OCPBUGS-99288: Add proxy env vars to AWS cloud-controller-manager deployment#9053
OCPBUGS-99288: Add proxy env vars to AWS cloud-controller-manager deployment#9053PoornimaSingour wants to merge 2 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/valid-reference
|
@PoornimaSingour: This pull request references Jira Issue OCPBUGS-99288, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughThe AWS cloud-controller-manager component now registers a deployment adapter. The adapter targets the cloud-controller-manager container and injects proxy environment variables using Suggested reviewers: 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
area/control-plane-operator
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: PoornimaSingour The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
89370dd to
747e029
Compare
openshift-ci-robot
added
jira/valid-bug
|
@PoornimaSingour: This pull request references Jira Issue OCPBUGS-99288, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@PoornimaSingour: This pull request references Jira Issue OCPBUGS-99288, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
OCPBUGS-99288 — Complete Summary ProblemAWS Cloud Controller Manager (CCM) deployment was missing HTTP_PROXY/HTTPS_PROXY/NO_PROXY environment variables when the management cluster uses a proxy. Other components (CCO, CAPA, konnectivity) already had this — CCM was the gap. Fix:
Verified on Cluster:
Testing Done
|
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #9053 +/- ##
==========================================
+ Coverage 44.50% 44.51% +0.01%
==========================================
Files 774 775 +1
Lines 96980 97003 +23
==========================================
+ Hits 43164 43184 +20
- Misses 50828 50831 +3
Partials 2988 2988
... and 2 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
…r deployment The CCM deployment was missing HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables when the management cluster is configured with a proxy. This was a regression from the v1 to v2 component framework migration where the proxy.SetEnvVars() call was not carried over.
747e029 to
ec5ae7a
Compare
jparrill
left a comment
jparrill
left a comment
There was a problem hiding this comment.
Dropped a comment, please let me know for tagging. Thanks
| httpsProxy string | ||
| noProxy string | ||
| validate func(*WithT, *corev1.Container) | ||
| }{ |
There was a problem hiding this comment.
The two test cases cover the main paths well. A couple of optional suggestions if you want to strengthen coverage:
-
Partial proxy: What happens when only
HTTP_PROXYis set butHTTPS_PROXYis empty?proxy.SetEnvVarshas a branch for this (if httpProxy != "" || httpsProxy != ""). -
Existing env vars preserved: The CCM manifest already defines
AWS_SHARED_CREDENTIALS_FILE,AWS_SDK_LOAD_CONFIG, andAWS_EC2_METADATA_DISABLED. Might be worth asserting those survive afteradaptDeploymentruns — the CCO tests do something similar.
Neither is blocking, the current coverage is reasonable for a bug fix.
…cases Add test coverage for partial proxy configurations (HTTP_PROXY-only and HTTPS_PROXY-only) and assert that existing AWS env vars are preserved after proxy injection, addressing review feedback. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/cloud_controller_manager/aws/deployment_test.go`:
- Around line 51-83: Update the proxy test cases using the noProxy fixture to
include a distinct user-supplied entry such as api.internal.example.com, and
extend their validate callbacks to assert that entry remains in the generated
NO_PROXY value alongside localhost, 127.0.0.1, and kube-apiserver. Ensure the
assertions cover preservation of custom bypass entries, not only adapter-added
defaults.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: c5376068-fb8a-496a-92c3-ca9d1efef780
📒 Files selected for processing (1)
control-plane-operator/controllers/hostedcontrolplane/v2/cloud_controller_manager/aws/deployment_test.go
| name: "When only HTTP_PROXY is set, it should add HTTP_PROXY and NO_PROXY but not HTTPS_PROXY", | ||
| httpProxy: "http://proxy.example.com:8080", | ||
| noProxy: "localhost,127.0.0.1", | ||
| validate: func(g *WithT, container *corev1.Container) { | ||
| httpProxy := podspec.FindEnvVar("HTTP_PROXY", container.Env) | ||
| g.Expect(httpProxy).ToNot(BeNil()) | ||
| g.Expect(httpProxy.Value).To(Equal("http://proxy.example.com:8080")) | ||
|
|
||
| g.Expect(podspec.FindEnvVar("HTTPS_PROXY", container.Env)).To(BeNil()) | ||
|
|
||
| noProxy := podspec.FindEnvVar("NO_PROXY", container.Env) | ||
| g.Expect(noProxy).ToNot(BeNil()) | ||
| g.Expect(noProxy.Value).To(ContainSubstring("localhost")) | ||
| g.Expect(noProxy.Value).To(ContainSubstring("127.0.0.1")) | ||
| g.Expect(noProxy.Value).To(ContainSubstring("kube-apiserver")) | ||
| }, | ||
| }, | ||
| { | ||
| name: "When only HTTPS_PROXY is set, it should add HTTPS_PROXY and NO_PROXY but not HTTP_PROXY", | ||
| httpsProxy: "https://proxy.example.com:8443", | ||
| noProxy: "localhost,127.0.0.1", | ||
| validate: func(g *WithT, container *corev1.Container) { | ||
| g.Expect(podspec.FindEnvVar("HTTP_PROXY", container.Env)).To(BeNil()) | ||
|
|
||
| httpsProxy := podspec.FindEnvVar("HTTPS_PROXY", container.Env) | ||
| g.Expect(httpsProxy).ToNot(BeNil()) | ||
| g.Expect(httpsProxy.Value).To(Equal("https://proxy.example.com:8443")) | ||
|
|
||
| noProxy := podspec.FindEnvVar("NO_PROXY", container.Env) | ||
| g.Expect(noProxy).ToNot(BeNil()) | ||
| g.Expect(noProxy.Value).To(ContainSubstring("localhost")) | ||
| g.Expect(noProxy.Value).To(ContainSubstring("127.0.0.1")) | ||
| g.Expect(noProxy.Value).To(ContainSubstring("kube-apiserver")) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Test preservation of a user-supplied NO_PROXY entry.
The current values only contain defaults (localhost and 127.0.0.1) that the adapter adds itself. A regression dropping a custom bypass could therefore pass. Add a distinct entry such as api.internal.example.com and assert it remains alongside the required defaults.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/cloud_controller_manager/aws/deployment_test.go`
around lines 51 - 83, Update the proxy test cases using the noProxy fixture to
include a distinct user-supplied entry such as api.internal.example.com, and
extend their validate callbacks to assert that entry remains in the generated
NO_PROXY value alongside localhost, 127.0.0.1, and kube-apiserver. Ensure the
assertions cover preservation of custom bypass entries, not only adapter-added
defaults.
|
@PoornimaSingour: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
What this PR does / why we need it:
The AWS Cloud Controller Manager (CCM) deployment was missing
HTTP_PROXY,HTTPS_PROXY, andNO_PROXYenvironment variables when the management cluster is configured with a proxy. This was a regression from the v1 to v2 component framework migration where theproxy.SetEnvVars()call was not carried over.This PR adds an
adaptDeploymentfunction that callsproxy.SetEnvVars()on the CCM container, following the same pattern used by other components (cloud-credential-operator, konnectivity, etc.).Which issue(s) this PR fixes:
Fixes: https://redhat.atlassian.net/browse/OCPBUGS-99288
Special notes for your reviewer:
proxy.SetEnvVars()reads fromos.Getenv("HTTP_PROXY")etc., which are inherited from the management cluster's proxy configuration. When no proxy is configured, the function is a no-op.Checklist:
Summary by CodeRabbit