Skip to content

MCO-2293: adds RHEL10 featuregate#2860

Open
cheesesashimi wants to merge 1 commit into
openshift:masterfrom
cheesesashimi:zzlotnik/rhel10-feature-gate
Open

MCO-2293: adds RHEL10 featuregate#2860
cheesesashimi wants to merge 1 commit into
openshift:masterfrom
cheesesashimi:zzlotnik/rhel10-feature-gate

Conversation

@cheesesashimi
Copy link
Copy Markdown
Member

The intent behind this FeatureGate is to enable RHEL10 by default in OCP 5.0 while allowing OCP 4.23 to opt into it, if desired. As of right now, there are still a few TODOs and tweaks that need to be done for this to have the desired effect.

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 26, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented May 26, 2026

@cheesesashimi: This pull request references MCO-2293 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

The intent behind this FeatureGate is to enable RHEL10 by default in OCP 5.0 while allowing OCP 4.23 to opt into it, if desired. As of right now, there are still a few TODOs and tweaks that need to be done for this to have the desired effect.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 26, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 67818a53-99c6-47c3-9c94-aa441d1d6ed9

📥 Commits

Reviewing files that changed from the base of the PR and between e3ea905 and 506967c.

📒 Files selected for processing (11)
  • features.md
  • features/features.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-Default.yaml
✅ Files skipped from review due to trivial changes (3)
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • features.md
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
🚧 Files skipped from review as they are similar to previous changes (7)
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-Default.yaml

📝 Walkthrough

Walkthrough

This PR adds a new OpenShift FeatureGate RHCOS10DefaultInstall (declared and registered in Go with version/profile-aware enablement), updates the features.md matrix, and modifies/adds FeatureGate payload manifests: a new 5-10 SelfManagedHA Default manifest and edits to several 4.x and 4-10 SelfManagedHA and Hypershift manifests to mark the gate enabled or disabled per release/profile.

Suggested reviewers

  • everettraven
  • JoelSpeed
  • chiragkyal
🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Title check ✅ Passed The title 'MCO-2293: adds RHEL10 featuregate' accurately describes the main change - adding a RHEL10 feature gate (specifically RHCOS10DefaultInstall).
Description check ✅ Passed The description explains the intent behind the feature gate addition - enabling RHEL10 by default in OCP 5.0 while allowing OCP 4.23 opt-in, which directly relates to the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PR modifies feature gate definitions and YAML configs only - no Ginkgo test files modified, so the test name stability check does not apply.
Test Structure And Quality ✅ Passed PR contains no Ginkgo tests. Repository does not use Ginkgo framework; only standard Go testing package is used. Check is not applicable.
Microshift Test Compatibility ✅ Passed No Ginkgo e2e tests are added in this PR. Changes are limited to feature gate code definitions, manifest configurations, and documentation. The MicroShift compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed This PR adds no Ginkgo e2e tests. Changes are only to feature gate registration code, YAML manifests, and documentation. The SNO test compatibility check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PR adds only feature gate definitions and FeatureGate CRD configurations, not deployment manifests or operator code with scheduling constraints. No topology-awareness issues present.
Ote Binary Stdout Contract ✅ Passed PR adds FeatureGateRHCOS10DefaultInstall using builder pattern with no stdout writes. No fmt.Print, klog, log.Print, or stdout I/O detected; error handling via panic() writes to stderr.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PR adds standard Go unit test using testing.T, not Ginkgo e2e tests. No It(), Describe(), Context(), When() patterns found, so custom check is not applicable.
No-Weak-Crypto ✅ Passed PR adds RHCOS10DefaultInstall feature gate (configuration only) with no weak crypto, custom crypto implementations, or unsafe secret comparisons detected.
Container-Privileges ✅ Passed PR adds RHEL10 feature gate configuration without introducing any container manifests with privileged settings. Modified files are feature gate definitions and documentation only.
No-Sensitive-Data-In-Logs ✅ Passed PR adds RHCOS10DefaultInstall feature gate with no logging code that exposes passwords, tokens, API keys, PII, or other sensitive data. Changes are configuration/metadata only.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 26, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 26, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 26, 2026

Hello @cheesesashimi! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@openshift-ci openshift-ci Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 26, 2026
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`:
- Around line 251-253: The manifest currently hard-disables the "RHEL10" feature
with a single status entry (version: "") which conflicts with the code-enabled
RHEL10 for >=5; update the 4-10 feature-gate manifest so RHEL10 has
version-specific status entries (e.g., an explicit disabled entry for versions
<5 and either no entry or an enabled entry for versions >=5) or split into
per-major manifests so 4.x keeps it disabled and 5+ resolves to enabled,
ensuring the unique feature name "RHEL10" is adjusted accordingly in the
manifest entries to match the version-gated behavior in features.go.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e7d6492b-243b-4292-a92d-66ba7822f8d4

📥 Commits

Reviewing files that changed from the base of the PR and between 09730f8 and 016b634.

📒 Files selected for processing (10)
  • features.md
  • features/features.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

Comment on lines +251 to +253
{
"name": "RHEL10"
},
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Static disable conflicts with version-gated enablement.

RHEL10 is enabled in features/features.go at Line 891 for version >=5, but this 4-10 manifest hard-disables it in the only status entry (version: ""). That mismatch can keep 5+ behavior/docs incorrect. Please represent RHEL10 with version-specific status entries (or equivalent per-major manifest split) so 4.x and 5+ resolve differently.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`
around lines 251 - 253, The manifest currently hard-disables the "RHEL10"
feature with a single status entry (version: "") which conflicts with the
code-enabled RHEL10 for >=5; update the 4-10 feature-gate manifest so RHEL10 has
version-specific status entries (e.g., an explicit disabled entry for versions
<5 and either no entry or an enabled entry for versions >=5) or split into
per-major manifests so 4.x keeps it disabled and 5+ resolves to enabled,
ensuring the unique feature name "RHEL10" is adjusted accordingly in the
manifest entries to match the version-gated behavior in features.go.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 26, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joelspeed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Comment thread features/features.go Outdated
enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
mustRegister()

FeatureGateRHEL10 = newFeatureGate("RHEL10").
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIUC the intent of this feature gate is to default installs to RHCOS10 (which will never happen in 4.x), so I would suggest:

Suggested change
FeatureGateRHEL10 = newFeatureGate("RHEL10").
FeatureGateRHCOS10DefaultInstall = newFeatureGate("RHCOS10DefaultInstall").

or something of that variety.

Note that including the substring Install in the feature gate switches the promotion criteria so that the tests will look at install success, rather than e2e test cases. Prioritizing these tests makes sense as the os stream feature gate should cover the e2e side of things.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll adjust it to your suggestion, thanks!

@cheesesashimi cheesesashimi force-pushed the zzlotnik/rhel10-feature-gate branch from 016b634 to 11f4856 Compare May 27, 2026 14:32
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (5)
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml (1)

122-124: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version-gated enablement conflicts with static manifest disable.

The feature gate is enabled for version ≥5 in features/features.go at line 891, but this SelfManagedHA Default manifest covering versions 4-10 disables it unconditionally. Clusters running OCP 5.0+ will experience a conflict between the code-level enablement and the manifest state. Implement version-specific status entries or split manifests by major version.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml`
around lines 122 - 124, The manifest
"featureGate-4-10-SelfManagedHA-Default.yaml" currently unconditionally lists
the "DefaultRHEL10" disable entry which conflicts with the version-gated
enablement in features/features.go (enabled for OCP ≥5); update the manifest to
be version-aware by either splitting this manifest into separate major-version
manifests (e.g., 4.x vs 5.x) or adding explicit version-scoped status entries
(minVersion/maxVersion) so "DefaultRHEL10" is not disabled for clusters running
OCP 5.0+ and aligns with the feature gate logic in features/features.go.
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml (1)

124-126: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version-gated enablement conflicts with static manifest disable.

DefaultRHEL10 is enabled for version ≥5 in features/features.go (line 891), yet this OKD manifest for versions 4-10 disables it with version: "". In OCP 5.0+, the feature gate will be incorrectly reported as disabled. Resolve by using version-specific status entries or creating separate manifests for v4 and v5+.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml`
around lines 124 - 126, The manifest currently disables the feature gate
"DefaultRHEL10" for the 4-10 OKD payload which conflicts with the code-level
gating that enables DefaultRHEL10 for versions >= 5 in features/features.go;
update the manifest so version-specific status is used (add a status entry that
enables DefaultRHEL10 for v5+ while keeping it disabled for v4) or split this
manifest into two manifests (one for v4 with version: "" disabling DefaultRHEL10
and one for v5+ that explicitly sets the feature status to enabled) to ensure
the runtime feature state matches the version-gated logic in the feature gate
implementation.
payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml (1)

125-127: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version-gated enablement conflicts with static manifest disable.

DefaultRHEL10 is enabled in features/features.go at line 891 for version ≥5 via enable(inVersion(5, greaterThanOrEqual)), but this 4-10 manifest unconditionally disables it (version: ""). For OCP 5.0+ clusters, the runtime behavior will conflict with the documented/intended state. Consider version-specific status entries or splitting manifests by major version so v5+ reflects the enabled state.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`
around lines 125 - 127, The manifest entry for feature "DefaultRHEL10"
unconditionally disables it (empty version/status) which conflicts with the
code-level enablement in features.go where DefaultRHEL10 is enabled via
enable(inVersion(5, greaterThanOrEqual)); update the feature gate manifest so
runtime state matches code by either adding a version-scoped status entry (e.g.,
set status disabled for versions <5 and enabled for ≥5) or split the manifest
into per-major-version files so the 5.x+ manifest reflects the enabled state for
DefaultRHEL10; locate the symbol "DefaultRHEL10" in the manifest and reconcile
it with the enable(inVersion(5, greaterThanOrEqual)) rule in
features/features.go.
payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml (1)

25-27: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version-gated enablement conflicts with static manifest disable.

DefaultRHEL10 is enabled in features/features.go at line 891 for version ≥5, but this DevPreviewNoUpgrade manifest spanning versions 4-10 hard-disables it. For v5+ clusters, this creates a mismatch between code enablement and manifest configuration. Use version-specific status entries or separate manifests per major version.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml`
around lines 25 - 27, The manifest hard-disables the feature named
"DefaultRHEL10" while the code in features/features.go enables that same feature
for version ≥5, creating a conflict; update this DevPreviewNoUpgrade manifest so
it does not blanket-disable DefaultRHEL10 across 4-10—either add
version-specific status entries in this manifest that keep it disabled only for
pre-v5 ranges or split this file into separate manifests per major version
(e.g., 4.x vs 5.x) so that DefaultRHEL10 remains enabled for v5+ clusters as
defined in features/features.go.
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml (1)

37-39: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version-gated enablement conflicts with static manifest disable.

The code in features/features.go at line 891 enables DefaultRHEL10 for version ≥5, but this TechPreviewNoUpgrade manifest for versions 4-10 unconditionally disables it. OCP 5.0+ clusters will see a mismatch between intended enablement and the manifest configuration. Use version-specific status entries or split the manifest by major version.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml`
around lines 37 - 39, The manifest unconditionally disables the feature named
"DefaultRHEL10" for 4-10 while the feature enablement logic in features.go (the
DefaultRHEL10 gating around version ≥5) will turn it on for OCP 5+, causing a
conflict; fix by making the manifest version-aware — either add version-scoped
status entries so "DefaultRHEL10" is disabled only for <5 and not for ≥5, or
split this TechPreviewNoUpgrade manifest into separate major-version manifests
(one for 4.x that keeps the disable, and one for 5.x+ that omits or sets the
feature to enabled), ensuring the manifest status for "DefaultRHEL10" matches
the gating logic in features.go.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`:
- Around line 125-127: The manifest entry for feature "DefaultRHEL10"
unconditionally disables it (empty version/status) which conflicts with the
code-level enablement in features.go where DefaultRHEL10 is enabled via
enable(inVersion(5, greaterThanOrEqual)); update the feature gate manifest so
runtime state matches code by either adding a version-scoped status entry (e.g.,
set status disabled for versions <5 and enabled for ≥5) or split the manifest
into per-major-version files so the 5.x+ manifest reflects the enabled state for
DefaultRHEL10; locate the symbol "DefaultRHEL10" in the manifest and reconcile
it with the enable(inVersion(5, greaterThanOrEqual)) rule in
features/features.go.

In
`@payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml`:
- Around line 25-27: The manifest hard-disables the feature named
"DefaultRHEL10" while the code in features/features.go enables that same feature
for version ≥5, creating a conflict; update this DevPreviewNoUpgrade manifest so
it does not blanket-disable DefaultRHEL10 across 4-10—either add
version-specific status entries in this manifest that keep it disabled only for
pre-v5 ranges or split this file into separate manifests per major version
(e.g., 4.x vs 5.x) so that DefaultRHEL10 remains enabled for v5+ clusters as
defined in features/features.go.

In `@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml`:
- Around line 122-124: The manifest
"featureGate-4-10-SelfManagedHA-Default.yaml" currently unconditionally lists
the "DefaultRHEL10" disable entry which conflicts with the version-gated
enablement in features/features.go (enabled for OCP ≥5); update the manifest to
be version-aware by either splitting this manifest into separate major-version
manifests (e.g., 4.x vs 5.x) or adding explicit version-scoped status entries
(minVersion/maxVersion) so "DefaultRHEL10" is not disabled for clusters running
OCP 5.0+ and aligns with the feature gate logic in features/features.go.

In `@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml`:
- Around line 124-126: The manifest currently disables the feature gate
"DefaultRHEL10" for the 4-10 OKD payload which conflicts with the code-level
gating that enables DefaultRHEL10 for versions >= 5 in features/features.go;
update the manifest so version-specific status is used (add a status entry that
enables DefaultRHEL10 for v5+ while keeping it disabled for v4) or split this
manifest into two manifests (one for v4 with version: "" disabling DefaultRHEL10
and one for v5+ that explicitly sets the feature status to enabled) to ensure
the runtime feature state matches the version-gated logic in the feature gate
implementation.

In
`@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml`:
- Around line 37-39: The manifest unconditionally disables the feature named
"DefaultRHEL10" for 4-10 while the feature enablement logic in features.go (the
DefaultRHEL10 gating around version ≥5) will turn it on for OCP 5+, causing a
conflict; fix by making the manifest version-aware — either add version-scoped
status entries so "DefaultRHEL10" is disabled only for <5 and not for ≥5, or
split this TechPreviewNoUpgrade manifest into separate major-version manifests
(one for 4.x that keeps the disable, and one for 5.x+ that omits or sets the
feature to enabled), ensuring the manifest status for "DefaultRHEL10" matches
the gating logic in features.go.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5fe9b4a8-34ee-44de-8367-db5284d24773

📥 Commits

Reviewing files that changed from the base of the PR and between 016b634 and 11f4856.

📒 Files selected for processing (10)
  • features.md
  • features/features.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
✅ Files skipped from review due to trivial changes (1)
  • features.md
🚧 Files skipped from review as they are similar to previous changes (3)
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

@cheesesashimi cheesesashimi force-pushed the zzlotnik/rhel10-feature-gate branch from 11f4856 to 52a66bb Compare May 27, 2026 18:56
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`:
- Around line 251-253: The manifest currently disables the
"RHCOS10DefaultInstall" feature for all versions because the featureGates entry
uses version: "" while the code (features/features.go via enable(inVersion(5,
greaterThanOrEqual))) expects it enabled for v>=5; update the manifest to match
the code by removing "RHCOS10DefaultInstall" from the global disabled list or
split the featureGates into version-specific entries so that it's explicitly
disabled for v<5 and absent/enabled for v>=5 (alternatively create separate
per-major-version manifests), ensuring the entry that references
"RHCOS10DefaultInstall" is scoped to the correct version range to avoid the
mismatch.

In
`@payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml`:
- Around line 61-63: The manifest's featureGates block is applying a disabled
list to all versions because the single entry uses version: "" which overrides
code's intent (features/features.go where RHCOS10DefaultInstall is enabled for
version >=5); update the manifest to make featureGates version-specific (e.g.,
add an entry with version ">=5" that enables RHCOS10DefaultInstall or split into
per-major-version manifests) so that RHCOS10DefaultInstall is not globally
disabled and matches the code's >=5 enablement.

In `@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml`:
- Around line 245-247: Manifest currently lists "RHCOS10DefaultInstall" in the
disabled/global entry that applies to all versions, which conflicts with the
enablement logic in features/features.go that enables RHCOS10DefaultInstall for
version >=5; update the manifest so the gate is disabled for v4 but enabled for
v5+ by adding version-scoped featureGates (or split into per-major-version
manifests) instead of a single version:"" entry—ensure the manifest's
featureGates entries align with the RHCOS10DefaultInstall enablement in
features/features.go so v5+ operators see it enabled while v4 remains disabled.

In
`@payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml`:
- Around line 67-69: The manifest currently lists "RHCOS10DefaultInstall" in the
global disabled list, which conflicts with the logic in features/features.go
that enables RHCOS10DefaultInstall for operator versions >=5; update the
manifest so the gate is disabled for v4.x but enabled for v5+ — either split the
global featureGates into version-specific entries (add a specific entry for
major version 4 that includes "RHCOS10DefaultInstall" in disabled, and a
separate entry for versions 5+ that does not list it) or create
per-major-version manifests so the runtime behavior of RHCOS10DefaultInstall
matches the code path in features/features.go.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ec3fe993-7623-46dc-9931-1142a978daf1

📥 Commits

Reviewing files that changed from the base of the PR and between 11f4856 and 52a66bb.

📒 Files selected for processing (10)
  • features.md
  • features/features.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
✅ Files skipped from review due to trivial changes (3)
  • features.md
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml

Comment on lines +251 to +253
{
"name": "RHCOS10DefaultInstall"
},
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version mismatch: gate enabled for v5+ in code but disabled in cross-version manifest.

This manifest covers versions 4,5,6,7,8,9,10 (line 8) but has a single featureGates entry with version: "" (line 365), meaning the disabled list applies to all versions. However, features/features.go line 891 enables this gate for version >=5 via enable(inVersion(5, greaterThanOrEqual)). Operators reading this manifest for v5+ will see RHCOS10DefaultInstall as disabled, conflicting with the code definition.

Consider splitting into version-specific entries (disabled for v<5, enabled/absent for v>=5) or separate per-major-version manifests so v4.x shows disabled and v5+ resolves to enabled.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`
around lines 251 - 253, The manifest currently disables the
"RHCOS10DefaultInstall" feature for all versions because the featureGates entry
uses version: "" while the code (features/features.go via enable(inVersion(5,
greaterThanOrEqual))) expects it enabled for v>=5; update the manifest to match
the code by removing "RHCOS10DefaultInstall" from the global disabled list or
split the featureGates into version-specific entries so that it's explicitly
disabled for v<5 and absent/enabled for v>=5 (alternatively create separate
per-major-version manifests), ensuring the entry that references
"RHCOS10DefaultInstall" is scoped to the correct version range to avoid the
mismatch.

Comment on lines +61 to +63
{
"name": "RHCOS10DefaultInstall"
},
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Version mismatch: gate enabled for v5+ in code but disabled in cross-version manifest.

This manifest covers versions 4,5,6,7,8,9,10 (line 8) but has a single featureGates entry with version: "" (line 367), applying the disabled list to all versions. features/features.go line 891 enables RHCOS10DefaultInstall for version >=5, but this manifest will show it as disabled for v5+ operators, conflicting with the code definition.

Consider version-specific entries or per-major-version manifests so v4.x and v5+ resolve correctly.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml`
around lines 61 - 63, The manifest's featureGates block is applying a disabled
list to all versions because the single entry uses version: "" which overrides
code's intent (features/features.go where RHCOS10DefaultInstall is enabled for
version >=5); update the manifest to make featureGates version-specific (e.g.,
add an entry with version ">=5" that enables RHCOS10DefaultInstall or split into
per-major-version manifests) so that RHCOS10DefaultInstall is not globally
disabled and matches the code's >=5 enablement.

@cheesesashimi cheesesashimi marked this pull request as ready for review May 28, 2026 15:56
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 28, 2026
@openshift-ci openshift-ci Bot requested review from JoelSpeed and everettraven May 28, 2026 15:56
Comment thread features/features.go Outdated
contactPerson("zzlotnik").
productScope(ocpSpecific).
enhancementPR("https://github.com/openshift/enhancements/pull/1874").
enable(inVersion(5, greaterThanOrEqual)).
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No featuresets here yet, is that deliberate?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just pushed an update which adds featuresets as follows:

  • In >= 5.0, RHCOS10 is installed by default on new clusters.
  • In < 5.0, RHCOS10 is installed by default only in new TechPreview clusters. Newly installed non-TechPreview clusters will continue to default to RHCOS9.
  • Install-time Hypershift support is still TBD right now, so this will only apply to self-managed clusters.

These are the featuresets that I think are correct, but I'm currently confirming that.

@openshift-ci openshift-ci Bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 3, 2026
@cheesesashimi cheesesashimi force-pushed the zzlotnik/rhel10-feature-gate branch from e3ea905 to 506967c Compare June 3, 2026 14:37
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 3, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Jun 3, 2026

@cheesesashimi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify-feature-promotion 506967c link true /test verify-feature-promotion
ci/prow/unit 506967c link true /test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants