Skip unchanged Route53 record UPSERTs

[xiaoyu74]

Context

During the investigation of incident ITN-2026-00214, we observed Route 53 API throttling in the shared PrivateLink/Jump AWS account.

One of the symptoms was delayed Route 53 reconciliation for newly provisioned private HCP clusters, which could leave the SRE Backplane access path incomplete even after the VPC Endpoint itself became available.

As part of the investigation, we identified one concrete inefficiency in AVO: validateR53HostedZoneRecord() performs a Route 53 ChangeResourceRecordSets(UPSERT) call on every successful reconcile, including periodic reconciles, even when the desired DNS record state has not changed.

Description

This PR persists a fingerprint of the last successfully applied record state and skips the AWS write when the hosted zone, record name, type, TTL, and VPCE DNS target are unchanged.

Other Notes

• This change is intentionally limited to reducing unnecessary Route 53 write traffic and does not modify other VPC Endpoint reconciliation behavior.

• More context: https://redhat-internal.slack.com/archives/C0BFNS43MU3/p1783574887081499?thread_ts=1783570361.438559&cid=C0BFNS43MU3

Summary by CodeRabbit

• New Features

  • Added smarter Route 53 handling for VPC endpoint DNS records, including fingerprint-based change detection to avoid unnecessary updates.
  • Expanded DNS record reconciliation to better handle first-time creation, updates, and existing records.

• Bug Fixes

  • Preserves existing status when record updates fail.
  • Improves compatibility for existing resources so previously created records are recognized and updated correctly on the next reconciliation.

• Tests

  • Added broader coverage for record creation, no-op updates, changes, failures, and deterministic fingerprinting.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: xiaoyu74
Once this PR has been reviewed and has the lgtm label, please assign typeid for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

Adds a Route53RecordFingerprint status field to VpcEndpointStatus, computes a SHA-256 fingerprint of Route53 UPSERT inputs during reconciliation to skip redundant record updates when unchanged, persists the fingerprint after updates, and extends mocks/tests to cover the new behavior including backward compatibility.

Changes

Route53 Record Fingerprinting

Layer / File(s)	Summary
Status field for fingerprint api/v1alpha2/vpcendpoint_types.go	Adds optional Route53RecordFingerprint field to VpcEndpointStatus to track the last applied Route53 record state.
Fingerprint computation and skip-upsert logic controllers/vpcendpoint/validation.go	Adds route53RecordFingerprint helper (SHA-256 of hosted zone id, record name/type, TTL, target), computes desired fingerprint during reconciliation, skips UPSERT when unchanged and record already created, and persists the new fingerprint into status after UPSERT.
Route53 mock support and validation tests pkg/aws_client/mock.go, controllers/vpcendpoint/validation_test.go	Extends MockedRoute53 with call counting, injectable errors, and GetHostedZone; adds NewMockedAwsClientWithRoute53 constructor; adds tests for first creation, unchanged-fingerprint skip, target/hostname changes, error preservation of state, backward compatibility with empty fingerprints, and fingerprint determinism.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: reedcort, geowa4, AlexSmithGH

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The new UPSERT-skip log includes the Route53 record hostname, which can expose internal/customer DNS names.	Remove or redact the record/hostedZoneId fields from that log, or keep only a generic skip message without customer-specific names.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	New test names are static, descriptive Go test functions; no dynamic values, Ginkgo titles, or generated identifiers appear in the added tests.
Test Structure And Quality	✅ Passed	The added tests are focused unit tests, use fake clients/helpers instead of cluster resources, and contain no Ginkgo/Eventual waits or cleanup issues.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the changed tests are standard Go unit tests and reference no MicroShift-unsupported OpenShift APIs or assumptions.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the changed tests are plain unit tests around Route53 fingerprinting and contain no SNO/topology assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Touched code only changes Route53 status/fingerprint logic and AWS mocks; no pod affinity, node selectors, topology spread, replicas, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	PASS: No changed main/init/TestMain/suite code writes to stdout; the only fmt.Fprintf writes to a sha256 hash, not stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR only adds unit tests in controllers/vpcendpoint/validation_test.go; no new Ginkgo e2e tests or network/IPv4-only assumptions were introduced.
No-Weak-Crypto	✅ Passed	Only SHA-256 fingerprinting was added; no MD5/SHA1/DES/RC4/3DES/Blowfish, custom crypto, or secret/token comparisons found.
Container-Privileges	✅ Passed	PASS: The PR only changes Route53 fingerprinting logic/tests; no manifests or touched files add privileged, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: skipping redundant Route53 UPSERTs when the record is unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.06%. Comparing base (3ae5318) to head (dea14b9).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #444      +/-   ##
==========================================
+ Coverage   40.46%   43.06%   +2.59%     
==========================================
  Files          32       32              
  Lines        2177     2206      +29     
==========================================
+ Hits          881      950      +69     
+ Misses       1191     1148      -43     
- Partials      105      108       +3     

Files with missing lines	Coverage Δ
api/v1alpha2/vpcendpoint_types.go	100.00% <ø> (ø)
controllers/vpcendpoint/validation.go	32.38% <100.00%> (+14.93%)	⬆️
pkg/aws_client/mock.go	85.45% <100.00%> (+0.83%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@xiaoyu74: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[xiaoyu74]

/hold