OPRUN-4705: Remove NewOLMPreflightPermissionChecks FeatureGate

[pedjak]

Summary

• Remove the FeatureGateNewOLMPreflightPermissionChecks definition from features/features.go
• Regenerate features.md and all payload-manifests/featuregates/ YAML files

Context

The upstream PreflightPermissions feature gate was removed from operator-controller (operator-framework/operator-controller#767) and the downstream mapping was removed from cluster-olm-operator (cluster-olm-operator#222). The gate definition in openshift/api is now dead weight — it is listed as enabled in TechPreview/DevPreview profiles but nothing acts on it.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @pedjak! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

📝 Walkthrough

Walkthrough

Removed the NewOLMPreflightPermissionChecks feature gate declaration and feature matrix row. Updated Hypershift and SelfManagedHA feature gate manifests to remove the gate from disabled or enabled lists, replacing it with NewOLMOwnSingleNamespace in the specified DevPreviewNoUpgrade and TechPreviewNoUpgrade configurations.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff only touches feature metadata/docs and YAML manifests; no Ginkgo test files or test titles were changed.
Test Structure And Quality	✅ Passed	No Ginkgo/spec test files were changed; this PR only removes a feature gate and regenerates docs/manifests, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: The commit only removes a feature-gate definition and regenerates docs/manifests; no Ginkgo tests or runtime checks were added or changed.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the diff only removes a feature gate and updates docs/manifests.
Topology-Aware Scheduling Compatibility	✅ Passed	Touched files only remove a dead feature gate and update feature-gate lists; no nodeSelector, affinity, spread, PDB, or replica scheduling logic was added.
Ote Binary Stdout Contract	✅ Passed	Removal-only PR; no stdout/logging writes were added in process-level code, and the touched Go file only deletes the feature gate.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only removes a feature gate and updates docs/manifests; no Ginkgo e2e tests or network/IP assumptions were added.
No-Weak-Crypto	✅ Passed	Diff only removes a feature-gate definition and regenerates docs/manifests; no weak crypto, custom crypto, or secret comparisons were added.
Container-Privileges	✅ Passed	Touched files only update feature-gate lists; scans found no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit only removes a feature gate and updates generated manifests/docs; no log statements or sensitive-data additions appear in the diff.
Title check	✅ Passed	The title clearly matches the main change: removing the NewOLMPreflightPermissionChecks feature gate.
Description check	✅ Passed	The description accurately summarizes the feature gate removal and manifest regeneration, matching the changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@pedjak: This pull request references OPRUN-4705 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Remove the FeatureGateNewOLMPreflightPermissionChecks definition from features/features.go
• Regenerate features.md and all payload-manifests/featuregates/ YAML files

Context

The upstream PreflightPermissions feature gate was removed from operator-controller (operator-framework/operator-controller#767) and the downstream mapping was removed from cluster-olm-operator (cluster-olm-operator#222). The gate definition in openshift/api is now dead weight — it is listed as enabled in TechPreview/DevPreview profiles but nothing acts on it.

Resolves: https://issues.redhat.com/browse/OPRUN-4705

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[qodo-for-rh-openshift]

PR Summary by Qodo

Remove NewOLMPreflightPermissionChecks feature gate definition

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Remove the dead NewOLMPreflightPermissionChecks feature gate from the registry.
• Regenerate feature gate documentation and payload featuregate manifests to drop the entry.
• Keep TechPreview/DevPreview profiles aligned with upstream operator-controller changes.

Diagram

graph TD
  A["features/features.go"] --> B["Generate feature artifacts"] --> C["features.md"]
  B --> D["payload-manifests/featuregates/*.yaml"] --> E["Cluster FeatureGate profiles"] --> F["OLM-related components"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Deprecate first, remove later

• ➕ Avoids breaking any downstream consumers still setting the gate name
• ➕ Provides a clear migration window and messaging
• ➖ Keeps dead configuration surface area and ongoing maintenance burden
• ➖ Continues to imply a supported behavior that no longer exists

2. Keep the gate but mark as ignored/no-op

• ➕ Preserves backward compatibility for clusters that reference the gate
• ➕ Makes the no-op status explicit
• ➖ Still expands API surface with a misleading option
• ➖ Requires additional documentation/logic to communicate the no-op

Recommendation: Proceed with removal as implemented: upstream and downstream consumers have already dropped the behavior, so keeping the gate only creates confusion and unused payload/profile entries. If any compatibility concern arises, handle it via release notes rather than retaining an inert gate indefinitely.

Files changed (10) +0 / -33

Refactor (1) +0 / -8

features.goRemove FeatureGateNewOLMPreflightPermissionChecks registration +0/-8

Remove FeatureGateNewOLMPreflightPermissionChecks registration

• Deletes the 'FeatureGateNewOLMPreflightPermissionChecks' definition from the feature gate registry, eliminating its metadata and profile enablement.

features/features.go

Documentation (1) +0 / -1

features.mdDrop NewOLMPreflightPermissionChecks from feature gate docs +0/-1

Drop NewOLMPreflightPermissionChecks from feature gate docs

• Removes the 'NewOLMPreflightPermissionChecks' row from the generated feature gate table so it no longer appears as enabled in TechPreview/DevPreview profiles.

features.md

Other (8) +0 / -24

featureGate-4-10-Hypershift-Default.yamlRemove gate from Hypershift Default profile manifest +0/-3

Remove gate from Hypershift Default profile manifest

• Regenerated payload manifest no longer lists 'NewOLMPreflightPermissionChecks' among enabled features for this profile.

payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yamlRemove gate from Hypershift DevPreviewNoUpgrade profile manifest +0/-3

Remove gate from Hypershift DevPreviewNoUpgrade profile manifest

• Regenerated payload manifest drops 'NewOLMPreflightPermissionChecks' from the enabled feature set.

payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml

featureGate-4-10-Hypershift-OKD.yamlRemove gate from Hypershift OKD profile manifest +0/-3

Remove gate from Hypershift OKD profile manifest

• Regenerated payload manifest removes 'NewOLMPreflightPermissionChecks' from the enabled features list.

payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yamlRemove gate from Hypershift TechPreviewNoUpgrade profile manifest +0/-3

Remove gate from Hypershift TechPreviewNoUpgrade profile manifest

• Regenerated payload manifest removes 'NewOLMPreflightPermissionChecks' from TechPreviewNoUpgrade enabled features.

payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-Default.yamlRemove gate from SelfManagedHA Default profile manifest +0/-3

Remove gate from SelfManagedHA Default profile manifest

• Regenerated payload manifest no longer includes 'NewOLMPreflightPermissionChecks' as an enabled feature.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yamlRemove gate from SelfManagedHA DevPreviewNoUpgrade profile manifest +0/-3

Remove gate from SelfManagedHA DevPreviewNoUpgrade profile manifest

• Regenerated payload manifest drops 'NewOLMPreflightPermissionChecks' from the enabled feature list for this profile.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-OKD.yamlRemove gate from SelfManagedHA OKD profile manifest +0/-3

Remove gate from SelfManagedHA OKD profile manifest

• Regenerated payload manifest removes 'NewOLMPreflightPermissionChecks' from the OKD profile enabled features.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yamlRemove gate from SelfManagedHA TechPreviewNoUpgrade profile manifest +0/-3

Remove gate from SelfManagedHA TechPreviewNoUpgrade profile manifest

• Regenerated payload manifest no longer lists 'NewOLMPreflightPermissionChecks' in TechPreviewNoUpgrade enabled features.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

[pedjak]

/jira refresh

[openshift-ci-robot]

@pedjak: This pull request references OPRUN-4705 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[pedjak]

/jira refresh

[openshift-ci-robot]

@pedjak: This pull request references OPRUN-4705 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tmshort]

/lgtm
Although I don't know why It's failing the hypershift check?

[tmshort]

/test verify-hypershift-integration

[qodo-for-rh-openshift]

PR-Agent: could not find a component named verify-hypershift-integration in a supported language in this PR.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[tmshort]

This isn't working?

/test verify-hypershift-integration

[JoelSpeed]

/override-sticky ci/prow/verify-hypershift-integration

This is broken presently until HyperShift bump their deps

/lgtm

This is walking back a feature that was never promoted and has since been reverted from the product

[openshift-ci]

@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-hypershift-integration

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

/override-sticky ci/prow/verify-hypershift-integration

This is broken presently until HyperShift bump their deps

/lgtm

This is walking back a feature that was never promoted and has since been reverted from the product

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed, tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pedjak]

Both CI failures are unrelated to this change (pure feature gate deletion):

• e2e-aws-ovn-techpreview: Two blocking flakes — a kubeconfig context lookup failure in [sig-arch] ... pods use downstream images (100% pass rate on Sippy/520 runs) and a pod readiness timeout in [sig-node] ... Allow dev fuse by default in CRI-O.
• e2e-azure: One blocking flake — transient EOF in [sig-auth] [Token Expiration] ... token authorization flow (97.95% pass rate on Sippy/4250 runs).

/retest

[pedjak]

/retest

[openshift-ci]

@pedjak: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tmshort]

/verified by CI

This is a removal, and since the CI passed, it means that nothing ought to be trying to use that feature-gate.

[openshift-ci-robot]

@tmshort: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

This is a removal, and since the CI passed, it means that nothing ought to be trying to use that feature-gate.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tmshort]

/retest
(due to tide)