Skip to content

Commit cb3a1a4

Browse files
hongkailiuhongkailiu
committed
UPSTREAM: <drop>: Verify manifests in e2e
1 parent 77b3287 commit cb3a1a4

4 files changed

Lines changed: 391 additions & 0 deletions

File tree

‎docs/superpowers/plans/2026-06-11-exclude-awsmachinepools-openshift.md‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
# Exclude AWSMachinePools from OpenShift Manifests Implementation Plan
2+
3+
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
4+
5+
**Goal:** Exclude unused awsmachinepool CRD and related resources from OpenShift manifests
6+
7+
**Architecture:** Add kustomize patches to `openshift/kustomization.yaml` that mark awsmachinepool resources with `config.kubernetes.io/local-config: "true"` annotation, causing kustomize to exclude them from final output.
8+
9+
**Tech Stack:** Kustomize, YAML
10+
11+
---
12+
13+
## File Structure
14+
15+
**Modified files:**
16+
- `openshift/kustomization.yaml` - Add exclusion patches for awsmachinepool resources
17+
- `openshift/capi-operator-manifests/default/manifests.yaml` - Generated output (regenerated by make)
18+
19+
**No new files created**
20+
21+
## Task 1: Add CRD Exclusion Patch
22+
23+
**Files:**
24+
- Modify: `openshift/kustomization.yaml:36` (after existing patches)
25+
26+
- [ ] **Step 1: Read current kustomization.yaml**
27+
28+
Check the existing patches section to understand where to add the new patches.
29+
30+
Run: `cat openshift/kustomization.yaml`
31+
32+
- [ ] **Step 2: Add CRD exclusion patch**
33+
34+
Add the following patch to the `patches:` section in `openshift/kustomization.yaml`, after the existing TLS configuration patch:
35+
36+
```yaml
37+
# Exclude awsmachinepool CRD - not used in OpenShift clusters
38+
- target:
39+
kind: CustomResourceDefinition
40+
name: awsmachinepools.infrastructure.cluster.x-k8s.io
41+
patch: |-
42+
- op: add
43+
path: /metadata/annotations/config.kubernetes.io~1local-config
44+
value: "true"
45+
```
46+
47+
This uses JSON Patch format (consistent with existing patches in the file) to add the `config.kubernetes.io/local-config: "true"` annotation.
48+
49+
- [ ] **Step 3: Verify syntax**
50+
51+
Run: `cat openshift/kustomization.yaml | grep -A5 "awsmachinepool"`
52+
Expected: See the newly added patch
53+
54+
## Task 2: Add MutatingWebhookConfiguration Exclusion Patch
55+
56+
**Files:**
57+
- Modify: `openshift/kustomization.yaml` (continue in patches section)
58+
59+
- [ ] **Step 1: Add MutatingWebhookConfiguration exclusion patch**
60+
61+
Add this patch immediately after the CRD patch:
62+
63+
```yaml
64+
# Exclude awsmachinepool mutating webhook
65+
- target:
66+
kind: MutatingWebhookConfiguration
67+
name: default.awsmachinepool.infrastructure.cluster.x-k8s.io
68+
patch: |-
69+
- op: add
70+
path: /metadata/annotations/config.kubernetes.io~1local-config
71+
value: "true"
72+
```
73+
74+
- [ ] **Step 2: Verify addition**
75+
76+
Run: `grep -c "MutatingWebhookConfiguration" openshift/kustomization.yaml`
77+
Expected: Count includes the new patch
78+
79+
## Task 3: Add ValidatingWebhookConfiguration Exclusion Patch
80+
81+
**Files:**
82+
- Modify: `openshift/kustomization.yaml` (continue in patches section)
83+
84+
- [ ] **Step 1: Add ValidatingWebhookConfiguration exclusion patch**
85+
86+
Add this patch immediately after the MutatingWebhookConfiguration patch:
87+
88+
```yaml
89+
# Exclude awsmachinepool validating webhook
90+
- target:
91+
kind: ValidatingWebhookConfiguration
92+
name: validation.awsmachinepool.infrastructure.cluster.x-k8s.io
93+
patch: |-
94+
- op: add
95+
path: /metadata/annotations/config.kubernetes.io~1local-config
96+
value: "true"
97+
```
98+
99+
- [ ] **Step 2: Verify all patches are added**
100+
101+
Run: `grep -A2 "awsmachinepool" openshift/kustomization.yaml`
102+
Expected: See all three patches (CRD, MutatingWebhook, ValidatingWebhook)
103+
104+
## Task 4: Regenerate OpenShift Manifests
105+
106+
**Files:**
107+
- Modify: `openshift/capi-operator-manifests/default/manifests.yaml` (auto-generated)
108+
109+
- [ ] **Step 1: Clean existing manifests**
110+
111+
Run: `rm -rf openshift/capi-operator-manifests/default/`
112+
Expected: Directory removed
113+
114+
- [ ] **Step 2: Regenerate manifests**
115+
116+
Run: `cd openshift && make ocp-manifests`
117+
Expected: Output shows "Processing provider cluster-api-provider-aws" and "Generating OpenShift manifests"
118+
119+
- [ ] **Step 3: Verify awsmachinepool CRD is excluded**
120+
121+
Run: `grep -i "awsmachinepools.infrastructure.cluster.x-k8s.io" openshift/capi-operator-manifests/default/manifests.yaml`
122+
Expected: No matches found (exit code 1)
123+
124+
- [ ] **Step 4: Verify awsmachinepool webhooks are excluded**
125+
126+
Run: `grep -i "awsmachinepool.infrastructure.cluster.x-k8s.io" openshift/capi-operator-manifests/default/manifests.yaml`
127+
Expected: No matches found (exit code 1)
128+
129+
- [ ] **Step 5: Verify no awsmachinepool references at all**
130+
131+
Run: `grep -i "awsmachinepool" openshift/capi-operator-manifests/default/manifests.yaml`
132+
Expected: No matches found (exit code 1)
133+
134+
- [ ] **Step 6: Count remaining CRDs**
135+
136+
Run: `grep "kind: CustomResourceDefinition" openshift/capi-operator-manifests/default/manifests.yaml | wc -l`
137+
Expected: A count (should be 1 less than before, but we're verifying it's non-zero)
138+
139+
## Task 5: Verify No Diff Issues
140+
141+
**Files:**
142+
- Verify: All modified files
143+
144+
- [ ] **Step 1: Run OpenShift verification**
145+
146+
Run: `cd openshift && make verify`
147+
Expected: Runs `make verify-ocp-manifests` and `./verify-diff.sh` with no errors
148+
149+
- [ ] **Step 2: Check git status**
150+
151+
Run: `git status`
152+
Expected: Shows modified `openshift/kustomization.yaml` and `openshift/capi-operator-manifests/default/manifests.yaml` (and possibly metadata.yaml)
153+
154+
- [ ] **Step 3: Review the diff**
155+
156+
Run: `git diff openshift/kustomization.yaml`
157+
Expected: Shows the three new patches added for awsmachinepool exclusion
158+
159+
- [ ] **Step 4: Verify manifests diff**
160+
161+
Run: `git diff openshift/capi-operator-manifests/default/manifests.yaml | grep "^-" | grep -i awsmachinepool | head -5`
162+
Expected: Shows lines being removed (awsmachinepool resources)
163+
164+
## Task 6: Commit Changes
165+
166+
**Files:**
167+
- Commit: `openshift/kustomization.yaml`, `openshift/capi-operator-manifests/default/manifests.yaml`
168+
169+
- [ ] **Step 1: Stage changes**
170+
171+
Run:
172+
```bash
173+
git add openshift/kustomization.yaml openshift/capi-operator-manifests/
174+
```
175+
176+
- [ ] **Step 2: Commit with DCO sign-off**
177+
178+
Run:
179+
```bash
180+
git commit -s -m "$(cat <<'EOF'
181+
Exclude awsmachinepools from OpenShift manifests
182+
183+
Add kustomize patches to mark awsmachinepool CRD and webhooks with
184+
config.kubernetes.io/local-config annotation, excluding them from
185+
generated OpenShift manifests as they are not used in OpenShift
186+
clusters.
187+
188+
Excluded resources:
189+
- CustomResourceDefinition: awsmachinepools.infrastructure.cluster.x-k8s.io
190+
- MutatingWebhookConfiguration: default.awsmachinepool.infrastructure.cluster.x-k8s.io
191+
- ValidatingWebhookConfiguration: validation.awsmachinepool.infrastructure.cluster.x-k8s.io
192+
193+
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
194+
EOF
195+
)"
196+
```
197+
198+
Expected: Commit created successfully
199+
200+
- [ ] **Step 3: Verify commit**
201+
202+
Run: `git log -1 --stat`
203+
Expected: Shows the commit with modified files
204+
205+
- [ ] **Step 4: Verify DCO sign-off**
206+
207+
Run: `git log -1 | grep "Signed-off-by"`
208+
Expected: Shows "Signed-off-by: [Your Name] <[your-email]>"
209+
210+
---
211+
212+
## Success Criteria
213+
214+
All tasks completed when:
215+
- ✅ `openshift/kustomization.yaml` contains three new patches for awsmachinepool exclusion
216+
- ✅ `grep -i "awsmachinepool" openshift/capi-operator-manifests/default/manifests.yaml` returns no matches
217+
- ✅ `make -C openshift verify` passes cleanly
218+
- ✅ Changes committed with DCO sign-off following project conventions
219+
- ✅ No changes to `config/` directory (awsmachinepools remain available for non-OpenShift deployments)

‎docs/superpowers/specs/2026-06-11-exclude-awsmachinepools-openshift-design.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Exclude AWSMachinePools from OpenShift Manifests
2+
3+
## Overview
4+
5+
Exclude all awsmachinepool-related resources (CRD, webhooks, RBAC) from OpenShift manifests because the `awsmachinepools.infrastructure.cluster.x-k8s.io` CRD is not used in the clusters being deployed.
6+
7+
## Requirements
8+
9+
- Permanently exclude awsmachinepool resources from generated OpenShift manifests
10+
- Exclude the CRD, associated webhooks, and RBAC permissions
11+
- Keep the awsmachinepool resources in the upstream config for non-OpenShift deployments
12+
- Follow existing patterns in the codebase
13+
14+
## Architecture
15+
16+
### Manifest Generation Flow
17+
18+
The current flow:
19+
1. `make ocp-manifests` invokes manifests-gen tool from cluster-capi-operator
20+
2. manifests-gen runs kustomize on `openshift/` directory
21+
3. Kustomize processes `config/default` which includes all CRDs via `config/crd`
22+
4. Output written to `openshift/capi-operator-manifests/default/manifests.yaml`
23+
24+
The solution:
25+
- Add kustomize patches in `openshift/kustomization.yaml`
26+
- Mark awsmachinepool resources with `config.kubernetes.io/local-config: "true"`
27+
- Kustomize automatically excludes these from final output
28+
29+
This follows the same pattern used by manifests-gen to exclude Secrets (see `openshift/tools/vendor/github.com/openshift/cluster-capi-operator/manifests-gen/kustomization.yaml`).
30+
31+
## Components
32+
33+
### Resources to Exclude
34+
35+
Based on analysis of generated manifests and source configuration:
36+
37+
1. **CustomResourceDefinition**: `awsmachinepools.infrastructure.cluster.x-k8s.io`
38+
2. **MutatingWebhookConfiguration**: `default.awsmachinepool.infrastructure.cluster.x-k8s.io`
39+
3. **ValidatingWebhookConfiguration**: `validation.awsmachinepool.infrastructure.cluster.x-k8s.io`
40+
4. **ClusterRole permissions**: Rules granting access to awsmachinepools resources
41+
5. **CA injection patches**: `config/crd/patches/cainjection_in_awsmachinepools.yaml`
42+
6. **Webhook patches**: `config/crd/patches/webhook_in_awsmachinepools.yaml`
43+
44+
**Why:** The CRD kustomization at `config/crd/kustomization.yaml` includes:
45+
- Line 14: `bases/infrastructure.cluster.x-k8s.io_awsmachinepools.yaml`
46+
- These patches apply CA injection and webhook configuration to the awsmachinepool CRD
47+
48+
However, since we're patching at the OpenShift kustomization level (which processes the full output from config/crd), we only need to mark the final rendered resources, not the source patches.
49+
50+
### Implementation
51+
52+
Add patches to `openshift/kustomization.yaml`:
53+
54+
```yaml
55+
patches:
56+
# Existing patches...
57+
58+
# Exclude awsmachinepool resources - not used in OpenShift clusters
59+
- target:
60+
kind: CustomResourceDefinition
61+
name: awsmachinepools.infrastructure.cluster.x-k8s.io
62+
patch: |
63+
apiVersion: apiextensions.k8s.io/v1
64+
kind: CustomResourceDefinition
65+
metadata:
66+
name: awsmachinepools.infrastructure.cluster.x-k8s.io
67+
annotations:
68+
config.kubernetes.io/local-config: "true"
69+
70+
- target:
71+
kind: MutatingWebhookConfiguration
72+
name: default.awsmachinepool.infrastructure.cluster.x-k8s.io
73+
patch: |
74+
apiVersion: admissionregistration.k8s.io/v1
75+
kind: MutatingWebhookConfiguration
76+
metadata:
77+
name: default.awsmachinepool.infrastructure.cluster.x-k8s.io
78+
annotations:
79+
config.kubernetes.io/local-config: "true"
80+
81+
- target:
82+
kind: ValidatingWebhookConfiguration
83+
name: validation.awsmachinepool.infrastructure.cluster.x-k8s.io
84+
patch: |
85+
apiVersion: admissionregistration.k8s.io/v1
86+
kind: ValidatingWebhookConfiguration
87+
metadata:
88+
name: validation.awsmachinepool.infrastructure.cluster.x-k8s.io
89+
annotations:
90+
config.kubernetes.io/local-config: "true"
91+
92+
- target:
93+
kind: ClusterRole
94+
name: capa-manager-role
95+
patch: |
96+
apiVersion: rbac.authorization.k8s.io/v1
97+
kind: ClusterRole
98+
metadata:
99+
name: capa-manager-role
100+
rules:
101+
- apiGroups: ["infrastructure.cluster.x-k8s.io"]
102+
resources: ["awsmachinepools", "awsmachinepools/finalizers", "awsmachinepools/status"]
103+
$patch: delete
104+
```
105+
106+
**Why:** Each patch targets a specific resource by kind and name, adding the local-config annotation that kustomize recognizes as a signal to exclude from output.
107+
108+
The ClusterRole patch removes awsmachinepool-related rules using the `$patch: delete` directive.
109+
110+
## Testing
111+
112+
### Verification Steps
113+
114+
1. Run `make ocp-manifests` to regenerate manifests
115+
2. Verify the generated manifests:
116+
```bash
117+
grep -i "awsmachinepool" openshift/capi-operator-manifests/default/manifests.yaml
118+
```
119+
Expected: No matches found
120+
121+
3. Verify other resources are still present:
122+
```bash
123+
grep "kind: CustomResourceDefinition" openshift/capi-operator-manifests/default/manifests.yaml | wc -l
124+
```
125+
Expected: Count reduced by 1 (one less CRD)
126+
127+
4. Run existing verification:
128+
```bash
129+
make -C openshift verify
130+
```
131+
Expected: Passes cleanly
132+
133+
### Test Coverage
134+
135+
- Unit tests: Not applicable (kustomize configuration)
136+
- E2E tests: Existing OpenShift e2e tests will verify the generated manifests work correctly
137+
- Manual testing: Deploy generated manifests to verify no awsmachinepool resources created
138+
139+
## Implementation Steps
140+
141+
1. Modify `openshift/kustomization.yaml` to add the exclusion patches
142+
2. Run `make ocp-manifests` to regenerate manifests
143+
3. Verify awsmachinepool resources are excluded
144+
4. Run `make -C openshift verify` to ensure no diff issues
145+
5. Commit changes with DCO sign-off
146+
147+
## Success Criteria
148+
149+
- Generated `openshift/capi-operator-manifests/default/manifests.yaml` contains no awsmachinepool references
150+
- `make -C openshift verify` passes
151+
- No changes to upstream `config/` directory (keeps awsmachinepools for non-OpenShift use)
152+
- Commit follows project conventions and includes DCO sign-off

‎openshift/e2e-tests.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ set -euo pipefail
44

55
echo "Running e2e-tests.sh"
66

7+
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
8+
"${SCRIPT_DIR}/e2e-verify-manifests.sh"
9+
710
unset GOFLAGS
811
tmp="$(mktemp -d)"
912

0 commit comments

Comments
 (0)