AUTOSCALE-827: apply KarpenterOperator feature gate to manifests

[maxcao13]

We replace the DevPreviewNoUpgrade featureset with the now merged KarpenterOperator feature gate which is only enabled in DevPreview clusters.

Summary by CodeRabbit

• Chores
  • Updated OpenShift release annotations across install and RBAC manifests to use the newer feature-gate value for Karpenter.
  • Aligned namespace, credentials, deployment, and cluster operator metadata with the same release gating setting.
  • No workload behavior, permissions, or deployment logic changed.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@maxcao13: This pull request references AUTOSCALE-827 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

We replace the DevPreviewNoUpgrade featureset with the now merged KarpenterOperator feature gate which is only enabled in DevPreview clusters.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maxcao13

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [maxcao13]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3cb0792a-1ed1-4fee-8917-5d2ab0219e34

📥 Commits

Reviewing files that changed from the base of the PR and between 01d708f and 39f2b80.

📒 Files selected for processing (7)

• hack/manifest-diff.sh
• install/00_credentials-request-aws.yaml
• install/00_namespace.yaml
• install/03_aggregate-clusterrole.yaml
• install/04_rbac.yaml
• install/05_deployment.yaml
• install/06_clusteroperator.yaml

---

Walkthrough

This PR replaces the OpenShift release-gating annotation release.openshift.io/feature-set: DevPreviewNoUpgrade with release.openshift.io/feature-gate: KarpenterOperator across all install manifests (namespace, credentials request, RBAC, deployment, clusterrole, clusteroperator) and updates the hack/manifest-diff.sh stamping script to generate this new annotation.

Changes

Feature-gate annotation migration

Layer / File(s)	Summary
Manifest stamping script update hack/manifest-diff.sh	Introduces CVO_FEATURE_GATE="KarpenterOperator" and updates the stamping query to write release.openshift.io/feature-gate instead of release.openshift.io/feature-set.
Core resource manifests annotation update install/00_namespace.yaml, install/00_credentials-request-aws.yaml, install/03_aggregate-clusterrole.yaml, install/05_deployment.yaml, install/06_clusteroperator.yaml	Each manifest's metadata annotations switch from release.openshift.io/feature-set: DevPreviewNoUpgrade to release.openshift.io/feature-gate: KarpenterOperator.
RBAC resources annotation update install/04_rbac.yaml	All ServiceAccount, Role, RoleBinding, ClusterRole, and ClusterRoleBinding resources for karpenter-operator, karpenter-dns, and karpenter-operator-operand update their annotations to release.openshift.io/feature-gate: KarpenterOperator.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: switching manifests to the KarpenterOperator feature gate.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes manifests and a shell script; no Ginkgo test declarations or test titles are added or modified.
Test Structure And Quality	✅ Passed	PR only changes manifests and a shell script; no Ginkgo test code is added or modified, so the test-quality criteria are not applicable.
Microshift Test Compatibility	✅ Passed	This PR only updates manifests and a shell script; no new Ginkgo e2e tests were added, so MicroShift compatibility isn’t implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo/e2e test files changed; the PR only updates manifests and a manifest-diff script, so SNO test assumptions are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only swaps feature-set annotations to feature-gate; no new affinity, spread, nodeSelector, replica, or topology assumptions were introduced.
Ote Binary Stdout Contract	✅ Passed	The PR only changes manifests and a helper script; no process-level Go/test setup code was modified to write to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR only updates manifests and a shell generator; no new Ginkgo e2e tests or IPv4/external-network assumptions were added.
No-Weak-Crypto	✅ Passed	Only manifest annotation/RBAC updates; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret-comparison code added.
Container-Privileges	✅ Passed	PR only swaps feature-gate annotations; no privileged/root/hostPID/hostNetwork/hostIPC/SYS_ADMIN or allowPrivilegeEscalation:true was introduced.
No-Sensitive-Data-In-Logs	✅ Passed	Changed files only update release annotations and static status echoes; no passwords, tokens, PII, hostnames, or customer data are logged or added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[maxcao13]

/test e2e-aws e2e-aws-operator

[maxcao13]

This requires us to apply the feature gate in the release repo job configs for e2e-aws and e2e-aws-operator.

EDIT: openshift/release#81504

[maxcao13]

/retest

[maxcao13]

/test e2e-aws

[joelsmith]

/lgtm

[maxcao13]

/test e2e-aws e2e-aws-operator

In theory, this should work immediately after merging since the jobs are configured to use latest integration stream?

[maxcao13]

/test e2e-aws

flaky test, nothing wrong with karpenter it seems

Cluster is correctly enabling the fg as well (from must-gather):

apiVersion: config.openshift.io/v1
kind: FeatureGate
metadata:
  name: cluster
spec:
  customNoUpgrade:
    enabled:
    - KarpenterOperator
  featureSet: CustomNoUpgrade

[maxcao13]

hey first time e2e-aws passed in awhile because we don't have to run everyone else's devpreview crap now 😛

thanks joel!

/verified by e2e-aws,e2e-aws-operator

[openshift-ci-robot]

@maxcao13: This PR has been marked as verified by e2e-aws,e2e-aws-operator.

Details

In response to this:

hey first time e2e-aws passed in awhile because we don't have to run everyone else's devpreview crap now 😛

thanks joel!

/verified by e2e-aws,e2e-aws-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[maxcao13]

/override ci/prow/verify

okay unfortunate timing with the merge of the aws-karpenter-provider-aws PR yesterday. going to solve this in a followup

[openshift-ci]

@maxcao13: Overrode contexts on behalf of maxcao13: ci/prow/verify

Details

In response to this:

/override ci/prow/verify

okay unfortunate timing with the merge of the aws-karpenter-provider-aws PR yesterday. going to solve this in a followup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@maxcao13: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.