Skip to content

Create ssh public key field - #1180

Open
tmstff wants to merge 7 commits into
openshift-online:mainfrom
tmstff:create_ssh_public_key_field
Open

Create ssh public key field#1180
tmstff wants to merge 7 commits into
openshift-online:mainfrom
tmstff:create_ssh_public_key_field

Conversation

@tmstff

@tmstff tmstff commented Jul 21, 2026

Copy link
Copy Markdown

Description

Implementation of ARO-26937: Update OCM SDK to include SSH public key field :

As part of the effort to make it possible for ARO HCP customers to connect to a cluster node via ssh, this change adds the fiels nodeSshPublicKey to enable the ARO HCP RP Backend to propagate the key to CS (which can then forward it to HyperShift).

Type of Change

  • Model change (new or modified types, resources, methods, or parameters)
  • Generated code update (make update after model change)
  • Breaking change (removes or renames existing model elements)
  • Documentation update
  • CI/CD or tooling change

Verification

  • make check passes (model syntax validation)
  • make verify passes (generated code matches model)
  • make lint passes (indentation enforcement) -> did not pass, but also on >4.000 locations that were not touched my this PR. Will try to take care of this separately.

Checklist

  • Model files follow the project's DSL conventions (see README)
  • Generated clientapi/ and openapi/ are updated if model changed (make update)

Summary by CodeRabbit

New Features

  • Added optional SSH public key configuration for cluster nodes, distributed to support secure maintenance access.
  • Added AWS spot-instance configuration for node pools, including an optional maximum price.
  • Added support for configuring the spot-instance termination-handler queue URL.
  • Added API, serialization, and schema support for these settings.

Chores

  • Improved linting consistency when scanning model files.

@openshift-ci
openshift-ci Bot requested review from davidleerh and vkareh July 21, 2026 08:11
@openshift-ci

openshift-ci Bot commented Jul 21, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tmstff
Once this PR has been reviewed and has the lgtm label, please assign tzvatot for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown

Walkthrough

The change adds ARO HCP node SSH key support and AWS Spot instance configuration to the models, OpenAPI schemas, generated Go client, builders, and JSON handling. It also updates release metadata and makes model-file lint discovery explicit.

Changes

ARO HCP cluster SSH key

Layer / File(s) Summary
Cluster contract and accessors
model/aro_hcp/v1alpha1/cluster_type.model, openapi/aro_hcp/v1alpha1/openapi.json, clientapi/arohcp/v1alpha1/cluster_type.go
Adds the optional NodeSSHPublicKey / node_ssh_public_key field and presence-aware Go accessors.
Builder and JSON integration
clientapi/arohcp/v1alpha1/cluster_builder.go, clientapi/arohcp/v1alpha1/cluster_type_json.go
Adds builder, copy, build, serialization, and deserialization support. Updates later field-presence indexes.

AWS Spot instance configuration

Layer / File(s) Summary
AWS configuration contracts
model/clusters_mgmt/v1/*, openapi/clusters_mgmt/v1/openapi.json
Adds termination_handler_queue_url, spot_market_options, and AwsNodePoolSpotMarketOptions.
Generated Spot option types and JSON support
clientapi/clustersmgmt/v1/aws_node_pool_spot_market_options_*
Adds option and list types, builders, accessors, iteration, copying, and JSON encoding and decoding.
AWS and node-pool integration
clientapi/clustersmgmt/v1/aws_*, clientapi/clustersmgmt/v1/aws_node_pool_*
Propagates the new values through builders, accessors, JSON paths, and shifted presence indexes.

Supporting updates

Layer / File(s) Summary
Release and lint updates
CHANGES.md, Makefile
Adds the 0.0.462 changelog entry and makes the lint target search for model files from the current directory.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AWSNodePoolBuilder
  participant AwsNodePoolSpotMarketOptionsBuilder
  participant JSONSerializer
  Client->>AWSNodePoolBuilder: set SpotMarketOptions
  AWSNodePoolBuilder->>AwsNodePoolSpotMarketOptionsBuilder: build nested options
  AWSNodePoolBuilder-->>Client: return AWSNodePool
  Client->>JSONSerializer: serialize spot_market_options
  JSONSerializer-->>Client: return JSON payload
Loading

Possibly related PRs

Suggested reviewers: vkareh, davidleerh

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: adding an SSH public key field for cluster node access.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto ✅ Passed The added code only stores and serializes model fields; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto imports, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed No tracked Kubernetes/container manifests contain privileged settings; searches found no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation entries.
No-Sensitive-Data-In-Logs ✅ Passed The PR-range diff adds no logging or direct-output calls and no logging imports; changed Go code only serializes API fields with jsoniter.
No-Hardcoded-Secrets ✅ Passed No hardcoded secret found: changed-path scans found no private-key markers, credential-bearing URLs, high-confidence tokens, long base64 literals, or sensitive-name string assignments.
No-Injection-Vectors ✅ Passed Changed code only adds generated models, builders, and JSON accessors; the Makefile uses a constant sh -c with null-delimited, quoted "$@" paths and no SQL, eval/exec, pickle, YAML, or DOM sinks.
Ai-Attribution ✅ Passed The authored PR description and seven PR commits contain no AI-tool mention; no Assisted-by, Generated-by, or AI Co-Authored-By trailer is present.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
model/aro_hcp/v1alpha1/cluster_type.model (1)

260-265: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Generated doc comments say 'node_SSH_public_key' instead of the actual node_ssh_public_key JSON key.

The model field name NodeSSHPublicKey (consecutive caps "SSH") causes the code generator's snake_case derivation used for Godoc text to preserve the capital "SSH", while the real JSON/OpenAPI key is correctly all-lowercase node_ssh_public_key. Purely cosmetic (doc text only, wire format unaffected), but confusing to SDK consumers reading the generated docs.

  • model/aro_hcp/v1alpha1/cluster_type.model#L260-L265: consider renaming the field (e.g. NodeSshPublicKey) if the generator's acronym handling can't be special-cased, to avoid the incorrect derived doc string.
  • clientapi/arohcp/v1alpha1/cluster_type.go#L1290-L1317: NodeSSHPublicKey()/GetNodeSSHPublicKey() doc comments reference 'node_SSH_public_key'; would be regenerated automatically once the root cause is addressed.
  • clientapi/arohcp/v1alpha1/cluster_builder.go#L775-L783: NodeSSHPublicKey setter doc comment has the same mismatch; would be regenerated automatically once the root cause is addressed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/aro_hcp/v1alpha1/cluster_type.model` around lines 260 - 265, Rename the
model field NodeSSHPublicKey to NodeSshPublicKey in
model/aro_hcp/v1alpha1/cluster_type.model lines 260-265 so generated
documentation derives the correct node_ssh_public_key spelling, while preserving
the JSON/OpenAPI key and API behavior; regenerate the affected client code,
including clientapi/arohcp/v1alpha1/cluster_type.go lines 1290-1317 and
clientapi/arohcp/v1alpha1/cluster_builder.go lines 775-783, with no direct
manual changes required there beyond the generated rename and corrected
comments.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@model/aro_hcp/v1alpha1/cluster_type.model`:
- Around line 260-265: Rename the model field NodeSSHPublicKey to
NodeSshPublicKey in model/aro_hcp/v1alpha1/cluster_type.model lines 260-265 so
generated documentation derives the correct node_ssh_public_key spelling, while
preserving the JSON/OpenAPI key and API behavior; regenerate the affected client
code, including clientapi/arohcp/v1alpha1/cluster_type.go lines 1290-1317 and
clientapi/arohcp/v1alpha1/cluster_builder.go lines 775-783, with no direct
manual changes required there beyond the generated rename and corrected
comments.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c1ef1049-26b4-4cdc-945a-b13395dd9d0c

📥 Commits

Reviewing files that changed from the base of the PR and between 29454e6 and 016d62c.

📒 Files selected for processing (6)
  • Makefile
  • clientapi/arohcp/v1alpha1/cluster_builder.go
  • clientapi/arohcp/v1alpha1/cluster_type.go
  • clientapi/arohcp/v1alpha1/cluster_type_json.go
  • model/aro_hcp/v1alpha1/cluster_type.model
  • openapi/aro_hcp/v1alpha1/openapi.json

@tmstff tmstff mentioned this pull request Jul 21, 2026
12 tasks
// The SSH public key used for secure access to cluster nodes. When set, this key
// is distributed to all nodes, enabling SSH access for debugging
// and maintenance purposes.
// This is currently only supported for ARO HCP

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

// This is currently only supported for ARO HCP

This comment is not needed, as the model is specific to aro-hcp

// is distributed to all nodes, enabling SSH access for debugging
// and maintenance purposes.
// This is currently only supported for ARO HCP
NodeSSHPublicKey String

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it updatable? If not, document it in the same way as other fields that are not.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's updatable, are both directions supported? document any restrictions

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's updatable. What do you mean by "both directions" ?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

by both directions I mean:

  • update from "there's a key set" to "no key set"
  • update from "no key set" to "there's a key set"

@miguelsorianod miguelsorianod Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's updatable.

Do we have an understanding on how that would be achieved (at RP level, CS level, ...) and what would be the impact (recreation of nodepools vs not, etc...) ? this is a cluster-level attribute but it controls node pool related configuration. This would include figuring out how to perform update state calculation and so on.

Do we know whether Hypershift supports updating it? if so, what are the consequences of doing so.

// is distributed to all nodes, enabling SSH access for debugging
// and maintenance purposes.
// This is currently only supported for ARO HCP
NodeSSHPublicKey String

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the expected format? explain it

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

valid ssh public key. Can add that.

"description": "Network settings of the cluster.",
"$ref": "#/components/schemas/Network"
},
"node_ssh_public_key": {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change to plural: nodes_ssh_public_key

"$ref": "#/components/schemas/Network"
},
"node_ssh_public_key": {
"description": "The SSH public key used for secure access to cluster nodes. When set, this key\nis distributed to all nodes, enabling SSH access for debugging\nand maintenance purposes.\nThis is currently only supported for ARO HCP",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cluster nodes -> cluster's node pool's nodes

// This is currently only supported for ROSA HCP
AutoNode ClusterAutoNode

// The SSH public key used for secure access to cluster nodes. When set, this key

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

// This is currently only supported for ROSA HCP
AutoNode ClusterAutoNode

// The SSH public key used for secure access to cluster nodes. When set, this key

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Has the API design been reviewed and approved on ARM side?

@miguelsorianod miguelsorianod Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ARM side PR is Azure/ARO-HCP#6157, which is currently in draft. I left some comments there too

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGES.md`:
- Around line 6-8: Remove the duplicate ROSAENG-61032 entries from CHANGES.md,
keeping a single entry for the change or replacing the duplicates with distinct
release 0.0.462 changes.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e49f56fb-662a-4880-b11b-93d128607f60

📥 Commits

Reviewing files that changed from the base of the PR and between 016d62c and 3b6529c.

📒 Files selected for processing (16)
  • CHANGES.md
  • clientapi/clustersmgmt/v1/aws_builder.go
  • clientapi/clustersmgmt/v1/aws_node_pool_builder.go
  • clientapi/clustersmgmt/v1/aws_node_pool_spot_market_options_builder.go
  • clientapi/clustersmgmt/v1/aws_node_pool_spot_market_options_list_builder.go
  • clientapi/clustersmgmt/v1/aws_node_pool_spot_market_options_list_type_json.go
  • clientapi/clustersmgmt/v1/aws_node_pool_spot_market_options_type.go
  • clientapi/clustersmgmt/v1/aws_node_pool_spot_market_options_type_json.go
  • clientapi/clustersmgmt/v1/aws_node_pool_type.go
  • clientapi/clustersmgmt/v1/aws_node_pool_type_json.go
  • clientapi/clustersmgmt/v1/aws_type.go
  • clientapi/clustersmgmt/v1/aws_type_json.go
  • model/clusters_mgmt/v1/aws_node_pool_spot_market_options_type.model
  • model/clusters_mgmt/v1/aws_node_pool_type.model
  • model/clusters_mgmt/v1/aws_type.model
  • openapi/clusters_mgmt/v1/openapi.json

Comment thread CHANGES.md
Comment on lines +6 to +8
- ROSAENG-61032 | task: ocm-api/sdk changes to support SpotMarketOptions for ROSA HCP
- ROSAENG-61032 | task: ocm-api/sdk changes to support SpotMarketOptions for ROSA HCP
- ROSAENG-61032 | task: ocm-api/sdk changes to support SpotMarketOptions for ROSA HCP

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Remove the duplicate changelog entries.

Lines 6-8 contain identical text. Keep one entry, or replace the duplicates with distinct changes included in release 0.0.462.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGES.md` around lines 6 - 8, Remove the duplicate ROSAENG-61032 entries
from CHANGES.md, keeping a single entry for the change or replacing the
duplicates with distinct release 0.0.462 changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants