[stevekuznetsov]

What this PR does / why we need it:

Propose OpenShift 4.21 / Kubernetes 1.34 as the minimum upstream HyperShift management-cluster version, and align local and GitHub Actions envtest coverage with that policy.

This is an explicit upstream support-policy change, not merely a faster local test default and not a claim that older OpenShift versions have left maintenance support. It needs agreement from maintainers and downstream consumers before merge.

Changes:

• Document OCP 4.21 or Kubernetes 1.34 as the management minimum, with platform-specific requirements still applicable.
• Update the quick-start management prerequisite and regenerate aggregated documentation.
• Retain OpenShift envtest binaries 1.34.1, 1.35.1, 1.36.2 and vanilla Kubernetes 1.34.0, 1.35.0, 1.36.0 in both Makefile and CI matrices.
• Explain that envtest validates management API servers, not hosted payload-version support; correct the README statement that ordinary make test runs the tagged suites.
• Remove a duplicated version range from agent guidance so the envtest README remains the reference.

Which issue(s) this PR fixes:

No Jira issue associated yet. Standalone policy proposal discussed while preparing #9634; no resource-policy API, CEL, or controller changes are included here.

Special notes for your reviewer:

Scope and migration: This removes default management-side coverage for OCP 4.17 through 4.20 and vanilla Kubernetes 1.31 through 1.33. Operators using older management clusters would need to upgrade before adopting an upstream build with the new baseline. Downstream products and managed services retain authority over their own support commitments; historical product-specific statements have not been silently rewritten.

Not changed: HostedCluster/NodePool minimum payload versions, supported-versions ConfigMap, CPO selection, runtime capability checks, API schemas, and workload templates. No new explicit installer/operator version rejection is introduced. Successful installation on an older cluster does not establish support. The generic single-version envtest default already uses Kubernetes 1.34.0 and is unchanged.

Motivation versus proof: Separate testing of the proposed policy CRD in #9634 found install-time CEL cost failures on OCP 4.19/4.20 binaries and passing admission on 4.21+. That is evidence of version-dependent API compatibility, not by itself authorization to drop older management support or evidence that all current HyperShift operations fail there. This PR makes the support decision explicit and independently reviewable. Until approved, it does not remove the compatibility blocker from #9634.

CI caveat: Wrapper workflows currently reference reusable workflows at @main. Pre-merge CI may therefore use the old matrix; the modified local matrices were exercised explicitly below.

Validation passed:

• GOMAXPROCS=4 make test-envtest-api-all ENVTEST_JOBS=3: all six retained downstream/upstream versions passed using this standalone worktree.
• GOMAXPROCS=4 make lint: zero issues.
• make docs-aggregate and git diff --check.
• make run-gitlint and git verify-commit HEAD.

Full make pre-commit and live management-cluster migration tests were not run. No runtime Go code changed. One signed-off, GPG-signed commit; keep draft pending support-policy review.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• Existing envtest coverage was run across all retained versions.
• Management support-policy change approved by maintainers and affected consumers.

Summary by CodeRabbit

• Documentation

  • Updated management cluster support guidance to OpenShift 4.21+ or Kubernetes 1.34+.
  • Added links and clarified compatibility expectations for management API servers.
  • Updated setup and envtest documentation with current supported versions and commands.
  • Clarified that tagged tests require explicit envtest targets.

• Tests

  • Envtest coverage now targets Kubernetes 1.34–1.36 and OpenShift 4.21–5.0.
  • Older Kubernetes and OpenShift versions are no longer included in the default envtest matrices.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@stevekuznetsov: This pull request explicitly references no jira issue.

Details

In response to this:

What this PR does / why we need it:

Propose OpenShift 4.21 / Kubernetes 1.34 as the minimum upstream HyperShift management-cluster version, and align local and GitHub Actions envtest coverage with that policy.

This is an explicit upstream support-policy change, not merely a faster local test default and not a claim that older OpenShift versions have left maintenance support. It needs agreement from maintainers and downstream consumers before merge.

Changes:

• Document OCP 4.21 or Kubernetes 1.34 as the management minimum, with platform-specific requirements still applicable.
• Update the quick-start management prerequisite and regenerate aggregated documentation.
• Retain OpenShift envtest binaries 1.34.1, 1.35.1, 1.36.2 and vanilla Kubernetes 1.34.0, 1.35.0, 1.36.0 in both Makefile and CI matrices.
• Explain that envtest validates management API servers, not hosted payload-version support; correct the README statement that ordinary make test runs the tagged suites.
• Remove a duplicated version range from agent guidance so the envtest README remains the reference.

Which issue(s) this PR fixes:

No Jira issue associated yet. Standalone policy proposal discussed while preparing #9634; no resource-policy API, CEL, or controller changes are included here.

Special notes for your reviewer:

Scope and migration: This removes default management-side coverage for OCP 4.17 through 4.20 and vanilla Kubernetes 1.31 through 1.33. Operators using older management clusters would need to upgrade before adopting an upstream build with the new baseline. Downstream products and managed services retain authority over their own support commitments; historical product-specific statements have not been silently rewritten.

Not changed: HostedCluster/NodePool minimum payload versions, supported-versions ConfigMap, CPO selection, runtime capability checks, API schemas, and workload templates. No new explicit installer/operator version rejection is introduced. Successful installation on an older cluster does not establish support. The generic single-version envtest default already uses Kubernetes 1.34.0 and is unchanged.

Motivation versus proof: Separate testing of the proposed policy CRD in #9634 found install-time CEL cost failures on OCP 4.19/4.20 binaries and passing admission on 4.21+. That is evidence of version-dependent API compatibility, not by itself authorization to drop older management support or evidence that all current HyperShift operations fail there. This PR makes the support decision explicit and independently reviewable. Until approved, it does not remove the compatibility blocker from #9634.

CI caveat: Wrapper workflows currently reference reusable workflows at @main. Pre-merge CI may therefore use the old matrix; the modified local matrices were exercised explicitly below.

Validation passed:

• GOMAXPROCS=4 make test-envtest-api-all ENVTEST_JOBS=3: all six retained downstream/upstream versions passed using this standalone worktree.
• GOMAXPROCS=4 make lint: zero issues.
• make docs-aggregate and git diff --check.
• make run-gitlint and git verify-commit HEAD.

Full make pre-commit and live management-cluster migration tests were not run. No runtime Go code changed. One signed-off, GPG-signed commit; keep draft pending support-policy review.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• Existing envtest coverage was run across all retained versions.
• Management support-policy change approved by maintainers and affected consumers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a9d3c5dd-d11c-4b4d-9e29-735b196e50f0

📥 Commits

Reviewing files that changed from the base of the PR and between 41c8d4a and 3f59e13.

⛔ Files ignored due to path filters (1)

• docs/content/reference/aggregated-docs.md is excluded by !docs/content/reference/aggregated-docs.md

📒 Files selected for processing (7)

• .github/workflows/envtest-kube-reusable.yaml
• .github/workflows/envtest-ocp-reusable.yaml
• AGENTS.md
• Makefile
• docs/content/getting-started/quick-setup.md
• docs/content/reference/versioning-support.md
• test/envtest/README.md

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request sets OpenShift 4.21 and Kubernetes 1.34 as the starting versions for management API server compatibility. Envtest configuration now covers Kubernetes 1.34–1.36 and corresponding OpenShift versions. Documentation updates describe the support policy, prerequisites, envtest coverage, feature gate filtering, and explicit test-target requirements.

Suggested reviewers: bryan-cox

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 3f59e

The compatibility policy, documentation, and envtest matrices are aligned, with no identified merge-blocking behavior.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: establishing OpenShift 4.21 as the upstream management baseline. It is directly related to the documented version and envtest coverage updat…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only workflow matrices, Makefile version lists, and documentation. The authoritative diff contains no Ginkgo test source or title calls such as It, Describe, Context, or…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only envtest version lists, workflows, Makefile configuration, and documentation. The authoritative diff contains no Ginkgo test source or changed It, BeforeEach, `A…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request does not add or modify deployment manifests, operator code, or controllers. The authoritative diff contains only documentation, Makefile version lists, and two GitHub Actions wo…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo or other executable tests were added. The reviewed range changes only workflow matrices, Makefile variables, and documentation; it contains no Go-file changes, IPv4 assumptions, or exter…
No-Weak-Crypto	✅ Passed	PASS: The pull request changes only envtest version lists, workflow comments, Makefile values, and documentation. The authoritative diff adds no MD5, SHA-1, DES, 3DES, RC4, Blowfish, ECB, custom crypt…
Container-Privileges	✅ Passed	The pull request changes only workflow version matrices, Makefile values, and documentation. The authoritative diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, `allow…
No-Sensitive-Data-In-Logs	✅ Passed	No logging that exposes sensitive data was introduced. The reviewed diff changes envtest version matrices, Makefile variables/comments, workflow comments, and documentation. The added lines contain no…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stevekuznetsov
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 47.54%. Comparing base (41c8d4a) to head (3f59e13).
⚠️ Report is 416 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9635   +/-   ##
=======================================
  Coverage   47.54%   47.54%           
=======================================
  Files         796      796           
  Lines      100027   100027           
=======================================
  Hits        47560    47560           
  Misses      49298    49298           
  Partials     3169     3169           

Flag	Coverage Δ
cmd-support	41.13% <ø> (ø)
cpo-hostedcontrolplane	50.48% <ø> (ø)
cpo-other	48.49% <ø> (ø)
hypershift-operator	57.86% <ø> (ø)
other	34.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

Stale PRs are closed after 21d of inactivity.

If this PR is still relevant, comment to refresh it or remove the stale label.
Mark the PR as fresh by commenting /remove-lifecycle stale.

If this PR is safe to close now please do so with /close.

/lifecycle stale

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.