Skip to content

CNV-83939: replace node-role.kubernetes.io/control-plane label with node-role.kubevirt.io/control-plane for HCP Clusters#4303

Open
orenc1 wants to merge 1 commit into
kubevirt:mainfrom
orenc1:hcp_replace_cp_label
Open

CNV-83939: replace node-role.kubernetes.io/control-plane label with node-role.kubevirt.io/control-plane for HCP Clusters#4303
orenc1 wants to merge 1 commit into
kubevirt:mainfrom
orenc1:hcp_replace_cp_label

Conversation

@orenc1

@orenc1 orenc1 commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

Use a kubevirt-specific label for HCP worker nodes instead of the standard Kubernetes control-plane label, in order to prevent misidentification of workers as control-plane nodes. Handle upgrade by removing the old HCO-set label when the new one is applied.
the new label of node-role.kubevirt.io/control-plane for virt-operator placement has been introduced at kubevirt/kubevirt#17763

What this PR does / why we need it:

Reviewer Checklist

Reviewers are supposed to review the PR for every aspect below one by one. To check an item means the PR is either "OK" or "Not Applicable" in terms of that item. All items are supposed to be checked before merging a PR.

  • PR Message
  • Commit Messages
  • How to test
  • Unit Tests
  • Functional Tests
  • User Documentation
  • Developer Documentation
  • Upgrade Scenario
  • Uninstallation Scenario
  • Backward Compatibility
  • Troubleshooting Friendly

Jira Ticket:

https://redhat.atlassian.net/browse/CNV-83939

Release note:

Label HCP worker nodes with node-role.kubevirt.io/control-plane rather than node-role.kubernetes.io/control-plane

@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Jun 11, 2026
@kubevirt-bot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign sradco for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jun 11, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4ca90982-e012-4077-b5d4-6cccf0faeb83

📥 Commits

Reviewing files that changed from the base of the PR and between e2322f3 and 98a8b86.

📒 Files selected for processing (4)
  • controllers/nodes/nodes_controller.go
  • controllers/nodes/nodes_controller_test.go
  • pkg/internal/nodeinfo/high_availability.go
  • pkg/nodeinfo/nodeinfo.go
🚧 Files skipped from review as they are similar to previous changes (3)
  • pkg/nodeinfo/nodeinfo.go
  • pkg/internal/nodeinfo/high_availability.go
  • controllers/nodes/nodes_controller.go

📝 Walkthrough

Walkthrough

This PR adds a kubevirt-specific control-plane label constant and reworks node labeling for HyperShift clusters: labelNode now assigns the kubevirt control-plane label to worker nodes, removes the legacy Kubernetes control-plane label only when it equals the HyperShift value (upgrade path), and skips API patches when labels are unchanged. isWorkerNode treats nodes with the legacy label set to the HyperShift value as workers for upgrade purposes. Tests were expanded for reconcile, startup, and upgrade scenarios.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Review notes

Strengths:

  • Upgrade handling confines legacy-label removal to nodes where the legacy value equals the HyperShift value, minimizing risk of removing operator-agnostic labels.
  • Tests cover reconcile, startup, multiple upgrade scenarios, and helper behavior; they exercise no-patch paths and preservation cases.

Areas for careful review:

  • controllers/nodes/nodes_controller.go (range_93a0f69bd776): verify patch skip condition and label mutation order to avoid transient states that could trigger external controllers.
  • controllers/nodes/nodes_controller.go (range_0bb575f4c4b8): confirm isWorkerNode change does not make non-HCO control-plane nodes eligible for kubevirt labeling.
  • tests covering upgrade scenarios (range_a979383a4686): ensure assertions exactly match intended ownership rules for when legacy label should be removed.

End note: controller logic and the upgrade tests are the highest-value review targets; overall the change is focused and well-covered — nice work.

Warning

Review ran into problems

🔥 Problems

Linked repositories: Your configuration references 13 linked repositories, but your current plan allows 0. Analyzed ``, skipped kubevirt/kubevirt, `kubevirt/containerized-data-importer`, `kubevirt/ssp-operator`, `kubevirt/cluster-network-addons-operator`, `kubevirt/hostpath-provisioner-operator`, `kubevirt/application-aware-quota`, `kubevirt/managed-tenant-quota`, `kubevirt/hyperconverged-cluster-operator`, `kubevirt/monitoring`, `kubevirt/community`, `kubevirt/enhancements`, `kubevirt/project-infra`, `kubevirt/kubevirtci`.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
controllers/nodes/nodes_controller_test.go (1)

476-491: ⚡ Quick win

Unused client initialization creates confusion.

The client cl at line 477 is created but never used—the reconciler's client is reassigned to cl2 before Reconcile is called. This pattern suggests incomplete refactoring and makes the test harder to follow.

♻️ Suggested simplification
-				resources := []client.Object{cpNode}
-				cl := commontestutils.InitClient(resources)
+				hco := commontestutils.NewHco()
+				resources := []client.Object{hco, cpNode}
+				cl := commontestutils.InitClient(resources)

 				r := &ReconcileNodeCounter{
 					Client:                       cl,
 					nodeEvents:                   nodeEvents,
 					HandleHyperShiftNodeLabeling: HandleHyperShiftNodeLabeling,
 				}

 				nodeinfo.HandleNodeChanges = func(_ context.Context, _ client.Client, _ *hcov1.HyperConverged, _ logr.Logger) (bool, error) {
 					return false, nil
 				}

-				hco := commontestutils.NewHco()
-				cl2 := commontestutils.InitClient([]client.Object{hco, cpNode})
-				r.Client = cl2
-
 				nodeRequest := reconcile.Request{

Then update line 504 to use cl instead of cl2.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controllers/nodes/nodes_controller_test.go` around lines 476 - 491, The test
creates an unused client variable cl with commontestutils.InitClient then
reassigns r.Client = cl2, which is confusing; fix by removing the unused cl and
either initialize only cl2 and set r.Client to that, or stop creating cl2 and
set r.Client to the original cl and update the later Reconcile call to use that
client. Specifically, update the setup around ReconcileNodeCounter, the
commontestutils.InitClient calls (cl and cl2), and the assignment r.Client so
only one client instance (referencing InitClient, NewHco, and the
ReconcileNodeCounter struct) is created and used.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@controllers/nodes/nodes_controller_test.go`:
- Around line 510-550: The test "Should not patch node already having the new
label and no old label" only checks labels but not whether a Patch was executed;
before calling r.Reconcile take the existing node from the fake client (cl) and
record its ResourceVersion (e.g., origRV := workerNode.ResourceVersion or fetch
into origNode), then call r.Reconcile and refetch updatedNode and assert
updatedNode.ResourceVersion == origRV (and keep the existing label assertions).
This verifies no patch occurred; alternatively wrap or replace cl with an
interceptor that counts Patch calls and assert the count is zero, referencing
the ReconcileNodeCounter r, the client variable cl, and the r.Reconcile call.

---

Nitpick comments:
In `@controllers/nodes/nodes_controller_test.go`:
- Around line 476-491: The test creates an unused client variable cl with
commontestutils.InitClient then reassigns r.Client = cl2, which is confusing;
fix by removing the unused cl and either initialize only cl2 and set r.Client to
that, or stop creating cl2 and set r.Client to the original cl and update the
later Reconcile call to use that client. Specifically, update the setup around
ReconcileNodeCounter, the commontestutils.InitClient calls (cl and cl2), and the
assignment r.Client so only one client instance (referencing InitClient, NewHco,
and the ReconcileNodeCounter struct) is created and used.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bf84c4ab-d846-43d6-af42-f284152950b9

📥 Commits

Reviewing files that changed from the base of the PR and between 28d9310 and 6c9e0cf.

📒 Files selected for processing (4)
  • controllers/nodes/nodes_controller.go
  • controllers/nodes/nodes_controller_test.go
  • pkg/internal/nodeinfo/high_availability.go
  • pkg/nodeinfo/nodeinfo.go

Comment thread controllers/nodes/nodes_controller_test.go
@orenc1 orenc1 force-pushed the hcp_replace_cp_label branch from 6c9e0cf to 1920db8 Compare June 11, 2026 07:55
@coveralls

coveralls commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

Coverage Report for CI Build 27349872515

Coverage increased (+0.04%) to 80.347%

Details

  • Coverage increased (+0.04%) from the base build.
  • Patch coverage: 29 of 29 lines across 1 file are fully covered (100%).
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.


Coverage Stats

Coverage Status
Relevant Lines: 13011
Covered Lines: 10454
Line Coverage: 80.35%
Coverage Strength: 2.05 hits per line

💛 - Coveralls

@hco-bot

hco-bot commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

hco-e2e-operator-sdk-sno-azure lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-aws
hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-azure
hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-aws

@kubevirt-bot

Copy link
Copy Markdown
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-aws, ci/prow/hco-e2e-operator-sdk-azure, ci/prow/hco-e2e-operator-sdk-sno-aws

Details

In response to this:

hco-e2e-operator-sdk-sno-azure lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-aws
hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-azure
hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@hco-bot

hco-bot commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure
hco-e2e-upgrade-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-aws
hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

@kubevirt-bot

Copy link
Copy Markdown
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-kv-smoke-azure, ci/prow/hco-e2e-upgrade-operator-sdk-aws, ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

Details

In response to this:

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure
hco-e2e-upgrade-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-aws
hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@nunnatsa nunnatsa left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a nit comment.

Comment thread controllers/nodes/nodes_controller.go Outdated
}

// Upgrade path: remove the old kubernetes control-plane label if it was set by HCO
if val, exists := node.Labels[nodeinfo.LabelNodeRoleControlPlane]; exists && val == hypershiftLabelValue {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's enough to check the value. if the key does not exist, it will return an empty string, which is also != hypershiftLabelValue.; e.g.

Suggested change
if val, exists := node.Labels[nodeinfo.LabelNodeRoleControlPlane]; exists && val == hypershiftLabelValue {
if node.Labels[nodeinfo.LabelNodeRoleControlPlane] == hypershiftLabelValue {

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right, the exists check is redundant in this case. fixed. thanks.

@orenc1 orenc1 force-pushed the hcp_replace_cp_label branch from 1920db8 to e2322f3 Compare June 11, 2026 11:35
…ode-role.kubevirt.io/control-plane for HCP Clusters

Use a kubevirt-specific label for HCP worker nodes instead of the
standard Kubernetes control-plane label, in order to prevent
misidentification of workers as control-plane nodes.
Handle upgrade by removing the old HCO-set label when the new one is applied.

Signed-off-by: Oren Cohen <ocohen@redhat.com>
Assisted-by: Claude <noreply@anthropic.com>
@orenc1 orenc1 force-pushed the hcp_replace_cp_label branch from e2322f3 to 98a8b86 Compare June 11, 2026 13:22
@sonarqubecloud

Copy link
Copy Markdown

@openshift-ci

openshift-ci Bot commented Jun 11, 2026

Copy link
Copy Markdown

@orenc1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/hco-e2e-operator-sdk-sno-aws 98a8b86 link false /test hco-e2e-operator-sdk-sno-aws
ci/prow/hco-e2e-operator-sdk-aws 98a8b86 link true /test hco-e2e-operator-sdk-aws
ci/prow/hco-e2e-upgrade-prev-operator-sdk-aws 98a8b86 link true /test hco-e2e-upgrade-prev-operator-sdk-aws
ci/prow/hco-e2e-upgrade-operator-sdk-sno-aws 98a8b86 link false /test hco-e2e-upgrade-operator-sdk-sno-aws
ci/prow/hco-e2e-operator-sdk-gcp 98a8b86 link true /test hco-e2e-operator-sdk-gcp
ci/prow/hco-e2e-operator-sdk-sno-azure 98a8b86 link false /test hco-e2e-operator-sdk-sno-azure
ci/prow/hco-e2e-consecutive-operator-sdk-upgrades-azure 98a8b86 link true /test hco-e2e-consecutive-operator-sdk-upgrades-azure
ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure 98a8b86 link false /test hco-e2e-upgrade-operator-sdk-sno-azure
ci/prow/hco-e2e-upgrade-operator-sdk-aws 98a8b86 link true /test hco-e2e-upgrade-operator-sdk-aws
ci/prow/hco-e2e-consecutive-operator-sdk-upgrades-aws 98a8b86 link true /test hco-e2e-consecutive-operator-sdk-upgrades-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@hco-bot

hco-bot commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

hco-e2e-upgrade-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-aws
hco-e2e-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-gcp
hco-e2e-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-aws

@kubevirt-bot

Copy link
Copy Markdown
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-aws, ci/prow/hco-e2e-operator-sdk-gcp, ci/prow/hco-e2e-upgrade-operator-sdk-aws

Details

In response to this:

hco-e2e-upgrade-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-aws
hco-e2e-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-gcp
hco-e2e-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@hco-bot

hco-bot commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

hco-e2e-upgrade-prev-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-aws

@kubevirt-bot

Copy link
Copy Markdown
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-prev-operator-sdk-aws

Details

In response to this:

hco-e2e-upgrade-prev-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dco-signoff: yes Indicates the PR's author has DCO signed all their commits. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants