OCPNODE-3863: Add CRIOCredentialProviderConfig API #2557
Conversation
|
Skipping CI for Draft Pull Request. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Hello @QiWang19! Some important instructions when contributing to openshift/api: |
openshift-ci
bot
added
the
size/XL
QiWang19
changed the title
QiWang19
force-pushed
the
creds-provider
branch
from
c00c122 to
1db4267
Compare
|
/retest-required |
QiWang19
force-pushed
the
creds-provider
branch
2 times, most recently
from
8805169 to
108219f
Compare
|
/test integration |
QiWang19
force-pushed
the
creds-provider
branch
from
108219f to
066bf58
Compare
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
PR has been reviewed by claude code /api-review. It helped run |
QiWang19
force-pushed
the
creds-provider
branch
2 times, most recently
from
d2a191b to
41bd600
Compare
openshift-ci
bot
added
size/XXL
QiWang19
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@QiWang19: This pull request references OCPNODE-3863 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@QiWang19: This pull request references OCPNODE-3863 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
QiWang19
force-pushed
the
creds-provider
branch
from
41bd600 to
e7df906
Compare
saschagrunert
left a comment
saschagrunert
left a comment
There was a problem hiding this comment.
Two nits, otherwise LGTM
|
/assign @everettraven |
QiWang19
force-pushed
the
creds-provider
branch
from
07c6dc5 to
267555a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (3)
config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml (1)
114-120: RelaxmatchImagespath regex to allow.in repository paths
Current regex forbids dots in the optional path (/[-a-z0-9_/]*), which can block valid/common repo names. (This was raised previously.)- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')openapi/generated_openapi/zz_generated.openapi.go (1)
21535-21705: Reintroduced:matchImages/conditionsarray limits described but not enforced in schema. The generated schema lacksMinItems/MaxItemsformatchImages(1..50) andMaxItemsforstatus.conditions(16), even though the descriptions require them—this is likely a source-marker or generator/regeneration issue (and was previously addressed).Please fix via the source Go types + regeneration (don’t patch this generated file). To verify quickly in-repo:
#!/bin/bash set -euo pipefail # Expect to see MinItems/MaxItems near matchImages and MaxItems near conditions. rg -n "matchImages|conditions" openapi/generated_openapi/zz_generated.openapi.go -n -C2 echo "---- matchImages constraints ----" rg -n "matchImages" openapi/generated_openapi/zz_generated.openapi.go -n -A40 | rg -n "MinItems|MaxItems|x-kubernetes-list-type" || true echo "---- conditions constraints ----" rg -n "\"conditions\"" openapi/generated_openapi/zz_generated.openapi.go -n -A40 | rg -n "MaxItems|x-kubernetes-list-type" || trueopenapi/openapi.json (1)
11785-11820: Add missing array bounds in generated schema (spec.matchImages,status.conditions)
This hunk still lacksminItems/maxItemsonmatchImagesandmaxItemsonstatus.conditions, so empty/unbounded lists remain valid at the OpenAPI layer. Please ensure codegen emitsminItems: 1,maxItems: 50formatchImagesandmaxItems: 4forconditions(likely via kubebuilder markers on the Go types).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (24)
config/v1alpha1/register.go(1 hunks)config/v1alpha1/tests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml(1 hunks)config/v1alpha1/types_crio_credential_provider_config.go(1 hunks)config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml(1 hunks)config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml(1 hunks)config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml(1 hunks)config/v1alpha1/zz_generated.deepcopy.go(1 hunks)config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml(1 hunks)config/v1alpha1/zz_generated.featuregated-crd-manifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml(1 hunks)config/v1alpha1/zz_generated.swagger_doc_generated.go(1 hunks)features.md(1 hunks)features/features.go(1 hunks)hack/update-payload-crds.sh(1 hunks)openapi/generated_openapi/zz_generated.openapi.go(2 hunks)openapi/openapi.json(1 hunks)payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml(1 hunks)payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml(1 hunks)payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-Default.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (11)
- payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml
- payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml
- hack/update-payload-crds.sh
- config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml
- config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml
- payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml
- payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml
- features.md
- payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml
- config/v1alpha1/tests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml
- config/v1alpha1/types_crio_credential_provider_config.go
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
payload-manifests/featuregates/featureGate-Hypershift-Default.yamlpayload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yamlconfig/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yamlconfig/v1alpha1/zz_generated.featuregated-crd-manifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yamlconfig/v1alpha1/register.goopenapi/generated_openapi/zz_generated.openapi.gofeatures/features.gopayload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yamlpayload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yamlconfig/v1alpha1/zz_generated.swagger_doc_generated.goconfig/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yamlopenapi/openapi.jsonconfig/v1alpha1/zz_generated.deepcopy.go
🧬 Code graph analysis (4)
config/v1alpha1/register.go (2)
config/v1alpha1/types_crio_credential_provider_config.go (2)
CRIOCredentialProviderConfig(25-43)CRIOCredentialProviderConfigList(139-147)config/v1alpha1/zz_generated.swagger_doc_generated.go (2)
CRIOCredentialProviderConfig(236-238)CRIOCredentialProviderConfigList(245-247)
features/features.go (1)
config/v1/types_feature.go (2)
DevPreviewNoUpgrade(49-49)TechPreviewNoUpgrade(45-45)
config/v1alpha1/zz_generated.swagger_doc_generated.go (1)
config/v1alpha1/types_crio_credential_provider_config.go (4)
CRIOCredentialProviderConfig(25-43)CRIOCredentialProviderConfigList(139-147)CRIOCredentialProviderConfigSpec(46-94)CRIOCredentialProviderConfigStatus(117-131)
config/v1alpha1/zz_generated.deepcopy.go (2)
config/v1alpha1/types_crio_credential_provider_config.go (5)
CRIOCredentialProviderConfig(25-43)CRIOCredentialProviderConfigList(139-147)CRIOCredentialProviderConfigSpec(46-94)MatchImage(112-112)CRIOCredentialProviderConfigStatus(117-131)config/v1alpha1/zz_generated.swagger_doc_generated.go (4)
CRIOCredentialProviderConfig(236-238)CRIOCredentialProviderConfigList(245-247)CRIOCredentialProviderConfigSpec(254-256)CRIOCredentialProviderConfigStatus(263-265)
🔇 Additional comments (11)
config/v1alpha1/zz_generated.deepcopy.go (1)
195-299: Generated DeepCopy implementations look correct for the new CRIOCredentialProviderConfig typespayload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml (1)
101-108: FeatureGate enablement update is consistentpayload-manifests/featuregates/featureGate-Hypershift-Default.yaml (1)
52-65: Default Hypershift gating (disabled) matches expected rollout postureconfig/v1alpha1/register.go (1)
30-47: Scheme registration for CRIOCredentialProviderConfig types looks correctfeatures/features.go (1)
134-140: String "CRIOCredentialProviderConfig" is consistent across code and payload manifestsAll references to the feature gate string maintain consistent casing and spelling across type definitions, CRD manifests, feature gate configurations, and generated code. No typos or case drift detected.
config/v1alpha1/zz_generated.featuregated-crd-manifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml (1)
1-214: LGTM! CRD validation design is sound.The CRD manifest is well-structured and addresses previous review concerns:
- The singleton enforcement via CEL validation (lines 208-210) correctly restricts the resource name to "cluster"
- The matchImages regex validation (line 119) has been verified through tests to correctly accept valid domain patterns with wildcards, ports, and paths
- The status constraints are semantically appropriate:
statusis optional and can be omitted for new resourcesminProperties: 1(line 132) ensures that if status is provided, it contains at least the conditions fieldminItems: 1(line 199) ensures that if conditions are provided, at least one condition is present- This prevents empty status objects while allowing controllers to properly initialize status with meaningful conditions
The validation rules align with the documented behavior that status can be omitted initially and will be populated by controllers with validation conditions.
config/v1alpha1/zz_generated.swagger_doc_generated.go (1)
229-265: LGTM! Swagger documentation is complete and follows established patterns.The generated Swagger documentation for CRIOCredentialProviderConfig and its related types is comprehensive and accurate:
- All four types (CRIOCredentialProviderConfig, CRIOCredentialProviderConfigList, CRIOCredentialProviderConfigSpec, CRIOCredentialProviderConfigStatus) have proper documentation maps
- Descriptions are detailed and match the CRD schema definitions
- The documentation clearly explains the singleton nature, matchImages validation requirements, and status conditions
The code follows the established pattern in this generated file. While the
map_CRIOCredentialProviderConfigListcould include an "items" entry for additional completeness (similar tomap_ClusterMonitoringListat line 169), this is consistent with most other *List types in this file which also omit that entry, and was noted in previous reviews.openapi/generated_openapi/zz_generated.openapi.go (1)
428-434: Registry wiring for new OpenAPI definitions looks consistent.payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml (3)
127-203: Clarify status constraints and conditions array handling.The status schema combines
minProperties: 1(line 132) withminItems: 1on the conditions array (line 198), which means status can only exist in one of two valid states: absent, or present with at least one condition. However, the description at lines 136–137 states "When omitted, it indicates that no conditions have been reported yet," which could be misunderstood as allowing an empty conditions array or empty status object{}.For clarity and to align with the intended controller behavior, consider:
- If this constraint is intentional (status must always contain conditions): update the description to explicitly state that status should only be present when there is at least one condition to report, or use a CEL validation rule to document this pattern.
- If empty status should be allowed: either remove
minProperties: 1or setminItems: 0on the conditions array, and update descriptions accordingly.The current schema is technically consistent, but the wording could mislead controller implementations into attempting invalid configurations.
50-126: matchImages validation and constraints are well-designed.The spec validation rules are comprehensive and appropriate:
- Regex pattern (line 119) correctly enforces lowercase FQDN format with optional wildcards, ports, and paths
- Wildcard constraints (line 116) prevent unsafe global matches
- Array bounds (minItems: 1, maxItems: 50) and string length limits (maxLength: 512) are reasonable
x-kubernetes-list-type: set(line 123) prevents duplicates
207-210: Singleton constraint enforcement is correct.The CEL validation rule properly enforces the singleton pattern by requiring
metadata.name == 'cluster', which aligns with the resource description and prevents accidental creation of multiple instances.
...fests/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml
Show resolved
Hide resolved
...s/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml
Show resolved
Hide resolved
QiWang19
force-pushed
the
creds-provider
branch
from
267555a to
da5c4a2
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (9)
config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml (1)
114-119: Fix matchImages path validation to allow dots in repository paths.The regex pattern on line 119 restricts the path component to
[-a-z0-9_/]*, excluding dots. Repository paths commonly include dots (e.g.,.tar,.tgz). This restriction is unnecessarily strict.Update the path character class to include dots, matching the fix needed in the DevPreviewNoUpgrade variant:
- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')Ensure both DevPreviewNoUpgrade and TechPreviewNoUpgrade CRD variants receive this fix for consistency.
payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml (1)
114-123: Allow dots inmatchImagespath component for repository paths.The regex pattern at line 119 disallows dots in the optional path segment:
(/[-a-z0-9_/]*)does not include\.. This rejects legitimate image references likeregistry.io/my.package/image, which commonly appear in container registries (e.g., Python packages, npm scopes with dots).Update the path character class to include dots:
- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml (1)
114-123: Allow dots inmatchImagespath component for repository paths.The regex pattern at line 119 disallows dots in the optional path segment:
(/[-a-z0-9_/]*)does not include\.. This rejects legitimate image references likeregistry.io/my.package/image, which commonly appear in container registries (e.g., Python packages, npm scopes with dots).Update the path character class to include dots:
- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')openapi/generated_openapi/zz_generated.openapi.go (2)
21636-21668:matchImagesschema missing MinItems/MaxItems vs documented 1..50 contract. This allows empty/unbounded arrays despite the description. Since this is generated output, fix via kubebuilder markers on the source type and regenerate; if generation still omits these, the openapi generation tooling/version likely isn’t honoring the markers."matchImages": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ "x-kubernetes-list-type": "set", }, }, SchemaProps: spec.SchemaProps{ Description: "matchImages is a required list ... This field is required and must contain between 1 and 50 entries. ...", Type: []string{"array"}, + MinItems: 1, + MaxItems: 50, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: "", Type: []string{"string"}, Format: "", }, }, }, }, },
21670-21705:conditionsschema missing MaxItems=16 vs documented limit. This makes the status array effectively unbounded. Fix at source + regenerate; if generation still omits it, treat as a tooling/generator gap."conditions": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ "x-kubernetes-list-map-keys": []interface{}{ "type", }, "x-kubernetes-list-type": "map", }, }, SchemaProps: spec.SchemaProps{ Description: "conditions represent ... The maximum number of conditions is 16. ...", Type: []string{"array"}, + MaxItems: 16, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: map[string]interface{}{}, Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.Condition"), }, }, }, }, },config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml (1)
114-119: Verify if path segment restriction is intentional.The
matchImagesvalidation regex at line 119 uses the character class[-a-z0-9_/]for the path portion, which does not include.(dot). This means patterns likeregistry.io/project.v2/subpathwould be rejected.A previous review flagged this same concern and was marked as "Addressed in commit a31eec1", but the regex still excludes dots from path segments. Please confirm whether:
- This restriction is intentional (paths with dots are not supported by design), or
- The fix was incomplete and the regex should be updated to
/[-a-z0-9._/]*to allow dots in pathsContainer image repository paths commonly include dots (per OCI naming conventions), so this limitation may surprise users and block valid configurations unless it's a deliberate design choice.
Based on past review comments.
payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml (1)
114-119: Verify if path segment restriction is intentional.The
matchImagesvalidation regex at line 119 uses the character class[-a-z0-9_/]for the path portion, which does not include.(dot). This means patterns likeregistry.io/project.v2/subpathwould be rejected.This is the same regex pattern as in the CustomNoUpgrade variant. Please confirm whether:
- This restriction is intentional (paths with dots are not supported by design), or
- The regex should be updated to
/[-a-z0-9._/]*to allow dots in pathsContainer image repository paths commonly include dots (per OCI naming conventions), so this limitation may surprise users and block valid configurations unless it's a deliberate design choice.
Based on past review comments.
openapi/openapi.json (2)
11792-11800: [Duplicate] Missing array bounds validation on matchImages.This issue was already flagged in a previous review. The
matchImagesarray schema lacksminItems: 1andmaxItems: 50constraints despite PR requirements specifying "1–50 unique strings". The array definition currently only includesx-kubernetes-list-type: "set"for uniqueness.Add the missing cardinality constraints:
"matchImages": { "description": "...", "type": "array", + "minItems": 1, + "maxItems": 50, "items": { "type": "string", "default": "" }, "x-kubernetes-list-type": "set" }Ensure the corresponding Go struct in
config/v1alpha1/types_crio_credential_provider_config.goincludes+kubebuilder:validation:MinItems=1and+kubebuilder:validation:MaxItems=50markers so codegen produces these OpenAPI constraints.
11807-11818: [Duplicate] Missing maxItems constraint on conditions array.This issue was already flagged in a previous review. The
conditionsarray schema in the status lacks themaxItems: 4constraint despite PR requirements specifying "up to 4" conditions. The array definition currently only includes list map configuration fortype-based keying.Add the missing cardinality constraint:
"conditions": { "description": "conditions represent the latest available observations of the configuration state", "type": "array", + "maxItems": 4, "items": { "default": {}, "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Condition" }, "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }Ensure the corresponding Go struct includes
+kubebuilder:validation:MaxItems=4marker so codegen produces this constraint in the OpenAPI schema.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (26)
config/v1alpha1/register.go(1 hunks)config/v1alpha1/tests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml(1 hunks)config/v1alpha1/types_crio_credential_provider_config.go(1 hunks)config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml(1 hunks)config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml(1 hunks)config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml(1 hunks)config/v1alpha1/zz_generated.deepcopy.go(1 hunks)config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml(1 hunks)config/v1alpha1/zz_generated.featuregated-crd-manifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml(1 hunks)config/v1alpha1/zz_generated.swagger_doc_generated.go(1 hunks)features.md(1 hunks)features/features.go(1 hunks)hack/update-payload-crds.sh(1 hunks)openapi/generated_openapi/zz_generated.openapi.go(2 hunks)openapi/openapi.json(1 hunks)payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml(1 hunks)payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml(1 hunks)payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-Default.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-OKD.yaml(1 hunks)payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-OKD.yaml(1 hunks)payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (10)
- config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml
- payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml
- features/features.go
- hack/update-payload-crds.sh
- config/v1alpha1/register.go
- payload-manifests/featuregates/featureGate-Hypershift-Default.yaml
- config/v1alpha1/types_crio_credential_provider_config.go
- features.md
- config/v1alpha1/zz_generated.swagger_doc_generated.go
- payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
config/v1alpha1/tests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yamlconfig/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yamlpayload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yamlpayload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yamlopenapi/generated_openapi/zz_generated.openapi.goconfig/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yamlpayload-manifests/featuregates/featureGate-Hypershift-OKD.yamlconfig/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yamlconfig/v1alpha1/zz_generated.featuregated-crd-manifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yamlpayload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yamlpayload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yamlpayload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yamlconfig/v1alpha1/zz_generated.deepcopy.gopayload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yamlopenapi/openapi.jsonpayload-manifests/featuregates/featureGate-SelfManagedHA-OKD.yaml
🧬 Code graph analysis (1)
config/v1alpha1/zz_generated.deepcopy.go (2)
config/v1alpha1/types_crio_credential_provider_config.go (5)
CRIOCredentialProviderConfig(25-43)CRIOCredentialProviderConfigList(139-147)CRIOCredentialProviderConfigSpec(46-94)MatchImage(112-112)CRIOCredentialProviderConfigStatus(117-131)config/v1alpha1/zz_generated.swagger_doc_generated.go (4)
CRIOCredentialProviderConfig(236-238)CRIOCredentialProviderConfigList(245-247)CRIOCredentialProviderConfigSpec(254-256)CRIOCredentialProviderConfigStatus(263-265)
🔇 Additional comments (11)
payload-manifests/featuregates/featureGate-Hypershift-OKD.yaml (1)
59-61: Feature gate entry correctly positioned in alphabetical order.Insertion into the disabled list is properly placed between
CRDCompatibilityRequirementOperatorandClientsAllowCBOR, maintaining alphabetical order.payload-manifests/featuregates/featureGate-SelfManagedHA-OKD.yaml (1)
59-61: Feature gate entry correctly positioned.Consistent with other OKD feature gate files. Entry is properly placed in the disabled list in alphabetical order.
payload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml (1)
103-105: Feature gate correctly enabled for DevPreviewNoUpgrade.Entry is properly placed in the enabled list in alphabetical order, consistent with the DevPreviewNoUpgrade feature set semantics.
payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml (1)
133-135: Feature gate correctly enabled for TechPreviewNoUpgrade.Entry properly positioned in the enabled list in alphabetical order, consistent with TechPreviewNoUpgrade feature gating.
payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml (1)
118-120: Feature gate entry correctly positioned for DevPreviewNoUpgrade.Properly placed in alphabetical order within the enabled list for Hypershift DevPreviewNoUpgrade.
config/v1alpha1/tests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml (1)
1-92: Test cases properly structured with comprehensive validation coverage.The YAML structure is correct (no nesting issues as were fixed in commit 514adaf), and the seven test cases comprehensively cover the matchImages validation rules: valid registries, invalid characters, uppercase enforcement, wildcard constraints, and global wildcard rejection. Test case error messages align with the CRD validation rules.
config/v1alpha1/zz_generated.featuregated-crd-manifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml (1)
127-203: LGTM: Status structure is properly optional and well-defined.The status field is correctly optional (not in the required array), with
minProperties: 1ensuring that when present it's not empty. The conditions array hasminItems: 1, preventing empty arrays, and the description correctly states "When omitted, it indicates that no conditions have been reported yet."—this aligns with the schema constraints.payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml (1)
127-203: LGTM: Status structure is properly optional and well-defined.The status field is correctly optional (not in the required array), with
minProperties: 1ensuring that when present it's not empty. The conditions array hasminItems: 1, preventing empty arrays, and the description correctly states "When omitted, it indicates that no conditions have been reported yet."—this aligns with the schema constraints.payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-CustomNoUpgrade.crd.yaml (1)
127-203: LGTM: Status structure is properly optional and well-defined.The status field is correctly optional (not in the required array), with
minProperties: 1ensuring that when present it's not empty. The conditions array hasminItems: 1, preventing empty arrays, and the description correctly states "When omitted, it indicates that no conditions have been reported yet."—this aligns with the schema constraints.openapi/generated_openapi/zz_generated.openapi.go (1)
428-434: OpenAPI registry wiring for new CRIOCredentialProviderConfig types looks correct.config/v1alpha1/zz_generated.deepcopy.go (1)
195-298: LGTM! Generated deepcopy implementations are correct.The auto-generated deepcopy methods for the new CRIOCredentialProviderConfig types follow the standard patterns and include proper nil checks, correct field copying, and appropriate runtime.Object implementations. All slice fields (MatchImages, Conditions, Items) are handled correctly with allocation and element-by-element deep copying.
...a1/tests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml
Show resolved
Hide resolved
| x-kubernetes-validations: | ||
| - message: global wildcard '*' is not allowed | ||
| rule: self != '*' | ||
| - message: invalid matchImages value, must be a valid fully qualified | ||
| domain name in lowercase with optional wildcard, port, and path | ||
| rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') |
There was a problem hiding this comment.
Fix matchImages path validation to allow dots in repository paths.
The regex pattern on line 119 restricts the path component to [-a-z0-9_/]*, which excludes dots (.). This is overly restrictive—repository paths commonly include dots (e.g., /my.repo/image.tar).
Update the path character class to include dots:
- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$')
+ rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')This aligns with the documented intent to support arbitrary repository paths. Based on learnings, this is a known issue flagged in previous reviews that should be corrected.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| x-kubernetes-validations: | |
| - message: global wildcard '*' is not allowed | |
| rule: self != '*' | |
| - message: invalid matchImages value, must be a valid fully qualified | |
| domain name in lowercase with optional wildcard, port, and path | |
| rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') | |
| x-kubernetes-validations: | |
| - message: global wildcard '*' is not allowed | |
| rule: self != '*' | |
| - message: invalid matchImages value, must be a valid fully qualified | |
| domain name in lowercase with optional wildcard, port, and path | |
| rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$') |
...anifests/criocredentialproviderconfigs.config.openshift.io/CRIOCredentialProviderConfig.yaml
Show resolved
Hide resolved
| // +required | ||
| MatchImages []MatchImage `json:"matchImages,omitempty"` |
There was a problem hiding this comment.
@JoelSpeed Is it mandatory to ship a default singleton resource? If we have to ship a default singleton manifest, it will be an empty spec since we don't have meaningful default values needed for default.
I think if we have to ship this default resource, spec.matchImages should be optional to pass the validation?
There was a problem hiding this comment.
No, I think it can be off by default and have it created only when the user wants something to actually happen
There was a problem hiding this comment.
@JoelSpeed The openshift has implementaiton does not allow oc delete cluster resources. And the API cel validation does not allow "" spec.matchImages.
As a result, a user cannot delete the entire configuration they added via the CR.
Would it makes sense to let users clear their configuration, even if the CR itself is cluster and cannot be deleted? Probably we can allow spec.matchImages to be empty.
Although from the underlying implementation, once the secret obejct(s) of the matchImages entry is deleted, the effective result is equivalent to removing item(s) from spec.matchImages.
$ oc delete criocredentialproviderconfig/cluster
Error from server (Forbidden): criocredentialproviderconfigs.config.openshift.io "cluster" is forbidden: deleting required criocredentialproviderconfigs.config.openshift.io resource, named cluster, is not allowed
| // metadata is the standard object's metadata. | ||
| // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata | ||
| // +optional | ||
| metav1.ObjectMeta `json:"metadata"` |
There was a problem hiding this comment.
Needs omitzero here please
| metav1.ObjectMeta `json:"metadata"` | |
| metav1.ObjectMeta `json:"metadata,omitzero"` |
QiWang19
force-pushed
the
creds-provider
branch
from
da5c4a2 to
e504b5e
Compare
|
/retest-required |
Hi @JoelSpeed, the enhancement PR got merged. openshift/enhancements#1861. we will need to followup on the enhancement to address the CRIOCredentialProvider resource a singleton. |
|
/lgtm |
|
Scheduling tests matching the |
openshift-ci
bot
added
the
approved
|
@QiWang19: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| // +kubebuilder:validation:MinItems=1 | ||
| // +listType=set | ||
| // +required | ||
| MatchImages []MatchImage `json:"matchImages,omitempty"` |
There was a problem hiding this comment.
@JoelSpeed WDYT? The openshift has implementaiton does not allow oc delete cluster resources. And the API cel validation does not allow "" spec.matchImages.
As a result, a user cannot delete the entire configuration they added via the CR.
Would it makes sense to let users clear their configuration, even if the CR itself is cluster and cannot be deleted? Probably we can allow spec.matchImages to be empty.
Although from the underlying implementation, once the secret obejct(s) of the matchImages entry is deleted, the effective result is equivalent to removing item(s) from spec.matchImages.
$ oc delete criocredentialproviderconfig/cluster
Error from server (Forbidden): criocredentialproviderconfigs.config.openshift.io "cluster" is forbidden: deleting required criocredentialproviderconfigs.config.openshift.io resource, named cluster, is not allowed
There was a problem hiding this comment.
@QiWang19 So this goes against some of our previous conversation, but good find! Do you have any idea where this is implemented? I wonder if there's a way to add an exception since we expect this cluster resource to not always exist.
Else yes, we will need to allow the spec to be removed for this particular resource
There was a problem hiding this comment.
@JoelSpeed That sounds good, we can add an exception at the code path
https://github.com/openshift/kubernetes/blob/76cb1db555ed7a57f12025018d54622ef2e9458c/openshift-kube-apiserver/admission/customresourcevalidation/config/deny_delete_cluster_config_resource.go#L31
There was a problem hiding this comment.
Verified correct code path we can add exception to allow delete criocredentialproviderconfig.config.openshift.io/cluster openshift/kubernetes#2542
on cluster 4.22.0-0.ci-2025-12-18-101944, openshift/kubernetes#2542, openshift/api#2557:
qiwan@fedora:~$ oc create -f /home/qiwan/Documents/test-crds/criocredentialprovider/criocp.yaml
criocredentialproviderconfig.config.openshift.io/cluster created
qiwan@fedora:~$ oc describe criocredentialproviderconfig.config.openshift.io/cluster
Name: cluster
Namespace:
Labels: <none>
Annotations: <none>
API Version: config.openshift.io/v1alpha1
Kind: CRIOCredentialProviderConfig
Metadata:
Creation Timestamp: 2025-12-18T19:50:35Z
Generation: 1
Resource Version: 38292
UID: 4ef0e05d-d875-46c9-b467-804513093041
Spec:
Match Images:
123456789.dkr.ecr.us-east-1.amazonaws.com
*.azurecr.io
*.*.registry.io
registry.io:8080/path
Events: <none>
qiwan@fedora:~$ oc delete criocredentialproviderconfig.config.openshift.io/cluster
criocredentialproviderconfig.config.openshift.io "cluster" deleted
|
/lgtm cancel |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: saschagrunert The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
bot
removed
the
approved
|
/verified by tests |
openshift-ci-robot
added
the
verified
|
@QiWang19: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@QiWang19 Can you try and get the OC PR merged before we merge this one please? |
ok, openshift/kubernetes#2549 is open. |
- Add API and feature gate for CRIOCredentialProviderConfig. Signed-off-by: Qi Wang <[email protected]>
QiWang19
force-pushed
the
creds-provider
branch
from
e504b5e to
c9eef66
Compare
openshift-ci-robot
removed
the
verified
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@config/v1alpha1/types_crio_credential_provider_config.go`:
- Around line 38-42: The comment for the Status field incorrectly says “nil” for
a value type; update the comment for the Status field on
CRIOCredentialProviderConfig to say that when omitted or set to its zero value
the status has not yet been populated by the controller, and that the controller
will populate CRIOCredentialProviderConfigStatus with validation conditions and
operational state; ensure the comment references the Status field and the
CRIOCredentialProviderConfigStatus type and removes any mention of “nil.”
♻️ Duplicate comments (4)
openapi/openapi.json (1)
12406-12414: Add array cardinality constraints for matchImages and conditions.Line 12406-12414 and Line 12421-12431 currently allow empty/oversized lists. If the API intends bounds (e.g., 1–50 matchImages and a capped conditions list), add
minItems/maxItemsvia the Go kubebuilder markers so the generator emits them here (avoid editing this generated file directly).🔧 Illustrative OpenAPI output (generated via markers)
"matchImages": { "description": "...", "type": "array", + "minItems": 1, + "maxItems": 50, "items": { "type": "string", "default": "" }, "x-kubernetes-list-type": "set" } ... "conditions": { "description": "conditions represent the latest available observations of the configuration state", "type": "array", + "maxItems": 4, "items": { "default": {}, "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Condition" }, "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }Kubernetes CRD OpenAPI schema minItems maxItems validation x-kubernetes-list-type set mapAlso applies to: 12421-12431
config/v1alpha1/zz_generated.swagger_doc_generated.go (1)
240-243: Additemsto the list SwaggerDoc map.
CRIOCredentialProviderConfigListomits theitemsentry, so generated docs won’t describe list contents (other*Listdocs in this file include it). Please add a briefitemsdescription.♻️ Proposed fix
var map_CRIOCredentialProviderConfigList = map[string]string{ "": "CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of CRIOCredentialProviderConfig", }Please confirm by regenerating swagger docs (e.g., via
hack/update-swagger-docs.sh) and checking the list description includesitems.payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-DevPreviewNoUpgrade.crd.yaml (1)
114-119: Allow dots in the matchImages path segment.Repository paths commonly include dots (e.g.,
registry.io/org/repo.v1). The current regex disallows.in the optional path, so valid patterns are rejected.🐛 Proposed fix
- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')Please verify with an example like
registry.io/org/repo.v1in the CRD validation tests (or a dry-run apply) to ensure the schema accepts dotted paths.payload-manifests/crds/0000_10_config-operator_01_criocredentialproviderconfigs-TechPreviewNoUpgrade.crd.yaml (1)
114-119: Allow dots in the matchImages path segment.Repository paths commonly include dots (e.g.,
registry.io/org/repo.v1). The current regex disallows.in the optional path, so valid patterns are rejected.🐛 Proposed fix
- rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9_/]*)?$') + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')Please verify with an example like
registry.io/org/repo.v1in the CRD validation tests (or a dry-run apply) to ensure the schema accepts dotted paths.
| // status represents the current state of the CRIOCredentialProviderConfig. | ||
| // When omitted or nil, it indicates that the status has not yet been set by the controller. | ||
| // The controller will populate this field with validation conditions and operational state. | ||
| // +optional | ||
| Status CRIOCredentialProviderConfigStatus `json:"status,omitzero,omitempty"` |
There was a problem hiding this comment.
Clarify status comment (non‑pointer can’t be nil).
Status is a value type, so “nil” doesn’t apply. Suggest wording that reflects omission/zero‑value instead.
✏️ Proposed doc tweak
- // When omitted or nil, it indicates that the status has not yet been set by the controller.
+ // When omitted (zero value), it indicates that the status has not yet been set by the controller.🤖 Prompt for AI Agents
In `@config/v1alpha1/types_crio_credential_provider_config.go` around lines 38 -
42, The comment for the Status field incorrectly says “nil” for a value type;
update the comment for the Status field on CRIOCredentialProviderConfig to say
that when omitted or set to its zero value the status has not yet been populated
by the controller, and that the controller will populate
CRIOCredentialProviderConfigStatus with validation conditions and operational
state; ensure the comment references the Status field and the
CRIOCredentialProviderConfigStatus type and removes any mention of “nil.”
5 participants
enhancement: OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication enhancements#1861
Add CRIOCredentialProviderConfig API setting configs https://github.com/cri-o/crio-credential-provider for retrieving mirror pull secrets
Add feature gate for CRIOCredentialProviderConfig feature gate.