TLS curves configuration feature gate by richardsonnick · Pull Request #2594 · openshift/api

richardsonnick · 2025-11-20T16:17:57Z

Adds feature gate for TLS curves configuration in API config.

Enhancement PR: openshift/enhancements#1894
Implementation PR: #2583

coderabbitai · 2025-11-20T16:18:24Z

📝 Walkthrough

Walkthrough

Adds a new public feature gate FeatureGateTLSCurvesConfiguration to the feature gate declarations and updates documentation and multiple FeatureGate payload manifests to include the new gate. The gate is declared with name "TLSCurvesConfiguration", Jira component "Networking", contact "davidesalerno", product scope ocpSpecific, enhancement PR "https://github.com/openshift/enhancements/pull/1894", enableIn(configv1.DevPreviewNoUpgrade), and is registered via mustRegister(). Payload manifests mark it enabled in DevPreviewNoUpgrade variants and list it in disabled arrays for Default and TechPreviewNoUpgrade variants. features.md gains a corresponding row. No changes to control flow or error handling.

Changes

Cohort / File(s)	Summary
Feature gate declaration & docs `features/features.go`, `features.md`	Adds public `FeatureGateTLSCurvesConfiguration` to `allFeatureGates` with name `"TLSCurvesConfiguration"`, Jira component `"Networking"`, contact `"davidesalerno"`, product scope `ocpSpecific`, enhancement PR `"https://github.com/openshift/enhancements/pull/1894"`, `enableIn(configv1.DevPreviewNoUpgrade)`, and `mustRegister()`. Adds a corresponding row in `features.md`.
Payload manifests — Hypershift variants `payload-manifests/featuregates/featureGate-Hypershift-Default.yaml`, `payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml`, `payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml`	Inserts `TLSCurvesConfiguration` into Hypershift FeatureGate YAMLs: present in the `enabled` list for DevPreviewNoUpgrade; present in the `disabled` lists for Default and TechPreviewNoUpgrade.
Payload manifests — SelfManagedHA variants `payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml`, `payload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml`, `payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml`	Inserts `TLSCurvesConfiguration` into SelfManagedHA FeatureGate YAMLs: present in the `enabled` list for DevPreviewNoUpgrade; present in the `disabled` lists for Default and TechPreviewNoUpgrade.
CRD changes `payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml`	Removes CEL-related fields and validations: the `cel` property and `CEL` enum option in `TokenClaimValidationRule`, associated `x-kubernetes-validations`, `discoveryURL` fields and validations across OIDC-related schema sections, and `userValidationRules` blocks. Adjusts required/type definitions accordingly.

Estimated code review effort

Medium — verify metadata and placement across manifests, docs, and the CRD removals.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding a TLS curves configuration feature gate across multiple files.
Description check	✅ Passed	The description is directly related to the changeset, explaining the purpose of adding a feature gate for TLS curves configuration with relevant enhancement PR reference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.5.0)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2025-11-20T16:19:06Z

Hello @richardsonnick! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

openshift-ci-robot · 2025-11-20T16:20:04Z

Pipeline controller notification
This repository is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

everettraven · 2025-11-20T19:10:53Z

features/features.go

 						mustRegister()
+
+	FeatureGateTLSCurvesConfiguration = newFeatureGate("TLSCurvesConfiguration").
+		reportProblemsToJiraComponent("kube-apiserver").


Why should problems be reported to this component?

To clarify, I'm asking because I don't see any stakeholders from the team responsible for this component represented in the enhancement proposal as reviewers or having signed off on being on the hook for bugs and issues related to this feature.

Hey @everettraven,
Sorry for the confusion, I'm working with @davidesalerno to add supporting docs for the new feature introduced here: #2583

We decided Networking was the best component.

everettraven · 2025-11-25T15:09:52Z

@richardsonnick Looks like this may need a rebase and it looks like you are missing the generated file updates here.

Running PROTO_OPTIONAL=true make update should re-generate everything you need.

richardsonnick · 2025-11-25T16:59:12Z

@richardsonnick Looks like this may need a rebase and it looks like you are missing the generated file updates here.

Running PROTO_OPTIONAL=true make update should re-generate everything you need.

Rebased and updated generated files. Thanks for the review

everettraven

/lgtm

openshift-ci-robot · 2025-11-25T18:01:20Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change

openshift-ci · 2025-11-25T18:01:25Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: everettraven

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [everettraven]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

davidesalerno · 2025-11-27T08:17:20Z

As discussed with @richardsonnick I need to verify if Jira component and contact person values are the right ones.

Should we also add some tests (see here)?

/hold

JoelSpeed · 2025-11-28T13:14:32Z

Tests are not required for new fates, only new fields. When you add the API tests will be important

openshift-ci · 2026-01-06T14:52:22Z

New changes are detected. LGTM label has been removed.

richardsonnick · 2026-01-06T14:52:47Z

Rebased + codegen

JoelSpeed · 2026-02-04T10:33:31Z

@richardsonnick Apologies, another rebase needed here as there's a conflict to resolve

openshift-ci · 2026-02-04T18:08:41Z

@richardsonnick: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-serial-techpreview-1of2	`b1e173a`	link	true	`/test e2e-aws-serial-techpreview-1of2`
ci/prow/e2e-aws-serial-1of2	`b1e173a`	link	true	`/test e2e-aws-serial-1of2`
ci/prow/e2e-aws-ovn-hypershift	`b1e173a`	link	true	`/test e2e-aws-ovn-hypershift`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

richardsonnick · 2026-02-05T15:18:00Z

/retest

richardsonnick · 2026-02-05T19:09:15Z

rebase nuked some test. Fixing.

everettraven · 2026-02-06T13:45:19Z

@davidesalerno @richardsonnick Are you happy with the component this gate is assigned to?

everettraven · 2026-02-06T14:12:06Z

Is this actually superseded by #2583 ? I noticed it also adds the gate.

richardsonnick changed the title ~~Curves feature gate~~ TLS curves configuration feature gate Nov 20, 2025

openshift-ci bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Nov 20, 2025

openshift-ci bot requested review from JoelSpeed and everettraven November 20, 2025 16:31

everettraven reviewed Nov 20, 2025

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 25, 2025

richardsonnick force-pushed the curves-feature-gate branch from 524928d to b1e173a Compare November 25, 2025 16:57

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 25, 2025

openshift-ci bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 25, 2025

everettraven approved these changes Nov 25, 2025

View reviewed changes

openshift-ci bot assigned everettraven Nov 25, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 25, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 25, 2025

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 27, 2025

richardsonnick force-pushed the curves-feature-gate branch from b1e173a to e39035c Compare January 6, 2026 14:52

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 6, 2026

openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 6, 2026

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 4, 2026

richardsonnick added 5 commits February 4, 2026 10:27

Add featuregate for TLS curve API config enhancement

e8d8f05

Update featuregate name

c272d16

Update Jira Component

5816a5c

Change contact person

a8ad1c0

Regenerate files after rebase

557b626

richardsonnick force-pushed the curves-feature-gate branch from e39035c to 557b626 Compare February 4, 2026 15:33

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 4, 2026

openshift-ci bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 4, 2026

make update

fb1fde8

openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 5, 2026

Conversation

richardsonnick commented Nov 20, 2025

Uh oh!

coderabbitai bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

openshift-ci bot commented Nov 20, 2025

Uh oh!

openshift-ci-robot commented Nov 20, 2025

Uh oh!

everettraven Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

everettraven Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

richardsonnick Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

everettraven commented Nov 25, 2025

Uh oh!

richardsonnick commented Nov 25, 2025

Uh oh!

everettraven left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Nov 25, 2025

Uh oh!

openshift-ci bot commented Nov 25, 2025

Uh oh!

davidesalerno commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JoelSpeed commented Nov 28, 2025

Uh oh!

openshift-ci bot commented Jan 6, 2026

Uh oh!

richardsonnick commented Jan 6, 2026

Uh oh!

JoelSpeed commented Feb 4, 2026

Uh oh!

openshift-ci bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richardsonnick commented Feb 5, 2026

Uh oh!

richardsonnick commented Feb 5, 2026

Uh oh!

everettraven commented Feb 6, 2026

Uh oh!

everettraven commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

coderabbitai bot commented Nov 20, 2025 •

edited

Loading

davidesalerno commented Nov 27, 2025 •

edited

Loading

openshift-ci bot commented Feb 4, 2026 •

edited

Loading