OCPBUGS-63152: use IPFamilies template for wait-for-node-ip by rbbratta · Pull Request #6289 · openshift/machine-config-operator

rbbratta · 2026-07-09T17:48:16Z

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh.

If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

Cursor AI assisted.

Summary by CodeRabbit

Bug Fixes
- Node IP binding checks now respect the configured IP family.
- Single-stack environments validate only the applicable IPv4 or IPv6 address.
- Dual-stack environments continue to validate both address families.
- Missing required addresses now cause validation to fail.
- Existing primary IP binding behavior remains unchanged.

openshift-merge-bot · 2026-07-09T17:48:20Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-09T17:48:23Z

@rbbratta: This pull request references Jira Issue OCPBUGS-63152, which is invalid:

expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.23.0" instead
expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh.

If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

Cursor AI assisted.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-09T17:52:56Z

Walkthrough

The node IP wait script now performs IPv4 and IPv6 bind checks based on configured IP families. A table-driven test verifies primary, IPv4, and IPv6 bind blocks for single-stack and dual-stack configurations.

Changes

Node IP family binding

Layer / File(s)	Summary
Conditional bind validation and rendering coverage `templates/common/_base/files/wait-for-node-ip.yaml`, `pkg/controller/template/render_test.go`	The template gates IPv4 and IPv6 checks using `.IPFamilies`. Missing selected-family addresses now cause exit status 1. Rendering tests cover IPv4, IPv6, dual-stack, and IPv6-primary configurations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

openshift/machine-config-operator#6395: Both changes update node IP configuration for IPFamilies and add rendering tests, but they modify different bind and VIP filtering logic.

Suggested reviewers: cheesesashimi, yuqi-zhang

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the bug and the main change: using the IPFamilies template for wait-for-node-ip.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The added test uses standard Go t.Run, not Ginkgo. Its subtest names come from fixed IPFamilies constants (IPv4, IPv6, DualStack variants) and contain no run-dependent values.
Test Structure And Quality	✅ Passed	The added test is a local Go testing table test, not Ginkgo; it creates no resources, has no waits, and all assertions include diagnostic messages.
Microshift Test Compatibility	✅ Passed	The added test is a Go testing.T unit test, not a Ginkgo e2e test, and it references no MicroShift-incompatible APIs or features.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The added test is a Go `testing.T` unit test in `pkg/controller/template/render_test.go`, not a Ginkgo e2e test, and it makes no multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only the node-IP shell template and its render test; it adds no workload manifests, replicas, affinity, topology spread, selectors, tolerations, or PDB constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only a shell template and a test; no OTE entry-point code or process-level stdout writes were added, and the test uses intercepted testing output.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The added test uses standard testing.T and local template rendering only; it is not a Ginkgo e2e test and has no IPv4-only or external connectivity requirement.
No-Weak-Crypto	✅ Passed	The PR changes only a node-IP template and render test; the complete diff contains no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR changes only a shell template and a Go test; added lines contain no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or root security settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no production logging. It adds exit status checks and tests; existing messages expose only bind IPs and ports, with no passwords, tokens, API keys, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-07-09T17:52:56Z

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

rbbratta · 2026-07-09T17:53:46Z

@cybertron @mko can we use the IPFamilies templating here or only with kubelet?

cybertron

Would like to see the duplication reduced, but otherwise this makes sense to me.

cybertron · 2026-07-10T17:07:51Z

-    # We only want to make sure that if nodeip-configuration detected an IP address, the
-    # address is usable.
+    # Family-specific checks follow ControllerConfig IPFamilies (network.config serviceNetwork; same as kubelet --node-ip).
+{{- if or (eq .IPFamilies "DualStack") (eq .IPFamilies "DualStackIPv6Primary") }}


I don't really like the duplication here. We can just wrap the individual checks in ifs that look for single stack of the opposite family. I.e.

if ipfamilies != ipv6 check for ipv4 if ipfamilies != ipv4 check for ipv6

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/common/_base/files/wait-for-node-ip.yaml`:
- Around line 41-56: Indent both conditional template blocks, including their
if/end actions, to the same level as the inline block scalar content in the
wait-for-node-IP template. Keep the shell commands and IPv4/IPv6 conditions
unchanged while ensuring all four template actions remain inside inline: | so
the rendered YAML passes yamllint.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ceff1f02-b7a7-49fa-b694-08bf141f5b86

📥 Commits

Reviewing files that changed from the base of the PR and between 777892a and ea7ccf0.

📒 Files selected for processing (2)

pkg/controller/template/render_test.go
templates/common/_base/files/wait-for-node-ip.yaml

rbbratta · 2026-07-28T04:05:51Z

+{{- if ne .IPFamilies "IPv4" }}
    ip=$(cat /run/nodeip-configuration/ipv6 || echo "")
    if [[ "${ip}" == "" ]]; then
      echo "No ipv6 to bind was found"


maybe we should fail here. We are expecting an IPv6 address to bind to.

Yeah, that probably makes sense now that we know which IP families should exist.

isabella-janssen · 2026-07-28T13:41:18Z

/hold

Holding to allow the Kube rebase to land in #6321. Please ensure this will not cause merge conflicts for the Kube rebase before unholding this PR.

isabella-janssen · 2026-07-29T19:53:50Z

/unhold

Kube rebase landed

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh. If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

Now that we know which IP families we should be using Fail if we can't bind to each family.

coderabbitai · 2026-08-11T12:01:39Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

openshift-ci-robot · 2026-08-11T12:08:08Z

@rbbratta: This pull request references Jira Issue OCPBUGS-63152, which is invalid:

expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.23.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh.

If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

Cursor AI assisted.

Summary by CodeRabbit

Bug Fixes

Node IP binding checks now respect the configured IP family.

Single-stack environments validate only the applicable IPv4 or IPv6 address.

Dual-stack environments continue to validate both address families.

Missing required addresses now cause validation to fail.

Existing primary IP binding behavior remains unchanged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai

🧹 Nitpick comments (1)

templates/common/_base/files/wait-for-node-ip.yaml (1)
41-58: 🎯 Functional Correctness | 🔵 Trivial | 🏗️ Heavy lift

Add execution coverage for the new failure path.

The new blocks change boot behavior: a missing selected-family address exits with status 1. Add a test that executes or simulates the rendered script for IPv4-only, IPv6-only, and dual-stack configurations. Assert the selected-family failure and confirm that single-stack configurations do not require the opposite family. The supplied pkg/controller/template/render_test.go test checks rendered text only.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@templates/common/_base/files/wait-for-node-ip.yaml` around lines 41 - 58, Add
execution-based test coverage for the rendered wait-for-node-IP script, covering
IPv4-only, IPv6-only, and dual-stack configurations. Verify each selected family
exits with status 1 when its address is missing, while single-stack cases
succeed without requiring the non-selected family; retain the existing
render-text assertions in render_test.go.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@templates/common/_base/files/wait-for-node-ip.yaml`:
- Around line 41-58: Add execution-based test coverage for the rendered
wait-for-node-IP script, covering IPv4-only, IPv6-only, and dual-stack
configurations. Verify each selected family exits with status 1 when its address
is missing, while single-stack cases succeed without requiring the non-selected
family; retain the existing render-text assertions in render_test.go.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 44f58ea9-04b9-4c07-95c4-0b4c4f2d9133

📥 Commits

Reviewing files that changed from the base of the PR and between cd2a4c6 and 9e0cbde.

📒 Files selected for processing (2)

pkg/controller/template/render_test.go
templates/common/_base/files/wait-for-node-ip.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

pkg/controller/template/render_test.go

rbbratta · 2026-09-01T13:46:33Z

/jira refresh

openshift-ci-robot · 2026-09-01T13:46:38Z

@rbbratta: This pull request references Jira Issue OCPBUGS-63152, which is invalid:

expected the bug to target either version "5.1.0." or "openshift-5.1.0.", but it targets "5.0.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rbbratta · 2026-09-01T13:47:47Z

/jira refresh

openshift-ci-robot · 2026-09-01T13:47:55Z

@rbbratta: This pull request references Jira Issue OCPBUGS-63152, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @rbbratta

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-01T13:47:59Z

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: rbbratta.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@rbbratta: This pull request references Jira Issue OCPBUGS-63152, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)

bug target version (5.1.0) matches configured target version for branch (5.1.0)

bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @rbbratta

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cybertron

/lgtm

openshift-merge-bot · 2026-09-01T20:52:42Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

rbbratta · 2026-09-22T12:51:34Z

/verified by @rbbratta

openshift-ci-robot · 2026-09-22T12:51:47Z

@rbbratta: This PR has been marked as verified by @rbbratta.

Details

In response to this:

/verified by @rbbratta

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

isabella-janssen

/approve

openshift-ci · 2026-09-22T13:10:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cybertron, isabella-janssen, rbbratta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [isabella-janssen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

isabella-janssen · 2026-09-22T13:14:37Z

/retest-required

openshift-merge-bot · 2026-09-22T13:59:34Z

/retest-required

Remaining retests: 0 against base HEAD 86eb9d9 and 2 for PR HEAD 9e0cbde in total

isabella-janssen · 2026-09-22T16:28:13Z

/retest-required

openshift-merge-bot · 2026-09-22T18:00:37Z

/retest-required

Remaining retests: 0 against base HEAD d893411 and 1 for PR HEAD 9e0cbde in total

openshift-merge-bot · 2026-09-22T19:01:47Z

/retest-required

Remaining retests: 0 against base HEAD 23e9d90 and 0 for PR HEAD 9e0cbde in total

isabella-janssen · 2026-09-22T19:45:02Z

/retest-required

isabella-janssen · 2026-09-22T19:58:30Z

/test unit

openshift-merge-bot · 2026-09-22T21:01:02Z

/hold

Revision 9e0cbde was retested 3 times: holding

isabella-janssen · 2026-09-23T13:18:23Z

/unhold
/test unit

openshift-merge-bot · 2026-09-23T14:21:24Z

/retest-required

Remaining retests: 0 against base HEAD 3e28cab and 2 for PR HEAD 9e0cbde in total

openshift-merge-bot · 2026-09-23T16:20:44Z

/retest-required

Remaining retests: 0 against base HEAD 7cda35c and 1 for PR HEAD 9e0cbde in total

openshift-merge-bot · 2026-09-23T17:22:28Z

/retest-required

Remaining retests: 0 against base HEAD 063ff1e and 0 for PR HEAD 9e0cbde in total

openshift-ci · 2026-09-23T17:35:17Z

@rbbratta: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/perfscale-control-plane-6nodes	`9e0cbde`	link	false	`/test perfscale-control-plane-6nodes`
ci/prow/unit	`9e0cbde`	link	true	`/test unit`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-merge-bot · 2026-09-23T18:19:37Z

/hold

Revision 9e0cbde was retested 3 times: holding

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 9, 2026

openshift-ci Bot requested review from cheesesashimi and yuqi-zhang July 9, 2026 17:48

cybertron reviewed Jul 10, 2026

View reviewed changes

rbbratta mentioned this pull request Jul 28, 2026

OCPBUGS-86571: node-ip: wait for both address families on dual-stack clusters openshift/baremetal-runtimecfg#391

Merged

rbbratta force-pushed the wait-for-node-ip-template branch from dbdb79b to ea7ccf0 Compare July 28, 2026 03:48

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread templates/common/_base/files/wait-for-node-ip.yaml

rbbratta commented Jul 28, 2026

View reviewed changes

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 29, 2026

rbbratta added 2 commits August 11, 2026 08:01

OCPBUGS-63152: use IPFamilies template for wait-for-node-ip

a3f5efd

See if we can use the kubelet dualstack node-ip templating info to help with wait-for-node-ip.sh. If kubelet is not trying to bind to an IPv6 address, then we don't need to wait for the IPv6 address?

fail if unable to bind IP family

9e0cbde

Now that we know which IP families we should be using Fail if we can't bind to each family.

rbbratta force-pushed the wait-for-node-ip-template branch from ea7ccf0 to 9e0cbde Compare August 11, 2026 12:01

coderabbitai Bot reviewed Aug 11, 2026

View reviewed changes

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 1, 2026

cybertron reviewed Sep 1, 2026

View reviewed changes

openshift-ci Bot assigned cybertron Sep 1, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 1, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 22, 2026

isabella-janssen reviewed Sep 22, 2026

View reviewed changes

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 22, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 22, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 23, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 23, 2026

Conversation

rbbratta commented Jul 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 9, 2026

Uh oh!

openshift-ci-robot commented Jul 9, 2026

Uh oh!

coderabbitai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot commented Jul 9, 2026

Review failed

Uh oh!

rbbratta commented Jul 9, 2026

Uh oh!

cybertron left a comment

Choose a reason for hiding this comment

Uh oh!

cybertron Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rbbratta Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

cybertron Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

isabella-janssen commented Jul 28, 2026

Uh oh!

isabella-janssen commented Jul 29, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026

Uh oh!

openshift-ci-robot commented Aug 11, 2026

Summary by CodeRabbit

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

rbbratta commented Sep 1, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Uh oh!

rbbratta commented Sep 1, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

cybertron left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Sep 1, 2026

Uh oh!

rbbratta commented Sep 22, 2026

Uh oh!

openshift-ci-robot commented Sep 22, 2026

Uh oh!

isabella-janssen left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

isabella-janssen commented Sep 22, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 22, 2026

Uh oh!

isabella-janssen commented Sep 22, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 22, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 22, 2026

rbbratta commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading