Revert aws tag validation

[patrickdillon]

User description

Day-2 ResourceTag updates are supported on Hypershift.

---

PR Type

Bug fix

---

Description

• Remove AWS tag key 'aws:' prefix validation restriction

• Allow Day-2 ResourceTag updates on Hypershift clusters

• Update generated API documentation and OpenAPI schemas

• Regenerate CRD manifests with updated tag validation rules

---

Diagram Walkthrough

flowchart LR
  A["AWS Tag Validation"] -->|Remove 'aws:' prefix restriction| B["Updated Tag Rules"]
  B -->|Regenerate| C["API Documentation"]
  B -->|Regenerate| D["OpenAPI Schemas"]
  B -->|Regenerate| E["CRD Manifests"]
  C --> F["Enable Day-2 Updates"]
  D --> F
  E --> F

Loading

File Walkthrough

	Relevant files
Documentation	2 files zz_generated.swagger_doc_generated.go Remove 'aws:' prefix restriction from tag key documentation +1/-1      zz_generated.openapi.go Remove 'aws:' prefix restriction from OpenAPI schema          +1/-1
Bug fix	1 files types_infrastructure.go Update AWS resource tag validation constraints                      +0/-4
Tests	1 files AAA_ungated.yaml Regenerate test fixtures with updated tag rules                    +0/-193
Configuration changes	15 files 0000_10_config-operator_01_infrastructures-Default.crd.yaml Regenerate default CRD manifest for infrastructures            +0/-11    0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml Regenerate DevPreview CRD manifest for infrastructures      +0/-11    0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml Regenerate CustomNoUpgrade CRD manifest for infrastructures +0/-11    0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml Regenerate TechPreview CRD manifest for infrastructures    +0/-11    0000_10_config-operator_01_infrastructures-OKD.crd.yaml Regenerate OKD CRD manifest for infrastructures                    +0/-11    AAA_ungated.yaml Regenerate ungated featuregated CRD manifest                          +0/-11    HighlyAvailableArbiter+DualReplica.yaml Regenerate HighlyAvailableArbiter+DualReplica featuregated manifest +0/-11    VSphereHostVMGroupZonal.yaml Regenerate VSphereHostVMGroupZonal featuregated manifest  +0/-11    DyanmicServiceEndpointIBMCloud.yaml Regenerate DyanmicServiceEndpointIBMCloud featuregated manifest +0/-11    AWSClusterHostedDNSInstall.yaml Regenerate AWSClusterHostedDNSInstall featuregated manifest +0/-11    AWSDualStackInstall.yaml Regenerate AWSDualStackInstall featuregated manifest          +0/-11    AzureClusterHostedDNSInstall.yaml Regenerate AzureClusterHostedDNSInstall featuregated manifest +0/-11    GCPClusterHostedDNSInstall.yaml Regenerate GCPClusterHostedDNSInstall featuregated manifest +0/-11    HighlyAvailableArbiter.yaml Regenerate HighlyAvailableArbiter featuregated manifest    +0/-11    NutanixMultiSubnets.yaml Regenerate NutanixMultiSubnets featuregated manifest          +0/-11
Additional files	23 files AzureDualStackInstall.yaml +0/-11    DualReplica.yaml +0/-11    OnPremDNSRecords.yaml +0/-11    VSphereMultiNetworks.yaml +0/-11    0000_80_machine-config_01_controllerconfigs-CustomNoUpgrade.crd.yaml +0/-14    0000_80_machine-config_01_controllerconfigs-Default.crd.yaml +0/-14    0000_80_machine-config_01_controllerconfigs-DevPreviewNoUpgrade.crd.yaml +0/-14    0000_80_machine-config_01_controllerconfigs-OKD.crd.yaml +0/-14    0000_80_machine-config_01_controllerconfigs-TechPreviewNoUpgrade.crd.yaml +0/-14    AAA_ungated.yaml +0/-14    AWSClusterHostedDNSInstall.yaml +0/-14    AWSDualStackInstall.yaml +0/-14    AzureClusterHostedDNSInstall.yaml +0/-14    AzureDualStackInstall.yaml +0/-14    DualReplica.yaml +0/-14    DyanmicServiceEndpointIBMCloud.yaml +0/-14    GCPClusterHostedDNSInstall.yaml +0/-14    HighlyAvailableArbiter+DualReplica.yaml +0/-14    HighlyAvailableArbiter.yaml +0/-14    NutanixMultiSubnets.yaml +0/-14    OnPremDNSRecords.yaml +0/-14    VSphereHostVMGroupZonal.yaml +0/-14    VSphereMultiNetworks.yaml +0/-14

---

[openshift-ci-robot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @patrickdillon! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR removes validation for AWS resourceTags across the codebase: XValidation rules that enforced resourceTags immutability/installation-time configuration and rules prohibiting tag keys starting with "aws:" were deleted from config types, CRDs, OpenAPI/Swagger docs, and related tests. The AWSResourceTag key description was updated to drop the "aws:" restriction. No public type signatures were changed; only validation rules, CRD schema constraints, generated OpenAPI/Swagger descriptions, and associated tests were removed or modified.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Revert aws tag validation' directly describes the main change - removing AWS tag key validation restrictions and enabling Day-2 ResourceTag updates.
Description check	✅ Passed	The description clearly explains the purpose of the changes: removing AWS tag key 'aws:' prefix validation and enabling Day-2 ResourceTag updates on Hypershift, with details on which files are modified.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.5.0)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Relaxed tag validation: The updated API documentation removes the aws:-prefix restriction for AWSResourceTag.key, so a human should verify the actual schema/controller validation still prevents invalid AWS-reserved tag keys (or that AWS now permits them) to avoid accepting externally-supplied invalid values. Referred Code "key": "key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag. Key should consist of between 1 and 128 characters, and may contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.", "value": "value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag. Value should consist of between 1 and 256 characters, and may contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'. Some AWS service do not support empty values. Since tags are added to resources in many services, the length of the tag value must meet the requirements of all services.", Learn more about managing compliance generic rules or creating your own custom rules
Update

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Restore immutability validation for resourceTags Restore the immutability validation for resourceTags in AWSPlatformStatus. Removing this validation is a critical bug as it can lead to inconsistencies between the Kubernetes object and the actual tags on AWS resources. config/v1/types_infrastructure.go [533-552] // AWSPlatformStatus holds the current status of the Amazon Web Services infrastructure provider. +// +kubebuilder:validation:XValidation:rule="has(oldSelf.resourceTags) == has(self.resourceTags)",message="resourceTags may only be configured during installation" type AWSPlatformStatus struct { // region holds the default AWS region for new AWS resources created by the cluster. Region string `json:"region"` // serviceEndpoints list contains custom endpoints which will override default // service endpoint of AWS Services. // There must be only one ServiceEndpoint for a service. // +listType=atomic // +optional ServiceEndpoints []AWSServiceEndpoint `json:"serviceEndpoints,omitempty"` // resourceTags is a list of additional tags to apply to AWS resources created for the cluster. // See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources. // AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags // available for the user. // +kubebuilder:validation:MaxItems=25 + // +kubebuilder:validation:XValidation:rule="self.all(x, x in oldSelf) && oldSelf.all(x, x in self)",message="resourceTags are immutable and may only be configured during installation" // +listType=atomic // +optional ResourceTags []AWSResourceTag `json:"resourceTags,omitempty"` } [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 10 __ Why: This suggestion correctly identifies a critical issue introduced by the PR: removing the immutability of resourceTags without a reconciliation mechanism can lead to a state mismatch between the cluster configuration and the actual AWS resources, which is a significant operational risk.	High
Update

[JoelSpeed]

/lgtm

[openshift-ci-robot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the master branch

Use /test ? to see all available tests.

[bryan-cox]

/test verify

[qodo-code-review]

PR-Agent: could not fine a component named verify in a supported language in this PR.

[JoelSpeed]

Need a new run of ./hack/update-payload-featuregates.sh to make verify pass

[patrickdillon]

./hack/update-payload-featuregates.sh

hm that didn't seem to do anything locally, but make update all (whereas I used make update originally) updated the payload manifests in 130e7ba 🤞

[patrickdillon]

/label tide/merge-method-squash

[patrickdillon]

./hack/update-payload-featuregates.sh

hm that didn't seem to do anything locally, but make update all (whereas I used make update originally) updated the payload manifests in 130e7ba 🤞

ah looks like it was ./hack/upadate-payload-crds.sh that was out of sync so this makes sense. I will default to make update all going forward, not to mention running verify locally.

[JoelSpeed]

/lgtm

The issue was actually that I broke the ordering, fixed in #2667 once I get that merged, normal flows should resume with make update after that

[openshift-ci-robot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change

[sjenning]

/override ci/prow/e2e-aws-ovn-hypershift

failed on a weird case where the latest release has a build timestamp before the initial release. But the failure on TestCreateCluster/Teardown from the denied Infrastructure update by the HCCO is gone.

[openshift-ci]

@sjenning: Overrode contexts on behalf of sjenning: ci/prow/e2e-aws-ovn-hypershift

Details

In response to this:

/override ci/prow/e2e-aws-ovn-hypershift

failed on a weird case where the latest release has a build timestamp before the initial release. But the failure on TestCreateCluster/Teardown from the denied Infrastructure update by the HCCO is gone.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[patrickdillon]

@JoelSpeed Can you refresh the lgtm? I went ahead and locally squashed commits for this PR too based on #2664 (comment). Perhaps it was not necessary for this PR...

[JoelSpeed]

/lgtm

[openshift-ci-robot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JoelSpeed]

/verified bypass

We are reverting to a previous good state

[openshift-ci-robot]

@JoelSpeed: The verified label has been added.

Details

In response to this:

/verified bypass

We are reverting to a previous good state

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 80c3fbc and 2 for PR HEAD 3991d78 in total

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD a2212e6 and 1 for PR HEAD 3991d78 in total

[JoelSpeed]

/override ci/prow/e2e-aws-serial
/override ci/prow/e2e-aws-serial-techpreview

[openshift-ci]

@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/e2e-aws-serial, ci/prow/e2e-aws-serial-techpreview

Details

In response to this:

/override ci/prow/e2e-aws-serial
/override ci/prow/e2e-aws-serial-techpreview

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@patrickdillon: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.