OCPCLOUD-2710: Extend AWS metadata service options in MAPA

[RadekManak]

Add httpEndpoint, httpPutResponseHopLimit, and instanceMetadataTags fields to MetadataServiceOptions to bring parity with CAPA. This allows users to configure additional aspects of the AWS Instance Metadata Service (IMDS) on machine instances, improving backwards compatibility and reducing conversion errors when these options are used in CAPA.

New fields:

• httpEndpoint: Enable/disable HTTP metadata endpoint (Enabled/Disabled)
• httpPutResponseHopLimit: Configure metadata token hop limit (1-64)
• instanceMetadataTags: Enable/disable instance tag access from metadata

[openshift-ci-robot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@RadekManak: This pull request references OCPCLOUD-2710 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Add httpEndpoint, httpPutResponseHopLimit, and instanceMetadataTags fields to MetadataServiceOptions to bring parity with CAPA. This allows users to configure additional aspects of the AWS Instance Metadata Service (IMDS) on machine instances, improving backwards compatibility and reducing conversion errors when these options are used in CAPA.

New fields:

• httpEndpoint: Enable/disable HTTP metadata endpoint (Enabled/Disabled)
• httpPutResponseHopLimit: Configure metadata token hop limit (1-64)
• instanceMetadataTags: Enable/disable instance tag access from metadata

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @RadekManak! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 179fa103-b306-45f8-ac9d-3928974060dd

📥 Commits

Reviewing files that changed from the base of the PR and between 47d84d5 and f5f2578.

⛔ Files ignored due to path filters (4)

• machine/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• machine/v1beta1/zz_generated.swagger_doc_generated.go is excluded by !**/zz_generated*
• openapi/generated_openapi/zz_generated.openapi.go is excluded by !openapi/**, !**/zz_generated*
• openapi/openapi.json is excluded by !openapi/**

📒 Files selected for processing (1)

• machine/v1beta1/types_awsprovider.go

🚧 Files skipped from review as they are similar to previous changes (1)

• machine/v1beta1/types_awsprovider.go

---

📝 Walkthrough

Walkthrough

Added IMDS state types with enabled and disabled constants. Expanded MetadataServiceOptions with endpoint, IPv6, hop-limit, and instance-tag fields, constrained authentication values to Required or Optional, and updated generated deepcopy and Swagger/OpenAPI metadata.

Suggested reviewers: mandre, everettraven

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: extending AWS metadata service options in MAPA.
Description check	✅ Passed	The description directly describes the added IMDS fields and their purpose, matching the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only API/schema files; no _test.go files or Ginkgo title patterns were modified.
Test Structure And Quality	✅ Passed	PASS: The PR only changes API types and generated schema/deepcopy files; no *_test.go or Ginkgo test code was modified, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; the PR only changes API types and generated deepcopy/OpenAPI docs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added; the diff only touches API types and generated schema/deepcopy files, so SNO-specific node assumptions are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only adds AWS IMDS API/schema fields and deepcopy/docs; no manifests, controllers, or pod scheduling constraints were changed.
Ote Binary Stdout Contract	✅ Passed	Touched files only add types/schema/deepcopy metadata; no main/init/suite code or stdout/logging writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes API types and generated docs/deepcopy/openapi files, with no IPv4 or external connectivity test code.
No-Weak-Crypto	✅ Passed	Diff only adds IMDS option enums/fields and generated docs/deepcopy; no MD5/SHA1/DES/RC4/3DES/Blowfish, custom crypto, or secret comparisons in changed hunks.
Container-Privileges	✅ Passed	PR only changes IMDS API types and generated schema/deepcopy docs; no container/K8s manifests or privileged settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	Changed files add IMDS schema/deepcopy/docs only; no logging calls or sensitive-data output found.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign everettraven for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[yuqi-zhang]

Generally seems fine, a couple of comments inline

Also to double check, there is no other reference to these objects in the api repo correct? i.e. the actual CRDs would be deployed via e.g. openshift/machine-api-provider-aws#170 ?

[yuqi-zhang]

nit: since we are defining a new type (HTTPEndpointState), we should probably validate on the type itself, so we don't have to duplicate validation if other places want to use it.

That said since this is the only occurrence, and we do similar validation for e.g. MetadataServiceAuthentication, we can keep it for consistency purposes.

[yuqi-zhang]

I believe that all 3 new fields do not need to be pointers. There's no need to distinguish between an omittited and empty value (they cannot be empty anyways due to the validations)

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[RadekManak]

/remove-lifecycle stale

Rebased onto current master.

@yuqi-zhang on pointers: these live in machine/v1beta1/types_awsprovider.go, which is go-validated (providerSpec), not OpenAPI/CRD-validated. That file is excluded from the default kubeapilinter optionalfields config (WhenRequired in .golangci.yaml) and instead linted via .golangci.go-validated.yaml with optionalfields.pointers.preference: Always (+ SuggestFix). That’s why these new optional fields are *T with omitempty.

Your note matches the default WhenRequired policy (Enum means zero isn’t admissible, so pointer isn’t required for serialization). That conflicts with the providerSpec Always policy.

Could you advise which way we should go?

1. Keep pointers to satisfy the go-validated providerSpec linter as configured today, or
2. Switch to non-pointers as you suggest — and if so, should .golangci.go-validated.yaml be relaxed (e.g. WhenRequired) for these providerSpec files?

Enum validation is on the types themselves (your other nit).
CRDs for these fields ship via consumers once api is vendored (openshift/machine-api-provider-aws#170).

[RadekManak]

/retest

[openshift-ci]

@RadekManak: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-hypershift-integration	f5f2578	link	true	/test verify-hypershift-integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[yuqi-zhang]

Ack, thanks for the update, will check with the API team for the suggested behaviour here