OCPBUGS-112638: Enable DeviceTaintRule API for hosted clusters

[harche]

What this PR does / why we need it:

Enables the resource.k8s.io/v1beta2 API in hosted kube-apiservers when the DRADeviceTaintRules feature gate is enabled on Kubernetes 1.36.

Without the runtime API, kube-scheduler enables its DeviceTaintRule informer but cannot list the resource. The informer never synchronizes, preventing the production scheduler from starting and leaving hosted-cluster workloads unscheduled after bootstrap.

The mapping is limited to Kubernetes 1.36. DeviceTaintRule is unavailable before 1.36 and graduates to resource.k8s.io/v1 in Kubernetes 1.37. The Kubernetes version is read from the control-plane release component metadata, and is only requested when the feature gate is enabled.

Related changes:

• OCPBUGS-112638: register DRADeviceTaintRules in TPNU api#3004 registers and enables DRADeviceTaintRules in TechPreviewNoUpgrade.
• OCPBUGS-112638: WIP: apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled cluster-kube-apiserver-operator#2275 adds the equivalent mapping for self-managed clusters.
• DRA: drop alpha/beta DRA API test if TPNU origin#31566 updates the DRA API availability test expectation.

Failure analysis: openshift/api#3004 (comment)

Which issue(s) this PR fixes:

Related to OCPBUGS-112638

Special notes for your reviewer:

The mapping is dormant when DRADeviceTaintRules is absent or disabled, allowing this change to merge before openshift/api#3004 activates the gate.

Unit coverage includes Kubernetes 1.35, 1.36, and 1.37; a disabled gate; missing Kubernetes component metadata; and component-version lookup errors.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs. Not applicable; this is an internal kube-apiserver runtime configuration fix.
• This change includes unit tests.

Summary by CodeRabbit

• New Features

  • Enabled Kubernetes API server support for resource.k8s.io/v1beta2 runtime configuration on Kubernetes 1.36 when DRADeviceTaintRules is enabled.

• Bug Fixes

  • Added validation and clear errors when the Kubernetes version is unavailable or cannot be determined for this configuration.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@harche: This pull request references Jira Issue OCPBUGS-112638, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Enables the resource.k8s.io/v1beta2 API in hosted kube-apiservers when the DRADeviceTaintRules feature gate is enabled on Kubernetes 1.36.

Without the runtime API, kube-scheduler enables its DeviceTaintRule informer but cannot list the resource. The informer never synchronizes, preventing the production scheduler from starting and leaving hosted-cluster workloads unscheduled after bootstrap.

The mapping is limited to Kubernetes 1.36. DeviceTaintRule is unavailable before 1.36 and graduates to resource.k8s.io/v1 in Kubernetes 1.37. The Kubernetes version is read from the control-plane release component metadata, and is only requested when the feature gate is enabled.

Related changes:

• OCPBUGS-112638: register DRADeviceTaintRules in TPNU api#3004 registers and enables DRADeviceTaintRules in TechPreviewNoUpgrade.
• OCPBUGS-112638: WIP: apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled cluster-kube-apiserver-operator#2275 adds the equivalent mapping for self-managed clusters.
• DRA: drop alpha/beta DRA API test if TPNU origin#31566 updates the DRA API availability test expectation.

Failure analysis: openshift/api#3004 (comment)

Which issue(s) this PR fixes:

Related to OCPBUGS-112638

Special notes for your reviewer:

The mapping is dormant when DRADeviceTaintRules is absent or disabled, allowing this change to merge before openshift/api#3004 activates the gate.

Unit coverage includes Kubernetes 1.35, 1.36, and 1.37; a disabled gate; missing Kubernetes component metadata; and component-version lookup errors.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs. Not applicable; this is an internal kube-apiserver runtime configuration fix.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Team

Run ID: ff9909e4-0920-4cfb-97eb-8f53d24c39b8

📥 Commits

Reviewing files that changed from the base of the PR and between c81e6d2 and 35f5b82.

📒 Files selected for processing (3)

• control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go
• control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go
• control-plane-operator/controllers/hostedcontrolplane/v2/kas/params.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The API server configuration now resolves the Kubernetes component version from the release image provider when DRADeviceTaintRules=true. It returns errors for provider failures, missing component versions, and invalid versions. For Kubernetes 1.36, it enables resource.k8s.io/v1beta2. Tests cover supported and unsupported versions, disabled gates, missing versions, provider errors, and expected configuration errors.

Sequence Diagram(s)

sequenceDiagram
  participant API server config
  participant Release image provider
  participant Runtime configuration
  API server config->>Release image provider: request Kubernetes component version
  Release image provider-->>API server config: return component version or error
  API server config->>Runtime configuration: enable resource.k8s.io/v1beta2 for Kubernetes 1.36

Loading

Suggested reviewers: bryan-cox

Merge Risk: ⚪ Minimal · up to 35f5b

This enables the required resource API only for Kubernetes 1.36 clusters with DRADeviceTaintRules enabled, preventing scheduler synchronization failures while preserving behavior for other versions and disabled gates.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request adds standard Go subtests, not Ginkgo tests. Each subtest uses t.Run(tc.name), and every added name value is a fixed string. The titles contain only stable feature and Kuber…
Test Structure And Quality	✅ Passed	PASS: The changed tests are standard Go tests, not Ginkgo tests. config_test.go uses testing.T, t.Run, and testify/require; it adds no It, BeforeEach, AfterEach, Eventually, or `Consis…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The pull request changes only hosted kube-apiserver runtime configuration and Kubernetes version lookup. The exact diff modifies config.go, config_test.go, and params.go; it adds `resourc…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests (TestGenerateConfig and TestKubernetesVersionForFeatureGates), not Ginkgo e2e tests. The added test code only uses in-memory configuration and fa…
No-Weak-Crypto	✅ Passed	The pull request adds feature-gate and Kubernetes-version handling only. The added lines introduce no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, no custom cryptography, and no secret or token …
Container-Privileges	✅ Passed	PASS: The PR changes only three Go files: KAS configuration logic, tests, and configuration parameters. The added behavior reads a Kubernetes version and adds the resource.k8s.io/v1beta2=true runtim…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds no logging calls. It adds only error returns for Kubernetes component lookup and version parsing. These errors contain release metadata or Kubernetes version values, not pa…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: enabling the DeviceTaintRule API for hosted clusters. It is specific and directly related to the pull request objectives.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: harche
Once this PR has been reviewed and has the lgtm label, please assign cblecker for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 84.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.12%. Comparing base (c81e6d2) to head (35f5b82).

Files with missing lines	Patch %	Lines
...or/controllers/hostedcontrolplane/v2/kas/config.go	84.00%	4 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9518   +/-   ##
=======================================
  Coverage   47.11%   47.12%           
=======================================
  Files         786      786           
  Lines       99220    99245   +25     
=======================================
+ Hits        46744    46765   +21     
- Misses      49317    49321    +4     
  Partials     3159     3159           

Files with missing lines	Coverage Δ
...or/controllers/hostedcontrolplane/v2/kas/params.go	90.00% <ø> (ø)
...or/controllers/hostedcontrolplane/v2/kas/config.go	87.81% <84.00%> (-0.26%)	⬇️

Flag	Coverage Δ
cmd-support	40.84% <ø> (ø)
cpo-hostedcontrolplane	50.37% <84.00%> (+0.04%)	⬆️
cpo-other	47.60% <ø> (ø)
hypershift-operator	57.24% <ø> (ø)
other	34.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@harche: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[cblecker]

/uncc