Skip to content

OCPBUGS-78151: Add provisioningNetworkGateway field to CBO#575

Open
jadhaj wants to merge 5 commits intoopenshift:mainfrom
jadhaj:OCPBUGS-78151
Open

OCPBUGS-78151: Add provisioningNetworkGateway field to CBO#575
jadhaj wants to merge 5 commits intoopenshift:mainfrom
jadhaj:OCPBUGS-78151

Conversation

@jadhaj
Copy link
Copy Markdown

@jadhaj jadhaj commented Mar 15, 2026

No description provided.

@openshift-ci openshift-ci bot requested a review from dtantsur March 15, 2026 10:00
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 15, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jadhaj
Once this PR has been reviewed and has the lgtm label, please assign dtantsur for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot requested a review from zaneb March 15, 2026 10:00
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 15, 2026

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)
  • do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 64e6be16-6081-4e15-8c34-4fc9e85379ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Adds an optional ProvisioningNetworkGateway field to the Provisioning API and CRD, validates the gateway (must be inside CIDR, outside DHCP range, not network/broadcast, not equal to provisioning IP), surfaces it in deployment config, and exposes it to the metal3-dnsmasq container with tests updated.

Changes

Cohort / File(s) Summary
API types & validation
api/v1alpha1/provisioning_types.go, api/v1alpha1/provisioning_validation.go, api/v1alpha1/provisioning_validation_test.go
Adds ProvisioningNetworkGateway to ProvisioningSpec; extends validateProvisioningNetworkSettings signature and logic to validate gateway IP (CIDR containment, DHCP range exclusion, not network/broadcast, not equal to provisioning IP); adds isNetworkOrBroadcastAddress helper and tests covering gateway scenarios.
CRD schema
config/crd/bases/metal3.io_provisionings.yaml, manifests/0000_31_cluster-baremetal-operator_02_metal3provisioning.crd.yaml
Adds provisioningNetworkGateway field definition and descriptive constraints to the Provisioning CRD schemas.
Provisioning runtime & pod config
provisioning/baremetal_config.go, provisioning/baremetal_pod.go, provisioning/baremetal_pod_test.go, provisioning/baremetal_config_test.go
Introduces gateway handling in deployment config (getGatewayIP), adds GATEWAY_IP env var to metal3-dnsmasq container, and updates tests and test builders to cover propagation.
Docs
README.md
Adds documentation describing the ProvisioningNetworkGateway field, its intended use when network is Managed, and its constraints.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (2)
api/v1alpha1/provisioning_validation.go (1)

82-88: Add targeted tests for the new gateway validation paths.

api/v1alpha1/provisioning_validation_test.go:406-445 still only exercises empty-gateway configs, so these branches can regress silently. Please add cases for gateway outside CIDR, equal to ProvisioningIP, inside ProvisioningDHCPRange, and ProvisioningNetwork omitted so the default-Managed behavior stays covered.

Also applies to: 152-152, 186-201, 242-248

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@api/v1alpha1/provisioning_validation.go` around lines 82 - 88, Add focused
unit tests in provisioning_validation_test.go that exercise the new gateway
validation branches for validateProvisioningNetworkSettings and the surrounding
validation logic: create test cases where ProvisioningNetworkGateway is (1)
outside ProvisioningNetworkCIDR, (2) equal to ProvisioningIP, (3) falls inside
ProvisioningDHCPRange, and (4) omitted so getProvisioningNetworkMode() defaults
to Managed; for each case instantiate a prov object (using fields
ProvisioningIP, ProvisioningNetworkCIDR, ProvisioningDHCPRange,
ProvisioningNetworkGateway and method getProvisioningNetworkMode()) and assert
the expected validation error or success. Add similar cases to the other
described test ranges (around the earlier blocks at the mentioned offsets) to
ensure coverage for both Managed and Unmanaged control paths.
provisioning/baremetal_pod_test.go (1)

250-250: Add a positive-path assertion for GATEWAY_IP value propagation.

Line 250 validates the empty baseline, but this PR’s core behavior is non-empty gateway propagation. Add one ManagedSpec case with ProvisioningNetworkGateway set and assert GATEWAY_IP=<gateway>.

Example test addition
+{
+  name:   "ManagedSpec with provisioning gateway",
+  config: managedProvisioning().ProvisioningNetworkGateway("172.30.20.1").build(),
+  expectedContainers: []corev1.Container{
+    withEnv(containers["metal3-httpd"], sshkey),
+    withEnv(containers["metal3-ironic"], sshkey),
+    containers["metal3-ramdisk-logs"],
+    containers["metal3-static-ip-manager"],
+    withEnv(containers["metal3-dnsmasq"], envWithValue("GATEWAY_IP", "172.30.20.1")),
+  },
+  sshkey: "sshkey",
+},

As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@provisioning/baremetal_pod_test.go` at line 250, Add a positive-path test
case that verifies non-empty gateway propagation: in the test table inside
provisioning/baremetal_pod_test.go add a ManagedSpec entry with
ProvisioningNetworkGateway set (e.g., "192.0.2.1") and assert that the resulting
env var list contains an entry with Name "GATEWAY_IP" and Value equal to that
gateway string; update the test that currently only checks {Name: "GATEWAY_IP",
Value: ""} to include this new case and its expected value so the provisioning
logic that reads ManagedSpec.ProvisioningNetworkGateway is validated.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@provisioning/baremetal_config.go`:
- Around line 128-134: getGatewayIP currently only returns the gateway when
spec.provisioningNetwork is explicitly set to ProvisioningNetworkManaged; change
the condition in getGatewayIP to treat an empty string as the implicit Managed
default (e.g. if config.ProvisioningNetwork ==
metal3iov1alpha1.ProvisioningNetworkManaged || config.ProvisioningNetwork == ""
then return &config.ProvisioningNetworkGateway) and make the same change to the
other helper that checks spec.provisioningNetwork (the similar check at lines
152-153) so CRs relying on the default Managed mode export GATEWAY_IP.

In `@provisioning/baremetal_pod.go`:
- Line 458: The test for UnmanagedSpec must be updated to expect that
buildEnvVar(gatewayIP, config) yields an EnvVar with only Name set (zero-value
Value) rather than relying on the base container's Value:""; update the
UnmanagedSpec test assertions to explicitly check that an EnvVar named
"GATEWAY_IP" is present and that its Value is the empty string/zero-value (or
nil-equivalent) as returned by buildEnvVar, or alternatively change the code
path in buildEnvVar/gatewayIP handling to omit GATEWAY_IP for unmanaged flows
and adjust the tests accordingly; reference buildEnvVar and the UnmanagedSpec
test case to locate where to change the expectation.

---

Nitpick comments:
In `@api/v1alpha1/provisioning_validation.go`:
- Around line 82-88: Add focused unit tests in provisioning_validation_test.go
that exercise the new gateway validation branches for
validateProvisioningNetworkSettings and the surrounding validation logic: create
test cases where ProvisioningNetworkGateway is (1) outside
ProvisioningNetworkCIDR, (2) equal to ProvisioningIP, (3) falls inside
ProvisioningDHCPRange, and (4) omitted so getProvisioningNetworkMode() defaults
to Managed; for each case instantiate a prov object (using fields
ProvisioningIP, ProvisioningNetworkCIDR, ProvisioningDHCPRange,
ProvisioningNetworkGateway and method getProvisioningNetworkMode()) and assert
the expected validation error or success. Add similar cases to the other
described test ranges (around the earlier blocks at the mentioned offsets) to
ensure coverage for both Managed and Unmanaged control paths.

In `@provisioning/baremetal_pod_test.go`:
- Line 250: Add a positive-path test case that verifies non-empty gateway
propagation: in the test table inside provisioning/baremetal_pod_test.go add a
ManagedSpec entry with ProvisioningNetworkGateway set (e.g., "192.0.2.1") and
assert that the resulting env var list contains an entry with Name "GATEWAY_IP"
and Value equal to that gateway string; update the test that currently only
checks {Name: "GATEWAY_IP", Value: ""} to include this new case and its expected
value so the provisioning logic that reads
ManagedSpec.ProvisioningNetworkGateway is validated.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 935de458-c818-4195-9dc6-23a9f6c85b03

📥 Commits

Reviewing files that changed from the base of the PR and between aff20f1 and ac7cfd8.

📒 Files selected for processing (10)
  • README.md
  • api/v1alpha1/provisioning_types.go
  • api/v1alpha1/provisioning_validation.go
  • config/crd/bases/metal3.io_provisionings.yaml
  • manifests/0000_31_cluster-baremetal-operator_02_metal3provisioning.crd.yaml
  • provisioning/baremetal_config.go
  • provisioning/baremetal_pod.go
  • provisioning/baremetal_pod_test.go
  • provisioning/image_cache.go
  • provisioning/image_customization.go

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (1)
provisioning/baremetal_config.go (1)

128-133: ⚠️ Potential issue | 🟠 Major

Honor the implicit Managed default when exporting GATEWAY_IP.

ValidateBaremetalProvisioningConfig() treats an empty spec.provisioningNetwork as Managed unless provisioningDHCPExternal flips it to Unmanaged. This helper only accepts an explicit Managed, so defaulted CRs validate successfully but never get GATEWAY_IP in the pod env.

Possible fix
 func getGatewayIP(config *metal3iov1alpha1.ProvisioningSpec) *string {
-	if config.ProvisioningNetwork == metal3iov1alpha1.ProvisioningNetworkManaged &&
-		config.ProvisioningNetworkGateway != "" {
+	managed := config.ProvisioningNetwork == metal3iov1alpha1.ProvisioningNetworkManaged ||
+		(config.ProvisioningNetwork == "" && !config.ProvisioningDHCPExternal)
+	if managed && config.ProvisioningNetworkGateway != "" {
 		return &config.ProvisioningNetworkGateway
 	}
 	return nil
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@provisioning/baremetal_config.go` around lines 128 - 133, getGatewayIP
currently only returns the gateway when spec.ProvisioningNetwork ==
ProvisioningNetworkManaged, but ValidateBaremetalProvisioningConfig treats an
empty ProvisioningNetwork as Managed (unless ProvisioningDHCPExternal flips it),
so defaulted CRs miss GATEWAY_IP; update getGatewayIP to treat an empty
ProvisioningNetwork as Managed when ProvisioningDHCPExternal is
false/unspecified (i.e., treat "" the same as ProvisioningNetworkManaged unless
ProvisioningDHCPExternal indicates Unmanaged), and still return
&config.ProvisioningNetworkGateway when ProvisioningNetworkGateway != "" so
exported env includes GATEWAY_IP for defaulted CRs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@api/v1alpha1/provisioning_validation.go`:
- Around line 186-201: The gateway validation must reject the subnet network and
broadcast addresses for IPv4 so they aren't used as provisioningNetworkGateway;
after parsing gateway (variable gateway) and confirming provisioningCIDR
contains it, detect IPv4 (gateway.To4() != nil), get the prefix length from
provisioningCIDR.Mask.Size(), and if the prefix length is <= 30 (i.e. there are
usable host addresses) compute the network address (provisioningCIDR.IP masked)
and the broadcast address (network | ^mask) and append errors if gateway equals
either the network or the broadcast address; keep the existing check that
gateway != provisioningIP (provisioningIP) intact.

---

Duplicate comments:
In `@provisioning/baremetal_config.go`:
- Around line 128-133: getGatewayIP currently only returns the gateway when
spec.ProvisioningNetwork == ProvisioningNetworkManaged, but
ValidateBaremetalProvisioningConfig treats an empty ProvisioningNetwork as
Managed (unless ProvisioningDHCPExternal flips it), so defaulted CRs miss
GATEWAY_IP; update getGatewayIP to treat an empty ProvisioningNetwork as Managed
when ProvisioningDHCPExternal is false/unspecified (i.e., treat "" the same as
ProvisioningNetworkManaged unless ProvisioningDHCPExternal indicates Unmanaged),
and still return &config.ProvisioningNetworkGateway when
ProvisioningNetworkGateway != "" so exported env includes GATEWAY_IP for
defaulted CRs.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 758c0796-a847-4b26-bf1b-910af2f894db

📥 Commits

Reviewing files that changed from the base of the PR and between ac7cfd8 and d738cd0.

📒 Files selected for processing (8)
  • README.md
  • api/v1alpha1/provisioning_types.go
  • api/v1alpha1/provisioning_validation.go
  • config/crd/bases/metal3.io_provisionings.yaml
  • manifests/0000_31_cluster-baremetal-operator_02_metal3provisioning.crd.yaml
  • provisioning/baremetal_config.go
  • provisioning/baremetal_pod.go
  • provisioning/baremetal_pod_test.go
🚧 Files skipped from review as they are similar to previous changes (4)
  • api/v1alpha1/provisioning_types.go
  • config/crd/bases/metal3.io_provisionings.yaml
  • provisioning/baremetal_pod_test.go
  • provisioning/baremetal_pod.go

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
api/v1alpha1/provisioning_validation.go (1)

217-236: Parse gatewayIP once and reuse it in both validation blocks.

Line 219 and Line 279 parse the same value independently. Reusing a single parsed gateway variable keeps validation behavior consistent and reduces maintenance risk.

♻️ Proposed refactor
 func validateProvisioningNetworkSettings(ip string, cidr string, dhcpRange string, gatewayIP string, provisioningNetworkMode ProvisioningNetwork) []error {
@@
-	// Validate gateway IP if provided
+	var gateway net.IP
+	// Validate gateway IP if provided
 	if gatewayIP != "" {
-		gateway := net.ParseIP(gatewayIP)
+		gateway = net.ParseIP(gatewayIP)
 		if gateway == nil {
 			errs = append(errs, fmt.Errorf("could not parse provisioningNetworkGateway %q", gatewayIP))
 			return errs
@@
 	if start != nil && end != nil {
@@
 		// Ensure gateway IP is not in the DHCP range if provided
-		if gatewayIP != "" {
-			gateway := net.ParseIP(gatewayIP)
-			if gateway != nil && bytes.Compare(gateway, start) >= 0 && bytes.Compare(gateway, end) <= 0 {
-				errs = append(errs, fmt.Errorf("invalid provisioningNetworkGateway %q, value must be outside of the provisioningDHCPRange %q", gatewayIP, dhcpRange))
-			}
+		if gateway != nil && bytes.Compare(gateway, start) >= 0 && bytes.Compare(gateway, end) <= 0 {
+			errs = append(errs, fmt.Errorf("invalid provisioningNetworkGateway %q, value must be outside of the provisioningDHCPRange %q", gatewayIP, dhcpRange))
 		}
 	}

As per coding guidelines, "-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

Also applies to: 277-283

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@api/v1alpha1/provisioning_validation.go` around lines 217 - 236, The gateway
IP (gatewayIP) is parsed twice; parse it once into a single variable (e.g.,
gateway := net.ParseIP(gatewayIP)) before the gateway validation blocks and
reuse that parsed "gateway" in both validation sections (the block that checks
Contains, Equal against provisioningIP, and isNetworkOrBroadcastAddress and the
later block around lines 277-283) to ensure consistent behavior; keep the same
nil-check (append error and return errs) after parsing and remove the duplicate
net.ParseIP call in the later validation so all checks reference the same parsed
gateway value.
provisioning/baremetal_config_test.go (1)

218-221: Add direct getMetal3DeploymentConfig(gatewayIP, ...) table coverage.

The new builder setter is useful, but this file still lacks an explicit table case for the gatewayIP config path (managed/default-managed vs unmanaged/disabled), which would protect this new behavior from regressions.

As per coding guidelines, "-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@provisioning/baremetal_config_test.go` around lines 218 - 221, Add a
table-driven test case exercising getMetal3DeploymentConfig for the gatewayIP
path: add rows covering managed/default-managed and unmanaged/disabled scenarios
and use the provisioningBuilder.ProvisioningNetworkGateway(...) setter to set
the input gateway value for each row; assert the produced config (from
getMetal3DeploymentConfig(...)) contains or omits the gatewayIP as expected and
include expected output checks in the table entry to prevent regressions of the
new ProvisioningNetworkGateway behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@api/v1alpha1/provisioning_validation.go`:
- Around line 217-236: The gateway IP (gatewayIP) is parsed twice; parse it once
into a single variable (e.g., gateway := net.ParseIP(gatewayIP)) before the
gateway validation blocks and reuse that parsed "gateway" in both validation
sections (the block that checks Contains, Equal against provisioningIP, and
isNetworkOrBroadcastAddress and the later block around lines 277-283) to ensure
consistent behavior; keep the same nil-check (append error and return errs)
after parsing and remove the duplicate net.ParseIP call in the later validation
so all checks reference the same parsed gateway value.

In `@provisioning/baremetal_config_test.go`:
- Around line 218-221: Add a table-driven test case exercising
getMetal3DeploymentConfig for the gatewayIP path: add rows covering
managed/default-managed and unmanaged/disabled scenarios and use the
provisioningBuilder.ProvisioningNetworkGateway(...) setter to set the input
gateway value for each row; assert the produced config (from
getMetal3DeploymentConfig(...)) contains or omits the gatewayIP as expected and
include expected output checks in the table entry to prevent regressions of the
new ProvisioningNetworkGateway behavior.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5bd28d92-51e2-4bd3-88b6-dae4cb9c7995

📥 Commits

Reviewing files that changed from the base of the PR and between d738cd0 and 025c937.

📒 Files selected for processing (9)
  • README.md
  • api/v1alpha1/provisioning_types.go
  • api/v1alpha1/provisioning_validation.go
  • config/crd/bases/metal3.io_provisionings.yaml
  • manifests/0000_31_cluster-baremetal-operator_02_metal3provisioning.crd.yaml
  • provisioning/baremetal_config.go
  • provisioning/baremetal_config_test.go
  • provisioning/baremetal_pod.go
  • provisioning/baremetal_pod_test.go
🚧 Files skipped from review as they are similar to previous changes (3)
  • provisioning/baremetal_pod.go
  • provisioning/baremetal_pod_test.go
  • api/v1alpha1/provisioning_types.go

@jadhaj jadhaj changed the title Add provisioningNetworkGateway field to CBO OCPBUGS-78151: Add provisioningNetworkGateway field to CBO Mar 16, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@jadhaj: An error was encountered searching for bug OCPBUGS-78151 on the Jira server at https://issues.redhat.com. No known errors were detected, please see the full error message for details.

Full error message. request failed. Please analyze the request body for more details. Status code: 403:

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 16, 2026

/jira refresh

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@jadhaj: Jira Issue OCPBUGS-78151 is in a security level that is not in the allowed security levels for this repo.
Allowed security levels for this repo are:

  • Red Hat Employee
  • Red Hat Partner
  • default
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 16, 2026

/refresh

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 16, 2026

/jira refresh

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@jadhaj: Jira Issue OCPBUGS-78151 is in a security level that is not in the allowed security levels for this repo.
Allowed security levels for this repo are:

  • Red Hat Employee
  • Red Hat Partner
  • default
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 16, 2026

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Mar 16, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@jadhaj: This pull request references Jira Issue OCPBUGS-78151, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jadhaj

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 16, 2026

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: jadhaj.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@jadhaj: This pull request references Jira Issue OCPBUGS-78151, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jadhaj

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
api/v1alpha1/provisioning_validation_test.go (1)

196-210: /31 and /32 cases don’t isolate the intended gateway behavior.

These two cases keep the default ProvisioningIP (172.30.20.3), which is outside the configured /31 and /32 CIDRs. The tests can therefore pass without actually proving the “usable host address” edge-case behavior for gateway values.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@api/v1alpha1/provisioning_validation_test.go` around lines 196 - 210, The two
test cases ("ValidManagedGatewayOn31Network" and
"ValidManagedGatewayOn32Network") still use the default ProvisioningIP
(172.30.20.3) which lies outside the /31 and /32 CIDRs, so they don't exercise
the gateway-in-CIDR edge case; update each spec built via managedProvisioning()
to set a ProvisioningIP inside the configured CIDR using ProvisioningIP(...)
(e.g., for the /31 case use an IP like 172.30.20.1 that falls within
172.30.20.0/31 and for the /32 case use the same host IP 172.30.20.1 for
172.30.20.1/32) so the test actually validates the “usable host address”
behavior for ProvisioningNetworkGateway/ProvisioningIP.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@api/v1alpha1/provisioning_validation.go`:
- Around line 102-131: The isNetworkOrBroadcastAddress function incorrectly
treats IPv6 addresses as network addresses because the IPv6 early-return (bits
== 128) happens after the network-address check; update the function so the IPv6
short-circuit runs before any network/broadcast comparisons (i.e., check if bits
== 128 and return false prior to computing networkAddr and comparing
ip.Equal(cidr.IP.Mask(cidr.Mask))). This preserves the IPv4-focused behavior
while ensuring an IPv6 gateway equal to cidr.IP is not rejected.

---

Nitpick comments:
In `@api/v1alpha1/provisioning_validation_test.go`:
- Around line 196-210: The two test cases ("ValidManagedGatewayOn31Network" and
"ValidManagedGatewayOn32Network") still use the default ProvisioningIP
(172.30.20.3) which lies outside the /31 and /32 CIDRs, so they don't exercise
the gateway-in-CIDR edge case; update each spec built via managedProvisioning()
to set a ProvisioningIP inside the configured CIDR using ProvisioningIP(...)
(e.g., for the /31 case use an IP like 172.30.20.1 that falls within
172.30.20.0/31 and for the /32 case use the same host IP 172.30.20.1 for
172.30.20.1/32) so the test actually validates the “usable host address”
behavior for ProvisioningNetworkGateway/ProvisioningIP.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee156305-3d3c-4372-a505-330d88b9cebe

📥 Commits

Reviewing files that changed from the base of the PR and between 025c937 and 3b6df3b.

📒 Files selected for processing (10)
  • README.md
  • api/v1alpha1/provisioning_types.go
  • api/v1alpha1/provisioning_validation.go
  • api/v1alpha1/provisioning_validation_test.go
  • config/crd/bases/metal3.io_provisionings.yaml
  • manifests/0000_31_cluster-baremetal-operator_02_metal3provisioning.crd.yaml
  • provisioning/baremetal_config.go
  • provisioning/baremetal_config_test.go
  • provisioning/baremetal_pod.go
  • provisioning/baremetal_pod_test.go
🚧 Files skipped from review as they are similar to previous changes (4)
  • provisioning/baremetal_config_test.go
  • manifests/0000_31_cluster-baremetal-operator_02_metal3provisioning.crd.yaml
  • provisioning/baremetal_config.go
  • provisioning/baremetal_pod.go

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 19, 2026

/retest-required

@MahnoorAsghar
Copy link
Copy Markdown
Contributor

LGTM aside from the nits

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 30, 2026

/verified by @jadhaj

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 30, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@jadhaj: This PR has been marked as verified by @jadhaj.

Details

In response to this:

/verified by @jadhaj

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Mar 30, 2026
@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 30, 2026

/test unit

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 30, 2026

@jadhaj: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 31, 2026

@dtantsur review comments addressed (hopefully) and all test passed

@jadhaj
Copy link
Copy Markdown
Author

jadhaj commented Mar 31, 2026

/verified by @jadhaj

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 31, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@jadhaj: This PR has been marked as verified by @jadhaj.

Details

In response to this:

/verified by @jadhaj

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants