[release-ocm-2.17] ACM-35997: apply disk encryption defaults on cluster create and update by openshift-cherrypick-robot · Pull Request #10513 · openshift/assisted-service

openshift-cherrypick-robot · 2026-06-24T16:13:23Z

This is an automated cherry-pick of #10442

/assign andrej1991

In OCPBUGS-86731 the issue was likelly caused by DiskEncryptionEnabledOn was an empty string and the validation threated empty string as enabled. A new test is also added to test the robustness.

Normalize nil or empty disk_encryption enable_on and mode to none and tpmv2 when syncing from AgentClusterInstall and when persisting cluster updates. Prevents writing an empty enable_on while mode stays tpmv2, which could leave hosts stuck in Discovering during hardware validation.

…kencryption tests so CI ginkgo flags are accepted, and remove the unused ginkgo table import from hostutil tests.

Use RequestsConfiguration at the API boundary so tang mode or tang_servers without enable_on cannot bypass the disk encryption feature gate on unsupported platforms.

…mon solution would be used in the whole project. a separate follow-up task will be added

Introduce HasMode for raw mode checks and IsSetWithTang as the Tang counterpart to IsSetWithTpm, then replace scattered inline enable_on and mode comparisons with the shared helpers in validators, manifest generation, API validation, and tang connectivity checks. This keeps runtime paths on IsSetWithTpm/IsSetWithTang, payload validation on HasMode where enable_on may still be unset, and role targeting on EnabledForRole everywhere.

openshift-ci-robot · 2026-06-24T16:13:26Z

@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: ACM-34978

Details

In response to this:

This is an automated cherry-pick of #10442

/assign andrej1991

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-06-24T16:13:35Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d09b0af0-0c6d-4ca2-a2f7-387f09f8518a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-06-24T16:16:37Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: openshift-cherrypick-robot
Once this PR has been reviewed and has the lgtm label, please assign danmanor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

andrej1991 · 2026-06-24T16:21:00Z

/hold

codecov · 2026-06-24T16:52:34Z

Codecov Report

❌ Patch coverage is 95.19231% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.43%. Comparing base (fbd5489) to head (93dc05c).

Files with missing lines	Patch %	Lines
internal/cluster/validations/validations.go	0.00%	2 Missing ⚠️
internal/hardware/validator.go	75.00%	1 Missing and 1 partial ⚠️
internal/common/disk_encryption.go	98.00%	1 Missing ⚠️

Additional details and impacted files

@@                 Coverage Diff                  @@
##           release-ocm-2.17   #10513      +/-   ##
====================================================
+ Coverage             44.40%   44.43%   +0.02%     
====================================================
  Files                   418      419       +1     
  Lines                 72957    72998      +41     
====================================================
+ Hits                  32394    32434      +40     
- Misses                37643    37644       +1     
  Partials               2920     2920

Files with missing lines	Coverage Δ
internal/bminventory/inventory.go	`72.04% <100.00%> (ø)`
...oller/controllers/clusterdeployments_controller.go	`73.55% <100.00%> (+0.16%)`	⬆️
...l/host/hostcommands/tang_connectivity_check_cmd.go	`81.70% <100.00%> (-0.44%)`	⬇️
internal/host/hostutil/host_utils.go	`55.90% <ø> (-1.67%)`	⬇️
internal/host/validator.go	`83.61% <100.00%> (+0.05%)`	⬆️
internal/network/manifests_generator.go	`76.69% <100.00%> (-0.23%)`	⬇️
internal/common/disk_encryption.go	`98.00% <98.00%> (ø)`
internal/cluster/validations/validations.go	`46.21% <0.00%> (ø)`
internal/hardware/validator.go	`79.88% <75.00%> (-0.45%)`	⬇️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

andrej1991 · 2026-06-25T09:12:21Z

/retest

openshift-ci-robot · 2026-06-25T09:15:20Z

@openshift-cherrypick-robot: This pull request references ACM-35997 which is a valid jira issue.

Details

In response to this:

This is an automated cherry-pick of #10442

/assign andrej1991

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-06-25T13:37:20Z

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ai-operator-disconnected-capi	`93dc05c`	link	true	`/test e2e-ai-operator-disconnected-capi`
ci/prow/e2e-ai-operator-ztp-capi	`93dc05c`	link	true	`/test e2e-ai-operator-ztp-capi`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

andrej1991 added 8 commits June 24, 2026 16:13

NO-ISSUE: make the isDiskEncryptionSetWithTpm function more robust

6402ae6

In OCPBUGS-86731 the issue was likelly caused by DiskEncryptionEnabledOn was an empty string and the validation threated empty string as enabled. A new test is also added to test the robustness.

extract internal/diskencryption package

68c8c30

fix diskencryption and hostutil unit test failures Use Ginkgo for dis…

70fcfcd

…kencryption tests so CI ginkgo flags are accepted, and remove the unused ginkgo table import from hostutil tests.

replace inline disk encryption enabled checks with IsConfigured

25822da

NO-ISSUE: reject tang disk encryption config when feature is disabled

20e1765

Use RequestsConfiguration at the API boundary so tang mode or tang_servers without enable_on cannot bypass the disk encryption feature gate on unsupported platforms.

reverting the commit 'extract internal/diskencryption package' so com…

d0316be

…mon solution would be used in the whole project. a separate follow-up task will be added

openshift-cherrypick-robot assigned andrej1991 Jun 24, 2026

openshift-cherrypick-robot mentioned this pull request Jun 24, 2026

ACM-34978: apply disk encryption defaults on cluster create and update #10442

Merged

20 tasks

openshift-ci Bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jun 24, 2026

openshift-ci Bot requested review from adriengentil and eliorerz June 24, 2026 16:16

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 24, 2026

andrej1991 changed the title ~~[release-ocm-2.17] ACM-34978: apply disk encryption defaults on cluster create and update~~ [release-ocm-2.17] ACM-35997: apply disk encryption defaults on cluster create and update Jun 25, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[release-ocm-2.17] ACM-35997: apply disk encryption defaults on cluster create and update#10513

[release-ocm-2.17] ACM-35997: apply disk encryption defaults on cluster create and update#10513
openshift-cherrypick-robot wants to merge 8 commits into
openshift:release-ocm-2.17from
openshift-cherrypick-robot:cherry-pick-10442-to-release-ocm-2.17

openshift-cherrypick-robot commented Jun 24, 2026

Uh oh!

openshift-ci-robot commented Jun 24, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 24, 2026

Review skipped

Uh oh!

openshift-ci Bot commented Jun 24, 2026

Uh oh!

andrej1991 commented Jun 24, 2026

Uh oh!

codecov Bot commented Jun 24, 2026

Uh oh!

andrej1991 commented Jun 25, 2026

Uh oh!

openshift-ci-robot commented Jun 25, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

openshift-ci Bot commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

openshift-cherrypick-robot commented Jun 24, 2026

Uh oh!

openshift-ci-robot commented Jun 24, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 24, 2026

Review skipped

Uh oh!

openshift-ci Bot commented Jun 24, 2026

Uh oh!

andrej1991 commented Jun 24, 2026

Uh oh!

codecov Bot commented Jun 24, 2026

Codecov Report

Uh oh!

andrej1991 commented Jun 25, 2026

Uh oh!

openshift-ci-robot commented Jun 25, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

openshift-ci-robot commented Jun 24, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jun 25, 2026 •

edited by openshift-ci Bot

Loading