ROSAENG-62084 | docs: update provisioning/teardown docs - #744
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughThe provisioning guide now obtains the cluster OIDC issuer URL directly. The teardown guide adds a preferred ChangesHosted cluster operations
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/hostedcluster-provisioning.md`:
- Line 74: Update the issuer lookup in the provisioning flow to use bounded
polling before creating the provider; accept only exactly one non-empty URL
matching the https:// scheme, reject empty, null, invalid, or multiple results,
and exit with a clear timeout error when no valid value is obtained.
- Around line 74-77: Update the documented cluster creation flow to capture the
JSON response from rosactl cluster create, extract its .oidc_issuer_url field,
and pass that value to rosactl cluster-oidc create. Remove the list-response
lookup using spec.hostedCluster.issuerURL so the OIDC provider uses the issuer
returned by cluster creation.
In `@docs/hostedcluster-teardown.md`:
- Around line 12-14: Update the access requirements in the hosted-cluster
teardown documentation to distinguish the manual break-glass workflow from the
rosactl workflow. State that rosactl requires reachable platform API access plus
the necessary AWS IAM permissions, while the manual procedure requires
break-glass access to the Regional and Management Clusters. Describe
authentication and authorization using AWS IAM rather than unspecified access
mechanisms.
- Around line 20-23: Update the CloudFormation deletion commands in the teardown
guide so they run in the documented order: cluster-oidc, cluster-iam, then
cluster-vpc.
- Around line 12-18: Update the teardown instructions around the rosactl example
to use commands documented by the linked CLI README, replacing the unsupported
“rosactl cluster delete <cluster-name> --wait” flow. If retaining that command,
identify the required CLI version and add the documented rosactl login and AWS
profile prerequisites.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 77e2ce0a-a35f-47ea-ae9a-9f9b685d8604
📒 Files selected for processing (2)
docs/hostedcluster-provisioning.mddocs/hostedcluster-teardown.md
| # 4. Get the cluster ID and cloud URL | ||
| CLOUDURL=$(rosactl cluster list --region $REGION -o json | jq -r --arg name "$CLUSTER_NAME" '.items[] | select(.name == $name) | "\(.spec.cloudUrl)/\(.id)"') | ||
| # 4. Get the OIDC issuer URL | ||
| OIDC_URL=$(rosactl cluster list -o json | jq -r --arg name "$CLUSTER_NAME" '.items[] | select(.name == $name) | .spec.hostedCluster.issuerURL') |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- document excerpt ---'
sed -n '45,95p' docs/hostedcluster-provisioning.md
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(rosactl|cluster-oidc|hostedcluster|provisioning)|\.go$|\.ts$|\.yaml$|\.yml$' | head -200
printf '%s\n' '--- command and field references ---'
rg -n --hidden -g '!vendor' -g '!node_modules' \
'rosactl cluster list|cluster-oidc create|issuerURL|hostedCluster' . | head -300Repository: openshift-online/rosa-hyperfleet
Length of output: 15324
🏁 Script executed:
#!/bin/bash
set -eu
if ! command -v jq >/dev/null 2>&1; then
printf '%s\n' 'jq is unavailable'
exit 0
fi
python3 - <<'PY' | while IFS= read -r case; do
name=${case%% *}
json=${case#* }
printf '%s\t' "$name"
printf '%s' "$json" | jq -r --arg name 'demo' \
'.items[] | select(.name == $name) | .spec.hostedCluster.issuerURL' \
2>&1 | od -An -tx1c | tr -d '\n'
printf '\n'
done
import json
cases = [
("missing_cluster", {"items": []}),
("missing_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {}}}]}),
("null_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": None}}}]}),
("empty_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": ""}}}]}),
("valid_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "https://issuer.example"}}}]}),
("invalid_scheme", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "http://issuer.example"}}}]}),
("duplicate_matches", {"items": [
{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "https://one.example"}}},
{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "https://two.example"}}},
]}),
]
for name, obj in cases:
print(name + "\t" + json.dumps(obj))
PYRepository: openshift-online/rosa-hyperfleet
Length of output: 222
🌐 Web query:
Search public documentation or source for rosactl cluster create, rosactl cluster list -o json, .spec.hostedCluster.issuerURL, and cluster-oidc create. Determine whether issuerURL is guaranteed to be populated immediately after cluster creation or only after asynchronous reconciliation.
💡 Result:
The issuerURL field (often referenced as spec.hostedCluster.issuerURL in OpenShift Hosted Control Plane/ROSA HCP environments) is not guaranteed to be populated immediately after the cluster creation command returns. Its availability is dependent on the asynchronous reconciliation process that provisions the control plane and its associated OIDC infrastructure [1][2][3]. The rosactl and rosa CLI commands used to initiate cluster or IAM resource creation are often non-blocking regarding the full lifecycle of the OIDC provider [4][5]. In many ROSA HCP (HyperShift) workflows, the cluster resource enters a provisioning state, and the issuerURL—which is required for features like IAM Roles for Service Accounts (IRSA)—is only populated once the control plane successfully initializes and the OIDC discovery document is hosted and accessible [1][2][3]. Because cluster provisioning involves multiple asynchronous steps, including the creation of the OIDC identity provider and the generation of the discovery document, users should expect to poll the cluster status or wait for the reconciliation to complete before the issuerURL becomes available [3]. When using rosactl cluster list --output json, the issuerURL field will typically appear as a null or missing value until the backend reconciliation controller has finished configuring the OIDC infrastructure [3].
Citations:
- 1: https://github.com/openshift-online/rosa-regional-platform-cli
- 2: https://github.com/openshift-online/rosa-hyperfleet-cli
- 3: https://github.com/openshift-online/rosa-hyperfleet/blob/main/docs/hostedcluster-provisioning.md
- 4: https://github.com/openshift/openshift-docs/blob/3c1ab270/modules/rosa-hcp-aws-private-create-cluster.adoc
- 5: https://github.com/openshift/openshift-docs/blob/3c1ab270/modules/rosa-hcp-sts-creating-a-cluster-egress-lockdown-cli.adoc
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
import shutil
import subprocess
jq = shutil.which("jq")
if jq is None:
print("jq is unavailable")
raise SystemExit(0)
cases = [
("missing_cluster", {"items": []}),
("missing_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {}}}]}),
("null_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": None}}}]}),
("empty_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": ""}}}]}),
("valid_issuer", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "https://issuer.example"}}}]}),
("invalid_scheme", {"items": [{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "http://issuer.example"}}}]}),
("duplicate_matches", {"items": [
{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "https://one.example"}}},
{"name": "demo", "spec": {"hostedCluster": {"issuerURL": "https://two.example"}}},
]}),
]
filter_expr = '.items[] | select(.name == $name) | .spec.hostedCluster.issuerURL'
for label, payload in cases:
result = subprocess.run(
[jq, "-r", "--arg", "name", "demo", filter_expr],
input=json.dumps(payload),
text=True,
capture_output=True,
check=False,
)
print(f"{label}: exit={result.returncode}, stdout={result.stdout!r}, stderr={result.stderr!r}")
PYRepository: openshift-online/rosa-hyperfleet
Length of output: 585
Poll for a single valid issuer URL before creating the provider.
The lookup can return empty output, null, an invalid scheme, or multiple URLs while reconciliation continues. Add a bounded retry that accepts exactly one non-empty https:// URL and exits with a clear error on timeout.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/hostedcluster-provisioning.md` at line 74, Update the issuer lookup in
the provisioning flow to use bounded polling before creating the provider;
accept only exactly one non-empty URL matching the https:// scheme, reject
empty, null, invalid, or multiple results, and exit with a clear timeout error
when no valid value is obtained.
| OIDC_URL=$(rosactl cluster list -o json | jq -r --arg name "$CLUSTER_NAME" '.items[] | select(.name == $name) | .spec.hostedCluster.issuerURL') | ||
|
|
||
| # 5. Create the OIDC provider (CloudFormation stack) | ||
| rosactl cluster-oidc create $CLUSTER_NAME --region $REGION --oidc-issuer-url $CLOUDURL | ||
| rosactl cluster-oidc create $CLUSTER_NAME --oidc-issuer-url $OIDC_URL |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target document ---'
cat -n docs/hostedcluster-provisioning.md | sed -n '55,90p'
printf '%s\n' '--- related rosactl usage ---'
rg -n -C 2 'cluster(-oidc)? (list|create)|--region "\$REGION"|issuerURL' --glob '!node_modules' .
printf '%s\n' '--- repository status and recent file summary ---'
git status --short
git diff --stat
git log -5 --oneline -- docs/hostedcluster-provisioning.mdRepository: openshift-online/rosa-hyperfleet
Length of output: 9111
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- commit change for the target document ---'
git show --format=fuller --no-ext-diff --unified=20 8e6d1e8 -- docs/hostedcluster-provisioning.md | sed -n '1,220p'
printf '%s\n' '--- repository remotes ---'
git remote -v
printf '%s\n' '--- rosactl references in tracked files ---'
git ls-files | xargs -r rg -n -i 'rosactl|cluster-oidc' || trueRepository: openshift-online/rosa-hyperfleet
Length of output: 6260
🌐 Web query:
rosactl "cluster-oidc" create "--region" OIDC issuer URL
💡 Result:
The command you are referencing, rosactl cluster-oidc create, does not exist in the official Red Hat OpenShift Service on AWS (ROSA) CLI (rosa) [1][2][3]. It appears to be confused with a command from a different, internal, or community-developed tool, such as the rosa-hyperfleet-cli (often referred to as rosactl) used for Regional Platform (RRP) operations [4][5][6]. In the context of the official rosa-hyperfleet-cli (rosactl) tool, the relevant command to create OIDC-related IAM resources is: rosactl cluster-iam create --oidc-issuer-url --region [4][5][6] This command automatically fetches the TLS thumbprint from the provided OIDC issuer URL and creates the necessary IAM OIDC provider and associated control plane IAM roles [4][5][6]. If you are working with official ROSA clusters and using the standard rosa CLI, you typically manage OIDC configuration using the following commands: 1. Create an OIDC configuration: rosa create oidc-config --mode=auto --yes [7][8][9] 2. Create the OIDC provider: rosa create oidc-provider --oidc-config-id <oidc_config_id> --mode auto -y [9] For official ROSA documentation, refer to the Red Hat OpenShift Service on AWS documentation portal [7][1].
Citations:
- 1: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/cli_tools/rosa-cli
- 2: https://github.com/openshift/rosa
- 3: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/rosa_cli/rosa-get-started-cli
- 4: https://github.com/openshift-online/rosa-regional-platform-cli
- 5: https://github.com/openshift-online/rosa-hyperfleet-cli
- 6: https://github.com/rosa-regional-platform-ci/rosa-regional-platform-cli
- 7: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws_classic_architecture/4/html-single/install_rosa_classic_clusters/index
- 8: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws_classic_architecture/4/html/install_rosa_classic_clusters/rosa-sts-creating-a-cluster-quickly
- 9: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws_classic_architecture/4/html/introduction_to_rosa/rosa-oidc-overview
🏁 Script executed:
#!/bin/bash
set -eu
API='https://api.github.com/repos/openshift-online/rosa-hyperfleet-cli'
printf '%s\n' '--- repository metadata ---'
curl -fsSL "$API" | jq '{default_branch, html_url, updated_at}'
BRANCH=$(curl -fsSL "$API" | jq -r '.default_branch')
printf '%s\n' '--- candidate command files ---'
curl -fsSL "$API/git/trees/$BRANCH?recursive=1' \
| jq -r '.tree[] | select(.type == "blob" and (.path | test("cluster|oidc"; "i")) and (.path | test("\\.(go|md|yaml|yml)$"))) | .path' \
| head -200Repository: openshift-online/rosa-hyperfleet
Length of output: 429
🌐 Web query:
site:github.com/openshift-online/rosa-hyperfleet-cli "cluster-oidc"
💡 Result:
In the context of cloud-managed Kubernetes clusters, such as those managed by tools like rosactl for Red Hat OpenShift Service on AWS (ROSA), cluster OIDC refers to an OpenID Connect (OIDC) identity provider associated with the cluster [1][2]. This provider enables OIDC federation, allowing cloud resources and services to authenticate and authorize requests by validating tokens issued by the Kubernetes cluster [3][2]. When managing IAM resources for such clusters, the OIDC provider is configured to trust the cluster's OIDC issuer URL [1][2]. This allows the cluster to use its native service account tokens to access cloud-specific APIs securely, without needing long-lived credentials [3][2]. For example, when creating IAM resources for a cluster, a command similar to the following is used to associate the OIDC issuer with the necessary IAM roles [2]: rosactl cluster-iam create my-cluster --oidc-issuer-url https://oidc.example.com/my-cluster --region us-east-1 During this process, the management tool typically fetches the TLS thumbprint of the OIDC issuer to ensure the authenticity of the endpoint [3][2]. This OIDC configuration is a foundational component for enabling fine-grained, role-based access control between the Kubernetes cluster and the underlying cloud infrastructure provider [2].
Citations:
- 1: https://github.com/openshift-online/rosa-hyperfleet-cli/blob/main/docs/architecture/ARCHITECTURE.md
- 2: https://github.com/openshift-online/rosa-hyperfleet-cli
- 3: https://github.com/openshift-online/rosa-hyperfleet-cli/blob/main/README.md
🏁 Script executed:
#!/bin/bash
set -eu
API='https://api.github.com/repos/openshift-online/rosa-hyperfleet-cli'
printf '%s\n' '--- repository metadata ---'
curl -fsSL "$API" | jq '{default_branch, html_url, updated_at}'
BRANCH=$(curl -fsSL "$API" | jq -r '.default_branch')
printf '%s\n' '--- candidate command files ---'
curl -fsSL "$API/git/trees/$BRANCH?recursive=1" \
| jq -r '.tree[] | select(.type == "blob" and (.path | test("cluster|oidc"; "i")) and (.path | test("\\.(go|md|yaml|yml)$"))) | .path' \
| head -200Repository: openshift-online/rosa-hyperfleet
Length of output: 377
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
printf '%s\n' '--- README command references ---'
curl -fsSL "$BASE/README.md" | rg -n -C 3 'cluster-iam|cluster-oidc|oidc-issuer-url|--region' || true
printf '%s\n' '--- archive paths for cluster and OIDC commands ---'
curl -fsSL 'https://github.com/openshift-online/rosa-hyperfleet-cli/archive/refs/heads/main.tar.gz' \
| tar -tzf - \
| rg -i '(cluster|oidc).*\.(go|md)$' \
| head -300Repository: openshift-online/rosa-hyperfleet
Length of output: 9525
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
for path in \
internal/commands/root.go \
internal/commands/cluster/list.go \
internal/commands/cluster/create.go \
internal/commands/clusteroidc/create.go \
internal/commands/clusteroidc/clusteroidc.go \
internal/commands/clusteriam/create.go \
internal/config/config.go
do
url="$BASE/$path"
body=$(curl -fsSL "$url" || true)
if [ -n "$body" ]; then
printf '\n--- %s ---\n' "$path"
printf '%s\n' "$body" | rg -n -C 5 'region|issuer|wait|ready|persistent|PreRun|RunE|list|Create' || true
fi
doneRepository: openshift-online/rosa-hyperfleet
Length of output: 22202
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
for path in \
internal/commands/cluster/create_test.go \
internal/commands/clusteroidc/clusteroidc_test.go \
internal/services/cluster/service.go \
internal/services/clusteroidc/service.go
do
printf '\n--- %s ---\n' "$path"
curl -fsSL "$BASE/$path" | rg -n -C 5 'issuer|region|wait|ready|status|CloudFormation|Create|List|cluster' || true
doneRepository: openshift-online/rosa-hyperfleet
Length of output: 16003
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
printf '%s\n' '--- cluster list response types and issuer fields ---'
curl -fsSL "$BASE/internal/commands/cluster/api.go" | cat -n | sed -n '1,240p'
curl -fsSL "$BASE/internal/commands/cluster/list.go" | cat -n | sed -n '35,135p'
printf '%s\n' '--- cluster create submission and response handling ---'
curl -fsSL "$BASE/internal/commands/cluster/create.go" | cat -n | sed -n '107,285p'Repository: openshift-online/rosa-hyperfleet
Length of output: 14900
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
printf '%s\n' '--- API model and tests mentioning OIDC issuer ---'
for path in $(curl -fsSL 'https://github.com/openshift-online/rosa-hyperfleet-cli/archive/refs/heads/main.tar.gz' \
| tar -tzf - | rg '(^|/)(api|service|cluster).*\.(go|json)$'); do
body=$(curl -fsSL "$BASE/${path#rosa-hyperfleet-cli-main/}" || true)
printf '%s\n' "$body" | rg -n -C 3 'issuerURL|issuer_url|hostedCluster|oidc_issuer_url|cluster create' && printf '\n--- %s ---\n' "$path" || true
doneRepository: openshift-online/rosa-hyperfleet
Length of output: 1505
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
printf '%s\n' '--- complete list model definitions ---'
curl -fsSL "$BASE/internal/commands/cluster/list.go" | cat -n | sed -n '1,42p'
printf '%s\n' '--- output flag declarations and response field usage ---'
curl -fsSL "$BASE/internal/commands/cluster/create.go" | cat -n | sed -n '85,108p'
curl -fsSL "$BASE/internal/services/cluster/service.go" | cat -n | sed -n '265,285p'
printf '%s\n' '--- shell behavior for an absent issuer URL ---'
bash -c 'set -e; OIDC_URL=$(printf "%s" "{\"items\":[]}" | jq -r --arg name "example" ".items[] | select(.name == \$name) | .spec.hostedCluster.issuerURL"); printf "status=%s value=<%s>\n" "$?" "$OIDC_URL"'Repository: openshift-online/rosa-hyperfleet
Length of output: 4038
🏁 Script executed:
#!/bin/bash
set -eu
BASE='https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main'
for path in \
internal/commands/cluster/list_test.go \
internal/commands/cluster/api_test.go \
internal/commands/cluster/create_test.go \
docs/README.md \
README.md
do
body=$(curl -fsSL "$BASE/$path" || true)
if [ -n "$body" ]; then
printf '\n--- %s ---\n' "$path"
printf '%s\n' "$body" | rg -n -C 5 'oidcIssuerURL|oidc_issuer_url|hostedCluster|spec|items' || true
fi
done
printf '\n--- all tracked CLI text containing issuer field names ---\n'
curl -fsSL 'https://github.com/openshift-online/rosa-hyperfleet-cli/archive/refs/heads/main.tar.gz' \
| tar -xOzf - --wildcards '*/internal/*' 2>/dev/null \
| rg -n -C 2 'oidcIssuerURL|oidc_issuer_url|hostedCluster' || trueRepository: openshift-online/rosa-hyperfleet
Length of output: 6949
🌐 Web query:
site:github.com/openshift-online/rosa-hyperfleet-api "oidcIssuerURL" OR "oidc_issuer_url"
💡 Result:
No matching results were found in openshift-online/rosa-hyperfleet-api for either:
oidcIssuerURLoidc_issuer_url
The search results instead surfaced unrelated repositories and general ROSA/OIDC documentation.
Extract the issuer URL from the cluster-create response.
The list response uses spec.oidcIssuerURL. The create response uses oidc_issuer_url. The current jq path returns an empty value, so cluster-oidc create fails with OIDC issuer URL must start with https://. Capture rosactl cluster create --output json, extract .oidc_issuer_url, and pass it to cluster-oidc create.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/hostedcluster-provisioning.md` around lines 74 - 77, Update the
documented cluster creation flow to capture the JSON response from rosactl
cluster create, extract its .oidc_issuer_url field, and pass that value to
rosactl cluster-oidc create. Remove the list-response lookup using
spec.hostedCluster.issuerURL so the OIDC provider uses the issuer returned by
cluster creation.
Source: MCP tools
| When the platform API is reachable, use [`rosactl`](https://github.com/openshift-online/rosa-hyperfleet-cli) | ||
| — it handles cluster deletion and CloudFormation stack cleanup without requiring | ||
| break-glass access: |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Resolve the access-scope contradiction.
The opening notice says that this procedure requires break-glass access to the Regional and Management Clusters. This section says that the preferred workflow does not require break-glass access. Distinguish the access requirements for the manual and rosactl workflows. Document the required AWS IAM and platform API permissions.
As per coding guidelines, use AWS IAM for all authentication and authorization.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/hostedcluster-teardown.md` around lines 12 - 14, Update the access
requirements in the hosted-cluster teardown documentation to distinguish the
manual break-glass workflow from the rosactl workflow. State that rosactl
requires reachable platform API access plus the necessary AWS IAM permissions,
while the manual procedure requires break-glass access to the Regional and
Management Clusters. Describe authentication and authorization using AWS IAM
rather than unspecified access mechanisms.
Source: Coding guidelines
| When the platform API is reachable, use [`rosactl`](https://github.com/openshift-online/rosa-hyperfleet-cli) | ||
| — it handles cluster deletion and CloudFormation stack cleanup without requiring | ||
| break-glass access: | ||
|
|
||
| ```bash | ||
| # Delete the cluster record and trigger platform-side cleanup (steps 1–4 below) | ||
| rosactl cluster delete <cluster-name> --wait |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
ref="${ROSACTL_REF:-main}"
readme="$(mktemp)"
trap 'rm -f "$readme"' EXIT
curl -fsSL \
"https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/${ref}/README.md" \
-o "$readme"
cluster_section="$(sed -n '/^### cluster$/,/^### cluster-vpc$/p' "$readme")"
if ! printf '%s\n' "$cluster_section" | rg -q 'cluster delete|--wait'; then
echo "The selected rosactl ref does not document cluster delete --wait." >&2
exit 1
fiRepository: openshift-online/rosa-hyperfleet
Length of output: 236
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- changed documentation context ---'
file="$(git ls-files 'docs/hostedcluster-teardown.md')"
test -n "$file"
cat -n "$file" | sed -n '1,80p'
printf '%s\n' '--- upstream CLI command and release evidence ---'
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
curl -fsSL https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main/README.md \
-o "$tmp/README.md"
printf '%s\n' 'README command references:'
rg -n -C 3 'cluster (create|list|delete|kubeconfig|get-token)|rosactl login|--wait' "$tmp/README.md" || true
printf '%s\n' 'Repository metadata:'
curl -fsSL https://api.github.com/repos/openshift-online/rosa-hyperfleet-cli \
| jq '{default_branch,archived,updated_at,license: .license.spdx_id}'
printf '%s\n' 'Tags:'
curl -fsSL 'https://api.github.com/repos/openshift-online/rosa-hyperfleet-cli/tags?per_page=20' \
| jq -r '.[] | [.name,.commit.sha] | `@tsv`'Repository: openshift-online/rosa-hyperfleet
Length of output: 6851
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
curl -fsSL \
https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main/README.md \
-o "$tmp"
printf '%s\n' '--- documented teardown commands ---'
sed -n '40,52p' "$tmp"
printf '%s\n' '--- documented prerequisites ---'
sed -n '55,90p' "$tmp"
printf '%s\n' '--- available release tags ---'
git ls-remote --tags --refs \
https://github.com/openshift-online/rosa-hyperfleet-cli.git \
| tail -n 20Repository: openshift-online/rosa-hyperfleet
Length of output: 1616
Replace the unsupported rosactl command
The linked CLI README documents separate teardown commands. It does not document rosactl cluster delete or --wait. Replace Line 18 with the documented flow, or identify the CLI version that provides this command and document the rosactl login and AWS profile prerequisites.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/hostedcluster-teardown.md` around lines 12 - 18, Update the teardown
instructions around the rosactl example to use commands documented by the linked
CLI README, replacing the unsupported “rosactl cluster delete <cluster-name>
--wait” flow. If retaining that command, identify the required CLI version and
add the documented rosactl login and AWS profile prerequisites.
Source: MCP tools
| # Delete CloudFormation stacks in the customer AWS account (step 5 below) | ||
| rosactl cluster-oidc delete <cluster-name> | ||
| rosactl cluster-vpc delete <cluster-name> | ||
| rosactl cluster-iam delete <cluster-name> |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
ref="${ROSACTL_REF:-main}"
actual="$(
curl -fsSL \
"https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/${ref}/README.md" |
sed -n '/# Teardown (reverse order)/,/^> Tip/p' |
rg -o 'rosactl (cluster-oidc|cluster-iam|cluster-vpc) delete'
)"
printf '%s\n' "$actual"Repository: openshift-online/rosa-hyperfleet
Length of output: 334
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- docs/hostedcluster-teardown.md ---'
cat -n docs/hostedcluster-teardown.md | sed -n '1,80p'
printf '%s\n' '--- CLI README teardown section ---'
curl -fsSL \
'https://raw.githubusercontent.com/openshift-online/rosa-hyperfleet-cli/main/README.md' |
sed -n '/# Teardown (reverse order)/,/^> Tip/p'
printf '%s\n' '--- relevant repository references ---'
rg -n -i 'cluster-(oidc|iam|vpc) delete|teardown \(reverse order\)|CloudFormation' \
docs README.md 2>/dev/null || trueRepository: openshift-online/rosa-hyperfleet
Length of output: 20669
Use the documented CloudFormation deletion order.
Delete cluster-oidc, then cluster-iam, then cluster-vpc. The guide currently deletes cluster-vpc before cluster-iam.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/hostedcluster-teardown.md` around lines 20 - 23, Update the
CloudFormation deletion commands in the teardown guide so they run in the
documented order: cluster-oidc, cluster-iam, then cluster-vpc.
Source: MCP tools
| CLOUDURL=$(rosactl cluster list --region $REGION -o json | jq -r --arg name "$CLUSTER_NAME" '.items[] | select(.name == $name) | "\(.spec.cloudUrl)/\(.id)"') | ||
| # 4. Get the OIDC issuer URL | ||
| OIDC_URL=$(rosactl cluster list -o json | jq -r --arg name "$CLUSTER_NAME" '.items[] | select(.name == $name) | .spec.hostedCluster.issuerURL') | ||
|
|
There was a problem hiding this comment.
I think we should include nodepool creation here. I had to refer to the rosactl cli docs after realizing my cluster had no worker nodes.
2 participants
Summary by CodeRabbit