OCPBUGS-64575: Refresh egress IP capacity annotation on informer resync

[ssonigra]

Summary

• The node controller's UpdateFunc only enqueued nodes on taint changes, causing SyncHandler to run only once at node add time
• The 2-minute informer resync events were silently dropped because old==new means taints never differ
• This left the cloud.network.openshift.io/egress-ipconfig annotation stale — capacity never updated as EgressIPs were assigned or released
• Fix: detect resync events (same ResourceVersion) and enqueue the node so SyncHandler re-queries the cloud API with current CPIC state

Root Cause

When an EgressIP is assigned, CNCC adds the IP to the cloud ENI via CloudPrivateIPConfig, but never recalculates the node's capacity annotation. The getCapacity() function correctly excludes CPIC-managed IPs, but it's only called from SyncHandler, which only ran at node add time (when no CPICs existed yet). This meant all IPs on the ENI — including later-assigned EgressIPs — were counted as "non-CPIC" in the stale annotation, double-reducing available capacity.

Test plan

• Deploy on AWS cluster with EgressIP configured
• Verify capacity annotation updates automatically every ~2 minutes without CNCC pod restart
• Assign an EgressIP and confirm capacity annotation reflects correct CPIC-excluded count
• Remove the EgressIP and confirm capacity annotation updates accordingly
• Verify no excessive AWS API calls beyond the 2-minute resync interval

🤖 Generated with Claude Code

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ssonigra
Once this PR has been reviewed and has the lgtm label, please assign abhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The node informer update handler now enqueues same-ResourceVersion resync events, while preserving taint-based enqueueing for updates with differing resource versions.

Changes

Node informer processing

Layer / File(s)	Summary
Resync and taint filtering pkg/controller/node/node_controller.go	The update handler extracts both node objects, enqueues same-ResourceVersion resyncs immediately, and checks taint differences only for changed resource versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: miheer, jluhrsen

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No test files were changed; the only modified file is production code, so there are no Ginkgo titles to assess for stability.
Test Structure And Quality	✅ Passed	No Ginkgo tests were added or modified in this PR; only the node controller implementation changed, so the test-quality criteria are not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the only changed file is a controller source file with no MicroShift-unsafe test APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only pkg/controller/node/node_controller.go changed; no new Ginkgo e2e tests or SNO-relevant test assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	The change only adjusts node informer enqueue logic; it adds no replicas, affinities, nodeSelectors, PDBs, or topology-based scheduling assumptions.
Ote Binary Stdout Contract	✅ Passed	The patch only changes a controller UpdateFunc; it adds no main/TestMain/suite setup code and no stdout writes in process-level code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes node_controller.go, so IPv4/disconnected-network compatibility is not implicated.
No-Weak-Crypto	✅ Passed	PASS: The PR only changes node informer resync enqueue logic; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, crypto imports, or secret/token comparisons were added.
Container-Privileges	✅ Passed	PR only changes pkg/controller/node/node_controller.go; no K8s/container manifests or privileged/securityContext fields were added.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging was added in the changed code; the diff only adjusts UpdateFunc enqueue logic and comments.
Title check	✅ Passed	The title clearly matches the main change: refreshing the egress IP capacity annotation on informer resync.
Description check	✅ Passed	The description is directly related to the node controller resync fix and the stale capacity annotation issue.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ssonigra]

When we assign an IP to the node the capacity of the node is not updated by the cncc until the pod is restarted this fix will solve that problem

[openshift-ci-robot]

@ssonigra: This pull request references Jira Issue OCPBUGS-64575, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• The node controller's UpdateFunc only enqueued nodes on taint changes, causing SyncHandler to run only once at node add time
• The 2-minute informer resync events were silently dropped because old==new means taints never differ
• This left the cloud.network.openshift.io/egress-ipconfig annotation stale — capacity never updated as EgressIPs were assigned or released
• Fix: detect resync events (same ResourceVersion) and enqueue the node so SyncHandler re-queries the cloud API with current CPIC state

Root Cause

When an EgressIP is assigned, CNCC adds the IP to the cloud ENI via CloudPrivateIPConfig, but never recalculates the node's capacity annotation. The getCapacity() function correctly excludes CPIC-managed IPs, but it's only called from SyncHandler, which only ran at node add time (when no CPICs existed yet). This meant all IPs on the ENI — including later-assigned EgressIPs — were counted as "non-CPIC" in the stale annotation, double-reducing available capacity.

Test plan

• Deploy on AWS cluster with EgressIP configured
• Verify capacity annotation updates automatically every ~2 minutes without CNCC pod restart
• Assign an EgressIP and confirm capacity annotation reflects correct CPIC-excluded count
• Remove the EgressIP and confirm capacity annotation updates accordingly
• Verify no excessive AWS API calls beyond the 2-minute resync interval

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ssonigra]

/retest

[openshift-ci]

@ssonigra: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn	182ac47	link	true	/test e2e-aws-ovn
ci/prow/security	182ac47	link	false	/test security
ci/prow/hypershift-e2e-aks	182ac47	link	true	/test hypershift-e2e-aks
ci/prow/e2e-azure-ovn	182ac47	link	true	/test e2e-azure-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.