USHIFT-6178 Enable Custom FeatureGates by copejon · Pull Request #5723 · openshift/microshift

copejon · 2025-11-11T16:32:42Z

No description provided.

pkg/config/apiserver.go

cmd/generate-config/config/config-openapi-spec.json

pacevedom · 2025-11-18T10:48:34Z

pkg/controllers/kube-apiserver.go

+	hardcodedFeatureGates := []string{"UserNamespacesSupport=true", "UserNamespacesPodSecurityStandards=true"}
+	featureGateArgs = append(featureGateArgs, hardcodedFeatureGates...)


Could we have a conflict here? Configuration allows disabling UserNamespacesSupport and UserNamespacesPodSecurityStandards.

This is now protected against by preventing the user to specify these values in the ushift config.

https://github.com/copejon/microshift/blob/e108194ba7642c410cfe7c95281d173682e55f94/pkg/config/apiserver.go#L206-L218

agullon · 2025-11-19T08:27:20Z

pkg/config/config_test.go

+		},
+		{


Suggested change

},

{

},

{

name: "feature-gates-custom-no-upgrade-with-empty-enabled-and-disabled-lists",

config: func() *Config {

c := mkDefaultConfig()

c.ApiServer.FeatureGates.FeatureSet = "CustomNoUpgrade"

c.ApiServer.FeatureGates.CustomNoUpgrade.Enabled = []string{}

c.ApiServer.FeatureGates.CustomNoUpgrade.Disabled = []string{}

return c

}(),

expectErr: true,

},

{

adding a test for the suggestion check I added last week

@agullon Thanks! For the sake of time, would you mind submitting this as a follow-up PR? Else CI will have to test the change, and then retest again for merge, which would take a long time.

add it #5795
please, review it

pkg/admin/prerun/featuregate_lock.go

pmtk · 2025-11-19T11:41:55Z

packaging/microshift/config.yaml

        maxFiles: 10
        # profile is the OpenShift profile specifying a specific logging policy
        profile: Default
+    featureGates:


I started wondering - if FGs are propagated, but someone would want to apply kubelet FG, should we move it out of apiServer and make it global to avoid confusion?

That's a very good point. I had shifted FGs under kube-apiserver to smooth the passthrough logic, but it doesn't solve the problem you rightly pointe out. I'll give this a second look and get back to you

Enabling a kubelet FG on the kube-apiserver and disabling it in the kubelet config results in the FG being disabled. This is b/c the kubelet goes against convention by prioritizing the config file over all other config vectors (CLI flags, KAS propagation).

This is only an issue if the user were to set contradictory featureGate values in the microshift config.

pkg/admin/prerun/featuregate_lock.go

pkg/config/apiserver.go

apiserver-config-flow.md

copejon

Darn it, I thought I'd made the comment as a one off, not a review.

cmd/generate-config/config/config-openapi-spec.json

This commit introduces a comprehensive document detailing the data flow of the API server configuration, tracing the path from the `apiServer` field in the MicroShift configuration file to its ingestion by the kube-apiserver. It includes a UML sequence diagram illustrating the configuration steps, key data structures, and the transformation of configuration values into command-line flags. Additionally, it updates the configuration structure to support feature gates, enhancing the API server's customization capabilities.

…issions

… as invalide Setting `featureSet: CustomNoUpgrade` with empty enabled/disabled lists should be invalid. Otherwise, the supposedly valid custom setting would cause a supported cluster to treat itself as unsupported: blocking FG unsetting and cluster upgrades. Co-authored-by: Alejandro Gullón <agullon@redhat.com>

…ble valudation replaced array prims with set.Sets for cleaner array comparisson added validation for edge case where user attempts to set required feature-gates. It is no longer allowed fixed critical issue with lock file management that caused deletion of custom configs to skip lock file checks

pkg/admin/prerun/featuregate_lock.go

pkg/config/apiserver.go

…readability refactored featureGateLockManagement() by moving hasCustomFeatureGates to after the lockFile-exists check because if the lock exists, it by default has / had custom featureGates.

copejon · 2025-11-20T22:48:00Z

/test ocp-full-conformance-serial-rhel-eus
/test ocp-full-conformance-rhel-eus

openshift-ci · 2025-11-21T00:13:16Z

@copejon: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

pacevedom

/lgtm

openshift-ci · 2025-11-21T19:39:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: copejon, pacevedom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [copejon,pacevedom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

copejon · 2025-11-21T20:09:59Z

/verified by @copejon, ci

openshift-ci-robot · 2025-11-21T20:10:11Z

@copejon: This PR has been marked as verified by @copejon,ci.

Details

In response to this:

/verified by @copejon, ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot requested review from pacevedom and vanhalenar November 11, 2025 16:34

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 11, 2025

copejon changed the title ~~USHIFT-6178 Enable Custom FeatureGates~~ [WIP] USHIFT-6178 Enable Custom FeatureGates Nov 11, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 11, 2025

copejon force-pushed the ushift-6178 branch from 6ba2ad3 to 4449038 Compare November 14, 2025 22:44

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 14, 2025

agullon reviewed Nov 17, 2025

View reviewed changes

pkg/config/apiserver.go Show resolved Hide resolved

copejon changed the title ~~[WIP] USHIFT-6178 Enable Custom FeatureGates~~ USHIFT-6178 Enable Custom FeatureGates Nov 17, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 17, 2025

copejon force-pushed the ushift-6178 branch from 4449038 to c319b61 Compare November 17, 2025 15:19

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 17, 2025

pacevedom reviewed Nov 18, 2025

View reviewed changes

agullon reviewed Nov 19, 2025

View reviewed changes

pmtk reviewed Nov 19, 2025

View reviewed changes

eslutsky mentioned this pull request Nov 19, 2025

USHIFT-6319: add uncore-cache e2e test kubelet config on Microshift #5765

Merged

copejon commented Nov 19, 2025

View reviewed changes

cmd/generate-config/config/config-openapi-spec.json Show resolved Hide resolved

copejon and others added 11 commits November 19, 2025 16:22

init featureGate config

af7dcda

merged featuregate unit tests into config unit test

4942804

merged featuregate unit tests into validation unit test

71a5da2

add featureGates to config.yaml

edd2876

refactor hardcoded feature gate values to make it a little more obvious

b195d86

removed kube-apiserver unit test because it required elevated fs perm…

0316630

…issions

generated new config

1c8ef49

make generate-config

33f1cb1

add featureGate lock file

eafbf0a

copejon force-pushed the ushift-6178 branch from b719aa6 to eafbf0a Compare November 19, 2025 22:23

delete stray sequence file

92a02be

pmtk reviewed Nov 20, 2025

View reviewed changes

pkg/admin/prerun/featuregate_lock.go Outdated Show resolved Hide resolved

pkg/admin/prerun/featuregate_lock.go Outdated Show resolved Hide resolved

pkg/config/apiserver.go Show resolved Hide resolved

copejon requested review from agullon, pacevedom and pmtk and removed request for pmtk November 20, 2025 18:12

refactor isCustomFeatureGatesConfigured to hasCustomFeatureGates for …

e108194

…readability refactored featureGateLockManagement() by moving hasCustomFeatureGates to after the lockFile-exists check because if the lock exists, it by default has / had custom featureGates.

pacevedom approved these changes Nov 21, 2025

View reviewed changes

openshift-ci bot assigned pacevedom Nov 21, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 21, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 21, 2025

openshift-merge-bot bot merged commit 5dcdcb5 into openshift:main Nov 21, 2025
12 checks passed

copejon deleted the ushift-6178 branch November 22, 2025 21:52

		hardcodedFeatureGates := []string{"UserNamespacesSupport=true", "UserNamespacesPodSecurityStandards=true"}
		featureGateArgs = append(featureGateArgs, hardcodedFeatureGates...)

-		},
-		{
+		},
+		{
+			name: "feature-gates-custom-no-upgrade-with-empty-enabled-and-disabled-lists",
+			config: func() *Config {
+				c := mkDefaultConfig()
+				c.ApiServer.FeatureGates.FeatureSet = "CustomNoUpgrade"
+				c.ApiServer.FeatureGates.CustomNoUpgrade.Enabled = []string{}
+				c.ApiServer.FeatureGates.CustomNoUpgrade.Disabled = []string{}
+				return c
+			}(),
+			expectErr: true,
+		},
+		{

Conversation

copejon commented Nov 11, 2025

Uh oh!

Uh oh!

Uh oh!

pacevedom Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

copejon Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

agullon Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

copejon Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

agullon Nov 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pmtk Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

copejon Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

copejon Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

copejon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

copejon commented Nov 20, 2025

Uh oh!

openshift-ci bot commented Nov 21, 2025

Uh oh!

pacevedom left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 21, 2025

Uh oh!

copejon commented Nov 21, 2025

Uh oh!

openshift-ci-robot commented Nov 21, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

copejon Nov 21, 2025 •

edited

Loading