Skip to content

OCPBUGS-100155: fix flaky MachineSet sync test by atomically verifying InfraTemplate - #647

Open
simkam wants to merge 1 commit into
openshift:mainfrom
simkam:e2e-machineset-sync-flake
Open

OCPBUGS-100155: fix flaky MachineSet sync test by atomically verifying InfraTemplate#647
simkam wants to merge 1 commit into
openshift:mainfrom
simkam:e2e-machineset-sync-flake

Conversation

@simkam

@simkam simkam commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

https://redhat.atlassian.net/browse/OCPBUGS-100155

The test that verifies AWSMachineTemplate rotation after a MAPI MachineSet providerSpec update was racy: it captured the new InfrastructureRef name in one Eventually block, then verified the template content in a separate block. Between these two steps, the sync controller could reconcile again and replace the intermediate template, leaving the test looking for a deleted object.

Fix by merging the two Eventually blocks into a single atomic poll that reads the current CAPI MachineSet, captures the InfrastructureRef name, and verifies the referenced template's InstanceType in the same iteration.

Also refresh the MAPI MachineSet from the API server before patching its providerSpec to avoid stale ResourceVersion conflicts.

Add an explicit RequeueAfter: time.Second when the machinesetsync controller is waiting for outdated InfraMachineTemplates to be deleted, providing a safety-net requeue instead of relying solely on watch events under CI load.

Summary by CodeRabbit

  • Bug Fixes
    • Improved machine set synchronization when replacing infrastructure templates.
    • Added a short delay while outdated templates are being deleted to prevent premature reconciliation.
    • Improved reliability when updating machine set provider specifications by refreshing the latest resource state first.
  • Tests
    • Expanded migration validation to confirm the replacement infrastructure template and instance type.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Aug 18, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@simkam: This pull request references Jira Issue OCPBUGS-100155, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.1.0) matches configured target version for branch (5.1.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-100155

The test that verifies AWSMachineTemplate rotation after a MAPI MachineSet providerSpec update was racy: it captured the new InfrastructureRef name in one Eventually block, then verified the template content in a separate block. Between these two steps, the sync controller could reconcile again and replace the intermediate template, leaving the test looking for a deleted object.

Fix by merging the two Eventually blocks into a single atomic poll that reads the current CAPI MachineSet, captures the InfrastructureRef name, and verifies the referenced template's InstanceType in the same iteration.

Also refresh the MAPI MachineSet from the API server before patching its providerSpec to avoid stale ResourceVersion conflicts.

Add an explicit RequeueAfter: time.Second when the machinesetsync controller is waiting for outdated InfraMachineTemplates to be deleted, providing a safety-net requeue instead of relying solely on watch events under CI load.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Aug 18, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: cf83200a-32a0-46e6-9725-d4f513692035

📥 Commits

Reviewing files that changed from the base of the PR and between 409c6b4 and bbd73f9.

📒 Files selected for processing (3)
  • e2e/machineset_migration_helpers.go
  • e2e/machineset_migration_mapi_authoritative_test.go
  • pkg/controllers/machinesetsync/machineset_sync_controller.go

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.


Walkthrough

The migration helper refreshes MachineSet state before updating the provider specification. The migration test validates replacement templates through direct client polling. The synchronization controller delays reconciliation while outdated infrastructure templates remain pending deletion.

Changes

MachineSet migration synchronization

Layer / File(s) Summary
Refresh and validate MachineSet migration
e2e/machineset_migration_helpers.go, e2e/machineset_migration_mapi_authoritative_test.go
The helper refreshes the MAPI MachineSet before updating its provider specification. The test polls the CAPI MachineSet, retrieves the replacement AWSMachineTemplate, and verifies its InstanceType.
Delay pending template reconciliation
pkg/controllers/machinesetsync/machineset_sync_controller.go
The controller requeues after one second when outdated infrastructure templates remain pending deletion.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to bbd73

The PR makes the MachineSet rotation test atomic and adds a bounded requeue safeguard while waiting for outdated templates to be deleted; no actionable merge-blocking risk remains.

Suggested reviewers: mdbooth

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Test Structure And Quality ❓ Inconclusive Initial diff review is complete, but assertion-message and repository-pattern checks need targeted inspection before deciding. Inspect the changed Ginkgo block, cleanup helpers, and comparable Eventually assertions to confirm whether the PR introduces a stated quality failure.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the flaky MachineSet sync test and its atomic InfraTemplate verification fix.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR diff changes no Ginkgo test declarations. The new By text is static, and dynamic template names occur only in assertion-body data.
Microshift Test Compatibility ✅ Passed The diff adds no Ginkgo test declaration; it only updates an existing test's polling and controller/helper code, so the new-test MicroShift check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR adds no new Ginkgo test. Its existing test changes only poll MachineSet and AWSMachineTemplate objects, with no multi-node or HA assumption.
Topology-Aware Scheduling Compatibility ✅ Passed The diff only refreshes API objects, changes test polling, and adds a one-second controller requeue; it adds no affinity, topology spread, selectors, tolerations, replica logic, or PDB constraints.
Ote Binary Stdout Contract ✅ Passed The PR diff adds API reads, assertions, imports, and a delayed requeue; it adds no stdout writes or process-level logging in main or suite setup.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The diff modifies an existing Ginkgo test and adds only Kubernetes API reads; targeted inspection found no IPv4 literals, IP parsing, public endpoints, or external connectivity.
No-Weak-Crypto ✅ Passed The diff only adds API refresh/polling and a one-second controller requeue; added-line scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed The patch changes only Go helpers, an e2e test, and controller requeue logic; no container/Kubernetes manifest or privilege setting is added.
No-Sensitive-Data-In-Logs ✅ Passed The patch adds no sensitive logging. New messages contain only MachineSet/template names and AWS instance types; the controller log statement is unchanged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from RadekManak and racheljpg August 18, 2026 10:28
@openshift-ci

openshift-ci Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign theobarberbany for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot

Copy link
Copy Markdown

@simkam: This pull request references Jira Issue OCPBUGS-100155, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.1.0) matches configured target version for branch (5.1.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-100155

The test that verifies AWSMachineTemplate rotation after a MAPI MachineSet providerSpec update was racy: it captured the new InfrastructureRef name in one Eventually block, then verified the template content in a separate block. Between these two steps, the sync controller could reconcile again and replace the intermediate template, leaving the test looking for a deleted object.

Fix by merging the two Eventually blocks into a single atomic poll that reads the current CAPI MachineSet, captures the InfrastructureRef name, and verifies the referenced template's InstanceType in the same iteration.

Also refresh the MAPI MachineSet from the API server before patching its providerSpec to avoid stale ResourceVersion conflicts.

Add an explicit RequeueAfter: time.Second when the machinesetsync controller is waiting for outdated InfraMachineTemplates to be deleted, providing a safety-net requeue instead of relying solely on watch events under CI load.

Summary by CodeRabbit

  • Bug Fixes
  • Improved machine set synchronization when replacing infrastructure templates.
  • Added a short delay while outdated templates are being deleted to prevent premature reconciliation.
  • Improved reliability when updating machine set provider specifications by refreshing the latest resource state first.
  • Tests
  • Expanded migration validation to confirm the replacement infrastructure template and instance type.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@simkam

simkam commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-capi-techpreview

@simkam

simkam commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-disconnected-techpreview
/test e2e-aws-capi-techpreview
/test e2e-aws-capi-techpreview-post-install
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

} else if shouldRequeue {
logger.Info("Waiting for Cluster API infrastructure machine templates to be deleted")
return ctrl.Result{}, nil
return ctrl.Result{RequeueAfter: time.Second}, nil

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a fan of this. There's no reason we should ever miss a watch event, even until intense load, even if the watch is cancelled and restarted at any point. This just hides bugs.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed

Comment thread e2e/machineset_migration_helpers.go Outdated
Comment on lines +325 to +327
if err := cl.Get(ctx, client.ObjectKeyFromObject(mapiMachineSet), mapiMachineSet); err != nil {
return fmt.Errorf("failed to refresh MachineSet %s: %w", mapiMachineSet.Name, err)
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was this strictly required? If not I prefer to remove it. I think this could make tests harder to debug if the helper might not actually be using the same object state it was passed.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, it is not required, removed.

Comment on lines +328 to +344
By("Waiting for new InfraTemplate with updated InstanceType to be created")
originalAWSMachineTemplateName := capiMachineSet.Spec.Template.Spec.InfrastructureRef.Name
capiMachineSet = capiframework.GetMachineSetWithRetry(mapiMSAuthMAPIName, capiframework.CAPINamespace)
Eventually(k.Object(capiMachineSet), capiframework.WaitMedium, capiframework.RetryMedium).Should(HaveField("Spec.Template.Spec.InfrastructureRef.Name", Not(Equal(originalAWSMachineTemplateName))), "Should have InfraTemplate name changed")
Eventually(func(g Gomega) {
g.Expect(cl.Get(ctx, client.ObjectKeyFromObject(capiMachineSet), capiMachineSet)).To(Succeed())

currentTemplateName := capiMachineSet.Spec.Template.Spec.InfrastructureRef.Name
g.Expect(currentTemplateName).ToNot(Equal(originalAWSMachineTemplateName),
"InfraTemplate name should have changed from %s", originalAWSMachineTemplateName)

By("Verifying new InfraTemplate has the updated InstanceType", func() {
newAWSMachineTemplate = &awsv1.AWSMachineTemplate{}
newAWSMachineTemplate.Name = capiMachineSet.Spec.Template.Spec.InfrastructureRef.Name
newAWSMachineTemplate.Name = currentTemplateName
newAWSMachineTemplate.Namespace = capiMachineSet.Namespace

Eventually(k.Object(newAWSMachineTemplate), capiframework.WaitShort, capiframework.RetryShort).Should(
HaveField("Spec.Template.Spec.InstanceType", Equal(newInstanceType)),
)
})
g.Expect(cl.Get(ctx, client.ObjectKeyFromObject(newAWSMachineTemplate), newAWSMachineTemplate)).To(Succeed())
g.Expect(newAWSMachineTemplate.Spec.Template.Spec.InstanceType).To(Equal(newInstanceType),
"AWSMachineTemplate %s should have InstanceType %s", currentTemplateName, newInstanceType)
}, capiframework.WaitMedium, capiframework.RetryMedium).Should(Succeed(),
"Should have a new InfraTemplate with InstanceType %s", newInstanceType)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

https://redhat.atlassian.net/browse/OCPBUGS-100155

The test that verifies `AWSMachineTemplate` rotation after a MAPI MachineSet `providerSpec` update was racy: it captured the new `InfrastructureRef` name in one `Eventually` block, then verified the template content in a separate block. Between these two steps, the sync controller could reconcile again and replace the intermediate template, leaving the test looking for a deleted object.

Fix by merging the two `Eventually` blocks into a single atomic poll that reads the current CAPI MachineSet, captures the `InfrastructureRef` name, and verifies the referenced template's `InstanceType` in the same iteration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@simkam
simkam force-pushed the e2e-machineset-sync-flake branch from bbd73f9 to 4b9a045 Compare August 26, 2026 15:37
@simkam

simkam commented Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-disconnected-techpreview
/test e2e-aws-capi-techpreview
/test e2e-aws-capi-techpreview-post-install
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

@simkam

simkam commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

1 similar comment
@simkam

simkam commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@openshift-ci

openshift-ci Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

@simkam: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants