CORENET-6861: Promote EVPN Feature Gate

[tssurya]

We are targeting to promote this feature in 4.22.0 post FF
So this PR will need a backport into 4.22.0 once it merges into master
This feature is only applicable to Baremetal Environments and not supported on clouds

We are getting our ducks in line for testing.

cc @jcaamano

[openshift-ci-robot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @tssurya! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[openshift-ci-robot]

@tssurya: This pull request references CORENET-6861 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: ffcbfc1b-0784-4d32-b434-b03f5ade70cd

📥 Commits

Reviewing files that changed from the base of the PR and between 5deac7b and 51fe56c.

📒 Files selected for processing (6)

• features.md
• features/features.go
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

✅ Files skipped from review due to trivial changes (3)

• features.md
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
• features/features.go

---

📝 Walkthrough

Walkthrough

FeatureGateEVPN was broadened in features/features.go to enable in inDefault() and inOKD() in addition to existing preview contexts. Corresponding payload manifests (payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml, featureGate-4-10-Hypershift-OKD.yaml, featureGate-4-10-SelfManagedHA-Default.yaml, featureGate-4-10-SelfManagedHA-OKD.yaml) were updated to move EVPN from disabled to enabled. In features.md the EVPN table row was relocated without changing its platform statuses.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.11.4)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[qodo-code-review]

Review Summary by Qodo

Promote EVPN feature gate to General Availability

✨ Enhancement

Walkthroughs

Description

• Promote EVPN feature gate from Tech Preview to General Availability
• Enable EVPN in default and OKD deployment profiles
• Move EVPN from preview-only to GA-enabled feature gates
• Fix indentation formatting in ConfidentialCluster feature gate definition

Diagram

flowchart LR
  A["EVPN Feature Gate"] -->|Enable in| B["Default Profile"]
  A -->|Enable in| C["OKD Profile"]
  A -->|Move from| D["Tech Preview Only"]
  B --> E["GA Status"]
  C --> E

Loading

File Changes

1. features/features.go ✨ Enhancement +8/-8

Enable EVPN in default and OKD profiles

• Updated FeatureGateEVPN enable configuration to include inDefault() and inOKD() in addition
 to preview modes
• Fixed indentation of FeatureGateConfidentialCluster definition from spaces to tabs for
 consistency

features/features.go

---

2. features.md 📝 Documentation +1/-1

Move EVPN to GA section in feature matrix

• Removed EVPN from the Tech Preview/Dev Preview section of the feature matrix
• Added EVPN to the GA (General Availability) section with all deployment profiles enabled

features.md

---

3. openapi/openapi.json ✨ Enhancement +245/-1

Add stable v1 Pacemaker cluster API definitions

• Added new com.github.openshift.api.etcd.v1.PacemakerCluster and related type definitions for
 stable v1 API
• Includes PacemakerClusterStatus, PacemakerClusterNodeStatus, PacemakerClusterResourceStatus,
 PacemakerClusterFencingAgentStatus, and PacemakerNodeAddress types
• Updated description for fencingAgents field in v1alpha1 to clarify behavior when discovery fails

openapi/openapi.json

---

View more (4)

4. payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml ⚙️ Configuration changes +3/-3

Move EVPN to default feature gates

• Removed EVPN from the TechPreviewNoUpgrade feature gate list
• Added EVPN to the Default feature gate list for GA enablement

payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

---

5. payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml ⚙️ Configuration changes +3/-3

Move EVPN to OKD default feature gates

• Removed EVPN from the TechPreviewNoUpgrade feature gate list
• Added EVPN to the Default feature gate list for OKD profile

payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

---

6. payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml ⚙️ Configuration changes +3/-3

Move EVPN to default feature gates

• Removed EVPN from the TechPreviewNoUpgrade feature gate list
• Added EVPN to the Default feature gate list for GA enablement

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

---

7. payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml ⚙️ Configuration changes +3/-3

Move EVPN to OKD default feature gates

• Removed EVPN from the TechPreviewNoUpgrade feature gate list
• Added EVPN to the Default feature gate list for OKD profile

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

ⓘ The new review experience is currently in Beta. Learn more

[openshift-ci-robot]

@tssurya: This pull request references CORENET-6861 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

We are targeting to promote this feature in 4.22.0 post FF this friday.
So this PR will need a backport into 4.22.0 once it merges into master
ETA: next week
We are getting our ducks in line for testing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@tssurya: This pull request references CORENET-6861 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

We are targeting to promote this feature in 4.22.0 post FF this friday.
So this PR will need a backport into 4.22.0 once it merges into master
ETA: next week
We are getting our ducks in line for testing.

cc @jcaamano

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tssurya]

/test verify-feature-promotion

[openshift-ci-robot]

@tssurya: This pull request references CORENET-6861 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

We are targeting to promote this feature in 4.22.0 post FF
So this PR will need a backport into 4.22.0 once it merges into master
This feature is only applicable to Baremetal Environments and not supported on clouds

We are getting our ducks in line for testing.

cc @jcaamano

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tssurya]

@JoelSpeed we have added tests for this feature, its here: https://sippy-auth.dptools.openshift.org/sippy-ng/tests/5.0/details?filters=%7B%22items%22%3A%5B%7B%22columnField%22%3A%22name%22%2C%22operatorValue%22%3A%22contains%22%2C%22value%22%3A%22FeatureGate%3AEVPN%5D%22%7D%5D%7D

however I still don't see the verify lane picking it up for the dual amd64 metal lanes.. any idea why?
error: only 0 tests found, need at least 5 for "EVPN" on {metal amd64 ha dual false} https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_api/2799/pull-ci-openshift-api-master-verify-feature-promotion/2047219529628520448

[JoelSpeed]

Your tests appear to be on the private sippy instance? Any idea why they are appearing there, vs the public instance? Is the test repository private?

[tssurya]

Your tests appear to be on the private sippy instance?

hmm how did you figure this out? :D what's the difference?

Any idea why they are appearing there, vs the public instance? Is the test repository private?

no tests are not in private - its running via OTE from https://github.com/openshift/ovn-kubernetes/blob/master/openshift/test/tests.go
and actual tests live https://github.com/openshift/ovn-kubernetes/blob/master/test/e2e/route_advertisements.go

but this is the first time we are using OTE framework - so maybe we are missing something ?

https://github.com/openshift/origin/pull/30560/changes#diff-40254fcde6cd9b1e826a5afcf2aa4edfca9bee78072abbb2528a512be5afe731R329 is the integration of the binary

[JoelSpeed]

/test verify-feature-promotion

[JoelSpeed]

@tssurya sippy.dptools vs sippy-auth.dptools struck me

Also, if you look at the tests, it appears to say jobTier: hidden. I suspect that is why. Any idea why those are hidden?

[tssurya]

@tssurya sippy.dptools vs sippy-auth.dptools struck me

Also, if you look at the tests, it appears to say jobTier: hidden. I suspect that is why. Any idea why those are hidden?

oh good point... let me dig into this

[tssurya]

@JoelSpeed I think we need to do something similar to https://github.com/openshift/sippy/pull/3188/changes to make the job / test to standard list (https://redhat-internal.slack.com/archives/C01CQA76KMX/p1767705656907569)

I'll send a PR there to see if that fixes things

[tssurya]

/test verify-feature-promotion

[tssurya]

/test verify-feature-promotion

[jcaamano]

/test verify-feature-promotion

[tssurya]

/test verify-feature-promotion

[qodo-code-review]

PR-Agent: could not find a component named verify-feature-promotion in a supported language in this PR.

[tssurya]

/test verify-feature-promotion

[qodo-code-review]

PR-Agent: could not find a component named verify-feature-promotion in a supported language in this PR.

[tssurya]

@JoelSpeed : I think we are ready here.. the error: only 0 tests found, need at least 5 for "EVPN" on {metal amd64 ha dual false} is gone, on metal/dualstack we seem to be passing the required runs.
The feature isn't supported on other platforms except metal. In metal the reason we don't have in IPV6 singlestack is because there is a feature limitation - this will be documented as unsupported. IPV4 singlestack is supported - but we didn't do BGP jobs there to avoid job overbloat. Our QE will ensure tests are run on singlestack as well cc @jechen0648 please add your verified label post testing our 3 manual high priority tests plus running our tests on a singlestack metal v4 env (since CI only covers dualstack for now).

[jcaamano]

@jechen0648 please add your verified label post testing our 3 manual high priority tests plus running our tests on a singlestack metal v4 env (since CI only covers dualstack for now).

For reference, the considerations platform and networks stack are the same we already had for RouteAdvertisements, feature we are building on top of:

This feature is only applicable to the metal platform and is only being tested on dual stack due to limitations in CI capacity (though there are single stack specific tests).

[JoelSpeed]

The linked OCPSTRAT-3185 is currently release blocker proposed, not approved. I know we are trying to be cautious about what we do and don't include in 5.0 at the moment.

Could we try and bring this up at the prio calls and check with the BU that we are keen to promote this in 5 vs waiting til 5.1?

[JoelSpeed]

Our QE will ensure tests are run on singlestack as well

The preference now would be to run E2Es reporting into component readiness, else we have no visibility into regressions. I understand the BGP jobs don't exist yet, what would it take/what would the cost be to add those?

[pperiyasamy]

/verified by ci

[openshift-ci-robot]

@pperiyasamy: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[pperiyasamy]

EVPN tests are running fine for v4 cluster as well, verified it via https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/78801/rehearse-78801-pull-ci-openshift-ovn-kubernetes-release-5.0-e2e-metal-ipi-ovn-ipv4-bgp-local-gw-techpreview/2051569726286467072.

[tssurya]

Our QE will ensure tests are run on singlestack as well

The preference now would be to run E2Es reporting into component readiness, else we have no visibility into regressions. I understand the BGP jobs don't exist yet, what would it take/what would the cost be to add those?

From feature standpoint dualstack lanes are already testing v4 and v6 - so its a superset of just v4.

[tssurya]

The linked OCPSTRAT-3185 is currently release blocker proposed, not approved. I know we are trying to be cautious about what we do and don't include in 5.0 at the moment.

Could we try and bring this up at the prio calls and check with the BU that we are keen to promote this in 5 vs waiting til 5.1?

We have submitted the SBAR for removing feature gate in 4.22, so 5.0 needs to land first and asap (I have cc-ed you on the email), I understand the paper trail needs to be blocker, but for EVPN, we have BU blessing, the reason its not yet marked blocker is because its waiting for outcome refinement procedure.

[jechen0648]

/verified by @jechen0648

[openshift-ci-robot]

@jechen0648: This PR has been marked as verified by @jechen0648.

Details

In response to this:

/verified by @jechen0648

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[JoelSpeed]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[JoelSpeed]

This PR has an approved SBAR (CC @dgoodwin)

/lgtm
/override ci/prow/verify-feature-promotion

[openshift-ci]

@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-feature-promotion

Details

In response to this:

This PR has an approved SBAR (CC @dgoodwin)

/lgtm
/override ci/prow/verify-feature-promotion

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 4023bcf and 2 for PR HEAD 51fe56c in total

[abhat]

/tide refresh

[openshift-ci]

@tssurya: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify	51fe56c	link	unknown	/test verify

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.