OCPBUGS-115159: aws: provision dedicated IAM resources for edge compute pool by tthvo · Pull Request #10836 · openshift/installer

tthvo · 2026-09-01T00:27:20Z

Description

The installer only creates IAM resources for the control-plane and worker pool while the edge (local/wavelength zone) pool has none and re-uses the those of worker nodes.

This introduces a few problems:

If an IAM role is specified for edge pool, it is ignored.
If an IAM role is specified for worker pool, it's also applied to edge pool unexpectedly.
If an IAM instance profile is specified for worker pool, the edge pool references a non-existing default worker profile since the installer doesn't create one.

This PR configures the installer to create dedicated IAM resources for edge pool. When a custom instance profile is defined, that profile continues to be utilized as before.

Summary by CodeRabbit

New Features
- Added support for edge compute pools in AWS IAM configuration.
- AWS machine sets now automatically use role-specific IAM instance profiles.
- IAM roles and profiles are created for configured compute pools, including optional edge pools when applicable.

The installer only creates IAM resources for the control-plane and worker pool while the edge (local/wavelength zone) pool has none and re-uses the those of worker nodes. This introduces a few problems: - If an IAM role is specified for edge pool, it is ignored. - If an IAM role is specified for worker pool, it's also applied to edge pool unexpectedly. - If an IAM instance profile is specified for worker pool, the edge pool references a non-existing default worker profile since the installer doesn't create one.

Worker and edge machine sets both derived the default instance profile name from a hard-coded "-worker-profile" suffix. Use the pool role so edge machine sets reference the edge instance profile instead of pointing to the worker profile.

openshift-merge-bot · 2026-09-01T00:27:23Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-01T00:27:27Z

@tthvo: This pull request references Jira Issue OCPBUGS-115159, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description

The installer only creates IAM resources for the control-plane and worker pool while the edge (local/wavelength zone) pool has none and re-uses the those of worker nodes.

This introduces a few problems:

If an IAM role is specified for edge pool, it is ignored.

If an IAM role is specified for worker pool, it's also applied to edge pool unexpectedly.

If an IAM instance profile is specified for worker pool, the edge pool references a non-existing default worker profile since the installer doesn't create one.

This PR configures the installer to create dedicated IAM resources for edge pool. When a custom instance profile is defined, that profile continues to be utilized as before.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tthvo · 2026-09-01T00:30:32Z

/cc @patrickdillon @mtulio

openshift-ci · 2026-09-01T00:32:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tthvo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-09-01T00:36:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5916f4e8-efca-46ce-ae36-b13152f03a15

📥 Commits

Reviewing files that changed from the base of the PR and between c8d2999 and 03f84e7.

📒 Files selected for processing (4)

pkg/asset/machines/aws/clusterapi_machinesets.go
pkg/asset/machines/aws/clusterapi_machinesets_test.go
pkg/asset/machines/aws/machinesets.go
pkg/infrastructure/aws/clusterapi/iam.go

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Walkthrough

AWS machine sets now generate IAM profiles from the cluster and machine role. AWS IAM provisioning now processes all configured compute pools and supports edge-specific policies, profiles, and roles.

Changes

AWS IAM role and profile support

Layer / File(s)	Summary
Role-specific machine-set profiles `pkg/asset/machines/aws/clusterapi_machinesets.go`, `pkg/asset/machines/aws/machinesets.go`, `pkg/asset/machines/aws/clusterapi_machinesets_test.go`	Default IAM profile names now use the cluster ID and machine role. Tests cover worker and edge pool profiles.
Edge IAM role definitions `pkg/infrastructure/aws/clusterapi/iam.go`	The AWS IAM code defines the edge role and adds its read-only EC2 and region description policy.
Compute pool IAM resolution `pkg/infrastructure/aws/clusterapi/iam.go`	IAM profile and role processing now iterates over configured compute pools and resolves worker and edge overrides by pool name. Optional edge pools without profiles are skipped.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 03f84

The change gives edge compute pools dedicated IAM resources while preserving custom instance-profile behavior, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: provisioning dedicated AWS IAM resources for the edge compute pool.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request adds and changes only static table-test names in `clusterapi_machinesets_test.go`. The tests use standard Go `t.Run(tt.name)`, not Ginkgo title APIs, and every `tt.name` is a literal …
Test Structure And Quality	✅ Passed	PASS. The pull request changes a standard Go `testing.T` table-driven test, not Ginkgo code. The added edge-profile case performs only local `ClusterAPIMachineSets` generation and checks one IAM-profi…
Microshift Test Compatibility	✅ Passed	PASS — The pull request adds no new Ginkgo e2e tests. The changed test uses Go's `testing.T` in `TestClusterAPIMachineSets`; the added cases are table-driven unit-test cases. Therefore the MicroShift …
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The only test change is a standard Go `testing` table test in `pkg/asset/machines/aws/clusterapi_machinesets_test.go`. It validates IAM profile names a…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The pull request changes AWS IAM role/profile selection and default profile names. It does not add or modify deployment manifests, operator scheduling logic, pod affinity, topology spread const…
Ote Binary Stdout Contract	✅ Passed	PASS: The PR adds no process-level stdout writes. Added production code uses `fmt.Sprintf` for values and adds IAM data and control flow. The existing `logrus` calls in `iam.go` are unchanged. Added t…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR adds no new Ginkgo e2e tests. The only changed test file uses Go `testing` with `TestClusterAPIMachineSets` and `t.Run`; it adds no IPv4-only logic or external connectivity. The other cha…
No-Weak-Crypto	✅ Passed	The pull request does not introduce weak cryptography or custom cryptographic code. The four changed Go files only add role-specific IAM profile and policy handling. Added-line analysis found no MD5, …
Container-Privileges	✅ Passed	PASS: The pull request changes only Go IAM and machine-set logic plus tests. The two-commit diff adds no Kubernetes/container manifest and no `privileged`, `hostPID`, `hostNetwork`, `hostIPC`, `SYS_AD…
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive-data logging was introduced. The pull request adds no log calls or log arguments; it only changes IAM profile selection and expands existing IAM reconciliation to edge pools. The existing…

Full details: Stable And Deterministic Test Names

Explanation

The pull request adds and changes only static table-test names in clusterapi_machinesets_test.go. The tests use standard Go t.Run(tt.name), not Ginkgo title APIs, and every tt.name is a literal string. The new IAM titles contain fixed role descriptions only; they contain no generated names, timestamps, UUIDs, node or namespace names, IP addresses, or other run-dependent values. The titles directly describe the behavior under test and are not overly specific.

Full details: Test Structure And Quality

Explanation

PASS. The pull request changes a standard Go testing.T table-driven test, not Ginkgo code. The added edge-profile case performs only local ClusterAPIMachineSets generation and checks one IAM-profile behavior. It creates no cluster resources, uses no waits, and has meaningful t.Fatalf/t.Errorf messages. The changed test follows the existing file's setup and assertion pattern.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request adds no new Ginkgo e2e tests. The changed test uses Go's testing.T in TestClusterAPIMachineSets; the added cases are table-driven unit-test cases. Therefore the MicroShift API and feature compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The only test change is a standard Go testing table test in pkg/asset/machines/aws/clusterapi_machinesets_test.go. It validates IAM profile names and does not assume multiple nodes, HA behavior, scheduling across nodes, or node roles on separate hosts.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The pull request changes AWS IAM role/profile selection and default profile names. It does not add or modify deployment manifests, operator scheduling logic, pod affinity, topology spread constraints, PDBs, replica calculations, or control-plane/worker node selectors. The existing MachineSet worker and edge labels, taints, and replica distribution are unchanged in the PR diff. Therefore, no topology-unaware scheduling constraint is introduced.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The PR adds no process-level stdout writes. Added production code uses fmt.Sprintf for values and adds IAM data and control flow. The existing logrus calls in iam.go are unchanged. Added test output calls are inside per-test validation functions, which the check excludes. No main, init, suite setup, TestMain, klog, or stdout logging configuration changes are present.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The PR adds no new Ginkgo e2e tests. The only changed test file uses Go testing with TestClusterAPIMachineSets and t.Run; it adds no IPv4-only logic or external connectivity. The other changes are production IAM and machine-set code.

Full details: No-Weak-Crypto

Explanation

The pull request does not introduce weak cryptography or custom cryptographic code. The four changed Go files only add role-specific IAM profile and policy handling. Added-line analysis found no MD5, SHA1, RC4, Blowfish, ECB, encryption, or secret/token comparisons. The apparent DES matches are AWS API names such as DescribeInstances, not DES cryptography.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only Go IAM and machine-set logic plus tests. The two-commit diff adds no Kubernetes/container manifest and no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-running setting. Existing privilege-related references are outside the changed files and are pre-existing.

Full details: No-Sensitive-Data-In-Logs

Explanation

No sensitive-data logging was introduced. The pull request adds no log calls or log arguments; it only changes IAM profile selection and expands existing IAM reconciliation to edge pools. The existing debug message logs an IAM instance-profile name, which is an infrastructure identifier, not a password, token, API key, PII, session ID, hostname, or customer payload.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-09-01T00:37:15Z

@tthvo: This pull request references Jira Issue OCPBUGS-115159, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Description

The installer only creates IAM resources for the control-plane and worker pool while the edge (local/wavelength zone) pool has none and re-uses the those of worker nodes.

This introduces a few problems:

If an IAM role is specified for edge pool, it is ignored.

If an IAM role is specified for worker pool, it's also applied to edge pool unexpectedly.

If an IAM instance profile is specified for worker pool, the edge pool references a non-existing default worker profile since the installer doesn't create one.

This PR configures the installer to create dedicated IAM resources for edge pool. When a custom instance profile is defined, that profile continues to be utilized as before.

Summary by CodeRabbit

New Features

Added support for edge compute pools in AWS IAM configuration.

AWS machine sets now automatically use role-specific IAM instance profiles.

IAM roles and profiles are created for configured compute pools, including optional edge pools when applicable.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tthvo · 2026-09-01T00:50:45Z

/test e2e-aws-ovn e2e-aws-default-config
/test e2e-aws-ovn-edge-zones-manifest-validation e2e-aws-ovn-edge-zones e2e-aws-ovn-shared-vpc-edge-zones

tthvo · 2026-09-01T02:35:35Z

/test aws-private e2e-aws-default-config

tthvo · 2026-09-01T05:15:22Z

/pipeline required

openshift-merge-bot · 2026-09-01T05:15:25Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn

tthvo · 2026-09-01T06:43:17Z

/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-shared-vpc-edge-zones

These e2es failed because no preferred instance type was found for the selected zones. However, they previously passed with the same commit for other local/wavelength zones.

This is expected as some zones have limited capacity and we also randomize zone selection in CI.

openshift-ci · 2026-09-01T10:35:11Z

@tthvo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-heterogeneous	`03f84e7`	link	false	`/test e2e-aws-ovn-heterogeneous`
ci/prow/e2e-aws-ovn-single-node	`03f84e7`	link	false	`/test e2e-aws-ovn-single-node`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tthvo added 2 commits August 31, 2026 16:52

openshift-ci Bot requested review from mtulio and patrickdillon September 1, 2026 00:30

Uh oh!

Conversation

tthvo commented Sep 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Sep 1, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Description

Uh oh!

tthvo commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Description

Summary by CodeRabbit

Uh oh!

tthvo commented Sep 1, 2026

Uh oh!

tthvo commented Sep 1, 2026

Uh oh!

tthvo commented Sep 1, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 1, 2026

Uh oh!

tthvo commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tthvo commented Sep 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading