Skip to content

OCPBUGS-63152: use IPFamilies template for wait-for-node-ip - #6289

Open
rbbratta wants to merge 1 commit into
openshift:mainfrom
rbbratta:wait-for-node-ip-template
Open

OCPBUGS-63152: use IPFamilies template for wait-for-node-ip#6289
rbbratta wants to merge 1 commit into
openshift:mainfrom
rbbratta:wait-for-node-ip-template

Conversation

@rbbratta

@rbbratta rbbratta commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh.

If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

Cursor AI assisted.

Summary by CodeRabbit

  • Bug Fixes
    • Node IP binding checks now respect the configured IP family.
    • Single-stack environments validate only the applicable IPv4 or IPv6 address.
    • Dual-stack environments continue to validate both address families.
    • Existing primary IP binding behavior and logging remain unchanged.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 9, 2026
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@rbbratta: This pull request references Jira Issue OCPBUGS-63152, which is invalid:

  • expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.23.0" instead
  • expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh.

If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

Cursor AI assisted.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rbbratta
Once this PR has been reviewed and has the lgtm label, please assign ptalgulk01 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown

Walkthrough

The node IP wait script now conditionally performs IPv4 and IPv6 bind checks based on configured IP families. A table-driven test verifies primary, IPv4, and IPv6 bind blocks for single-stack and dual-stack configurations.

Changes

Node IP family binding

Layer / File(s) Summary
Conditional bind validation and coverage
templates/common/_base/files/wait-for-node-ip.yaml, pkg/controller/template/render_test.go
The template gates IPv4 and IPv6 bind checks using .IPFamilies, while rendering tests verify expected bind blocks for each IP family configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: cheesesashimi, yuqi-zhang

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: making wait-for-node-ip use IPFamilies-aware templating.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo titles exist; the new subtest names are static enum strings (IPv4/IPv6/DualStack) and case numbers, with no generated or variable data.
Test Structure And Quality ✅ Passed The new unit test is focused on one template behavior, uses clear failure messages, and needs no cluster setup/cleanup or timeouts.
Microshift Test Compatibility ✅ Passed PASS: The added test is a plain Go unit test, not a Ginkgo e2e test, and it only renders a template/compares strings—no MicroShift-unsupported APIs or cluster assumptions.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e test was added; this change is a unit test plus template rendering logic, with no multi-node/HA assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed PR only updates a node-IP wait script template and its test; it adds no pod scheduling constraints, node selectors, affinity, spread, or replica logic.
Ote Binary Stdout Contract ✅ Passed Only process entrypoint added is TestMain, which just parses flags and exits; no stdout writes (fmt.Print/klog/log.SetOutput) were introduced in main/init/suite setup.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The new test is a unit/template-render test, not a Ginkgo e2e test, and it only checks template strings—no hardcoded IPv4 or external connectivity.
No-Weak-Crypto ✅ Passed Touched files only add IP-family template logic and tests; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges ✅ Passed The PR only changes an ignition script template and its test; no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings appear.
No-Sensitive-Data-In-Logs ✅ Passed No new sensitive logging was introduced; the PR only adds IP-family conditionals and tests, while existing IP bind echoes were unchanged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@rbbratta

rbbratta commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

@cybertron @mko can we use the IPFamilies templating here or only with kubelet?

@cybertron cybertron left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would like to see the duplication reduced, but otherwise this makes sense to me.

# We only want to make sure that if nodeip-configuration detected an IP address, the
# address is usable.
# Family-specific checks follow ControllerConfig IPFamilies (network.config serviceNetwork; same as kubelet --node-ip).
{{- if or (eq .IPFamilies "DualStack") (eq .IPFamilies "DualStackIPv6Primary") }}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't really like the duplication here. We can just wrap the individual checks in ifs that look for single stack of the opposite family. I.e.

if ipfamilies != ipv6
  check for ipv4
if ipfamilies != ipv4
  check for ipv6

See if we can use the kubelet dualstack node-ip templating info
to help with wait-for-node-ip.sh.

If kubelet is not trying to bind to an IPv6 address, then we don't
need to wait for the IPv6 address?
@rbbratta
rbbratta force-pushed the wait-for-node-ip-template branch from dbdb79b to ea7ccf0 Compare July 28, 2026 03:48

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/common/_base/files/wait-for-node-ip.yaml`:
- Around line 41-56: Indent both conditional template blocks, including their
if/end actions, to the same level as the inline block scalar content in the
wait-for-node-IP template. Keep the shell commands and IPv4/IPv6 conditions
unchanged while ensuring all four template actions remain inside inline: | so
the rendered YAML passes yamllint.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ceff1f02-b7a7-49fa-b694-08bf141f5b86

📥 Commits

Reviewing files that changed from the base of the PR and between 777892a and ea7ccf0.

📒 Files selected for processing (2)
  • pkg/controller/template/render_test.go
  • templates/common/_base/files/wait-for-node-ip.yaml

Comment on lines +41 to +56
{{- if ne .IPFamilies "IPv6" }}
ip=$(cat /run/nodeip-configuration/ipv4 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv4 to bind was found"
else
wait_for_ip_bind "${ip}"
fi

{{- end }}
{{- if ne .IPFamilies "IPv4" }}
ip=$(cat /run/nodeip-configuration/ipv6 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv6 to bind was found"
else
wait_for_ip_bind "${ip}"
fi
{{- end }}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Keep the template YAML-valid.

The column-zero template actions terminate inline: |, so yamllint fails at Line 42. Indent all four actions to the block-scalar level.

Proposed fix
-{{- if ne .IPFamilies "IPv6" }}
+    {{- if ne .IPFamilies "IPv6" }}
...
-{{- end }}
+    {{- end }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
{{- if ne .IPFamilies "IPv6" }}
ip=$(cat /run/nodeip-configuration/ipv4 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv4 to bind was found"
else
wait_for_ip_bind "${ip}"
fi
{{- end }}
{{- if ne .IPFamilies "IPv4" }}
ip=$(cat /run/nodeip-configuration/ipv6 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv6 to bind was found"
else
wait_for_ip_bind "${ip}"
fi
{{- end }}
{{- if ne .IPFamilies "IPv6" }}
ip=$(cat /run/nodeip-configuration/ipv4 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv4 to bind was found"
else
wait_for_ip_bind "${ip}"
fi
{{- end }}
{{- if ne .IPFamilies "IPv4" }}
ip=$(cat /run/nodeip-configuration/ipv6 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv6 to bind was found"
else
wait_for_ip_bind "${ip}"
fi
{{- end }}
🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 42-42: syntax error: could not find expected ':'

(syntax)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@templates/common/_base/files/wait-for-node-ip.yaml` around lines 41 - 56,
Indent both conditional template blocks, including their if/end actions, to the
same level as the inline block scalar content in the wait-for-node-IP template.
Keep the shell commands and IPv4/IPv6 conditions unchanged while ensuring all
four template actions remain inside inline: | so the rendered YAML passes
yamllint.

Source: Linters/SAST tools

{{- if ne .IPFamilies "IPv4" }}
ip=$(cat /run/nodeip-configuration/ipv6 || echo "")
if [[ "${ip}" == "" ]]; then
echo "No ipv6 to bind was found"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we should fail here. We are expecting an IPv6 address to bind to.

@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@rbbratta: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/bootstrap-unit ea7ccf0 link true /test bootstrap-unit
ci/prow/unit ea7ccf0 link true /test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@isabella-janssen

Copy link
Copy Markdown
Member

/hold

Holding to allow the Kube rebase to land in #6321. Please ensure this will not cause merge conflicts for the Kube rebase before unholding this PR.

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants