SPLAT-2588: Promoting AWSServiceLBNetworkSecurityGroup on hypershift

[mtulio]

Promotes the AWSServiceLBNetworkSecurityGroup feature gate to Default on Hypershift cluster profiles.

This feature was already GA on SelfManaged (enabled in Default) and was gated behind TechPreviewNoUpgrade on Hypershift.
Hypershift implementation: hypershift/pull/7460

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@mtulio: This pull request references SPLAT-2588 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @mtulio! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[mtulio]

/test ?

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR enables the AWSServiceLBNetworkSecurityGroup feature for Hypershift Default and OKD. Features/features.go consolidates the feature's enable condition into a single call covering default, OKD, and both tech/dev preview no-upgrade profiles. The Hypershift Default and OKD FeatureGate manifests remove the gate from disabled lists and add it to enabled lists. The features.md documentation table reorders rows and marks AWSServiceLBNetworkSecurityGroup as Enabled for both Hypershift variants.

Suggested reviewers

• JoelSpeed
• everettraven

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided by the author, making it impossible to assess whether the description relates to the changeset.	Add a description that explains the purpose of promoting AWSServiceLBNetworkSecurityGroup on Hypershift and the rationale behind this change.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly references the main change: promoting AWSServiceLBNetworkSecurityGroup on Hypershift, which directly matches the feature gate modifications across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies feature gate configuration and documentation files (features.md, features/features.go, and payload-manifests YAML). No Ginkgo test files or test names are added or modified.
Test Structure And Quality	✅ Passed	Ginkgo tests properly implement single responsibility, use BeforeEach/AfterEach for setup/cleanup of resources and CRDs, include appropriate timeouts on Eventually calls, provide meaningful asserti...
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. Changes are feature gate configuration and documentation updates only, making the MicroShift test compatibility check not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR does not add any Ginkgo e2e tests. It only modifies feature gate configuration files and documentation, making the SNO test compatibility check not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only modifies feature gate configuration (features.md, features.go, FeatureGate CRDs). No deployment manifests, operator code, controllers, or scheduling constraints are introduced.
Ote Binary Stdout Contract	✅ Passed	PR contains only configuration and documentation changes to feature gates; no process-level code with stdout writes (main, init, TestMain, BeforeSuite, AfterSuite) was added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. Changes are limited to feature gate configuration and documentation, making the IPv6/disconnected network compatibility check inapplicable.
No-Weak-Crypto	✅ Passed	PR makes no cryptographic changes; only promotes AWSServiceLBNetworkSecurityGroup feature gate via configuration updates and documentation changes.
Container-Privileges	✅ Passed	PR modifies only feature gate configurations, documentation, and Go code—no Kubernetes container manifests with security contexts are present or modified.
No-Sensitive-Data-In-Logs	✅ Passed	PR contains no logging statements or sensitive data (passwords, tokens, keys, PII) in code changes. All modifications are configuration/documentation updates for feature gate promotion.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@mtulio: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[mtulio]

/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance

[mtulio]

/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance

[mtulio]

/test e2e-aws-ovn-hypershift-conformance

[mtulio]

/test e2e-aws-ovn-hypershift

[mtulio]

/test all

[mtulio]

/test all

[mtulio]

/test e2e-aws-ovn-hypershift-conformance

[mtulio]

/test e2e-aws-ovn-hypershift-conformance

[mtulio]

/test verify-feature-promotion

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 50c3975 and 2 for PR HEAD fd7d48b in total

[mtulio]

/test e2e-aws-ovn

[mtulio]

many test failures in the e2e-aws-ovn-hypershift-conformance that is unrelated with this PR, all [cloud-provider-aws-e2e-* tests are passing or skipped.

Triggering again:

/test e2e-aws-ovn-hypershift-conformance

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD fcee122 and 1 for PR HEAD fd7d48b in total

[mtulio]

/retest-required

[mtulio]

Test Failure Summary for PR #2838

Job 1: pull-ci-openshift-api-master-e2e-aws-ovn (Prow link)

Blocking failure (1):
[sig-api-machinery] CRDValidationRatcheting [Privileged:ClusterAdmin] [FeatureGate:CRDValidationRatcheting] MUST NOT fail to update a resource due to CRD Validation Rule errors on unchanged correlatable fields

This is a known low-frequency flake in the CRDValidationRatcheting conformance suite (Jira component: kube-apiserver). Sippy shows a 99.81% pass rate across 3,736 runs in the current period (7 failures), with no open OCPBUGS bugs. The test validates that CRD validation ratcheting allows updates when correlatable fields are unchanged — the failure is a rare timing-sensitive race unrelated to the AWSServiceLBNetworkSecurityGroup feature gate promotion, which modifies only feature gate enablement for Hypershift and does not touch API machinery or CRD validation logic.

Informing failures (10): All 10 informing failures are [Feature:NetworkSegmentation][ovn-kubernetes-ote] tests — a batch failure pattern consistent with known OVN-Kubernetes UserDefinedNetwork flakiness, unrelated to this PR.

---

Job 2: pull-ci-openshift-api-master-e2e-aws-ovn-hypershift-conformance (Prow link)

Blocking failure (1):
[Jira:"Cloud Credential Operator"] Cluster_Operator CCO is enabled [Suite:cco/conformance/parallel][OTP][PolarionID:64885][platform:aws] Critical-CCO-based flow for olm managed operators and AWS STS

This is a heavily failing test with only a 28.01% pass rate across 332 runs (239 failures) in the current Sippy period for release 5.0 (Jira component: Cloud Credential Operator). No open OCPBUGS bug was found linked to this test, though the extremely low pass rate across the entire release indicates a systemic issue with CCO STS credential flow for OLM-managed operators — not a regression introduced by this PR. The AWSServiceLBNetworkSecurityGroup promotion changes only feature gate enablement and does not modify CCO, OLM, or STS credential handling.

Informing failures (11): 10 are [Feature:NetworkSegmentation][ovn-kubernetes-ote] tests (same pattern as Job 1), plus 1 [sig-node] Pod InPlace Resize Container test — all unrelated to this PR.

---

Conclusion: Neither blocking failure is related to the AWSServiceLBNetworkSecurityGroup feature gate promotion. Both are pre-existing flakes/failures affecting the broader release, not regressions from this change.

[mtulio]

/test e2e-gcp

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD bb02c82 and 0 for PR HEAD fd7d48b in total

[mtulio]

Hey @JoelSpeed , can we skip e2e-gcp, looking the history it seems pretty unstable and unrelated to this change

https://prow.ci.openshift.org/job-history/gs/test-platform-results/pr-logs/directory/pull-ci-openshift-api-master-e2e-gcp

[mtulio]

/test e2e-gcp

[mtulio]

/test e2e-gcp

[openshift-merge-bot]

/hold

Revision fd7d48b was retested 3 times: holding

[mtulio]

This is a permanent failure. Waiting Bryce to revert it per Slack discussion.
/hold cancel
/assign everettraven

[mtulio]

/test e2e-gcp

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 39631f4 and 2 for PR HEAD fd7d48b in total

[openshift-ci]

@mtulio: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.