Skip to content

OCPBUGS-74511: Remove RouteExternalCertificate feature gate #2962

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jcmoraisjr wants to merge 1 commit into
base: master
Choose a base branch
from
Open

OCPBUGS-74511: Remove RouteExternalCertificate feature gate #2962

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion features.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,6 @@
| MutableCSINodeAllocatableCount| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
| MutatingAdmissionPolicy| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
| OpenShiftPodSecurityAdmission| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
| RouteExternalCertificate| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
| ServiceAccountTokenNodeBinding| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
| SigstoreImageVerification| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
| SigstoreImageVerificationPKI| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
Expand Down
8 changes: 0 additions & 8 deletions features/features.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,14 +178,6 @@ var (
enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
mustRegister()

FeatureGateRouteExternalCertificate = newFeatureGate("RouteExternalCertificate").
reportProblemsToJiraComponent("router").
contactPerson("chiragkyal").
productScope(ocpSpecific).
enhancementPR(legacyFeatureGateWithoutEnhancement).
enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
mustRegister()

FeatureGateNetworkConnect = newFeatureGate("NetworkConnect").
reportProblemsToJiraComponent("Networking/ovn-kubernetes").
contactPerson("tssurya").
Expand Down
2 changes: 0 additions & 2 deletions features/legacyfeaturegates.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,6 @@ var legacyFeatureGates = sets.New(
// never add to this list, if you think you have an exception ask @deads2k
"PrivateHostedZoneAWS",
// never add to this list, if you think you have an exception ask @deads2k
"RouteExternalCertificate",
// never add to this list, if you think you have an exception ask @deads2k
"SetEIPForNLBIngressController",
// never add to this list, if you think you have an exception ask @deads2k
"SignatureStores",
Expand Down
2 changes: 0 additions & 2 deletions payload-command/render/legacyfeaturegates.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,8 +87,6 @@ var legacyFeatureGates = sets.New(
// never add to this list, if you think you have an exception ask @deads2k
"PrivateHostedZoneAWS",
// never add to this list, if you think you have an exception ask @deads2k
"RouteExternalCertificate",
// never add to this list, if you think you have an exception ask @deads2k
"SetEIPForNLBIngressController",
// never add to this list, if you think you have an exception ask @deads2k
"SignatureStores",
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,9 +364,6 @@
{
"name": "OpenShiftPodSecurityAdmission"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "ServiceAccountTokenNodeBinding"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,9 +342,6 @@
{
"name": "ProvisioningRequestAvailable"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "SELinuxMount"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,9 +366,6 @@
{
"name": "OpenShiftPodSecurityAdmission"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "ServiceAccountTokenNodeBinding"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,9 +342,6 @@
{
"name": "OpenShiftPodSecurityAdmission"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "SELinuxMount"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,9 +364,6 @@
{
"name": "OpenShiftPodSecurityAdmission"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "ServiceAccountTokenNodeBinding"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,9 +342,6 @@
{
"name": "ProvisioningRequestAvailable"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "SELinuxMount"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,9 +366,6 @@
{
"name": "OpenShiftPodSecurityAdmission"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "ServiceAccountTokenNodeBinding"
},
Expand Down
3 changes: 0 additions & 3 deletions payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,9 +342,6 @@
{
"name": "OpenShiftPodSecurityAdmission"
},
{
"name": "RouteExternalCertificate"
},
{
"name": "SELinuxMount"
},
Expand Down
3 changes: 1 addition & 2 deletions route/v1/generated.proto
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 0 additions & 2 deletions route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
name: "Route"
crdName: routes.route.openshift.io
featureGates:
- RouteExternalCertificate
Comment on lines -4 to -5

@qodo-for-rh-openshift qodo-for-rh-openshift Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Informational

2. Stale test gating docs 🐞 Bug ⚙ Maintainability

The PR removes the featureGates requirement from the RouteExternalCertificate test suite YAML,
making that suite run as ungated, but README.md still presents it as an example of a feature-gated
test for RouteExternalCertificate. This mismatch can mislead contributors about how to
author/associate feature-gated API validation tests.
Agent Prompt 
## Issue description
`route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml` is no longer feature-gated (the `featureGates` field was removed), but README.md still documents it as a feature-gated example for `RouteExternalCertificate`.

## Issue Context
The test runner treats an empty/missing `featureGates` list as an ungated suite and runs it against all matching CRD manifests.

## Fix Focus Areas
- README.md[55-82]
- route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml[1-6]

## Suggested fix
- Update README.md to remove/replace the `RouteExternalCertificate.yaml` “feature-gated example” section (since the gate was removed), or rewrite it to reflect the new ungated state.
- (Optional but clearer) Rename `RouteExternalCertificate.yaml` to a non-featuregate-specific filename (keeping it under the same tests directory), since it now contains ungated validation tests.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

tests:
onCreate:
- name: Should be able to create a minimal Route
Expand Down
3 changes: 1 addition & 2 deletions route/v1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,7 +422,7 @@ type RouterShard struct {
// TLSConfig defines config used to secure a route and provide termination
//
// +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=RouteExternalCertificate,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
// +kubebuilder:validation:XValidation:rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
Comment on lines 422 to +425

@qodo-for-rh-openshift qodo-for-rh-openshift Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Undocumented tlsconfig xvalidation rule 📘 Rule violation ⚙ Maintainability

TLSConfig has a new +kubebuilder:validation:XValidation rule without a plain-language Go comment
explaining the cross-field constraint. This reduces API clarity and violates the requirement to
document XValidation rules in comments.
Agent Prompt 
## Issue description
`TLSConfig` includes a `+kubebuilder:validation:XValidation` marker, but the surrounding Go doc comment does not explain (in plain language) what the rule enforces.

## Issue Context
The compliance requirement expects a human-readable explanation immediately above the XValidation marker so readers understand the cross-field constraint without parsing CEL/annotation syntax.

## Fix Focus Areas
- route/v1/types.go[422-425]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

type TLSConfig struct {
// termination indicates the TLS termination type.
//
Expand Down Expand Up @@ -475,7 +475,6 @@ type TLSConfig struct {
// The router service account needs to be granted with read-only access to this secret,
// please refer to openshift docs for additional details.
//
// +openshift:enable:FeatureGate=RouteExternalCertificate
// +optional
ExternalCertificate *LocalObjectReference `json:"externalCertificate,omitempty" protobuf:"bytes,7,opt,name=externalCertificate"`
}
Expand Down
4 changes: 2 additions & 2 deletions route/v1/zz_generated.crd-manifests/routes.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,13 +558,13 @@ spec:
- termination
type: object
x-kubernetes-validations:
- message: cannot have both spec.tls.certificate and spec.tls.externalCertificate
rule: '!(has(self.certificate) && has(self.externalCertificate))'
- message: 'cannot have both spec.tls.termination: passthrough and
spec.tls.insecureEdgeTerminationPolicy: Allow'
rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy)
? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow''))
: true'
- message: cannot have both spec.tls.certificate and spec.tls.externalCertificate
rule: '!(has(self.certificate) && has(self.externalCertificate))'
to:
description: |-
to is an object the route should use as the primary backend. Only the Service kind
Expand Down
3 changes: 1 addition & 2 deletions route/v1/zz_generated.featuregated-crd-manifests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ routes.route.openshift.io:
CRDName: routes.route.openshift.io
Capability: ""
Category: ""
FeatureGates:
- RouteExternalCertificate
FeatureGates: []
FilenameOperatorName: ""
FilenameOperatorOrdering: ""
FilenameRunLevel: ""
Expand Down
19 changes: 19 additions & 0 deletions route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,23 @@ spec:
the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically
verify.
type: string
externalCertificate:
description: |-
externalCertificate provides certificate contents as a secret reference.
This should be a single serving certificate, not a certificate
chain. Do not include a CA certificate. The secret referenced should
be present in the same namespace as that of the Route.
Forbidden when `certificate` is set.
The router service account needs to be granted with read-only access to this secret,
please refer to openshift docs for additional details.
properties:
name:
description: |-
name of the referent.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
insecureEdgeTerminationPolicy:
description: |-
insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While
Expand Down Expand Up @@ -489,6 +506,8 @@ spec:
rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy)
? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow''))
: true'
- message: cannot have both spec.tls.certificate and spec.tls.externalCertificate
rule: '!(has(self.certificate) && has(self.externalCertificate))'
to:
description: |-
to is an object the route should use as the primary backend. Only the Service kind
Expand Down
Loading