✨ Rosa Config implementaiton #5499

PanSpagetka · 2025-05-21T13:37:12Z

Based on proposal #5451
Adding RosaRoleConfig API with implementation. that should create Account/Operator roles and OIDC config/provider necessary to create ROSA cluster.

We need to move RosaMachinePoolAutoScaling definition to controlplane, because otherwise there would be circular dependency.

What type of PR is this?
/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

[] squashed commits
includes documentation
includes emoji in title
adds unit tests
adds or updates e2e tests

Release note:

Add Rosa Role Config API and implementation

k8s-ci-robot · 2025-05-21T13:37:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign neolit123 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-05-21T13:37:22Z

Hi @PanSpagetka. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

serngawy · 2025-06-17T19:36:21Z

Dockerfile

 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
+COPY ./rosa /workspace/rosa


why are we adding this ? what is the rosa file

serngawy · 2025-06-17T19:36:38Z

Dockerfile

     --mount=type=cache,target=/go/pkg/mod \
     go mod download

+# RUN go mod download


no need for this line

serngawy · 2025-06-17T19:37:35Z

PROJECT

can you just add the RosaRoleConfig item without changing the order of other items

serngawy · 2025-06-17T19:38:28Z

config/default/tmp.yaml

why do we need this file ?

serngawy · 2025-06-17T19:38:54Z

config/crd/kustomization.yaml

 - patches/webhook_in_awsmanagedcontrolplanes.yaml
 - patches/webhook_in_eksconfigs.yaml
 - patches/webhook_in_eksconfigtemplates.yaml
+#- patches/webhook_in_rosaroleconfigs.yaml


I believe you need to uncomment this line

serngawy · 2025-06-17T19:46:49Z

exp/controllers/rosaroleconfig_controller.go

+		}
+	}
+
+	if scope.RosaRoleConfig.Status.OIDCID == "" {


I believe you should check/set the RosaRoleConfig condition first , then get the oidc using OCM client if it is not exist then create it.
Same applied for account-roles and operator-roles

serngawy · 2025-06-17T19:47:52Z

exp/controllers/rosaroleconfig_controller.go

+		}
+	}
+
+	err = r.deleteOperatorRoles(ocmClient, awsClient, scope.RosaRoleConfig.Spec.AccountRoleConfig.Prefix)


Do we need to delete the operator roles before the oidc-provider ?

Nope, a changed it so it matches reverse creation order.

I guess the order here is not correct, deleting the operatrRoles first then oidc-provider then odic-config ?

serngawy · 2025-06-17T19:49:45Z

exp/controllers/rosaroleconfig_controller.go

+	return ocmClient.DeleteOidcConfig(oidcConfigID)
+}
+
+type reporter struct {


please move this to another file , better to be under pkg/.../rosa

PanSpagetka · 2025-08-18T12:56:20Z

@nrb Thank you for review! I created new temporary commit with changes, so its easier to review. I will squash it when we agree that code is good enough.

serngawy · 2025-08-20T08:24:29Z

controlplane/rosa/api/v1beta2/rosacontrolplane_types.go

 	// +immutable
-	ControlPlaneOperatorARN string `json:"controlPlaneOperatorARN"`
-	KMSProviderARN          string `json:"kmsProviderARN"`
+	ControlPlaneOperatorARN string `json:"controlPlaneOperatorARN,omitempty"`


@PanSpagetka Not sure if I understand your comment , The case we were discussing is We have the 8 Roles ARN are created for first time so all of them exist, then one or more roles get deleted by aws admin using aws console for example (not using our CR) . when reconcile happen some of those 8 roles will not retrieved by awsClient. So we will re-create the missing roles and set the ARN. Why we you need to set it empty ? there is no chance we will have this case.

serngawy · 2025-08-20T08:42:50Z

exp/controllers/rosaroleconfig_controller.go

+	if err != nil {
+		return r.createOIDCConfig(scope, ocmClient)
+	}


@PanSpagetka the logic here not make sense , if there is an error we don't re-create the oidc config we return the error.

Its because scope.IAMClient().GetRole returns error when role is not found. And if the role is not found, we cant derive the OIDC id from it.

serngawy · 2025-08-20T08:43:10Z

exp/controllers/rosaroleconfig_controller.go

+	if err != nil {
+		return r.createOIDCConfig(scope, ocmClient)
+	}


Similarly GetOIDCIDFromOperatorRole returns error when we cant get OIDC id from the role. So we create new one

exp/controllers/rosaroleconfig_controller.go

PanSpagetka · 2025-09-04T05:49:33Z

/retest-required

PanSpagetka · 2025-09-04T06:02:46Z

/retest-required

PanSpagetka · 2025-09-04T12:24:42Z

@nrb @serngawy could you take another look? I think we should be good now

serngawy · 2025-09-11T15:32:53Z

/hold

serngawy · 2025-09-15T19:21:28Z

/close
for the favor of this one #5667

k8s-ci-robot · 2025-09-15T19:21:35Z

@serngawy: Closed this PR.

In response to this:

/close
for the favor of this one #5667

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 21, 2025

k8s-ci-robot requested review from Ankitasw and serngawy May 21, 2025 13:37

k8s-ci-robot added needs-priority size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 21, 2025

PanSpagetka marked this pull request as draft May 21, 2025 13:37

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 21, 2025

PanSpagetka force-pushed the rosa-roles-implementations branch from 11dac0b to 6056618 Compare May 28, 2025 13:43

serngawy mentioned this pull request May 29, 2025

✨ Add RosaRoles config #5473

Closed

5 tasks

PanSpagetka force-pushed the rosa-roles-implementations branch 6 times, most recently from 1587db4 to 9121ec2 Compare June 9, 2025 13:40

PanSpagetka force-pushed the rosa-roles-implementations branch 3 times, most recently from 07b73a3 to 097252f Compare June 16, 2025 11:47

serngawy suggested changes Jun 17, 2025

View reviewed changes

PanSpagetka force-pushed the rosa-roles-implementations branch from 097252f to 0c9fa93 Compare June 18, 2025 11:40

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 19, 2025

PanSpagetka force-pushed the rosa-roles-implementations branch 3 times, most recently from b3aded3 to 23fa4cb Compare June 24, 2025 11:29

PanSpagetka force-pushed the rosa-roles-implementations branch 2 times, most recently from 2515be2 to c0d0d2a Compare July 7, 2025 10:28

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Aug 18, 2025

serngawy suggested changes Aug 20, 2025

View reviewed changes

PanSpagetka force-pushed the rosa-roles-implementations branch from 8040331 to f17676b Compare August 20, 2025 11:03

serngawy reviewed Aug 20, 2025

View reviewed changes

exp/controllers/rosaroleconfig_controller.go Outdated Show resolved Hide resolved

serngawy reviewed Aug 20, 2025

View reviewed changes

exp/controllers/rosaroleconfig_controller.go Outdated Show resolved Hide resolved

PanSpagetka force-pushed the rosa-roles-implementations branch 2 times, most recently from a2ee9fc to c99f988 Compare August 21, 2025 10:58

serngawy reviewed Aug 22, 2025

View reviewed changes

exp/controllers/rosaroleconfig_controller.go Outdated Show resolved Hide resolved

exp/controllers/rosaroleconfig_controller.go Show resolved Hide resolved

PanSpagetka force-pushed the rosa-roles-implementations branch 2 times, most recently from cc3c065 to daeac96 Compare August 27, 2025 07:09

PanSpagetka force-pushed the rosa-roles-implementations branch 3 times, most recently from 47368c1 to fe78ee9 Compare September 3, 2025 14:37

PanSpagetka added 5 commits September 4, 2025 08:15

Add RosaRoleConfig API and CRD.

9d1ea3d

Enable partial reconcile of Rosa Operator Roles

de3bfae

Review fixes

c3f5825

Add integration tests

22da8ec

Add more tests

fed1e9c

PanSpagetka force-pushed the rosa-roles-implementations branch from fe78ee9 to fed1e9c Compare September 4, 2025 06:29

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 11, 2025

k8s-ci-robot closed this Sep 15, 2025

serngawy mentioned this pull request Sep 24, 2025

✨ Rosa roles config implementations #5667

Merged

5 tasks

✨ Rosa Config implementaiton #5499

✨ Rosa Config implementaiton #5499

Uh oh!

Conversation

PanSpagetka commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented May 21, 2025

Uh oh!

k8s-ci-robot commented May 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

serngawy Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PanSpagetka commented Aug 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PanSpagetka commented Sep 4, 2025

Uh oh!

PanSpagetka commented Sep 4, 2025

Uh oh!

PanSpagetka commented Sep 4, 2025

Uh oh!

serngawy commented Sep 11, 2025

Uh oh!

serngawy commented Sep 15, 2025

Uh oh!

k8s-ci-robot commented Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

PanSpagetka commented May 21, 2025 •

edited

Loading

serngawy Jun 17, 2025 •

edited

Loading