AUTOSCALE-571: fix(karpenter): don't associate public IP addresses for the default OpenshiftEC2NodeClass by joshbranham · Pull Request #7853 · openshift/hypershift

joshbranham · 2026-03-04T16:57:16Z

What this PR does / why we need it:

Previously, Karpenter would reconcile the default named OpenshiftEC2NodeClass to use public IPs if the annotation was set. This annotation was used for testing purposes, and was likely added as the initial e2e test suite had public subnets only.

The default behavior for this OpenshiftEC2NodeClass should be that it works in private subnets. However, if you use a public subnet, you should not expect to get a public IP.

If a user wants to use public subnets with a public IP for nodes, they should make their own OpenshiftEC2NodeClass and set spec.AssociatePublicIPAddress: true there.

Which issue(s) this PR fixes:

Fixes AUTOSCALE-571

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

Summary by CodeRabbit

Bug Fixes
- Removed automatic public IP address assignment for OpenShift Karpenter EC2 node classes based on HCP annotations. The AssociatePublicIPAddress setting now defaults to unset during reconciliation, changing how public IP addresses are managed for EC2 nodes.

openshift-ci-robot · 2026-03-04T16:57:19Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-03-04T16:57:21Z

@joshbranham: This pull request references AUTOSCALE-571 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Previously, Karpenter would reconcile the default named OpenshiftEC2NodeClass to use public IPs if the annotation was set. This annotation was used for testing purposes, and was likely added as the initial e2e test suite had public subnets only.

The default behavior for this OpenshiftEC2NodeClass should be that it works in private subnets. However, if you use a public subnet, you should not expect to get a public IP.

If a user wants to use public subnets with a public IP for nodes, they should make their own OpenshiftEC2NodeClass and set spec.AssociatePublicIPAddress: true there.

Which issue(s) this PR fixes:

Fixes AUTOSCALE-571

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-04T16:57:29Z

@joshbranham: This pull request references AUTOSCALE-571 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Previously, Karpenter would reconcile the default named OpenshiftEC2NodeClass to use public IPs if the annotation was set. This annotation was used for testing purposes, and was likely added as the initial e2e test suite had public subnets only.

The default behavior for this OpenshiftEC2NodeClass should be that it works in private subnets. However, if you use a public subnet, you should not expect to get a public IP.

If a user wants to use public subnets with a public IP for nodes, they should make their own OpenshiftEC2NodeClass and set spec.AssociatePublicIPAddress: true there.

Which issue(s) this PR fixes:

Fixes AUTOSCALE-571

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-04T16:57:40Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9a8abbdc-6087-43dc-8e00-f1d4088e44b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

Removed a conditional block from the Karpenter controller that previously assigned the OpenshiftEC2NodeClass AssociatePublicIPAddress property based on an HCP annotation. The property now remains unset during default reconciliation, eliminating annotation-driven public IP assignment logic.

Changes

Cohort / File(s)	Summary
Controller Logic Simplification `karpenter-operator/controllers/karpenter/karpenter_controller.go`	Removed 3 lines of conditional logic that set `AssociatePublicIPAddress` to true when the `AWSMachinePublicIPs` annotation equaled "true". The property is now left unset (default behavior) in the OpenshiftEC2NodeClass reconciliation.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Structure And Quality	⚠️ Warning	Test file lacks coverage for reconcileDefaultOpenshiftEC2NodeClass function changes, specifically annotation-driven public IP assignment removal.	Add unit tests for reconcileDefaultOpenshiftEC2NodeClass verifying default creation, annotation ignoring, and explicit spec configuration requirements.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: removing automatic public IP assignment for the default OpenshiftEC2NodeClass, which matches the code removal of the annotation-driven AssociatePublicIPAddress logic.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	All test names use static, descriptive strings with no dynamic information such as UUIDs, timestamps, or generated suffixes.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci-robot · 2026-03-04T16:59:19Z

@joshbranham: This pull request references AUTOSCALE-571 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Previously, Karpenter would reconcile the default named OpenshiftEC2NodeClass to use public IPs if the annotation was set. This annotation was used for testing purposes, and was likely added as the initial e2e test suite had public subnets only.

The default behavior for this OpenshiftEC2NodeClass should be that it works in private subnets. However, if you use a public subnet, you should not expect to get a public IP.

If a user wants to use public subnets with a public IP for nodes, they should make their own OpenshiftEC2NodeClass and set spec.AssociatePublicIPAddress: true there.

Which issue(s) this PR fixes:

Fixes AUTOSCALE-571

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Summary by CodeRabbit

Bug Fixes

Removed automatic public IP address assignment for OpenShift Karpenter EC2 node classes based on HCP annotations. The AssociatePublicIPAddress setting now defaults to unset during reconciliation, changing how public IP addresses are managed for EC2 nodes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joshbranham · 2026-03-04T18:59:30Z

/test unit
/test e2e-azure-self-managed
/test e2e-aws-autonode

joshbranham · 2026-03-04T20:35:48Z

/test e2e-azure-self-managed

joshbranham · 2026-03-10T23:20:22Z

/test security

joshbranham · 2026-03-12T21:56:06Z

/verified by @joshbranham in e2e

openshift-ci-robot · 2026-03-12T21:56:18Z

@joshbranham: This PR has been marked as verified by @joshbranham in e2e.

Details

In response to this:

/verified by @joshbranham in e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jkyros · 2026-03-14T00:04:15Z

Now that #7933 is in, this should be able to come out since we're explicitly selecting private networks by default, a public one shouldn't be able to be in the list and need this.
/lgtm

openshift-ci-robot · 2026-03-14T00:04:31Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

joshbranham · 2026-03-14T04:00:57Z

/test e2e-aws

enxebre · 2026-03-23T15:23:11Z

/test e2e-aws-autonode
/test e2e-aws-techpreview

enxebre · 2026-03-23T15:36:09Z

This aligns with

hypershift/test/e2e/karpenter_test.go

Line 54 in 4585fa1

clusterOpts.AWSPlatform.PublicOnly = false

We'll want to revaluate this to not degrade infra cost in presubmits.

/approve
/lgtm

joshbranham · 2026-03-23T16:15:33Z

/test e2e-aws-autonode
/test e2e-aws

joshbranham · 2026-03-23T20:19:50Z

/retest-required

joshbranham · 2026-03-24T01:49:30Z

/verified by @joshbranham in e2e

openshift-ci-robot · 2026-03-24T01:49:41Z

@joshbranham: This PR has been marked as verified by @joshbranham in e2e.

Details

In response to this:

/verified by @joshbranham in e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joshbranham · 2026-03-24T02:44:27Z

Looks like I need 5830cf1 but don't want to rebase and retest if I don't have to. Can you try to override again @enxebre

/test e2e-aws-techpreview

joshbranham · 2026-03-24T13:39:54Z

/test e2e-aws-techpreview

cristianoveiga · 2026-03-24T14:54:15Z

/test e2e-aws-techpreview

hey @joshbranham , I believe you will need the fix on #8037.

The e2e-aws-techpreview will fail without that.

…penshiftEC2NodeClass Previously, Karpenter would reconcile the default named OpenshiftEC2NodeClass to use public IPs if the annotation was set. This annotation was used for testing purposes, and was likely added as the initial e2e test suite had public subnets only. The default behavior for this OpenshiftEC2NodeClass should be that it works in private subnets. However, if you use a public subnet, you should not expect to get a public IP. If a user wants to use public subnets with a public IP for nodes, they should make their own OpenshiftEC2NodeClass and set `spec.AssociatePublicIPAddress: true` there.

enxebre · 2026-03-25T15:00:32Z

/approve
/lgtm
/test e2e-aws-techpreview
/verified by e2e @joshbranham
/hold
on the test passing

openshift-ci-robot · 2026-03-25T15:00:45Z

@enxebre: This PR has been marked as verified by e2e @joshbranham.

Details

In response to this:

/approve
/lgtm
/test e2e-aws-techpreview
/verified by e2e @joshbranham
/hold
on the test passing

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-25T15:00:52Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

openshift-ci · 2026-03-25T15:00:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, joshbranham

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

joshbranham · 2026-03-25T17:34:16Z

/test e2e-aks
/test e2e-azure-self-managed

joshbranham · 2026-03-25T19:31:20Z

/retest-required

joshbranham · 2026-03-25T19:43:16Z

/test e2e-aws-techpreview

joshbranham · 2026-03-25T21:20:04Z

/hold cancel

joshbranham · 2026-03-26T00:24:48Z

/retest-required

joshbranham · 2026-03-26T00:25:08Z

/test e2e-aws-techpreview

joshbranham · 2026-03-26T02:55:30Z

/test e2e-azure-self-managed

joshbranham · 2026-03-26T04:44:12Z

/retest-required

openshift-ci · 2026-03-26T10:49:42Z

@joshbranham: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-techpreview	`05d7dca`	link	false	`/test e2e-aws-techpreview`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 4, 2026

openshift-ci bot added the do-not-merge/needs-area label Mar 4, 2026

openshift-ci bot requested review from elmiko and jparrill March 4, 2026 16:57

openshift-ci bot added area/karpenter-operator Indicates the PR includes changes related to the Karpenter operator and removed do-not-merge/needs-area labels Mar 4, 2026

jkyros reviewed Mar 5, 2026

View reviewed changes

Comment thread karpenter-operator/controllers/karpenter/karpenter_controller.go

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 12, 2026

openshift-ci bot assigned jkyros Mar 14, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 14, 2026

joshbranham force-pushed the drop-public-ip-default-karpenter-nodeclass branch from 127840e to 7bdcca3 Compare March 23, 2026 14:38

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Mar 23, 2026

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 23, 2026

openshift-ci bot assigned enxebre Mar 23, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 23, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 24, 2026

joshbranham force-pushed the drop-public-ip-default-karpenter-nodeclass branch from 7bdcca3 to 05d7dca Compare March 25, 2026 14:14

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Mar 25, 2026

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 25, 2026

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 25, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 25, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 25, 2026

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 25, 2026

openshift-merge-bot bot merged commit 39adbe6 into openshift:main Mar 26, 2026
27 of 28 checks passed

Conversation

joshbranham commented Mar 4, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Mar 4, 2026

Uh oh!

openshift-ci-robot commented Mar 4, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-ci-robot commented Mar 4, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

coderabbitai bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

openshift-ci-robot commented Mar 4, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

joshbranham commented Mar 4, 2026

Uh oh!

joshbranham commented Mar 4, 2026

Uh oh!

Uh oh!

joshbranham commented Mar 10, 2026

Uh oh!

joshbranham commented Mar 12, 2026

Uh oh!

openshift-ci-robot commented Mar 12, 2026

Uh oh!

jkyros commented Mar 14, 2026

Uh oh!

openshift-ci-robot commented Mar 14, 2026

Uh oh!

joshbranham commented Mar 14, 2026

Uh oh!

enxebre commented Mar 23, 2026

Uh oh!

enxebre commented Mar 23, 2026

Uh oh!

joshbranham commented Mar 23, 2026

Uh oh!

joshbranham commented Mar 23, 2026

Uh oh!

joshbranham commented Mar 24, 2026

Uh oh!

openshift-ci-robot commented Mar 24, 2026

Uh oh!

joshbranham commented Mar 24, 2026

Uh oh!

joshbranham commented Mar 24, 2026

Uh oh!

cristianoveiga commented Mar 24, 2026

Uh oh!

enxebre commented Mar 25, 2026

Uh oh!

openshift-ci-robot commented Mar 25, 2026

Uh oh!

joshbranham commented Mar 4, 2026 •

edited by coderabbitai bot

Loading

openshift-ci-robot commented Mar 4, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Mar 4, 2026 •

edited by openshift-ci bot

Loading

coderabbitai bot commented Mar 4, 2026 •

edited

Loading

openshift-ci-robot commented Mar 4, 2026 •

edited by openshift-ci bot

Loading