Skip to content

OCPBUGS-74511: Remove RouteExternalCertificate feature gate - #2962

Open
jcmoraisjr wants to merge 1 commit into
openshift:masterfrom
jcmoraisjr:OCPBUGS-74511-remove-featuregate-v2
Open

OCPBUGS-74511: Remove RouteExternalCertificate feature gate#2962
jcmoraisjr wants to merge 1 commit into
openshift:masterfrom
jcmoraisjr:OCPBUGS-74511-remove-featuregate-v2

Conversation

@jcmoraisjr

Copy link
Copy Markdown
Member

RouteExternalCertificate is enabled by default, this update is removing its declaration from the legacy featuregates list, from CRD declarations and from type annotations.

This PR is reapplying #2693, which was reverted by #2862 due to the missing to bump o/kubernetes in o/origin. This bump was done via openshift/origin#31237.

https://redhat.atlassian.net/browse/OCPBUGS-74511

RouteExternalCertificate is enabled by default, this update is removing
its declaration from the legacy featuregates list, from CRD
declarations and from type annotations.

https://redhat.atlassian.net/browse/OCPBUGS-74511
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 30, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@jcmoraisjr: This pull request references Jira Issue OCPBUGS-74511, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @melvinjoseph86

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

RouteExternalCertificate is enabled by default, this update is removing its declaration from the legacy featuregates list, from CRD declarations and from type annotations.

This PR is reapplying #2693, which was reverted by #2862 due to the missing to bump o/kubernetes in o/origin. This bump was done via openshift/origin#31237.

https://redhat.atlassian.net/browse/OCPBUGS-74511

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Hello @jcmoraisjr! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@openshift-ci
openshift-ci Bot requested a review from melvinjoseph86 July 30, 2026 12:33
@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 81b7ca92-57b5-47fe-ad48-94ba580cb602

📥 Commits

Reviewing files that changed from the base of the PR and between 72624b9 and 5ab63ae.

⛔ Files ignored due to path filters (4)
  • route/v1/zz_generated.crd-manifests/routes.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • route/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/zz_generated*
  • route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/AAA_ungated.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/RouteExternalCertificate.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
📒 Files selected for processing (15)
  • features.md
  • features/features.go
  • features/legacyfeaturegates.go
  • payload-command/render/legacyfeaturegates.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
  • route/v1/generated.proto
  • route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml
  • route/v1/types.go
💤 Files with no reviewable changes (13)
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • features.md
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
  • payload-command/render/legacyfeaturegates.go
  • payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
  • features/legacyfeaturegates.go
  • route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • features/features.go

📝 Walkthrough

Walkthrough

The RouteExternalCertificate feature gate was removed from feature documentation, global and legacy registrations, and 4.10 payload manifests. TLSConfig externalCertificate is no longer guarded by that gate, while mutual exclusivity with certificate is enforced unconditionally. The related route test no longer configures the removed feature gate.

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main change: removing the RouteExternalCertificate feature gate.
Description check ✅ Passed The description matches the changeset and explains the gate removal and its context.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo test titles were added or changed; the only touched test fixture uses static YAML test names.
Test Structure And Quality ✅ Passed No Ginkgo test code changed; the only test artifact is declarative YAML with a single onCreate case, so the Ginkgo-specific checklist isn’t applicable.
Microshift Test Compatibility ✅ Passed No new Ginkgo tests were added; the only test manifest uses the Route API (MicroShift-supported) and removes feature-gate enablement, so no unsupported MicroShift assumptions.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo/e2e tests were added; the diff only changes feature-gate/CRD metadata and YAML schema fixtures, not SNO-sensitive test logic.
Topology-Aware Scheduling Compatibility ✅ Passed Touched files only remove RouteExternalCertificate feature-gate/CRD annotations; no node selectors, affinity, spreads, PDBs, or replica logic were added.
Ote Binary Stdout Contract ✅ Passed Touched files only adjust feature-gate declarations and CRD annotations; no main/init/TestMain/suite setup or stdout logging writes were added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No Ginkgo e2e test code was added or changed; the only test-related edit is YAML metadata removing a featureGates entry.
No-Weak-Crypto ✅ Passed Touched files only change feature gates and validation markers; targeted scans found no weak crypto primitives or non-constant-time secret comparisons.
Container-Privileges ✅ Passed The diff only removes RouteExternalCertificate feature-gate declarations and updates route validation; no privileged, hostPID, hostNetwork, hostIPC, or allowPrivilegeEscalation settings are added.
No-Sensitive-Data-In-Logs ✅ Passed No logging code was added or changed; the diff only updates feature-gate/CRD metadata and schema comments, with no log calls or sensitive data in logs.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jul 30, 2026
@qodo-for-rh-openshift

Copy link
Copy Markdown

PR Summary by Qodo

Remove RouteExternalCertificate feature gate and ungate Route externalCertificate

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

Grey Divider

AI Description

• Remove RouteExternalCertificate from legacy feature gate registries and payload FeatureGate
 manifests.
• Ungate Route TLS externalCertificate field and validations across types and generated CRDs.
• Update feature documentation and CRD tests to reflect default enablement.
Diagram

graph TD
  FG["Feature gate registry"] --> LG["Legacy gate lists"] --> PF["Payload FeatureGate YAMLs"]
  RT["Route API types"] --> CRD["Generated Route CRDs"] --> TEST["CRD schema tests"]
  RT --> DOC["features.md"]
Loading
High-Level Assessment

Removing the feature gate is the right approach now that RouteExternalCertificate is enabled by default: it eliminates redundant gating surfaces (registration, legacy lists, payload manifests, and featuregated CRD variants) and makes the schema/validation uniformly enforced via standard XValidation.

Files changed (18) +24 / -47

Enhancement (2) +2 / -4
generated.protoUngate TLS externalCertificate proto annotations and validation +1/-2

Ungate TLS externalCertificate proto annotations and validation

• Converts the FeatureGateAware XValidation to a standard kubebuilder XValidation and removes the feature-gate enable annotation for externalCertificate, making the mutual-exclusion rule unconditional in the schema annotations.

route/v1/generated.proto

types.goUngate TLSConfig.ExternalCertificate field and validation in Go types +1/-2

Ungate TLSConfig.ExternalCertificate field and validation in Go types

• Replaces the FeatureGateAware XValidation with an unconditional XValidation and removes the feature-gate enable annotation from the ExternalCertificate field.

route/v1/types.go

Refactor (1) +0 / -8
features.goUnregister RouteExternalCertificate feature gate +0/-8

Unregister RouteExternalCertificate feature gate

• Removes the RouteExternalCertificate feature gate definition from the central feature gate registry to prevent it from being referenced as a configurable gate.

features/features.go

Tests (1) +0 / -2
RouteExternalCertificate.yamlRemove feature gate requirement from RouteExternalCertificate schema tests +0/-2

Remove feature gate requirement from RouteExternalCertificate schema tests

• Deletes the featureGates stanza from the Route CRD schema test input, reflecting that the behavior is no longer gated.

route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml

Documentation (1) +0 / -1
features.mdRemove RouteExternalCertificate from feature matrix docs +0/-1

Remove RouteExternalCertificate from feature matrix docs

• Drops the RouteExternalCertificate row from the documented feature list, reflecting that it is no longer managed as a feature gate.

features.md

Other (13) +22 / -32
legacyfeaturegates.goRemove RouteExternalCertificate from legacy feature gate set +0/-2

Remove RouteExternalCertificate from legacy feature gate set

• Deletes RouteExternalCertificate from the legacy feature gate allowlist to stop advertising it as a legacy gate.

features/legacyfeaturegates.go

legacyfeaturegates.goAlign payload render legacy gates with removal +0/-2

Align payload render legacy gates with removal

• Removes RouteExternalCertificate from the legacy feature gate set used by payload rendering tooling for consistency with the canonical list.

payload-command/render/legacyfeaturegates.go

featureGate-4-10-Hypershift-Default.yamlStop listing RouteExternalCertificate in Hypershift Default feature set +0/-3

Stop listing RouteExternalCertificate in Hypershift Default feature set

• Removes the RouteExternalCertificate entry from the enabled feature list in the Hypershift Default FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yamlStop listing RouteExternalCertificate in Hypershift DevPreviewNoUpgrade +0/-3

Stop listing RouteExternalCertificate in Hypershift DevPreviewNoUpgrade

• Removes the RouteExternalCertificate entry from the Hypershift DevPreviewNoUpgrade FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml

featureGate-4-10-Hypershift-OKD.yamlStop listing RouteExternalCertificate in Hypershift OKD feature set +0/-3

Stop listing RouteExternalCertificate in Hypershift OKD feature set

• Removes the RouteExternalCertificate entry from the Hypershift OKD FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yamlStop listing RouteExternalCertificate in Hypershift TechPreviewNoUpgrade +0/-3

Stop listing RouteExternalCertificate in Hypershift TechPreviewNoUpgrade

• Removes the RouteExternalCertificate entry from the Hypershift TechPreviewNoUpgrade FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-Default.yamlStop listing RouteExternalCertificate in SelfManagedHA Default feature set +0/-3

Stop listing RouteExternalCertificate in SelfManagedHA Default feature set

• Removes the RouteExternalCertificate entry from the SelfManagedHA Default FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yamlStop listing RouteExternalCertificate in SelfManagedHA DevPreviewNoUpgrade +0/-3

Stop listing RouteExternalCertificate in SelfManagedHA DevPreviewNoUpgrade

• Removes the RouteExternalCertificate entry from the SelfManagedHA DevPreviewNoUpgrade FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-OKD.yamlStop listing RouteExternalCertificate in SelfManagedHA OKD feature set +0/-3

Stop listing RouteExternalCertificate in SelfManagedHA OKD feature set

• Removes the RouteExternalCertificate entry from the SelfManagedHA OKD FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yamlStop listing RouteExternalCertificate in SelfManagedHA TechPreviewNoUpgrade +0/-3

Stop listing RouteExternalCertificate in SelfManagedHA TechPreviewNoUpgrade

• Removes the RouteExternalCertificate entry from the SelfManagedHA TechPreviewNoUpgrade FeatureGate payload manifest.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

routes.crd.yamlEnsure mutual-exclusion validation is present in generated Route CRD +2/-2

Ensure mutual-exclusion validation is present in generated Route CRD

• Reorders/ensures the x-kubernetes-validations list contains the rule forbidding both tls.certificate and tls.externalCertificate without relying on feature-gated manifests.

route/v1/zz_generated.crd-manifests/routes.crd.yaml

zz_generated.featuregated-crd-manifests.yamlRemove RouteExternalCertificate from CRD feature-gate metadata +1/-2

Remove RouteExternalCertificate from CRD feature-gate metadata

• Updates the generated featuregated CRD manifest metadata to an empty FeatureGates list for routes.route.openshift.io.

route/v1/zz_generated.featuregated-crd-manifests.yaml

AAA_ungated.yamlMove externalCertificate schema into ungated Route CRD variant +19/-0

Move externalCertificate schema into ungated Route CRD variant

• Adds the externalCertificate property and the certificate/externalCertificate mutual-exclusion validation into the ungated CRD variant so the field is always present without a dedicated feature-gated CRD manifest.

route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/AAA_ungated.yaml

@openshift-ci
openshift-ci Bot requested review from Miciah and everettraven July 30, 2026 12:35
@qodo-for-rh-openshift

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (1) 📜 Skill insights (0)

Context used
⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials
✅ Compliance rules (platform): 29 rules
✅ Skills: api-review

Grey Divider


Remediation recommended

1. Undocumented TLSConfig XValidation rule 📘 Rule violation ⚙ Maintainability
Description
TLSConfig has a new +kubebuilder:validation:XValidation rule without a plain-language Go comment
explaining the cross-field constraint. This reduces API clarity and violates the requirement to
document XValidation rules in comments.
Code

route/v1/types.go[R422-425]

// TLSConfig defines config used to secure a route and provide termination
//
// +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow"
-// +openshift:validation:FeatureGateAwareXValidation:featureGate=RouteExternalCertificate,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
+// +kubebuilder:validation:XValidation:rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
Relevance

●●● Strong

Team often requests clearer validation documentation/comments; accepted examples around
XValidation/comment clarity in PRs #2851 and #2680.

PR-#2851
PR-#2680

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
PR Compliance ID 196 requires a natural-language comment immediately above each
+kubebuilder:validation:XValidation marker describing the cross-field rule. In
route/v1/types.go, the newly added XValidation for certificate vs externalCertificate appears
without any such explanatory comment line above it.

Rule 196: Document XValidation rules in Go comments for CRD fields
route/v1/types.go[422-425]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`TLSConfig` includes a `+kubebuilder:validation:XValidation` marker, but the surrounding Go doc comment does not explain (in plain language) what the rule enforces.

## Issue Context
The compliance requirement expects a human-readable explanation immediately above the XValidation marker so readers understand the cross-field constraint without parsing CEL/annotation syntax.

## Fix Focus Areas
- route/v1/types.go[422-425]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Informational

2. Stale test gating docs 🐞 Bug ⚙ Maintainability
Description
The PR removes the featureGates requirement from the RouteExternalCertificate test suite YAML,
making that suite run as ungated, but README.md still presents it as an example of a feature-gated
test for RouteExternalCertificate. This mismatch can mislead contributors about how to
author/associate feature-gated API validation tests.
Code

route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml[L4-5]

-featureGates:
-- RouteExternalCertificate
Relevance

●● Moderate

Docs/test gating mismatches occasionally flagged, but no clear accepted precedent; similar
featureGate cleanups in PR #2693.

PR-#2693
PR-#2706

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The suite file no longer declares any required featureGates, while the README still describes it
as a feature-gated example; the test harness explicitly treats missing/empty feature gates as
ungated and runs such suites against all CRD files for that CRD name.

route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml[1-6]
README.md[55-82]
tests/crd_filter.go[24-53]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml` is no longer feature-gated (the `featureGates` field was removed), but README.md still documents it as a feature-gated example for `RouteExternalCertificate`.

## Issue Context
The test runner treats an empty/missing `featureGates` list as an ungated suite and runs it against all matching CRD manifests.

## Fix Focus Areas
- README.md[55-82]
- route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml[1-6]

## Suggested fix
- Update README.md to remove/replace the `RouteExternalCertificate.yaml` “feature-gated example” section (since the gate was removed), or rewrite it to reflect the new ungated state.
- (Optional but clearer) Rename `RouteExternalCertificate.yaml` to a non-featuregate-specific filename (keeping it under the same tests directory), since it now contains ungated validation tests.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

To customize comments, go to the Qodo configuration screen, or learn more in the docs.

Qodo Logo

Comment thread route/v1/types.go
Comment on lines 422 to +425
// TLSConfig defines config used to secure a route and provide termination
//
// +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=RouteExternalCertificate,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
// +kubebuilder:validation:XValidation:rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Undocumented tlsconfig xvalidation rule 📘 Rule violation ⚙ Maintainability

TLSConfig has a new +kubebuilder:validation:XValidation rule without a plain-language Go comment
explaining the cross-field constraint. This reduces API clarity and violates the requirement to
document XValidation rules in comments.
Agent Prompt
## Issue description
`TLSConfig` includes a `+kubebuilder:validation:XValidation` marker, but the surrounding Go doc comment does not explain (in plain language) what the rule enforces.

## Issue Context
The compliance requirement expects a human-readable explanation immediately above the XValidation marker so readers understand the cross-field constraint without parsing CEL/annotation syntax.

## Fix Focus Areas
- route/v1/types.go[422-425]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Comment on lines -4 to -5
featureGates:
- RouteExternalCertificate

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Informational

2. Stale test gating docs 🐞 Bug ⚙ Maintainability

The PR removes the featureGates requirement from the RouteExternalCertificate test suite YAML,
making that suite run as ungated, but README.md still presents it as an example of a feature-gated
test for RouteExternalCertificate. This mismatch can mislead contributors about how to
author/associate feature-gated API validation tests.
Agent Prompt
## Issue description
`route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml` is no longer feature-gated (the `featureGates` field was removed), but README.md still documents it as a feature-gated example for `RouteExternalCertificate`.

## Issue Context
The test runner treats an empty/missing `featureGates` list as an ungated suite and runs it against all matching CRD manifests.

## Fix Focus Areas
- README.md[55-82]
- route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml[1-6]

## Suggested fix
- Update README.md to remove/replace the `RouteExternalCertificate.yaml` “feature-gated example” section (since the gate was removed), or rewrite it to reflect the new ungated state.
- (Optional but clearer) Rename `RouteExternalCertificate.yaml` to a non-featuregate-specific filename (keeping it under the same tests directory), since it now contains ungated validation tests.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

@JoelSpeed

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 30, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 30, 2026
@melvinjoseph86

Copy link
Copy Markdown

based on RouteExternalCertificate, i am marking this as verified
/verified by @mjoseph

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 30, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@melvinjoseph86: This PR has been marked as verified by @mjoseph.

Details

In response to this:

based on RouteExternalCertificate, i am marking this as verified
/verified by @mjoseph

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 72624b9 and 2 for PR HEAD 5ab63ae in total

@melvinjoseph86

Copy link
Copy Markdown

/retest-required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 05ea89d and 1 for PR HEAD 5ab63ae in total

@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@jcmoraisjr: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify-hypershift-integration 5ab63ae link true /test verify-hypershift-integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants