Skip to content

ROSAENG-6150 | fix: local zone and wavelength zone subnets no longer listed when creating machine pool - #3462

Draft
markirish wants to merge 1 commit into
openshift:masterfrom
markirish:ROSAENG-6150-localzone-subnet-should-not-be-listed
Draft

ROSAENG-6150 | fix: local zone and wavelength zone subnets no longer listed when creating machine pool#3462
markirish wants to merge 1 commit into
openshift:masterfrom
markirish:ROSAENG-6150-localzone-subnet-should-not-be-listed

Conversation

@markirish

@markirish markirish commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

PR Summary

Exclude local zone and wavelength zone subnets from HCP machinepool creation

Detailed Description of the Issue

When creating a machinepool for a ROSA HCP cluster interactively, the subnet picker listed all private subnets in the VPC, including subnets in AWS Local Zones and Wavelength Zones. HCP clusters do not support nodepools in these zone types, so presenting them as options was misleading and could lead to failed machinepool creation.

The cluster creation path (cmd/create/cluster/cmd.go) already filtered these out using GetAvailabilityZoneType, but the machinepool creation path in pkg/machinepool/helper.go did not. This change adds the same filtering to both getSubnetOptions (interactive subnet list) and getSubnetFromAvailabilityZone (AZ-based subnet selection) for HCP clusters. Classic clusters are unaffected since they can legitimately have machinepools in local zones. Excluded subnets are reported to the user via a warning message, and an explicit error is returned if no subnets remain after filtering.

Related Issues and PRs

Type of Change

  • feat - adds a new user-facing capability.
  • fix - resolves an incorrect behavior or bug.
  • docs - updates documentation only.
  • style - formatting or naming changes with no logic impact.
  • refactor - code restructuring with no behavior change.
  • test - adds or updates tests only.
  • chore - maintenance work (tooling, housekeeping, non-product code).
  • build - changes build system, packaging, or dependencies for build output.
  • ci - changes CI pipelines, jobs, or automation workflows.
  • perf - improves performance without changing intended behavior.

Previous Behavior

When creating a machine pool in an HCP cluster, all subnets were listed, including those in local zones and wavelength zones.

Behavior After This Change

Local zones and wavelength zones are now filtered out when creating machine pools in HCP clusters

How to Test (Step-by-Step)

Preconditions

  • A ROSA HCP cluster in a VPC that has both standard-AZ private subnets and local zone or wavelength zone private subnets (e.g., us-east-1-atl-1a or us-east-1-wl1-atl-wlz-1)
    • AWS credentials configured with ec2:DescribeAvailabilityZones permission

Test Steps

  1. Run rosa create machinepool --cluster= -i
  2. When prompted "Select subnet for a hosted machine pool", answer Yes
  3. Observe the subnet list

Expected Results

  • Local zone and wavelength zone subnets should NOT appear in the list
  • A warning should be printed: WARN: The following subnets were excluded because they are on local zone or wavelength zone:
  • Only standard availability zone subnets should be selectable

Proof of the Fix

  • Screenshots:
  • Videos:
  • Logs/CLI output:
  • Other artifacts:

Breaking Changes

  • No breaking changes
  • Yes, this PR introduces a breaking change (describe impact and migration plan below)

Breaking Change Details / Migration Plan

Developer Verification Checklist

  • Commit subject/title follows [JIRA-TICKET] | [TYPE]: <MESSAGE>.
  • PR description clearly explains both what changed and why.
  • Relevant Jira/GitHub issues and related PRs are linked.
  • make install-hooks has been run in this clone.
  • Tests were added/updated where appropriate.
  • I manually tested the change.
  • make test passes.
  • make lint passes.
  • make rosa passes.
  • Documentation or repo-local agent guidance was added/updated where appropriate.
  • Any risk, limitation, or follow-up work is documented.

Summary by CodeRabbit

  • Bug Fixes
    • Hosted Control Plane clusters now exclude Local Zone and Wavelength Zone subnets when selecting private subnets.
    • Clear errors are shown when no eligible standard subnets remain.
    • Classic clusters continue to support all available subnets.
    • Subnet selection and resolution now consistently use the eligible subnet set.

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Private subnet retrieval now excludes Local Zone and Wavelength Zone subnets for Hosted Control Plane clusters. Availability-zone type lookups are cached. Excluded subnet IDs are reported, and retrieval returns an error when no eligible subnets remain. Subnet option selection and availability-zone resolution use the filtered subnet set. Tests cover Hosted Control Plane filtering, classic-cluster behavior, empty results, propagated errors, and updated AWS mock expectations.


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error The new Warnf logs excluded AWS subnet IDs from customer VPCs; these customer-specific infrastructure identifiers are customer data exposed in warning output. Do not log subnet IDs. Log only the number of excluded subnets or a redacted/non-identifying summary.
Test Structure And Quality ⚠️ Warning New Ginkgo cases in helper_test.go add bare Expect assertions, including Expect(err).ToNot(HaveOccurred()) and subnet checks, without diagnostic messages. Add meaningful messages to every assertion introduced by the new subnet-filtering tests, such as identifying the operation and expected subnet set.
✅ Passed checks (13 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the fix to exclude Local Zone and Wavelength Zone subnets during machine pool creation.
Description check ✅ Passed The description explains the problem, rationale, behavior change, testing steps, and expected results, but leaves issue links and verification items incomplete.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR adds eight Ginkgo When/It titles, and all use fixed string literals with no generated identifiers, timestamps, IPs, interpolation, or concatenation.
Microshift Test Compatibility ✅ Passed PASS: The diff adds mocked Ginkgo unit tests under pkg/machinepool, not e2e tests, and references no unavailable MicroShift OpenShift APIs, resources, namespaces, or unsupported features.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The diff adds Ginkgo unit tests under pkg/machinepool for subnet filtering; they make no multi-node, scheduling, failover, scaling, or HA assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The diff changes only AWS subnet filtering and tests in pkg/machinepool; it adds no deployment, controller, manifest, or topology scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The production diff adds only Reporter.Warnf for the new warning; reporter.Warnf writes to os.Stderr. No OTE process-level stdout write or suite setup change was introduced.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Added Ginkgo tests use mocked AWS calls and availability-zone names only; they contain no IPv4 assumptions or external/public network connectivity.
No-Weak-Crypto ✅ Passed The PR diff only adds subnet filtering, warnings, AWS zone lookups, and tests; it introduces no weak crypto primitive, custom crypto, or secret/token comparison.
Container-Privileges ✅ Passed The PR changes only Go source and tests. The diff adds no container/Kubernetes manifests or privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@markirish
markirish marked this pull request as draft August 12, 2026 03:06
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 12, 2026
@openshift-ci

openshift-ci Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: markirish
Once this PR has been reviewed and has the lgtm label, please assign marcolan018 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/machinepool/helper_test.go`:
- Around line 406-414: The test case around getSubnetOptions must also verify
the exclusion warning, not only the filtered subnet results. Capture or inspect
the reporter output and assert that it includes both excluded subnet IDs,
“subnet-local” and “subnet-wavelength”, in sorted order while preserving the
existing subnet option assertions.

In `@pkg/machinepool/helper.go`:
- Around line 153-155: Update the error return in the GetAvailabilityZoneType
call to wrap the original error with %w and include the az value in the
contextual message, while preserving error propagation to callers.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 375ec22c-5f3e-4b24-8201-9266986e7339

📥 Commits

Reviewing files that changed from the base of the PR and between 161e404 and 06370e8.

📒 Files selected for processing (3)
  • pkg/machinepool/helper.go
  • pkg/machinepool/helper_test.go
  • pkg/machinepool/machinepool_test.go

Comment on lines +406 to +414
It("excludes local zone and wavelength zone subnets", func() {
subnetOptions, err := getSubnetOptions(r, cluster)
Expect(err).ToNot(HaveOccurred())
Expect(subnetOptions).To(HaveLen(2))
for _, opt := range subnetOptions {
Expect(opt).ToNot(ContainSubstring("subnet-local"))
Expect(opt).ToNot(ContainSubstring("subnet-wavelength"))
}
})

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Assert the exclusion warning.

This test verifies filtered subnet options only. It does not verify the required warning. A regression that removes Reporter.Warnf still passes.

Add a focused assertion that the warning includes the excluded subnet IDs in sorted order. The PR objective states that excluded subnets generate a warning. As per coding guidelines, “tests should prove correctness.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/machinepool/helper_test.go` around lines 406 - 414, The test case around
getSubnetOptions must also verify the exclusion warning, not only the filtered
subnet results. Capture or inspect the reporter output and assert that it
includes both excluded subnet IDs, “subnet-local” and “subnet-wavelength”, in
sorted order while preserving the existing subnet option assertions.

Source: Coding guidelines

Comment thread pkg/machinepool/helper.go
Comment on lines +153 to +155
zoneType, err = r.AWSClient.GetAvailabilityZoneType(az)
if err != nil {
return nil, err

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C2 'GetAvailabilityZoneType\(|fmt\.Errorf\(.*%w' pkg/machinepool pkg/aws

Repository: openshift/rosa

Length of output: 12012


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- pkg/machinepool/helper.go imports and target function ---'
sed -n '1,210p' pkg/machinepool/helper.go

printf '%s\n' '--- AWS implementation ---'
sed -n '1125,1165p' pkg/aws/client.go

printf '%s\n' '--- nearby machinepool error-return patterns ---'
rg -n -C3 'return nil, err|fmt\.Errorf\(' pkg/machinepool/helper.go

printf '%s\n' '--- static check of the target error path ---'
python3 - <<'PY'
from pathlib import Path
p = Path("pkg/machinepool/helper.go")
text = p.read_text()
needle = 'zoneType, err = r.AWSClient.GetAvailabilityZoneType(az)'
pos = text.index(needle)
window = text[pos:pos + 220]
print(window)
print("fmt imported:", '"fmt"' in text.split(")", 1)[0])
print("target wraps with %w:", "fmt.Errorf" in window and "%w" in window)
PY

Repository: openshift/rosa

Length of output: 14598


Wrap the GetAvailabilityZoneType error with context.

At pkg/machinepool/helper.go:155, use %w and include az so callers can identify the failed lookup while retaining the original error.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/machinepool/helper.go` around lines 153 - 155, Update the error return in
the GetAvailabilityZoneType call to wrap the original error with %w and include
the az value in the contextual message, while preserving error propagation to
callers.

Source: Coding guidelines

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dco-signoff: yes do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant