OCPBUGS-34950: Fix OpenStack infrastructure bootstrap issues

[eshulman2]

This commit addresses two related issues in OpenStack IPI installations:

1. Bootstrap security group for SSH access to enable log collection
2. Proper cleanup of installer-created bootstrap resources

Problem 1: Bootstrap Log Collection

Bootstrap machine logs cannot be collected when installation fails because
the bootstrap VM uses the master security group, which doesn't allow SSH
access from the installation source address. This prevents gathering
diagnostic information needed to troubleshoot failed installations.

Problem 2: Orphaned Bootstrap Resources

During investigation of bootstrap resource lifecycle, discovered that CAPO
deletes floating IPs instead of disassociating them when removing control
plane machines. This contradicts the maintainer's design intent (see comment
at openstackmachine_controller.go:291) and causes issues for installer-managed
floating IPs.

Solution

1. Bootstrap Security Group

• Created dedicated bootstrap security group with SSH access from anywhere
• Tagged with openshiftRole=bootstrap for lifecycle management
• Enables SSH access to bootstrap VM for log collection on failure

2. PostDestroyer Implementation

• Implemented PostDestroyer interface for OpenStack provider
• Runs after CAPO deletes bootstrap machine, ensuring resources are detached
• Cleans up bootstrap floating IP (disassociated by CAPO)
• Cleans up bootstrap security group (no longer attached to deleted VM)
• Uses tag-based identification: both resources tagged with
  openshiftClusterID={infraID} AND openshiftRole=bootstrap

[stephenfin]

/assign @stephenfin

Looks like there are some linter issues to address here?

[eshulman2]

/retest

[eshulman2]

/retest

[stephenfin]

This looks great. I have left a lot of comments but most of them are nits: feel free to ignore if you disagree. I think the main meaningful changes are the use of net/http consts and handling deletion of FIPs/SGs when there are more than one and you get errors.

[stephenfin]

/retitle OCPBUGS-34950: Fix OpenStack infrastructure bootstrap issues

[openshift-ci-robot]

@eshulman2: This pull request references Jira Issue OCPBUGS-34950, which is invalid:

• expected the bug to target the "4.21.0" version, but no target version was set
• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This commit addresses two related issues in OpenStack IPI installations:

1. Bootstrap security group for SSH access to enable log collection
2. Proper cleanup of installer-created bootstrap resources

Problem 1: Bootstrap Log Collection

Bootstrap machine logs cannot be collected when installation fails because
the bootstrap VM uses the master security group, which doesn't allow SSH
access from the installation source address. This prevents gathering
diagnostic information needed to troubleshoot failed installations.

Problem 2: Orphaned Bootstrap Resources

During investigation of bootstrap resource lifecycle, discovered that CAPO
deletes floating IPs instead of disassociating them when removing control
plane machines. This contradicts the maintainer's design intent (see comment
at openstackmachine_controller.go:291) and causes issues for installer-managed
floating IPs.

Solution

1. Bootstrap Security Group

• Created dedicated bootstrap security group with SSH access from anywhere
• Tagged with openshiftRole=bootstrap for lifecycle management
• Enables SSH access to bootstrap VM for log collection on failure

2. PostDestroyer Implementation

• Implemented PostDestroyer interface for OpenStack provider
• Runs after CAPO deletes bootstrap machine, ensuring resources are detached
• Cleans up bootstrap floating IP (disassociated by CAPO)
• Cleans up bootstrap security group (no longer attached to deleted VM)
• Uses tag-based identification: both resources tagged with
  openshiftClusterID={infraID} AND openshiftRole=bootstrap

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eshulman2]

I believe I addressed all concerns and comments and also improved the error handling and logging :)

[eshulman2]

/jira refresh

[openshift-ci-robot]

@eshulman2: This pull request references Jira Issue OCPBUGS-34950, which is invalid:

• expected the bug to target the "4.21.0" version, but no target version was set
• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eshulman2]

/jira refresh

[openshift-ci-robot]

@eshulman2: This pull request references Jira Issue OCPBUGS-34950, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.0) matches configured target version for branch (4.21.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eshulman2]

/retest

[stephenfin]

/approve
/lgtm
/hold in case @mandre wants to come back around to this

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stephenfin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/asset/machines/openstack/OWNERS [stephenfin]
• pkg/infrastructure/openstack/OWNERS [stephenfin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mandre]

/lgtm
/label acknowledge-critical-fixes-only
/verified by CI
/hold cancel

[mandre]

/verified remove

[mandre]

/verified later

[openshift-ci-robot]

@mandre: This PR does not have verified or verified-later labels.

In response to this:

/verified remove

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@mandre: /verified later <@username> requires at least one GitHub @username to be specified (it can be a comma delimited list). It indicates the engineer(s) that will be performing the verification. See https://docs.ci.openshift.org/docs/architecture/jira/#premerge-verification for more information.

In response to this:

/verified later

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[mandre]

/verified later @imatza-rh

[openshift-ci-robot]

@mandre: This PR has been marked to be verified later by @imatza-rh.

In response to this:

/verified later @imatza-rh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@eshulman2: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@eshulman2: Jira Issue OCPBUGS-34950: All pull requests linked via external trackers have merged:

• openshift/installer#10148

This pull request has the verified-later tag and will need to be manually moved to VERIFIED after testing. Jira Issue OCPBUGS-34950 has been moved to the MODIFIED state.

In response to this:

This commit addresses two related issues in OpenStack IPI installations:

1. Bootstrap security group for SSH access to enable log collection
2. Proper cleanup of installer-created bootstrap resources

Problem 1: Bootstrap Log Collection

Bootstrap machine logs cannot be collected when installation fails because
the bootstrap VM uses the master security group, which doesn't allow SSH
access from the installation source address. This prevents gathering
diagnostic information needed to troubleshoot failed installations.

Problem 2: Orphaned Bootstrap Resources

During investigation of bootstrap resource lifecycle, discovered that CAPO
deletes floating IPs instead of disassociating them when removing control
plane machines. This contradicts the maintainer's design intent (see comment
at openstackmachine_controller.go:291) and causes issues for installer-managed
floating IPs.

Solution

1. Bootstrap Security Group

• Created dedicated bootstrap security group with SSH access from anywhere
• Tagged with openshiftRole=bootstrap for lifecycle management
• Enables SSH access to bootstrap VM for log collection on failure

2. PostDestroyer Implementation

• Implemented PostDestroyer interface for OpenStack provider
• Runs after CAPO deletes bootstrap machine, ensuring resources are detached
• Cleans up bootstrap floating IP (disassociated by CAPO)
• Cleans up bootstrap security group (no longer attached to deleted VM)
• Uses tag-based identification: both resources tagged with
  openshiftClusterID={infraID} AND openshiftRole=bootstrap

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.