Ephemeral Cluster Controller: Add provisioning metrics and standard conditions

[danilo-gemoli]

This PR brings several improvements:

• Migrated from custom EphemeralClusterCondition to standard metav1.Condition
• Added EventRecorder to both reconciler and prowJobReconciler
• MaxConcurrentReconciles configurable as a command line parameter
• Added the following metrics: ephemeralcluster_count, ephemeralcluster_provisioning_duration_seconds, ephemeralcluster_deprovisioning_duration_seconds

/label tide/merge-method-squash

Summary

The Ephemeral Cluster Controller now uses standard Kubernetes metav1.Condition objects with observed-generation tracking. Its CRD schema and printer columns reflect the updated status model.

The controller now records Kubernetes events for validation, provisioning, ProwJob lifecycle changes, readiness, errors, and deprovisioning. CI operators receive clearer visibility into cluster lifecycle actions.

Operators can configure reconciliation parallelism with the maxConcurrentReconciles command-line flag. The setting applies to both EphemeralCluster and ProwJob reconciliation.

The controller adds metrics for cluster counts and provisioning and deprovisioning durations. It removes the obsolete EphemeralClusterStatus CRD and updates tests and fixtures for the new conditions and events.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f62bac8d-54f1-4678-abf8-67cc6ee2bb67

📥 Commits

Reviewing files that changed from the base of the PR and between 00fc95d and aed1af3.

📒 Files selected for processing (1)

• pkg/controller/ephemeralcluster/reconciler.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift/release (manual)
• openshift/ci-docs (manual)
• openshift/release-controller (manual)
• openshift/ci-chat-bot (manual)

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/controller/ephemeralcluster/reconciler.go

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The change standardizes EphemeralCluster conditions on metav1.Condition, adds lifecycle printer columns and Kubernetes events, exposes configurable reconciliation concurrency, updates ProwJob abortion handling, and expands reconciliation tests.

Changes

EphemeralCluster controller

Layer / File(s)	Summary
Condition contract and status schema pkg/api/ephemeralcluster/v1/types.go, pkg/api/ephemeralcluster/v1/ci.openshift.io_ephemeralclusters.yaml, pkg/controller/ephemeralcluster/reconciler.go	Status conditions now use Kubernetes condition metadata, validation, observed generations, and list-map markers. Printer columns expose the ProwJob ID and lifecycle phase.
Generation-aware reconciliation and events pkg/controller/ephemeralcluster/reconciler.go, pkg/controller/ephemeralcluster/prowjobreconciler.go, pkg/controller/ephemeralcluster/metrics.go	Reconcilers update generation-aware conditions and record validation, ProwJob, credential, readiness, deprovisioning, and abortion events. Metrics use Kubernetes condition statuses.
Configurable reconciliation concurrency cmd/dptp-controller-manager/main.go, pkg/controller/ephemeralcluster/reconciler.go, pkg/controller/ephemeralcluster/prowjobreconciler.go	A command-line flag configures maximum reconciliation concurrency for both controllers. The default is 1.
Reconciliation tests and fixtures pkg/controller/ephemeralcluster/reconciler_test.go, pkg/controller/ephemeralcluster/prowjobreconciler_test.go, pkg/controller/ephemeralcluster/testdata/*, pkg/controller/ephemeralcluster/testutil_test.go	Tests and fixtures use metav1.Condition and verify recorded events across creation, reconciliation, and deletion flows.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to aed1a

The PR adds provisioning metrics, standard conditions, event recording, and configurable reconciliation concurrency without any identified actionable merge-blocking risk at the current head.

Suggested reviewers: psalajova, smg247

🚥 Pre-merge checks | ✅ 15 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Coverage For New Features	⚠️ Warning	The pull request adds WithMaxConcurrentReconciles, but no unit test references or invokes it. The new command-line flag and its custom-value wiring also have no parser or wiring test. The change to …	Add table-driven unit tests for WithMaxConcurrentReconciles, including default and custom values, and test command-line parsing for the new flag. Add a regression case that reaches abortProwJob with each non-aborted final state and veri…

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Ephemeral Cluster Controller and its two main changes: provisioning metrics and standard conditions. It is concise and related to the pull request objectives.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	No Go error-handling failure was introduced. The diff adds no new ignored error returns and no panic calls. The changed EphemeralCluster GET path still wraps errors with `fmt.Errorf("get ephemeral clu…
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request does not add or change any Ginkgo test title. The changed Go tests use standard testing with static t.Run(tc.name, ...) names. The test function names and all table-case nam…
Test Structure And Quality	✅ Passed	PASS: The changed tests are standard Go table-driven tests using testing.T and t.Run; they contain no Ginkgo It, BeforeEach, AfterEach, Eventually, or Consistently blocks. The tests use …
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added. The pull request only modifies existing Go unit tests under pkg/controller/ephemeralcluster, which use the standard testing package and Test... functions. The…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds no new Ginkgo e2e tests. The only modified Go test files use standard func Test... functions, and the PR patch adds no It, Describe, Context, or When declarations…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — the pull request does not introduce a topology-dependent pod scheduling constraint. The diff changes controller concurrency, event recording, conditions, metrics, and CRD schemas. The new concu…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request adds no process-level stdout writes. The only changed main-process code adds a flag and passes its value to the controller. New record.Event calls publish Kubernetes events an…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR adds no Ginkgo e2e tests. The changed test files use standard Go Test... functions, and the added test code only checks fake Kubernetes events and conditions. No IPv4 assumptions or ext…
No-Weak-Crypto	✅ Passed	No weak cryptography was introduced. The pull-request diff adds no crypto imports or uses of MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB. The added comparisons operate on condition metadata such as `T…
Container-Privileges	✅ Passed	No container privilege violation was introduced. The PR changes a CRD, status fixtures, and Go controller logic. The changed YAML contains a CustomResourceDefinition and status data, not a Pod or othe…
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data is introduced into logs or event messages. The new events contain fixed status text, ProwJob names/states, cluster identifiers, and validation errors containing cluster/tenant/profil…

Full details: Go Error Handling

Explanation

No Go error-handling failure was introduced. The diff adds no new ignored error returns and no panic calls. The changed EphemeralCluster GET path still wraps errors with fmt.Errorf("get ephemeral cluster: %w", err). New controller setup errors remain checked and wrapped. New event-recorder calls do not return errors, and production reconcilers initialize the recorder from the manager; tests initialize fake recorders. The existing UniqueAdd boolean discard is unchanged from main.

Full details: Test Coverage For New Features

Explanation

The pull request adds WithMaxConcurrentReconciles, but no unit test references or invokes it. The new command-line flag and its custom-value wiring also have no parser or wiring test. The change to abortProwJob is a bug fix: it now skips ErrorState, FailureState, and SuccessState, but the tests cover only AbortedState in that path. The existing success test exercises final-state reporting, not abortion. Event emission and condition migration are covered by the updated table-driven reconciliation tests.

Resolution

Add table-driven unit tests for WithMaxConcurrentReconciles, including default and custom values, and test command-line parsing for the new flag. Add a regression case that reaches abortProwJob with each non-aborted final state and verifies that the ProwJob is not updated or re-aborted. Keep the existing event and condition assertions.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request does not add or change any Ginkgo test title. The changed Go tests use standard testing with static t.Run(tc.name, ...) names. The test function names and all table-case names are identical to origin/main. No dynamic name construction or generated identifiers appear in the changed test code.

Full details: Test Structure And Quality

Explanation

PASS: The changed tests are standard Go table-driven tests using testing.T and t.Run; they contain no Ginkgo It, BeforeEach, AfterEach, Eventually, or Consistently blocks. The tests use in-memory controller-runtime fake clients and fake event recorders, so they do not create persistent cluster resources or perform indefinite cluster waits. Added event assertions use the diagnostic message events differ, and existing test failures include contextual t.Errorf/t.Fatalf messages.

Full details: Microshift Test Compatibility

Explanation

No new Ginkgo e2e tests were added. The pull request only modifies existing Go unit tests under pkg/controller/ephemeralcluster, which use the standard testing package and Test... functions. The change set contains no test/** e2e files or Ginkgo declarations, so the MicroShift compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request adds no new Ginkgo e2e tests. The only modified Go test files use standard func Test... functions, and the PR patch adds no It, Describe, Context, or When declarations. The changed tests are controller unit tests, so the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — the pull request does not introduce a topology-dependent pod scheduling constraint. The diff changes controller concurrency, event recording, conditions, metrics, and CRD schemas. The new concurrency flag only sets controller-runtime MaxConcurrentReconciles. No deployment manifest, replica count, affinity, topology spread constraint, node selector, toleration, or PodDisruptionBudget was added or modified. The existing generated ProwJob scheduling call is unchanged.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request adds no process-level stdout writes. The only changed main-process code adds a flag and passes its value to the controller. New record.Event calls publish Kubernetes events and do not write to stdout. main() logging initialization and existing logrus calls are unchanged. No fmt.Print*, os.Stdout, Ginkgo suite setup, or new klog output appears in the changed files.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The PR adds no Ginkgo e2e tests. The changed test files use standard Go Test... functions, and the added test code only checks fake Kubernetes events and conditions. No IPv4 assumptions or external connectivity requirements were introduced.

Full details: No-Weak-Crypto

Explanation

No weak cryptography was introduced. The pull-request diff adds no crypto imports or uses of MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB. The added comparisons operate on condition metadata such as Type and Status, not secrets or tokens. Secret handling only reads and stores Kubernetes Secret data.

Full details: Container-Privileges

Explanation

No container privilege violation was introduced. The PR changes a CRD, status fixtures, and Go controller logic. The changed YAML contains a CustomResourceDefinition and status data, not a Pod or other container manifest. No added privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or root execution setting was found. The privilegedTenants references are controller tenant configuration, not container privileges.

Full details: No-Sensitive-Data-In-Logs

Explanation

No sensitive data is introduced into logs or event messages. The new events contain fixed status text, ProwJob names/states, cluster identifiers, and validation errors containing cluster/tenant/profile identifiers. The credential bytes read from Secrets are only placed in Secret data and are never formatted into a log or event. Existing WithError log calls remain unchanged; the new error events do not receive credential values.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danilo-gemoli, jmguzik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [danilo-gemoli,jmguzik]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e

[danilo-gemoli]

/override ci/prow/e2e

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/e2e

Details

In response to this:

/override ci/prow/e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 8e471f3 and 2 for PR HEAD aed1af3 in total

[danilo-gemoli]

/override ci/prow/images

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/images

Details

In response to this:

/override ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[danilo-gemoli]

/override ci/prow/images

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/images

Details

In response to this:

/override ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@danilo-gemoli: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.