[release-ocm-2.15] MGMT-23757: Make InfraEnv CpuArchitecture immutable after creation

[bluesort]

Changing Spec.CpuArchitecture after InfraEnv creation didn't regenerate boot artifacts, causing download links to point to the wrong architecture (e.g., links still pointed to x86_64 after changing to s390x). This fix makes Spec.CpuArchitecture immutable by adding webhook validation that rejects any attempts to modify the field after creation, preventing the inconsistent state.

List all the issues related to this PR

• New Feature
• Enhancement
• Bug fix
• Tests
• Documentation
• CI/CD

What environments does this code impact?

• Automation (CI, tools, etc)
• Cloud
• Operator Managed Deployments
• None

How was this code tested?

• assisted-test-infra environment
• dev-scripts environment
• Reviewer's test appreciated
• Waiting for CI to do a full test run
• Manual (Elaborate on how it was tested)
• No tests needed

Checklist

• Title and description added to both, commit and PR.
• Relevant issues have been associated (see CONTRIBUTING guide)
• This change does not require a documentation update (docstring, docs, README, etc)
• Does this change include unit-tests (note that code changes require unit-tests)

Reviewers Checklist

• Are the title and description (in both PR and commit) meaningful and clear?
• Is there a bug required (and linked) for this change?
• Should this PR be backported?

[openshift-ci-robot]

@bluesort: This pull request references MGMT-23757 which is a valid jira issue.

Details

In response to this:

Changing Spec.CpuArchitecture after InfraEnv creation didn't regenerate boot artifacts, causing download links to point to the wrong architecture (e.g., links still pointed to x86_64 after changing to s390x). This fix makes Spec.CpuArchitecture immutable by adding webhook validation that rejects any attempts to modify the field after creation, preventing the inconsistent state.

List all the issues related to this PR

• New Feature
• Enhancement
• Bug fix
• Tests
• Documentation
• CI/CD

What environments does this code impact?

• Automation (CI, tools, etc)
• Cloud
• Operator Managed Deployments
• None

How was this code tested?

• assisted-test-infra environment
• dev-scripts environment
• Reviewer's test appreciated
• Waiting for CI to do a full test run
• Manual (Elaborate on how it was tested)
• No tests needed

Checklist

• Title and description added to both, commit and PR.
• Relevant issues have been associated (see CONTRIBUTING guide)
• This change does not require a documentation update (docstring, docs, README, etc)
• Does this change include unit-tests (note that code changes require unit-tests)

Reviewers Checklist

• Are the title and description (in both PR and commit) meaningful and clear?
• Is there a bug required (and linked) for this change?
• Should this PR be backported?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 38204676-6336-487e-8e87-395b20fe0e53

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.51%. Comparing base (894f93f) to head (1ba5f99).
⚠️ Report is 4 commits behind head on release-ocm-2.15.

Additional details and impacted files

@@                 Coverage Diff                  @@
##           release-ocm-2.15   #10104      +/-   ##
====================================================
+ Coverage             43.49%   43.51%   +0.01%     
====================================================
  Files                   407      407              
  Lines                 70562    70577      +15     
====================================================
+ Hits                  30691    30711      +20     
+ Misses                37137    37134       -3     
+ Partials               2734     2732       -2     

Files with missing lines	Coverage Δ
...ks/agentinstall/v1beta1/infraenv_admission_hook.go	87.50% <100.00%> (+1.36%)	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[bluesort]

/cc @eliorerz

[rccrdpccl]

@bluesort did you consider CEL validations instead of webhooks code?

[bluesort]

@bluesort did you consider CEL validations instead of webhooks code?

@rccrdpccl I wasn't aware of CEL validations - they would have been a good fit here. We have other webhook validation that could also be handled with CEL (e.g. ClusterRef and OSImageVersion mutual exclusion), maybe a larger refactor task is warranted?

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bluesort, gamli75

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [gamli75]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@bluesort: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.