs on Hypershift..

Details

In response to this:

/verified by CI job with dummy verify-feature-promotion showing job evaluating job runs on Hypershift.

I am going to ask chai-bot to clean up this fix removing the dummy promotion which is addressed by #2838

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.