[release-2.9] ✨ Rosa roles config implementations #5692

serngawy · 2025-10-06T17:14:50Z

manual cherry-pick for this PR-5667

What type of PR is this?
feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

Release note:

Adding Rosa Role Config API and implementation

…tion

Bumps the dependencies group in /hack/tools with 7 updates: | Package | From | To | | --- | --- | --- | | [github.com/a8m/envsubst](https://github.com/a8m/envsubst) | `1.4.2` | `1.4.3` | | [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq) | `4.44.6` | `4.47.1` | | [github.com/spf13/pflag](https://github.com/spf13/pflag) | `1.0.6` | `1.0.7` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.32.3` | `0.32.8` | | [sigs.k8s.io/controller-tools](https://github.com/kubernetes-sigs/controller-tools) | `0.17.3` | `0.18.0` | | [sigs.k8s.io/kind](https://github.com/kubernetes-sigs/kind) | `0.26.0` | `0.29.0` | | [sigs.k8s.io/kustomize/kustomize/v5](https://github.com/kubernetes-sigs/kustomize) | `5.5.0` | `5.7.1` | Updates `github.com/a8m/envsubst` from 1.4.2 to 1.4.3 - [Release notes](https://github.com/a8m/envsubst/releases) - [Commits](a8m/envsubst@v1.4.2...v1.4.3) Updates `github.com/mikefarah/yq/v4` from 4.44.6 to 4.47.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@v4.44.6...v4.47.1) Updates `github.com/spf13/pflag` from 1.0.6 to 1.0.7 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.6...v1.0.7) Updates `k8s.io/apimachinery` from 0.32.3 to 0.32.8 - [Commits](kubernetes/apimachinery@v0.32.3...v0.32.8) Updates `sigs.k8s.io/controller-tools` from 0.17.3 to 0.18.0 - [Release notes](https://github.com/kubernetes-sigs/controller-tools/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-tools/blob/main/envtest-releases.yaml) - [Commits](kubernetes-sigs/controller-tools@v0.17.3...v0.18.0) Updates `sigs.k8s.io/kind` from 0.26.0 to 0.29.0 - [Release notes](https://github.com/kubernetes-sigs/kind/releases) - [Commits](kubernetes-sigs/kind@v0.26.0...v0.29.0) Updates `sigs.k8s.io/kustomize/kustomize/v5` from 5.5.0 to 5.7.1 - [Release notes](https://github.com/kubernetes-sigs/kustomize/releases) - [Commits](kubernetes-sigs/kustomize@kustomize/v5.5.0...kustomize/v5.7.1) --- updated-dependencies: - dependency-name: github.com/a8m/envsubst dependency-version: 1.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/mikefarah/yq/v4 dependency-version: 4.47.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/spf13/pflag dependency-version: 1.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: k8s.io/apimachinery dependency-version: 0.32.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: sigs.k8s.io/controller-tools dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: sigs.k8s.io/kind dependency-version: 0.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: sigs.k8s.io/kustomize/kustomize/v5 dependency-version: 5.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) from 0.5.12 to 0.5.14. - [Commits](ulikunitz/xz@v0.5.12...v0.5.14) --- updated-dependencies: - dependency-name: github.com/ulikunitz/xz dependency-version: 0.5.14 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/go-viper/mapstructure/releases) - [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md) - [Commits](go-viper/mapstructure@v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/go-viper/mapstructure/v2 dependency-version: 2.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps the dependencies group in /hack/tools with 4 updates: [github.com/spf13/pflag](https://github.com/spf13/pflag), [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery), [sigs.k8s.io/controller-tools](https://github.com/kubernetes-sigs/controller-tools) and [sigs.k8s.io/kind](https://github.com/kubernetes-sigs/kind). Updates `github.com/spf13/pflag` from 1.0.7 to 1.0.10 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.7...v1.0.10) Updates `k8s.io/apimachinery` from 0.33.0 to 0.33.4 - [Commits](kubernetes/apimachinery@v0.33.0...v0.33.4) Updates `sigs.k8s.io/controller-tools` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/kubernetes-sigs/controller-tools/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-tools/blob/main/envtest-releases.yaml) - [Commits](kubernetes-sigs/controller-tools@v0.18.0...v0.19.0) Updates `sigs.k8s.io/kind` from 0.29.0 to 0.30.0 - [Release notes](https://github.com/kubernetes-sigs/kind/releases) - [Commits](kubernetes-sigs/kind@v0.29.0...v0.30.0) --- updated-dependencies: - dependency-name: github.com/spf13/pflag dependency-version: 1.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: k8s.io/apimachinery dependency-version: 0.33.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: sigs.k8s.io/controller-tools dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: sigs.k8s.io/kind dependency-version: 0.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

- Update go.mod and hack/tools/go.mod to Go 1.24.7 - Update Makefile GO_VERSION to 1.24.7 - Update GitHub Actions workflow to use Go 1.24 - Update golangci-kal.yml to use Go 1.24 - Upgrade golangci-lint to v1.60.3 for Go 1.24 compatibility

Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 4 to 5. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@v4...v5) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [actions/github-script](https://github.com/actions/github-script) from 7.0.1 to 8.0.0. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@60a0d83...ed59741) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps the dependencies group in /hack/tools with 2 updates: [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq) and [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery). Updates `github.com/mikefarah/yq/v4` from 4.47.1 to 4.47.2 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@v4.47.1...v4.47.2) Updates `k8s.io/apimachinery` from 0.34.0 to 0.34.1 - [Commits](kubernetes/apimachinery@v0.34.0...v0.34.1) --- updated-dependencies: - dependency-name: github.com/mikefarah/yq/v4 dependency-version: 4.47.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: k8s.io/apimachinery dependency-version: 0.34.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: serngawy <[email protected]>

This commit adds support for AMD SEV-SNP instances, so users can utilize confidential computing technology on cluster nodes. Signed-off-by: Fangge Jin <[email protected]>

Signed-off-by: serngawy <[email protected]>

linux-foundation-easycla · 2025-10-06T17:14:57Z

✅ login: fiunchinho / name: Jose Armesto (54bc415, 9d82d11)
✅ login: alam0rt / name: sam lockart (058eabe, a915d3c, b456ba4, 83e5d36, 2566c8a, e73c53c, feebd44, ab0c792, b2bb96b, bcb9122, 24aa66a, ba45de7)
✅ login: dependabot[bot] / name: dependabot[bot] (1d3f142, 2416035, e456362, fabad05, 62c41a4, 05c538c, 421deb6, f703c19, 227f1ab, 2c54e07, 848dab3)
✅ login: darkweaver87 / name: Rémi BUISSON (ef16761)
✅ login: serngawy / name: Mohamed ElSerngawy (d29f649, 9788faf)
✅ login: fangge1212 / name: Fangge Jin (2b5f38b)
✅ login: PanSpagetka / name: Robin Knaur (9d5c6b3, f0abfbf, 258fcc0, ee6d5f4, 6b11711)
✅ login: bryan-cox / name: Bryan Cox (62a8f84)
✅ login: chrischdi / name: Christian Schlotter (caed4ea)
❌ The email address for the commit (948d685, 3360b2b) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.

k8s-ci-robot · 2025-10-06T17:14:58Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nrb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

darkweaver87 and others added 30 commits October 6, 2025 10:11

fix: add missing IAM action for emptyRoutesDefaultVPCSecurityGroup op…

ef16761

…tion

Update generated code

f703c19

devbox updates

948d685

go bump, seems needed to build envsubst

3360b2b

✨ Create only one nat gateway per AZ

9d82d11

Return early if Cluster is paused

54bc415

Update generated code

05c538c

add field to v1beta2

feebd44

add conversions and field to webhook tests

ab0c792

add to scope

058eabe

use correct type

ba45de7

add tests for preserving delete

b456ba4

make generate

2566c8a

move to correct test case

83e5d36

move to addon type

a915d3c

remove old field

e73c53c

add back

b2bb96b

wire up

24aa66a

generate again

bcb9122

Add make target to generate test-infra prowjobs via CAPI's prowjob-gen

caed4ea

build: upgrade Go version to 1.24.7

62a8f84

- Update go.mod and hack/tools/go.mod to Go 1.24.7 - Update Makefile GO_VERSION to 1.24.7 - Update GitHub Actions workflow to use Go 1.24 - Update golangci-kal.yml to use Go 1.24 - Upgrade golangci-lint to v1.60.3 for Go 1.24 compatibility

serngawy and others added 8 commits October 6, 2025 10:11

Fix RosaControlPlane sync defaulet RosaMachinePool

9788faf

Signed-off-by: serngawy <[email protected]>

Add support for AMD SEV-SNP instances

2b5f38b

This commit adds support for AMD SEV-SNP instances, so users can utilize confidential computing technology on cluster nodes. Signed-off-by: Fangge Jin <[email protected]>

Add RosaRoleConfig API and CRD.

f0abfbf

Enable partial reconcile of Rosa Operator Roles

9d5c6b3

Review fixes

ee6d5f4

Add integration tests

258fcc0

Add more tests

6b11711

Fix comments

d29f649

Signed-off-by: serngawy <[email protected]>

k8s-ci-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Oct 6, 2025

k8s-ci-robot requested review from cnmcavoy and fiunchinho October 6, 2025 17:14

k8s-ci-robot added needs-priority cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Oct 6, 2025

serngawy closed this Oct 6, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[release-2.9] ✨ Rosa roles config implementations #5692

[release-2.9] ✨ Rosa roles config implementations #5692

Uh oh!

serngawy commented Oct 6, 2025

Uh oh!

linux-foundation-easycla bot commented Oct 6, 2025

Uh oh!

k8s-ci-robot commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

[release-2.9] ✨ Rosa roles config implementations #5692

[release-2.9] ✨ Rosa roles config implementations #5692

Uh oh!

Conversation

serngawy commented Oct 6, 2025

Uh oh!

linux-foundation-easycla bot commented Oct 6, 2025

Uh oh!

k8s-ci-robot commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants