[AISOS-2052] CAPO validation webhook rejects OpenStackMachine spec patches during IPI install on OCP 4.22.x

[forgeSmith-bot]

Summary

This pull request resolves an issue where the CAPO validation webhook rejects OpenStackMachine spec patches during OpenShift Container Platform (OCP) 4.22.x IPI install by preventing the CAPO controller from mutating the OpenStackMachine spec in-place during conversion. By performing a deep copy of the PortOpts slice and its individual elements, the original OpenStackMachine spec remains unmodified in memory. This prevents the CAPI patch helper from sending mutated spec patches that violate strict spec immutability and are rejected by the validating webhook, thereby ensuring stable machine provisioning and successful bootstrap.

Changes

Controller logic

• Modified controllers/openstackmachine_controller.go: Updated the conversion logic within openStackMachineSpecToOpenStackServerSpec to deep-copy the Ports slice and each individual PortOpts element using the autogenerated DeepCopyInto helper. This isolates downstream in-place mutations (such as assigned networks, fixed IPs, and security groups) from the original machine spec in memory.

Test suite

• Modified controllers/openstackmachine_controller_test.go: Enhanced the existing unit test runner TestOpenStackMachineSpecToOpenStackServerSpec to assert that the input OpenStackMachineSpec is never mutated post-conversion. The test now clones the input spec prior to conversion and verifies that the pre-call and post-call states are identical using reflect.DeepEqual.

Implementation Notes

• Autogenerated deep copy helpers: Utilized Kubebuilder-autogenerated DeepCopyInto functions found in api/v1beta1/zz_generated.deepcopy.go to guarantee a deep copy of all elements, slices, and pointers.
• Minimal footprint: The fix is entirely self-contained within the controller logic and unit tests, avoiding public API schema modifications or external dependency additions.
• Bi-directional testing: Verified that the new immutability assertions actively fail when the deep-copy logic is temporarily reverted, confirming that the test suite is robust against regressions.

Testing

• Unit tests: Enhanced TestOpenStackMachineSpecToOpenStackServerSpec to assert immutability of the input specs.
• Local verification: Executed the test suite (make test-capo) and confirmed all tests pass cleanly.
• Linting & Formatting: Verified the codebase is fully compliant with golangci-lint and formatting standards with zero issues.

Related Tickets

• AISOS-2052
• AISOS-2074

---

Generated by Forge SDLC Orchestrator

Summary by CodeRabbit

• Bug Fixes

  • Prevented machine port settings from being modified during server spec generation, improving reliability of network configuration handling.
  • Resolved CI verification failures caused by outdated vendored dependencies.

• Tests

  • Added coverage to ensure input machine specs remain unchanged after conversion.

• Documentation

  • Updated internal CI handoff and failure notes with the latest investigation and fix status.

[openshift-ci]

Hi @forgeSmith-bot. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 92c59163-2083-48f4-8a2b-9fc4911cabb3

📥 Commits

Reviewing files that changed from the base of the PR and between e5a7c43 and c166daa.

⛔ Files ignored due to path filters (1)

• hack/tools/vendor/sigs.k8s.io/cluster-api-provider-openstack/controllers/openstackmachine_controller.go is excluded by !**/vendor/**

📒 Files selected for processing (5)

• .forge/ci-failures.md
• .forge/fix-plan.md
• .forge/handoff.md
• .forge/logs/verify-build-log.txt
• .forge/logs/verify-prow-page.html

✅ Files skipped from review due to trivial changes (5)

• .forge/ci-failures.md
• .forge/fix-plan.md
• .forge/handoff.md
• .forge/logs/verify-prow-page.html
• .forge/logs/verify-build-log.txt

---

Walkthrough

Modifies the OpenStackMachine controller to deep-copy provided port options before mutation, preventing mutation of the caller's input slice, with a corresponding immutability regression test. Also adds .forge documentation and log artifacts recording CI failure diagnosis, fix plan, and Prow job logs/HTML.

Changes

Deep-copy fix and tests

Layer / File(s)	Summary
Deep-copy ports before mutation controllers/openstackmachine_controller.go	serverPorts is now built by allocating a new slice and deep-copying each provided port via DeepCopyInto instead of directly reusing the input slice.
Immutability regression test controllers/openstackmachine_controller_test.go	Test deep-copies the input spec before conversion and asserts via reflect.DeepEqual that the original spec is unchanged afterward.

CI forge diagnostic artifacts

Layer / File(s)	Summary
Failure record and fix plan .forge/ci-failures.md, .forge/fix-plan.md, .forge/handoff.md	Documents the verify-vendoring CI failure, root cause (outdated vendored files), remediation steps (make vendor), and completed handoff/review records.
Prow verify build log and job page .forge/logs/verify-build-log.txt, .forge/logs/verify-prow-page.html	Adds the full verify job build log showing the vendoring diff and failure, plus a generated Spyglass HTML job result page.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

Not applicable.

Related PRs: None identified.

Suggested labels: bug, ci, vendoring

Suggested reviewers: None identified.

Poem:
A rabbit copied ports with care,
No mutation left to spare,
CI logs now tell the tale,
Of vendored files gone stale,
Deep-copy fixed, tests stand tall—
Hop, hop, hooray, we caught it all! 🐇

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	.forge/logs/verify-prow-page.html commits a CSRF token, and verify-build-log.txt includes internal IP/CI hostnames.	Redact tokens/CSRF values, internal hostnames/IPs, and any other sensitive identifiers from committed log artifacts before merging.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title correctly describes the CAPO webhook patch rejection issue and the OCP 4.22.x install context addressed by the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: the modified test file uses static table-driven names; no Ginkgo titles or dynamic/generated values were added.
Test Structure And Quality	✅ Passed	The added unit test is focused, uses standard table-driven Go style, adds a clear immutability assertion, and has no cluster/timeout/cleanup concerns.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the changed test is a plain Go unit test with no MicroShift-incompatible APIs or guards needed.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes controller logic and a standard unit test, with no multi-node/SNO assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The controller change only deep-copies PortOpts, and the test checks input immutability; no scheduling/topology/replica logic was added.
Ote Binary Stdout Contract	✅ Passed	Touched files are controller/test only; no main/init/TestMain/suite setup or stdout writes were added, so the OTE stdout contract isn’t impacted.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only changes controller logic and a Go unit test; no new Ginkgo e2e tests, hardcoded IPv4s, or external connectivity requirements were added in the modified files.
No-Weak-Crypto	✅ Passed	Scanned all PR files and the changed controller/test code; found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR only changes controller/test/docs files; no container/K8s manifests were modified, and the touched files contain no privileged settings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.forge/handoff.md (1)

44-44: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Minor: Path reference may be environment-specific.

Line 44 references /workspace/docs/ as an absolute path. If this documentation is meant to be shared or persisted, consider using a repository-relative path (e.g., docs/ or ./docs/) for portability across different environments and clones.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.forge/handoff.md at line 44, Replace the absolute path reference in the
handoff documentation with a repository-relative path so it works across
environments; update the relevant text in the markdown entry that currently
points to the docs directory using an absolute `/workspace/...` style path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.forge/handoff.md:
- Line 44: Replace the absolute path reference in the handoff documentation with
a repository-relative path so it works across environments; update the relevant
text in the markdown entry that currently points to the docs directory using an
absolute `/workspace/...` style path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c3f681ad-81cb-41a7-a950-727cb404e260

📥 Commits

Reviewing files that changed from the base of the PR and between 76198b2 and 678b676.

📒 Files selected for processing (3)

• .forge/handoff.md
• controllers/openstackmachine_controller.go
• controllers/openstackmachine_controller_test.go

[tusharjadhav3302]

/approve
/lgtm

[ekuris-redhat]

Please remove the handoff.md file

[forgeSmith-bot]

Forge is addressing PR review feedback now. This status update is informational.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tusharjadhav3302
Once this PR has been reviewed and has the lgtm label, please assign eshulman2 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[eshulman2]

/ok-to-test

[eshulman2]

/forge skip-gate tide

[forgeSmith-bot]

✅ CI gate skipped by @eshulman2

The following check will be treated as passing for this PR:

• tide

All other CI checks still apply. Re-evaluating CI status now.

[eshulman2]

/test e2e-hypershift

[openshift-ci]

@forgeSmith-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.