OCPCLOUD-3557: split capi-controllers and machine-api-migration

admission-policies/default/authoritative-api-transition-requires-capi-infrastructure-ready.yaml

@@ -48,7 +48,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-param-match
       expression: 'object.metadata.name == params.metadata.name'

admission-policies/default/cluster-api-machine-set-vap.yaml

@@ -47,7 +47,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-param-match
       expression: 'object.metadata.name == params.metadata.name'

admission-policies/default/cluster-api-machine-vap.yaml

@@ -47,7 +47,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-param-match
       expression: 'object.metadata.name == params.metadata.name'

admission-policies/default/machine-api-machine-set-vap.yaml

@@ -48,7 +48,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-authoritativeAPI-clusterapi
       expression: 'object.status.authoritativeAPI == "ClusterAPI"'

admission-policies/default/machine-api-machine-vap.yaml

@@ -48,7 +48,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-authoritativeAPI-clusterapi
       expression: 'object.status.authoritativeAPI == "ClusterAPI"'

admission-policies/default/validate-capi-machine-creation.yaml

@@ -42,7 +42,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-param-match
       expression: 'object.metadata.name == params.metadata.name'

admission-policies/default/validate-capi-machine-set-creation.yaml

@@ -42,7 +42,8 @@ spec:
       expression: >-
         !(request.userInfo.username in [
             "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-            "system:serviceaccount:openshift-cluster-api:capi-controllers"
+            "system:serviceaccount:openshift-cluster-api:capi-controllers",
+            "system:serviceaccount:openshift-cluster-api:machine-api-migration"
         ])
     - name: check-param-match
       expression: 'object.metadata.name == params.metadata.name'

capi-operator-manifests/default/manifests.yaml

@@ -28,7 +28,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.status.authoritativeAPI == "ClusterAPI"
@@ -155,7 +156,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.status.authoritativeAPI == "ClusterAPI"
@@ -280,7 +282,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.metadata.name == params.metadata.name
@@ -392,7 +395,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.metadata.name == params.metadata.name
@@ -652,7 +656,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.metadata.name == params.metadata.name
@@ -730,7 +735,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.metadata.name == params.metadata.name
@@ -907,7 +913,8 @@ spec:
       !(request.userInfo.username in [
 
           "system:serviceaccount:openshift-machine-api:machine-api-controllers",
-          "system:serviceaccount:openshift-cluster-api:capi-controllers"
+          "system:serviceaccount:openshift-cluster-api:capi-controllers",
+          "system:serviceaccount:openshift-cluster-api:machine-api-migration"
       ])
     name: check-only-non-service-account-requests
   - expression: object.metadata.name == params.metadata.name
@@ -984,10 +991,10 @@ spec:
           name: webhook-server
           protocol: TCP
         - containerPort: 8443
-          name: diagnostics-o
+          name: diagnostics
           protocol: TCP
         - containerPort: 9440
-          name: healthz-o
+          name: healthz
           protocol: TCP
         resources:
           requests:
@@ -1001,32 +1008,6 @@ spec:
         - mountPath: /tmp/k8s-metrics-server/serving-certs
           name: metrics-cert
           readOnly: true
-      - args:
-        - --diagnostics-address=:8442
-        - --health-addr=:9441
-        command:
-        - /machine-api-migration
-        env:
-        - name: RELEASE_VERSION
-          value: 0.0.1-snapshot
-        image: registry.ci.openshift.org/openshift:cluster-capi-operator
-        name: machine-api-migration
-        ports:
-        - containerPort: 8442
-          name: diagnostics-m
-          protocol: TCP
-        - containerPort: 9441
-          name: healthz-m
-          protocol: TCP
-        resources:
-          requests:
-            cpu: 10m
-            memory: 50Mi
-        terminationMessagePolicy: FallbackToLogsOnError
-        volumeMounts:
-        - mountPath: /tmp/k8s-metrics-server/serving-certs
-          name: metrics-cert
-          readOnly: true
       nodeSelector:
         node-role.kubernetes.io/control-plane: ""
       priorityClassName: system-cluster-critical

cmd/capi-controllers/main.go

@@ -235,11 +235,6 @@ func getDefaultCacheOptions(capiNamespace string, sync time.Duration) cache.Opti
 					defaultMachineAPINamespace: {},
 				},
 			},
-			&mapiv1beta1.MachineSet{}: {
-				Namespaces: map[string]cache.Config{
-					defaultMachineAPINamespace: {},
-				},
-			},
 			&mapiv1beta1.Machine{}: {
 				Namespaces: map[string]cache.Config{
 					defaultMachineAPINamespace: {},

docs/rbac.md

@@ -20,15 +20,26 @@ Both SAs also bind to ClusterRole `system:openshift:openshift-cluster-api:read-t
 
 ### capi-controllers
 
-The `capi-controllers` ServiceAccount (used by both the `capi-controllers` and `machine-api-migration` containers) has permissions split across scopes:
+The `capi-controllers` ServiceAccount runs the `capi-controllers` binary (core cluster, infra cluster, kubeconfig, secret sync, and webhook controllers):
 
 | Manifest | Kind | Scope | Purpose |
 |----------|------|-------|---------|
-| `0000_30_cluster-api_03_rbac_roles.yaml` | ClusterRole `openshift-capi-controllers` | cluster-wide | Cluster-scoped resources only: infrastructures, clusteroperators, featuregates, clusterversions, nodes, CRDs |
-| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-cluster-api` | CAPI core + infra provider resources, secrets, pod self-read, events, leases |
-| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-machine-api` | MAPI machines, machinesets, controlplanemachinesets, secrets, events |
+| `0000_30_cluster-api_03_rbac_roles.yaml` | ClusterRole `openshift-capi-controllers` | cluster-wide | Cluster-scoped resources: infrastructures, clusteroperators, nodes |
+| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-cluster-api` | CAPI Cluster + infra cluster resources, secrets, pod self-read, events, leases |
+| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-machine-api` | MAPI machines (read-only for InfraCluster), controlplanemachinesets (InfraCluster), secrets (read-only) |
 | `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers-kube-system` | `kube-system` | Secrets (vSphere credentials) |
-| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `cluster-capi-operator-pull-secret` | `openshift-config` | Pull-secret read |
+
+This SA also binds to ClusterRole `system:openshift:openshift-cluster-api:read-tls-configuration` for APIServer TLS profile reading.
+
+### machine-api-migration
+
+The `machine-api-migration` ServiceAccount runs the `machine-api-migration` binary (machine/machineset sync and migration controllers):
+
+| Manifest | Kind | Scope | Purpose |
+|----------|------|-------|---------|
+| `0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml` | ClusterRole `openshift-machine-api-migration` | cluster-wide | Cluster-scoped resources: infrastructures (get only), featuregates, clusterversions, CRDs |
+| `0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml` | Role `machine-api-migration` | `openshift-cluster-api` | CAPI Cluster (read), Machine/MachineSet + infra cluster (read)/machine/machinetemplate resources, events, leader election lease (scoped to `machine-api-migration-leader`) |
+| `0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml` | Role `machine-api-migration` | `openshift-machine-api` | MAPI machines (full), machinesets (no create), events |
 
 This SA also binds to ClusterRole `system:openshift:openshift-cluster-api:read-tls-configuration` for APIServer TLS profile reading.
 

e2e/cluster_api_machine_management.go

@@ -56,6 +56,14 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:ClusterAPIMachineManage
 			framework.AssertDeploymentAvailable("capi-controllers", framework.CAPINamespace)
 		})
 
+		It("should have the machine-api-migration deployment available", func() {
+			if !framework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) {
+				Skip("Skipping, machine-api-migration is only deployed when MachineAPIMigration is enabled")
+			}
+
+			framework.AssertDeploymentAvailable("machine-api-migration", framework.CAPINamespace)
+		})
+
 		It("should have the capi-installer deployment available", func() {
 			framework.AssertDeploymentAvailable("capi-installer", framework.CAPIOperatorNamespace)
 		})

manifests/0000_30_cluster-api_02_machine-api-migration-service-account.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: openshift-cluster-api
+  name: machine-api-migration
+  annotations:
+    exclude.release.openshift.io/internal-openshift-hosted: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/feature-gate: "MachineAPIMigration"