OCPBUGS-92836: UPSTREAM: <carry>: upkeep cpu partitioning admission webhook

[eggfoobar]

cpu partitioning no longer needs to check node for resource types as of 4.13, removing check to clean up any error noise during bootstrap and remove call for nodes since it is no longer needed.

the previous flow checked node resource type for older clusters before the authoritative flag of cpuPartitioning was introduced

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Summary by CodeRabbit

• Bug Fixes
  • Improved CPU partitioning eligibility evaluation during admission by relying on cluster infrastructure status instead of node listings.
  • Removed an edge case that could incorrectly block or misclassify clusters when no nodes are available.
• Tests
  • Updated admission coverage to reflect the new eligibility behavior and removed the obsolete “no nodes” admission expectation.

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-92836, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

cpu partitioning no longer needs to check node for resource types as of 4.13, removing check to clean up any error noise during bootstrap and remove call for nodes since it is no longer needed.

the previous flow checked node resource type for older clusters before the authoritative flag of cpuPartitioning was introduced

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@eggfoobar: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• cb6cac2|UPSTREAM: : upkeep cpu partitioning admission webhook: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9dccf3a5-1504-41e4-aa0a-bec490fdd865

📥 Commits

Reviewing files that changed from the base of the PR and between cb6cac2 and 13ace3c.

📒 Files selected for processing (2)

• openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go
• openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go

---

Walkthrough

The admission plugin now decides CPU-partitioning eligibility from infrastructure status only, without listing nodes. The table-driven tests were updated to use plain nodes and no longer include the zero-node rejection case.

Changes

CPU Partitioning Simplification

Layer / File(s)	Summary
Admission decision flow openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go	Removes node listing and the related empty-cluster rejection from Admit, updates the CPU-partitioning call to use only clusterInfra.Status, and simplifies isCPUPartitioning to check CPUPartitioningAllNodes only.
Admission test updates openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go	Changes the admission table cases to use testNode() instead of testNodeWithManagementResource() and removes the zero-node error case.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is directly related to the main change by naming the cpu partitioning admission webhook being updated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed tests use only hardcoded table names; no titles include dynamic values, generated IDs, or other unstable strings.
Test Structure And Quality	✅ Passed	The changed tests are small table-driven unit tests with no cluster resources or waits; assertions have context and there’s no Ginkgo-style setup/cleanup issue to flag.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the touched test file uses plain Go testing and contains no It/Describe/Context/When blocks or MicroShift-relevant e2e APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only unit-test updates were made; no new Ginkgo/e2e tests or multi-node assumptions were added, so SNO compatibility is unchanged.
Topology-Aware Scheduling Compatibility	✅ Passed	Change is limited to admission logic; it removes node-content checks and adds no affinity, selectors, replica, or topology-spread scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	Changed files only touch admission logic/tests; package scans found no fmt.Print, klog/stdout setup, or main/TestMain-style entrypoints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the changes are unit tests only and contain no IPv4-only or external connectivity assumptions.
No-Weak-Crypto	✅ Passed	Diff only removes node listing and updates tests; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/toke n comparisons were added.
Container-Privileges	✅ Passed	PR only changes admission Go logic/tests; no container/K8s manifests or privilege flags (privileged, hostPID, hostNetwork, hostIPC, allowPrivilegeEscalation, SYS_ADMIN) were added.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging was added; the changed paths contain no klog/log calls or sensitive keywords.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[eggfoobar]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-single-node-live-iso periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-upgrade periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-arbiter

[openshift-ci]

@eggfoobar: trigger 3 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-single-node-live-iso
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-upgrade
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-arbiter

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/545a43e0-75dd-11f1-8d49-95d737a6f3ba-0

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-92836, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

cpu partitioning no longer needs to check node for resource types as of 4.13, removing check to clean up any error noise during bootstrap and remove call for nodes since it is no longer needed.

the previous flow checked node resource type for older clusters before the authoritative flag of cpuPartitioning was introduced

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Summary by CodeRabbit

• Bug Fixes
• Improved CPU partitioning eligibility checks during admission so they rely on cluster infrastructure status instead of inspecting node listings.
• Removed an edge case that could block or misclassify clusters with no available nodes during mutation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@eggfoobar: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 13ace3c|UPSTREAM: : upkeep cpu partitioning admission webhook: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[eggfoobar]

/jira refresh

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-92836, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eggfoobar]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-single-node-live-iso periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-upgrade periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-arbiter

[openshift-ci]

@eggfoobar: trigger 3 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-single-node-live-iso
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-upgrade
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-arbiter

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/139f9ba0-75df-11f1-9345-6b72252910d3-0

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-92836, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

cpu partitioning no longer needs to check node for resource types as of 4.13, removing check to clean up any error noise during bootstrap and remove call for nodes since it is no longer needed.

the previous flow checked node resource type for older clusters before the authoritative flag of cpuPartitioning was introduced

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Summary by CodeRabbit

• Bug Fixes
• Improved CPU partitioning eligibility evaluation during admission by relying on cluster infrastructure status instead of node listings.
• Removed an edge case that could incorrectly block or misclassify clusters when no nodes are available.
• Tests
• Updated admission coverage to reflect the new eligibility behavior and removed the obsolete “no nodes” admission expectation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eggfoobar]

/retest-required

[eggfoobar]

/verified by CI

CI lanes are no longer showing the error message.

Previous Presubmits WITHOUT the fix show the event message

With this PR the event no longer shows up

[openshift-ci-robot]

@eggfoobar: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

CI lanes are no longer showing the error message.

Previous Presubmits WITHOUT the fix show the event message

With this PR the event no longer shows up

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jubittajohn]

/test all

[jubittajohn]

Could we hold off on this PR until the Kube rebase is merged? We're likely targeting sometime this week for the Kube rebase changes to land, and we'd prefer to avoid additional code churn until that's complete.

[jubittajohn]

/hold
until #2653 merges

[bertinatto]

The changes introduced here look good to me; we'll want to squash them in the next rebase.

/remove-label backports/unvalidated-commits
/lgtm

Leaving the hold tag so that we coordinate with the kube rebase.

[bertinatto]

/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, eggfoobar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [bertinatto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jubittajohn]

/test all

[eggfoobar]

/retest-required

[eggfoobar]

/cherry-pick release-4.22

[openshift-cherrypick-robot]

@eggfoobar: once the present PR merges, I will cherry-pick it on top of release-4.22 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[eggfoobar]

Thanks guys, @bertinatto we will need to backport this to 4.22, I added the cherry pick command to allow the bot to create the jira tickets, but I'm not sure if that's the right way we carry backports for k8s

[eggfoobar]

/retest-required

[jubittajohn]

/test all
(Retesting to capture presubmit job signals to support the Kube rebase)

[eggfoobar]

/retest-required

[eggfoobar]

/retest-required

[eggfoobar]

/retest-required

[eggfoobar]

/retest-required

[jubittajohn]

/hold cancel

[jubittajohn]

/retest

[openshift-ci]

@eggfoobar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-techpreview	13ace3c	link	false	/test e2e-aws-ovn-techpreview
ci/prow/e2e-aws-ovn-cgroupsv2	13ace3c	link	true	/test e2e-aws-ovn-cgroupsv2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jubittajohn]

/retest-required