Skip to content

Conversation

@vr4manta
Copy link

@vr4manta vr4manta commented Oct 1, 2025

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Summary by CodeRabbit

  • New Features

    • Added AWS dedicated-host support with configurable affinity modes ("default", "host") and host identifier validation.
  • Security / Permissions

    • AWS credentials policy expanded to allow instance-type discovery (ec2:DescribeInstanceTypes).
  • Tests

    • Expanded conversion and fuzzing tests covering host-affinity, host-ID validation, and related error cases.
  • Chores

    • Dependency and module version updates for build/test tooling.

✏️ Tip: You can customize this high-level summary in your review settings.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 1, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Oct 1, 2025

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS

Dependencies

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 1, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 1, 2025

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai
Copy link

coderabbitai bot commented Oct 1, 2025

📝 Walkthrough

Walkthrough

Adds AWS dedicated-host placement support across CAPA↔MAPI conversions (HostAffinity/HostID mapping and validation, tenancy constants), updates fuzz and unit tests for many placement scenarios, bumps several module dependencies, and adds ec2:DescribeInstanceTypes to the AWS credentials-request manifest.

Changes

Cohort / File(s) Summary
Credentials Request
manifests/0000_30_cluster-api_01_credentials-request.yaml
Added ec2:DescribeInstanceTypes to the AWS provider IAM actions in the credentials-request manifest.
CAPA → MAPI conversion
pkg/conversion/capi2mapi/aws.go, pkg/conversion/capi2mapi/aws_fuzz_test.go, pkg/conversion/capi2mapi/aws_test.go
Introduced tenancy constants (TenancyDefault, TenancyDedicated, TenancyHost); added host-ID regex and convertAWSDedicatedHostToMAPI to validate and map CAPA HostAffinity/HostID to MAPI HostPlacement; integrated placement into toProviderSpec; expanded fuzzers and unit tests covering many HostAffinity/HostID cases (valid/invalid).
MAPI → CAPA conversion
pkg/conversion/mapi2capi/aws.go, pkg/conversion/mapi2capi/aws_fuzz_test.go, pkg/conversion/mapi2capi/aws_test.go
Added convertAWSHostAffinityToCAPI and convertAWSHostIDToCAPI to map MAPI HostPlacement back to CAPA HostAffinity/HostID; introduced fuzzPlacement and replaced the anonymous tenancy fuzz; added tests for AnyAvailable and DedicatedHost placements.
Module updates
go.mod, e2e/go.mod, hack/tools/go.mod
Bumped sigs.k8s.io/cluster-api-provider-aws requirement; updated kustomize/tool versions in hack/tools/go.mod.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐇 I hopped through specs and regex with delight,

I nudged HostAffinity to land just right,
From CAPA to MAPI I carried each ID,
Tests and fuzzers tickled every tidy bit,
A little rabbit's hop — precise and bright.

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 67.77% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main feature addition: dedicated host support for AWS, with a ticket reference.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 1, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Oct 1, 2025

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS

Dependencies

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 1, 2025
@vr4manta vr4manta force-pushed the SPLAT-2167 branch 2 times, most recently from 6355141 to 7ba97c3 Compare November 10, 2025 16:22
@openshift-ci-robot
Copy link

openshift-ci-robot commented Nov 11, 2025

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS

Dependencies

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@vr4manta vr4manta force-pushed the SPLAT-2167 branch 2 times, most recently from dc53d82 to e5cbce2 Compare November 11, 2025 17:16
@vr4manta
Copy link
Author

/test all

@vr4manta
Copy link
Author

/test all

@vr4manta vr4manta force-pushed the SPLAT-2167 branch 2 times, most recently from ed41da7 to 320eac0 Compare November 13, 2025 14:40
@openshift-ci-robot
Copy link

openshift-ci-robot commented Nov 13, 2025

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS

Dependencies

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

- ec2:DescribeDhcpOptions
- ec2:DescribeImages
- ec2:DescribeInstances
- ec2:DescribeInstanceTypes
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe it would be nice to add this change to a new commit referencing the reason of adding it (upstream PR, jira feature, etc).

this would be used to document in the future and/or in managed services to eventually update the managed IAM.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure! There is a warning message that is caused by this missing. I am not 100% sure this feature introduced it, but I am happy to put into a separate commit.

mapaProviderConfig.HostPlacement = &mapiv1beta1.HostPlacement{
Affinity: ptr.To(mapiv1beta1.HostAffinityDedicatedHost),
DedicatedHost: &mapiv1beta1.DedicatedHost{
ID: *m.awsMachine.Spec.HostID,
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we need to check HostID isnt nil to be safe or is there already a previous validation of this scenario?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good question. lots of these CRs have checks in their respective webhooks / CRDs. I can add a check here as well. I was on the fence about it.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Nov 14, 2025

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@vr4manta vr4manta marked this pull request as ready for review November 14, 2025 13:15
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 14, 2025
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 13, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 13, 2026
@vr4manta
Copy link
Author

Need to look into why e2e fails for host id.

@vr4manta all failed because CAPI to MAPI failed, seems this part hasn't been implemented yet.

            Reason: "FailedToConvertCAPIMachineSetToMAPI",
            Message: "failed to convert CAPI machine set to MAPI machine set: spec.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
        },

This is happening because upstream bug defaults to host, not default. this results in the conversion logic failing hostID for not being set when in reality it should not be due to default.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 13, 2026

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Summary by CodeRabbit

  • New Features

  • AWS dedicated-host support with configurable affinity modes ("default" and "host")

  • Support for explicit host identifier assignment in dedicated-host configurations

  • Security / Permissions

  • Enhanced AWS credentials policy allowing instance-type discovery (ec2:DescribeInstanceTypes)

  • Tests

  • Expanded conversion and fuzzing tests to cover host-affinity and host-ID validation scenarios

  • Chores

  • Dependency updates and module version bumps across build/test tooling

✏️ Tip: You can customize this high-level summary in your review settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Fix all issues with AI agents
In @e2e/go.mod:
- Line 27: Add a TODO comment above the pseudo-version dependency line for
sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
noting this is a temporary workaround that depends on an upstream PR fix
(include PR number/link and an expected removal condition), mirroring the style
and placement used for other temporary dependencies in lines 5-10 so future
maintainers know why this pseudo-version is vendored and when to revert it.

In @hack/tools/go.mod:
- Line 11: Your updated dependency line "sigs.k8s.io/kustomize/kustomize/v5
v5.7.1" introduces breaking changes: v5.5.0 removed Starlark KRM function
support and v5.7.1 changed exec plugin arg parsing; inspect any use of
Starlark-based KRM functions and any exec plugins in your kustomize
overlays/plugins, run end-to-end builds to validate behavior, and either (a)
adapt those plugins/manifests to native Go functions or alternative scripting or
adjust exec plugin invocation to the new argument parsing, or (b) pin the
kustomize version to a compatible release (e.g., v5.4.1) in the go.mod until
you’ve migrated and tested.

In @pkg/conversion/capi2mapi/aws.go:
- Around line 258-260: The branch that validates HostID format currently appends
errHostIDRequired when awsDedicatedHostNamePattern.MatchString(*spec.HostID)
fails; change that to append errHostIDInvalidFormat instead so the error
reflects an invalid format (use the same error symbol as the default case),
i.e., replace errHostIDRequired with errHostIDInvalidFormat in the errorList
append for the awsDedicatedHostNamePattern check involving spec.HostID and
fldPath.Child("dedicatedHost").Child("id").
🧹 Nitpick comments (4)
go.mod (1)

318-320: Remove or clarify the confusing trailing comments.

The comment states "Using replace for force update" but the actual implementation uses a require directive (line 41), not a replace directive. The commented-out replace directive is redundant and adds noise.

Consider either:

  1. Removing these trailing lines entirely since the version is already specified at line 41
  2. Clarifying the comment to explain why this is documented (e.g., "Note: Previously considered using replace directive, but using require with pseudo-version instead")
♻️ Proposed cleanup
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )
-
-// Using replace for force update of 2.10
-//replace sigs.k8s.io/cluster-api-provider-aws/v2 => sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
pkg/conversion/capi2mapi/aws.go (2)

176-176: Stale TODO comment.

This TODO indicates conversion should be added when the MAPI API is finalized, but the conversion is now implemented at lines 187-191 directly below. Consider removing or updating this comment.

Proposed fix
-		// HostPlacement: TODO: add conversion from CAPA HostAffinity and HostID to MAPI HostPlacement when the MAPI API is finalized.

252-285: Consider using defined constants instead of string literals.

The switch cases use string literals "host" and "default", but constants TenancyHost and TenancyDefault are defined in this same file (lines 59, 63). Using the constants would improve maintainability.

Proposed fix
 	switch *spec.HostAffinity {
-	case "host":
+	case TenancyHost:
 		// For "host", host id is required in mapi.  Let's make sure it is set and id is valid
 		if spec.HostID == nil {
 			errorList = append(errorList, field.Required(fldPath.Child("dedicatedHost").Child("id"), errHostIDRequired))
 			break
 		} else if !awsDedicatedHostNamePattern.MatchString(*spec.HostID) {
-			errorList = append(errorList, field.Invalid(fldPath.Child("dedicatedHost").Child("id"), *spec.HostID, errHostIDRequired))
+			errorList = append(errorList, field.Invalid(fldPath.Child("dedicatedHost").Child("id"), *spec.HostID, errHostIDInvalidFormat))
 			break
 		}

 		host = &mapiv1beta1.HostPlacement{
 			Affinity: ptr.To(mapiv1beta1.HostAffinityDedicatedHost),
 			DedicatedHost: &mapiv1beta1.DedicatedHost{
 				ID: *spec.HostID,
 			},
 		}
-	case "default":
+	case TenancyDefault:
 		host = &mapiv1beta1.HostPlacement{
 			Affinity: ptr.To(mapiv1beta1.HostAffinityAnyAvailable),
 		}
pkg/conversion/mapi2capi/aws.go (1)

276-279: Stale TODO comments.

These TODO comments indicate the conversion is not yet implemented, but lines 294-295 now set HostAffinity and HostID using the new helper functions. Consider removing these stale comments.

Proposed fix
-		// TODO: add conversion from MAPI HostPlacement to CAPA HostAffinity and HostID when the MAPA API is finalized.
-		// HostAffinity: not set yet as they are not stable in MAPI yet.
-		// HostID: not set yet as they are not stable in MAPI yet.
-
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between e2642d9 and 1021a99.

⛔ Files ignored due to path filters (44)
  • e2e/go.sum is excluded by !**/*.sum
  • go.sum is excluded by !**/*.sum
  • go.work.sum is excluded by !**/*.sum
  • hack/tools/go.sum is excluded by !**/*.sum
  • vendor/github.com/sergi/go-diff/AUTHORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/CONTRIBUTORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/LICENSE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/match.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/modules.txt is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachinetemplate_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/grep.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/run-fns.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/api/docs.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/build.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagenablehelm.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagsforfunctions.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/create/create.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbase.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addcomponent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addgenerator.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addtransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/fix/convert.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removebuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeconfigmap.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removemetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removesecret.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removetransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile/kustomizationfile.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/util/validate.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/localize/localize.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kyaml/copyutil/copyutil.go is excluded by !**/vendor/**, !vendor/**
📒 Files selected for processing (10)
  • e2e/go.mod
  • go.mod
  • hack/tools/go.mod
  • manifests/0000_30_cluster-api_01_credentials-request.yaml
  • pkg/conversion/capi2mapi/aws.go
  • pkg/conversion/capi2mapi/aws_fuzz_test.go
  • pkg/conversion/capi2mapi/aws_test.go
  • pkg/conversion/mapi2capi/aws.go
  • pkg/conversion/mapi2capi/aws_fuzz_test.go
  • pkg/conversion/mapi2capi/aws_test.go
🚧 Files skipped from review as they are similar to previous changes (3)
  • pkg/conversion/mapi2capi/aws_test.go
  • manifests/0000_30_cluster-api_01_credentials-request.yaml
  • pkg/conversion/mapi2capi/aws_fuzz_test.go
🧰 Additional context used
🧬 Code graph analysis (1)
pkg/conversion/capi2mapi/aws_fuzz_test.go (1)
pkg/conversion/capi2mapi/aws.go (3)
  • TenancyDefault (59-59)
  • TenancyDedicated (61-61)
  • TenancyHost (63-63)
🔇 Additional comments (8)
go.mod (1)

41-41: Verify the AWS provider pseudo-version contains expected upstream fixes and evaluate the TODO comment necessity.

The pseudo-version v2.10.1-0.20251223195230-7aa98eaf0ba3 should be confirmed to include the dedicated host fixes mentioned in PR objectives and validated for consistency across all go.mod files. The suggested TODO comment referencing issue #5801 requires verification that this PR reference is accurate and that a temporary marker is appropriate for this dependency.

pkg/conversion/capi2mapi/aws.go (1)

187-191: LGTM!

The dedicated host conversion is correctly integrated into toProviderSpec. Errors are properly aggregated and the placement host field is set on the provider config.

pkg/conversion/capi2mapi/aws_test.go (2)

74-117: LGTM!

Comprehensive test coverage for valid HostAffinity and HostID combinations, including both 8-character and 17-character host IDs for both "default" and "host" affinity types.


118-183: LGTM!

Thorough negative test cases covering various invalid HostID formats: too short, wrong lengths (9 and 16 characters), uppercase characters, missing h- prefix, and non-hex characters. This ensures the regex validation is properly tested.

pkg/conversion/capi2mapi/aws_fuzz_test.go (1)

196-223: LGTM!

The fuzzer function is well-structured with 6 cases covering the valid combinations of Tenancy, HostAffinity, and HostID. The hardcoded HostID "h-0123456789abcdef0" is a valid 17-character hex format. Good coverage for round-trip fuzz testing.

pkg/conversion/mapi2capi/aws.go (3)

501-516: LGTM!

The function correctly handles nil-safety for both placement and placement.Affinity. The mapping from MAPI HostAffinityAnyAvailable"default" and HostAffinityDedicatedHost"host" is consistent with the reverse conversion in capi2mapi/aws.go.


518-531: LGTM!

The function correctly returns the HostID only when appropriate (for AnyAvailable or DedicatedHost affinity) and safely handles nil DedicatedHost. This aligns with the symmetric conversion behavior in capi2mapi.


294-295: LGTM!

The new fields are correctly populated using the conversion helpers. This completes the bidirectional conversion support for dedicated host placement.

k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
sigs.k8s.io/cluster-api v1.11.3
sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.0
sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Read the full e2e/go.mod file to see the context
cat e2e/go.mod

Repository: openshift/cluster-capi-operator

Length of output: 7048


🏁 Script executed:

# Search for the commit hash and PR references in the codebase
rg "7aa98eaf0ba3|5801" -C 3

Repository: openshift/cluster-capi-operator

Length of output: 29898


Add TODO comment for consistency with other temporary dependencies.

This pseudo-version should include a TODO comment documenting that it depends on an upstream PR fix, following the pattern used for other temporary dependencies in lines 5-10. The module is properly vendored, but lacks documentation explaining its temporary status.

Suggested change
+// TODO: Update to released version once upstream fix is available
	sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
// TODO: Update to released version once upstream fix is available
sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
🤖 Prompt for AI Agents
In @e2e/go.mod at line 27, Add a TODO comment above the pseudo-version
dependency line for sigs.k8s.io/cluster-api-provider-aws/v2
v2.10.1-0.20251223195230-7aa98eaf0ba3 noting this is a temporary workaround that
depends on an upstream PR fix (include PR number/link and an expected removal
condition), mirroring the style and placement used for other temporary
dependencies in lines 5-10 so future maintainers know why this pseudo-version is
vendored and when to revert it.

github.com/jstemmer/go-junit-report v0.9.1
github.com/onsi/ginkgo/v2 v2.27.2
sigs.k8s.io/kustomize/kustomize/v5 v5.4.1
sigs.k8s.io/kustomize/kustomize/v5 v5.7.1
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's check the current state of the go.mod file to see the actual versions
cat hack/tools/go.mod | head -30

Repository: openshift/cluster-capi-operator

Length of output: 206


🌐 Web query:

kustomize v5.4.1 v5.7.1 breaking changes release notes

💡 Result:

Summary of breaking changes between kustomize v5.4.1 and v5.7.1:

  • v5.4.0 (fixed in v5.4.1): null YAML values were being replaced by the string "null" (breaking change introduced in v5.4.0). [1]. (newreleases.io)
  • v5.5.0: removal of Starlark support for KRM functions (breaking change). [2]. (newreleases.io)
  • v5.7.1: no new breaking behavior called out in the v5.7.1 release notes; the release primarily drops the shlex dependency and updates libraries (note: if your workflows rely on the exec plugin argument parsing, test after upgrading). [3]. (github.com)

Sources:
[1] kustomize v5.4.1 / v5.4.0 release notes. (newreleases.io)
[2] kustomize v5.5.0 release notes (breaking: Starlark support removed). (newreleases.io)
[3] kustomize v5.7.1 release notes (drop shlex dependency; dependency updates). (github.com)

Would you like links to the specific GitHub release pages or a short upgrade checklist?

Citations:


🌐 Web query:

sigs.k8s.io/kustomize/kustomize/v5 v5.7.1 changelog

💡 Result:

Summary of kustomize v5.7.1 (sigs.k8s.io/kustomize/kustomize/v5)

  • Drops the shlex dependency (replace shlex-based arg parsing for exec plugin).
  • Updates dependencies: kyaml → v0.20.1, cmd/config → v0.20.1, api → v0.20.1.
  • Note: release message warns to file an issue if existing manifests become corrupted by the exec-plugin arg parsing change.

Source: GitHub release for kustomize v5.7.1. [1]

[1] kubernetes-sigs/kustomize — Releases (kustomize/v5.7.1).


Kustomize v5.5.0 removed Starlark support for KRM functions and v5.7.1 changed exec plugin argument parsing due to dropping the shlex dependency.

The update path (v5.4.1 → v5.7.1) introduces breaking changes in v5.5.0 (Starlark support removal) and a behavioral change in v5.7.1 (shlex dependency drop affecting exec plugin arg parsing). Verify whether:

  • Your kustomize configurations or plugins use Starlark for KRM functions
  • Your workflows rely on the exec plugin—if so, test argument parsing after upgrading
🤖 Prompt for AI Agents
In @hack/tools/go.mod at line 11, Your updated dependency line
"sigs.k8s.io/kustomize/kustomize/v5 v5.7.1" introduces breaking changes: v5.5.0
removed Starlark KRM function support and v5.7.1 changed exec plugin arg
parsing; inspect any use of Starlark-based KRM functions and any exec plugins in
your kustomize overlays/plugins, run end-to-end builds to validate behavior, and
either (a) adapt those plugins/manifests to native Go functions or alternative
scripting or adjust exec plugin invocation to the new argument parsing, or (b)
pin the kustomize version to a compatible release (e.g., v5.4.1) in the go.mod
until you’ve migrated and tested.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 13, 2026

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Summary by CodeRabbit

  • New Features

  • AWS dedicated-host support with configurable affinity modes ("default", "host") and explicit host identifier assignment

  • Security / Permissions

  • AWS credentials policy expanded to allow instance-type discovery (ec2:DescribeInstanceTypes)

  • Tests

  • Expanded conversion and fuzzing tests covering host-affinity and host-ID validation and error cases

  • Chores

  • Dependency and module version updates for build/test tooling

✏️ Tip: You can customize this high-level summary in your review settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
go.mod (1)

318-320: Remove or clarify the commented-out replace directive.

The comment on line 319 states "Using replace for force update" but the replace directive on line 320 is commented out, making it inactive and misleading. Additionally, the commented replace would be a no-op (replacing the module with itself at the same version).

Consider:

  1. Removing these lines if they're leftover development notes, or
  2. Clarifying the documentation if this is meant as a reference for future maintainers.
🧹 Suggested cleanup
-
-// Using replace for force update of 2.10
-//replace sigs.k8s.io/cluster-api-provider-aws/v2 => sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 1021a99 and 1023a8f.

⛔ Files ignored due to path filters (44)
  • e2e/go.sum is excluded by !**/*.sum
  • go.sum is excluded by !**/*.sum
  • go.work.sum is excluded by !**/*.sum
  • hack/tools/go.sum is excluded by !**/*.sum
  • vendor/github.com/sergi/go-diff/AUTHORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/CONTRIBUTORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/LICENSE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/match.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/modules.txt is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachinetemplate_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/grep.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/run-fns.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/api/docs.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/build.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagenablehelm.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagsforfunctions.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/create/create.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbase.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addcomponent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addgenerator.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addtransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/fix/convert.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removebuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeconfigmap.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removemetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removesecret.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removetransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile/kustomizationfile.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/util/validate.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/localize/localize.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kyaml/copyutil/copyutil.go is excluded by !**/vendor/**, !vendor/**
📒 Files selected for processing (3)
  • e2e/go.mod
  • go.mod
  • hack/tools/go.mod
🚧 Files skipped from review as they are similar to previous changes (2)
  • e2e/go.mod
  • hack/tools/go.mod
🔇 Additional comments (1)
go.mod (1)

41-41: This dependency bump correctly pulls in the upstream host affinity fix.

The pseudo-version points to commit 7aa98eaf0ba3 (full SHA: 7aa98eaf0ba3d6436ef17db0cd1b7a65b40bc5a9), which is the merge of PR #5801 to the release-2.10 branch. The fix changes the HostAffinity default from host to default and improves API documentation, as intended.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 13, 2026

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Summary by CodeRabbit

  • New Features

  • AWS dedicated-host support with configurable affinity modes ("default", "host") and explicit host identifier handling

  • Security / Permissions

  • AWS credentials policy expanded to allow instance-type discovery (ec2:DescribeInstanceTypes)

  • Tests

  • Expanded conversion and fuzzing tests covering host-affinity and host-ID validation and error cases

  • Chores

  • Dependency and module version updates for build/test tooling

✏️ Tip: You can customize this high-level summary in your review settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
go.mod (1)

318-320: Remove or clarify the dead commented code.

The commented-out replace directive on line 320 is redundant since line 41 already requires the same pseudo-version directly. The comment on line 319 ("Using replace for force update of 2.10") is misleading because no replace is actually in effect.

Either remove these lines entirely or, if kept for documentation purposes, update the comment to clarify this is historical context.

🧹 Suggested cleanup
-
-// Using replace for force update of 2.10
-//replace sigs.k8s.io/cluster-api-provider-aws/v2 => sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.1-0.20251223195230-7aa98eaf0ba3
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 1023a8f and 22fd0ed.

⛔ Files ignored due to path filters (44)
  • e2e/go.sum is excluded by !**/*.sum
  • go.sum is excluded by !**/*.sum
  • go.work.sum is excluded by !**/*.sum
  • hack/tools/go.sum is excluded by !**/*.sum
  • vendor/github.com/sergi/go-diff/AUTHORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/CONTRIBUTORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/LICENSE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/match.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/modules.txt is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachinetemplate_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/grep.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/run-fns.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/api/docs.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/build.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagenablehelm.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagsforfunctions.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/create/create.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbase.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addcomponent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addgenerator.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addtransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/fix/convert.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removebuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeconfigmap.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removemetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removesecret.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removetransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile/kustomizationfile.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/util/validate.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/localize/localize.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kyaml/copyutil/copyutil.go is excluded by !**/vendor/**, !vendor/**
📒 Files selected for processing (8)
  • e2e/go.mod
  • go.mod
  • hack/tools/go.mod
  • manifests/0000_30_cluster-api_01_credentials-request.yaml
  • pkg/conversion/capi2mapi/aws_fuzz_test.go
  • pkg/conversion/capi2mapi/aws_test.go
  • pkg/conversion/mapi2capi/aws_fuzz_test.go
  • pkg/conversion/mapi2capi/aws_test.go
🚧 Files skipped from review as they are similar to previous changes (3)
  • hack/tools/go.mod
  • e2e/go.mod
  • manifests/0000_30_cluster-api_01_credentials-request.yaml
🔇 Additional comments (5)
pkg/conversion/mapi2capi/aws_test.go (1)

96-121: LGTM!

The new test entries properly cover the two main HostPlacement scenarios for MAPI→CAPI conversion:

  • AnyAvailable affinity without a dedicated host ID
  • DedicatedHost affinity with a valid host ID

The host ID format h-0123456789abcdef0 correctly follows the expected pattern (h- prefix + 17 lowercase hex characters).

pkg/conversion/capi2mapi/aws_fuzz_test.go (1)

196-223: LGTM!

The refactored fuzzAWSMachineSpecTenancy function now correctly operates on the full AWSMachineSpec, ensuring that correlated fields (Tenancy, HostAffinity, HostID) are set consistently for each fuzzing case. The six cases provide good coverage of the valid combinations:

  • Default and dedicated tenancy without host placement
  • Host tenancy with default affinity (any available host) with/without a host ID
  • Host tenancy with host affinity (dedicated host) requiring a host ID
  • Empty tenancy baseline
pkg/conversion/capi2mapi/aws_test.go (1)

74-214: LGTM!

Excellent test coverage for the CAPI→MAPI host placement conversion. The tests comprehensively validate:

  1. Valid scenarios: Both 8-character and 17-character HostID formats with different HostAffinity values
  2. Invalid scenarios: Various malformed HostIDs (wrong length, uppercase, missing prefix, non-hex characters)
  3. Edge cases: Missing required HostID when affinity is "host", unsupported affinity values

The distinction in error messages between "Required value" (line 190, when HostID is mandatory) and "Invalid value" (line 201, when HostID is optional but malformed) correctly reflects the different validation contexts.

pkg/conversion/mapi2capi/aws_fuzz_test.go (2)

190-226: LGTM!

The fuzzPlacement function correctly covers all six host placement variants for MAPI→CAPI fuzzing, mirroring the structure in capi2mapi/aws_fuzz_test.go. The cases properly maintain consistency between correlated fields (Tenancy, Host.Affinity, Host.DedicatedHost).


310-313: LGTM!

The fuzzPlacement function is correctly added to the fuzzer function slice, positioned before fuzzProviderConfig to ensure placement fields are fuzzed before the provider config processes them.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 13, 2026

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Summary by CodeRabbit

  • New Features

  • Added AWS dedicated-host support with configurable affinity modes ("default", "host") and host identifier validation.

  • Security / Permissions

  • AWS credentials policy expanded to allow instance-type discovery (ec2:DescribeInstanceTypes).

  • Tests

  • Expanded conversion and fuzzing tests covering host-affinity, host-ID validation, and related error cases.

  • Chores

  • Dependency and module version updates for build/test tooling.

✏️ Tip: You can customize this high-level summary in your review settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In @go.mod:
- Line 41: The go.mod entry for sigs.k8s.io/cluster-api-provider-aws/v2
currently points to a non-existent pseudo-version
"v2.10.1-0.20251223195230-7aa98eaf0ba3"; update this dependency to a resolvable
version by either changing it to the latest existing release (for example
"v2.10.0") or replacing the pseudo-version with a correct commit/pseudo-version
that actually exists upstream, and if you need the fix from PR #5801 verify
which released tag contains that commit before pinning the version.
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 22fd0ed and 4be065e.

⛔ Files ignored due to path filters (44)
  • e2e/go.sum is excluded by !**/*.sum
  • go.sum is excluded by !**/*.sum
  • go.work.sum is excluded by !**/*.sum
  • hack/tools/go.sum is excluded by !**/*.sum
  • vendor/github.com/sergi/go-diff/AUTHORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/CONTRIBUTORS is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/LICENSE is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/match.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go is excluded by !**/vendor/**, !vendor/**
  • vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go is excluded by !**/vendor/**, !vendor/**
  • vendor/modules.txt is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachine_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/awsmachinetemplate_webhook.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2/types.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/grep.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/commands/run-fns.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/api/docs.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/build.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagenablehelm.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/flagsforfunctions.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/create/create.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbase.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addbuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addcomponent.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addgenerator.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/add/addtransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/fix/convert.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removebuildmetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeconfigmap.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removemetadata.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removeresource.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removesecret.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/edit/remove/removetransformer.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile/kustomizationfile.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/internal/util/validate.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/localize/localize.go is excluded by !**/vendor/**, !vendor/**
  • vendor/sigs.k8s.io/kustomize/kyaml/copyutil/copyutil.go is excluded by !**/vendor/**, !vendor/**
📒 Files selected for processing (3)
  • e2e/go.mod
  • go.mod
  • hack/tools/go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
  • e2e/go.mod
🔇 Additional comments (1)
hack/tools/go.mod (1)

11-11: Verify kustomize version update for breaking changes before applying.

The proposed kustomize updates introduce confirmed breaking changes:

  • v5.5.0: Removed Starlark support for KRM functions—verify your manifests don't depend on this feature.
  • v5.7.1: Replaced shlex dependency with carapace shlex, affecting exec-plugin argument parsing—test your exec-plugin invocations if used.

Confirm these changes won't impact your build or development workflows before merging.

Copy link
Member

@damdo damdo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

To trigger the tests

/hold

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 13, 2026
@openshift-ci-robot
Copy link

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-techpreview
/test e2e-aws-ovn
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-openstack-ovn-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 13, 2026

@vr4manta: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-e2e-aws-ovn 3820d2b link false /test okd-scos-e2e-aws-ovn
ci/prow/e2e-aws-capi-techpreview 4be065e link true /test e2e-aws-capi-techpreview
ci/prow/e2e-aws-ovn-serial-1of2 4be065e link true /test e2e-aws-ovn-serial-1of2
ci/prow/e2e-metal3-capi-techpreview 4be065e link false /test e2e-metal3-capi-techpreview
ci/prow/e2e-azure-ovn-techpreview 4be065e link false /test e2e-azure-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@vr4manta
Copy link
Author

It seems this project is not responsible for the CRDs of AWS CAPI provider. We'll need to update https://github.com/openshift/cluster-api-provider-aws to pull in the latest changes from upstream that fixes the default value of hostAffinity to be default instead of host.

@huali9
Copy link
Contributor

huali9 commented Jan 14, 2026

Thank you @vr4manta , I checked @damdo 's pr kubernetes-sigs/cluster-api-provider-aws#5801 seems only set hostAffinity=default is a valid value.
And I tried creating CAPI machine set with hostAffinity=default alone, the machine get Running, but when migrate to MAPI, it still met error. I recorded in the test case red background word part, could you please help to take a look? Thanks!

  - lastTransitionTime: "2026-01-14T05:38:48Z"
    message: 'failed to update MAPI machine set: admission webhook "validation.machineset.machine.openshift.io"
      denied the request: spec.placement.host: Forbidden: host may only be specified
      when tenancy is ''host'''
    reason: FailedToUpdateMAPIMachineSet
    severity: Error
    status: "False"
    type: Synchronized

@vr4manta
Copy link
Author

Thank you @vr4manta , I checked @damdo 's pr kubernetes-sigs/cluster-api-provider-aws#5801 seems only set hostAffinity=default is a valid value. And I tried creating CAPI machine set with hostAffinity=default alone, the machine get Running, but when migrate to MAPI, it still met error. I recorded in the test case red background word part, could you please help to take a look? Thanks!

  - lastTransitionTime: "2026-01-14T05:38:48Z"
    message: 'failed to update MAPI machine set: admission webhook "validation.machineset.machine.openshift.io"
      denied the request: spec.placement.host: Forbidden: host may only be specified
      when tenancy is ''host'''
    reason: FailedToUpdateMAPIMachineSet
    severity: Error
    status: "False"
    type: Synchronized

do we log the resulting values? I think its creating "" versions of the field which makes it not != null. I can add a check to ignore "" as well in that case. I'll also take a deeper look to see what else we can do to fix the conversions.

@huali9
Copy link
Contributor

huali9 commented Jan 15, 2026

Thank you @vr4manta I created a bug https://issues.redhat.com/browse/OCPBUGS-73821 to better trace the issue and attached the details on that.

@huali9
Copy link
Contributor

huali9 commented Jan 15, 2026

@vr4manta I noticed you submitted a PR to modify MAPI. However, I'm wondering if we should modify CAPI instead? Because configuring hostAffinity=default alone in CAPI doesn't have any effect on the AWS side.

I also tested this directly with AWS, and setting only Affinity=default is not allowed:

(my_virtualenv) liuhuali@Lius-MacBook-Pro ~ % AWS_PROFILE=saml aws ec2 run-instances --region us-east-2 \
    --image-id ami-0bc8dda494f111572 --count 1 \
    --instance-type m6i.xlarge --key-name huliu-testdns \
    --security-group-ids sg-0d65b14a8ccd244cf sg-0bd10eeaf07acbf20 \
    --subnet-id subnet-03045088d51981a3f \
    --placement Affinity=default

An error occurred (InvalidParameterCombination) when calling the RunInstances operation: The parameter affinity cannot be used without specifying a tenancy of 'host'

This confirms that Affinity requires Tenancy=host to be set as well. We should align with AWS's behavior, shouldn't we?

@vr4manta
Copy link
Author

@vr4manta I noticed you submitted a PR to modify MAPI. However, I'm wondering if we should modify CAPI instead? Because configuring hostAffinity=default alone in CAPI doesn't have any effect on the AWS side.

I also tested this directly with AWS, and setting only Affinity=default is not allowed:

(my_virtualenv) liuhuali@Lius-MacBook-Pro ~ % AWS_PROFILE=saml aws ec2 run-instances --region us-east-2 \
    --image-id ami-0bc8dda494f111572 --count 1 \
    --instance-type m6i.xlarge --key-name huliu-testdns \
    --security-group-ids sg-0d65b14a8ccd244cf sg-0bd10eeaf07acbf20 \
    --subnet-id subnet-03045088d51981a3f \
    --placement Affinity=default

An error occurred (InvalidParameterCombination) when calling the RunInstances operation: The parameter affinity cannot be used without specifying a tenancy of 'host'

This confirms that Affinity requires Tenancy=host to be set as well. We should align with AWS's behavior, shouldn't we?

I agree this should be fixed upstream. The other PR is to make the two match since its broke now. It will take sprints / months to get this backported into the openshift/cluster-api-provider-aws. Once fixed, we can make match so there isn't breakage this this lasting during development. But I'll discuss with @damdo what options we have and i'll update this PR with the results.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 16, 2026

@vr4manta: This pull request references SPLAT-2167 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

SPLAT-2167

Changes

  • Added dedicated host support for AWS
  • Created new dedicated host tests
  • Fixed tests that were breaking due to updates upstream that were pulled in
  • Added missing permission ec2:DescribeInstanceTypes to cluster api credentials request

Dependencies

Notes

There seems to be a required permission that was missing for dedicated host support. When running these changes, a warning event was observed in the cluster capi operator namespace.

6s          Warning   FailedDescribeInstanceTypes   awscluster/ngirard-dh-5bb5w                           insufficient permissions to describe instance types for instance type "m6i.xlarge", falling back to the default architecture of "x86_64": operation error EC2: DescribeInstanceTypes, https response error StatusCode: 403, RequestID: 387549b4-ab58-48af-b14d-3882b6c7da52, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::726924432237:user/ngirard-dh-5bb5w-openshift-cluster-api-aws-72f7q is not authorized to perform: ec2:DescribeInstanceTypes because no identity-based policy allows the ec2:DescribeInstanceTypes action

Summary by CodeRabbit

  • New Features

  • Added AWS dedicated-host support with configurable affinity modes ("default", "host") and host identifier validation.

  • Security / Permissions

  • AWS credentials policy expanded to allow instance-type discovery (ec2:DescribeInstanceTypes).

  • Tests

  • Expanded conversion and fuzzing tests covering host-affinity, host-ID validation, and related error cases.

  • Chores

  • Dependency and module version updates for build/test tooling.

✏️ Tip: You can customize this high-level summary in your review settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@vr4manta
Copy link
Author

Created upstream PR to fix CAPA to match AWS cli.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants