OCPBUGS-86008: Gate Route watch on management cluster capability

[smrtrfszm]

What this PR does / why we need it:

The hosted-cluster-config-operator unconditionally watches route.openshift.io/v1 Routes against the management cluster to react to hostname changes on the metrics-proxy Route. On management clusters that do not expose the Routes API (e.g. non-OpenShift management clusters) this watch fails during controller setup and prevents HCCO from starting.

Detect the management cluster Route capability using the existing capabilities.DetectManagementClusterCapabilities helper and only register the watch when route.openshift.io is registered. This mirrors the pattern already used in other parts of the code.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-86008

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Bug Fixes
  • Operator now performs a one-time capability check at startup, improving compatibility with diverse management clusters.
  • Skips watches for unsupported APIs, preventing startup failures when certain resources aren’t available.
  • Only monitors Route resources when the management cluster reports Route support, reducing unnecessary errors and improving stability.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1e5a2b1a-ebb1-4b44-b56e-731f77b15c7e

📥 Commits

Reviewing files that changed from the base of the PR and between 07098a5 and 1f4af14.

📒 Files selected for processing (3)

• control-plane-operator/hostedclusterconfigoperator/cmd.go
• control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
• control-plane-operator/hostedclusterconfigoperator/operator/config.go

---

📝 Walkthrough

Walkthrough

The operator now performs a one-time management-cluster discovery at startup to detect capabilities and stores them in HostedClusterConfigOperatorConfig.ManagementClusterCapabilities. The resources controller's Setup consults that capability checker and registers a watch for OpenShift Route resources only when the Route capability is detected; startup returns an error if discovery or capability detection fails.

Sequence Diagram(s)

sequenceDiagram
    participant Cmd
    participant DiscoveryClient
    participant ManagementClusterAPI
    participant CapabilitiesDetector
    participant ResourcesController
    participant RouteAPI

    Cmd->>DiscoveryClient: create discovery client from kubeconfig
    DiscoveryClient->>ManagementClusterAPI: query API resources
    ManagementClusterAPI-->>DiscoveryClient: API resource list
    DiscoveryClient->>CapabilitiesDetector: provide resource list
    CapabilitiesDetector-->>ResourcesController: capabilities (Route present / absent)
    alt Route capability present
        ResourcesController->>RouteAPI: register watch for Route resources
        RouteAPI-->>ResourcesController: watch started
    else Route capability absent
        ResourcesController-->>ResourcesController: skip Route watch
    end

Loading

🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: gating (conditionally enabling) the Route watch based on management cluster capability detection.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies non-test production code only; hostedclusterconfigoperator uses standard Go testing, not Ginkgo. No Ginkgo test names to evaluate.
Test Structure And Quality	✅ Passed	PR explicitly states "docs and unit tests not included" in checklist. The codebase uses standard Go testing (testing.T), not Ginkgo, making the check inapplicable to this PR.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests added in this PR. All added test files are standard Go unit tests using func TestXXX(t *testing.T), not Ginkgo e2e tests with It(), Describe(), etc.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR; the changes are only to operational/controller code (capability detection and config updates) not test code.
Topology-Aware Scheduling Compatibility	✅ Passed	PR introduces no scheduling constraints. Changes make Route watch conditional on capability presence, improving HyperShift and non-OpenShift cluster compatibility.
Ote Binary Stdout Contract	✅ Passed	PR modifies production operator code, not OTE test binary. No direct stdout writes in process-level code; logger configured before discovery.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added in this PR. The three modified files contain no test code, and the PR checklist confirms "docs and unit tests not included."

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: smrtrfszm
Once this PR has been reviewed and has the lgtm label, please assign jparrill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 0% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 40.40%. Comparing base (36dfb1b) to head (1f4af14).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
...-plane-operator/hostedclusterconfigoperator/cmd.go	0.00%	34 Missing ⚠️
...rconfigoperator/controllers/resources/resources.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8484      +/-   ##
==========================================
- Coverage   40.40%   40.40%   -0.01%     
==========================================
  Files         755      755              
  Lines       93235    93249      +14     
==========================================
  Hits        37675    37675              
- Misses      52858    52872      +14     
  Partials     2702     2702              

Files with missing lines	Coverage Δ
...tor/hostedclusterconfigoperator/operator/config.go	0.00% <ø> (ø)
...rconfigoperator/controllers/resources/resources.go	55.35% <0.00%> (-0.02%)	⬇️
...-plane-operator/hostedclusterconfigoperator/cmd.go	0.00% <0.00%> (ø)

Flag	Coverage Δ
cmd-support	34.44% <ø> (ø)
cpo-hostedcontrolplane	41.76% <ø> (ø)
cpo-other	40.27% <0.00%> (-0.05%)	⬇️
hypershift-operator	50.72% <ø> (ø)
other	31.54% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci-robot]

@smrtrfszm: This pull request references Jira Issue OCPBUGS-86008, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

The hosted-cluster-config-operator unconditionally watches route.openshift.io/v1 Routes against the management cluster to react to hostname changes on the metrics-proxy Route. On management clusters that do not expose the Routes API (e.g. non-OpenShift management clusters) this watch fails during controller setup and prevents HCCO from starting.

Detect the management cluster Route capability using the existing capabilities.DetectManagementClusterCapabilities helper and only register the watch when route.openshift.io is registered. This mirrors the pattern already used in other parts of the code.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-86008

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Bug Fixes
• Only monitor the Route resource when the management cluster reports Route capability, preventing operator startup failures on non-OpenShift management clusters.
• Controller startup is now more resilient: it detects cluster capabilities and skips incompatible watches so the operator can run on a wider range of management clusters without errors.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@smrtrfszm: This pull request references Jira Issue OCPBUGS-86008, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

What this PR does / why we need it:

The hosted-cluster-config-operator unconditionally watches route.openshift.io/v1 Routes against the management cluster to react to hostname changes on the metrics-proxy Route. On management clusters that do not expose the Routes API (e.g. non-OpenShift management clusters) this watch fails during controller setup and prevents HCCO from starting.

Detect the management cluster Route capability using the existing capabilities.DetectManagementClusterCapabilities helper and only register the watch when route.openshift.io is registered. This mirrors the pattern already used in other parts of the code.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-86008

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Bug Fixes
• Only monitor the Route resource when the management cluster reports Route capability, preventing operator startup failures on non-OpenShift management clusters.
• Controller startup is now more resilient: it detects cluster capabilities and skips incompatible watches so the operator can run on a wider range of management clusters without errors.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go`:
- Around line 313-318: The reconcile logic still performs a Get on routev1.Route
even when the management cluster lacks the Route API; update the code to gate
that Route-dependent logic by checking
opts.ManagementClusterCapabilities.Has(capabilities.CapabilityRoute) before
attempting any route operations. Add the capability check either at the caller
that invokes reconcileMetricsForwarder or at the start of
reconcileMetricsForwarder itself so that when CapabilityRoute is false it
returns early (or skips the Route.Get/Route-specific flows) and does not attempt
to interact with routev1.Route.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1d5b9f2e-167f-44f7-93d1-a03784aaf380

📥 Commits

Reviewing files that changed from the base of the PR and between f54aa29 and 07098a5.

📒 Files selected for processing (3)

• control-plane-operator/hostedclusterconfigoperator/cmd.go
• control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
• control-plane-operator/hostedclusterconfigoperator/operator/config.go

[TwoDCube]

/lgtm
/retest

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

[TwoDCube]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

[TwoDCube]

/retest

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-aws | Build: 2057486725835395072 | Cost: $3.4691852500000016 | Failed step: hypershift-aws-run-e2e-nested

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[TwoDCube]

/retest

[TwoDCube]

/retest

[openshift-ci]

@smrtrfszm: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[smrtrfszm]

/verified by @smrtrfszm

Before this change on a vanilla kubernetes, HCCO was in a crash loop with error message:

Error: failed to wait for resources caches to sync: timed out waiting for cache to be synced for Kind *v1.Route

After this change on a vanilla kubernetes, HCCO is 1/1 ready:

oc get pod -n master-cluster1 -l hypershift.openshift.io/control-plane-component=hosted-cluster-config-operator
NAME                                              READY   STATUS    RESTARTS   AGE
hosted-cluster-config-operator-7b64db5b59-vlmjd   1/1     Running   0          30m

[openshift-ci-robot]

@smrtrfszm: This PR has been marked as verified by @smrtrfszm.

Details

In response to this:

/verified by @smrtrfszm

Before this change on a vanilla kubernetes, HCCO was in a crash loop with error message:

Error: failed to wait for resources caches to sync: timed out waiting for cache to be synced for Kind *v1.Route

After this change on a vanilla kubernetes, HCCO is 1/1 ready:

oc get pod -n master-cluster1 -l hypershift.openshift.io/control-plane-component=hosted-cluster-config-operator
NAME                                              READY   STATUS    RESTARTS   AGE
hosted-cluster-config-operator-7b64db5b59-vlmjd   1/1     Running   0          30m

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[hypershift-jira-solve-ci]

I now have all the information needed for a complete analysis. Here is the report:

Test Failure Analysis Complete

Job Information

• Prow Job: codecov/patch, codecov/project
• Build ID: N/A (Codecov check runs, not Prow CI jobs)
• PR: #8484 — OCPBUGS-86008: Gate Route watch on management cluster capability
• Repository: openshift/hypershift
• Head Commit: 1f4af14
• Base Commit: 36dfb1b

Test Failure Analysis

Error

codecov/patch: 0.00% of diff hit (target 40.40%)
codecov/project: 40.40% (-0.01%) compared to 36dfb1b

Summary

Both Codecov checks fail because the PR introduces 38 new executable lines across two files — cmd.go (34 lines) and resources.go (4 lines) — and none of these lines are covered by any unit test. The codecov/patch check reports 0% patch coverage against a 40.40% target, and codecov/project reports a -0.01% regression in overall project coverage. The third changed file (operator/config.go) is a struct definition with no executable code, so it does not affect coverage. These are not Prow CI failures; they are Codecov coverage-gate check runs that enforce minimum test coverage on new code.

Root Cause

The PR adds two blocks of untested executable code:

1. control-plane-operator/hostedclusterconfigoperator/cmd.go (34 missing lines): A new block in the Run() method (lines ~227–239) that creates a discovery.NewDiscoveryClientForConfig, calls capabilities.DetectManagementClusterCapabilities(), and passes the result into the HostedClusterConfigOperatorConfig struct. The entire cmd.go file already has 0% coverage (it is an operator entrypoint with no unit tests), so these new lines inherit that zero-coverage baseline. Additionally, the struct literal assignment block (lines ~320–345) was reformatted with a new field ManagementClusterCapabilities, adding 1 net new executable line there.

2. control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go (4 missing lines): The Setup() function now conditionally gates the Route watch behind opts.ManagementClusterCapabilities.Has(capabilities.CapabilityRoute). The 4 new lines (the if condition, the inner if err := c.Watch(...), the return fmt.Errorf(...), and the closing brace) are not covered by any existing test.

The capabilities package itself (support/capabilities/) is well-tested — management_cluster_capabilities_test.go thoroughly tests DetectManagementClusterCapabilities and Has(), and a MockCapabilityChecker is already provided. The gap is that no test exercises the consumers of these capabilities in cmd.go or resources.go.

The codecov/project failure is a consequence: 14 net new uncovered lines drop overall coverage from 40.40% to 40.39% (displayed as -0.01%), triggering the project-level gate.

Recommendations

1. Add a unit test for the Route-watch gating in resources.go: The Setup() function in resources.go should have a test that uses capabilities.MockCapabilityChecker to verify:

   • When CapabilityRoute is present → c.Watch for Routes is called.
   • When CapabilityRoute is absent → c.Watch for Routes is skipped.
     This would cover the 4 missing lines in resources.go and is the most impactful fix.

2. Accept that cmd.go has 0% coverage: The cmd.go file is an operator entrypoint (Run() method) that wires together real Kubernetes clients, controller-runtime managers, and cluster connections. It is inherently difficult to unit-test (the entire file is at 0% already). The 34 "missing" lines are mostly the reformatted struct literal plus the discovery client setup. Adding tests here would require extensive mocking of ctrl.GetConfigOrDie(), cluster.New(), etc., which provides low value.

3. If Codecov gates are blocking merge: Check if the repository has Codecov status checks set as required in branch protection. If they are informational (not required), these failures can be safely ignored for this PR. If required, adding the resources.go test from recommendation 1 should bring patch coverage above 0% and may satisfy the threshold.

4. Consider adding cmd.go to the Codecov ignore list in codecov.yml: Since the entire file is at 0% coverage and is an integration-level entrypoint, adding it to the ignore list (alongside other similar files already ignored) would prevent it from inflating patch coverage failures on future PRs.

Evidence

Evidence	Detail
codecov/patch result	0.00% of diff hit (target 40.40%) — 38 new lines, 0 covered
codecov/project result	40.40% (-0.01%) — 14 net new uncovered lines regress overall coverage
cmd.go baseline coverage	0.00% (unchanged, entire file has no tests)
resources.go baseline coverage	55.35% → dropped to 55.33% (-0.02%)
operator/config.go coverage	0.00% — struct-only file, no executable code, does not affect metrics
Lines missing in cmd.go	34 lines: discovery client creation, DetectManagementClusterCapabilities call, error handling, struct field assignment
Lines missing in resources.go	4 lines: if opts.ManagementClusterCapabilities.Has(...) conditional block gating Route watch
MockCapabilityChecker exists	support/capabilities/management_cluster_capabilities.go provides MockCapabilityChecker ready for use in tests
Existing test coverage for capabilities	management_cluster_capabilities_test.go has comprehensive tests for DetectManagementClusterCapabilities and Has()
Changed files	3 files changed: +67 lines, -46 lines (most deletions are whitespace reformatting for alignment)

---