[release-4.19] OCPBUGS-56119: error from generateAndValidateRenderedMachineConfig function can be misleading

[dkhater-redhat]

What I did
Fixes: #OCPBUGS-56119
Fix misleading error in generateAndValidateRenderedMachineConfig

When a full-render reconciliation fails, we now iterate through the
base MachineConfigs one by one—to
pinpoint the exact config that introduced the irreconcilable change.
If a partial render fails, we report that config’s name and its error,
instead of incorrectly blaming an earlier override. We still fall back
to the original combined error behavior if no single config produces
the full-render failure.

How to verify it
See https://issues.redhat.com/browse/OCPBUGS-54692

[openshift-ci-robot]

@dkhater-redhat: This pull request references Jira Issue OCPBUGS-56119, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-54697 is in the state ON_QA, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
• dependent Jira Issue OCPBUGS-54697 targets the "4.20.0" version, which is one of the valid target versions: 4.20.0
• bug has dependents

Requesting review from QA contact:
/cc @sergiordlr

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

What I did
Fixes: #OCPBUGS-56119
Fix misleading error in generateAndValidateRenderedMachineConfig

When a full-render reconciliation fails, we now iterate through the
base MachineConfigs one by one—to
pinpoint the exact config that introduced the irreconcilable change.
If a partial render fails, we report that config’s name and its error,
instead of incorrectly blaming an earlier override. We still fall back
to the original combined error behavior if no single config produces
the full-render failure.

How to verify it
See https://issues.redhat.com/browse/OCPBUGS-54692

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@dkhater-redhat: This pull request references Jira Issue OCPBUGS-56119, which is valid.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-54697 is in the state ON_QA, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
• dependent Jira Issue OCPBUGS-54697 targets the "4.20.0" version, which is one of the valid target versions: 4.20.0
• bug has dependents

Requesting review from QA contact:
/cc @sergiordlr

In response to this:

• What I did
  Fixes: #OCPBUGS-56119
  Fix misleading error in generateAndValidateRenderedMachineConfig

When a full-render reconciliation fails, we now iterate through the
base MachineConfigs one by one—to
pinpoint the exact config that introduced the irreconcilable change.
If a partial render fails, we report that config’s name and its error,
instead of incorrectly blaming an earlier override. We still fall back
to the original combined error behavior if no single config produces
the full-render failure.

• How to verify it
  See https://issues.redhat.com/browse/OCPBUGS-54692

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/lgtm
/label backport-risk-assessed

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: djoshy, dkhater-redhat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [djoshy,dkhater-redhat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dkhater-redhat]

/cherry-pick release-4.18 release-4.17 release-4.16

[openshift-cherrypick-robot]

@dkhater-redhat: once the present PR merges, I will cherry-pick it on top of release-4.18 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.18 release-4.17 release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ptalgulk01]

Pre-merge verification:
Verified using IPI based AWS cluster

launch 4.19,openshift/machine-config-operator#5033 aws

Applied the below MC which include the fips configuration

MC Example

 oc create -f - << EOF
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: luks-worker
spec:
  config:
    ignition:
      version: 3.4.0
    storage:
      filesystems:
        - device: /dev/mapper/root
          format: xfs
          label: root
          wipeFilesystem: true
      luks:
        - clevis:
            tpm2: true
          device: /dev/disk/by-partlabel/root
          label: luks-root
          name: root
          wipeVolume: true
EOF

Check the MCP degrade logs does not include 00-worker

  - lastTransitionTime: "2025-05-14T05:34:32Z"
    message: 'Failed to render configuration for pool worker: could not generate rendered
      MachineConfig: reconciliation failed between current config "rendered-worker-68b09b47b5a0d60933a1245c37892a78"
      and base config "luks-worker": ignition filesystems section contains changes'
    reason: ""
    status: "True"
    type: RenderDegraded

/label cherry-pick-approved

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD e9e9d5e and 2 for PR HEAD 2b07d56 in total

[openshift-ci]

@dkhater-redhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-op-ocl	2b07d56	link	false	/test e2e-gcp-op-ocl
ci/prow/e2e-azure-ovn-upgrade-out-of-change	2b07d56	link	false	/test e2e-azure-ovn-upgrade-out-of-change

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@dkhater-redhat: Jira Issue OCPBUGS-56119: All pull requests linked via external trackers have merged:

• openshift/machine-config-operator#5044

Jira Issue OCPBUGS-56119 has been moved to the MODIFIED state.

In response to this:

What I did
Fixes: #OCPBUGS-56119
Fix misleading error in generateAndValidateRenderedMachineConfig

When a full-render reconciliation fails, we now iterate through the
base MachineConfigs one by one—to
pinpoint the exact config that introduced the irreconcilable change.
If a partial render fails, we report that config’s name and its error,
instead of incorrectly blaming an earlier override. We still fall back
to the original combined error behavior if no single config produces
the full-render failure.

How to verify it
See https://issues.redhat.com/browse/OCPBUGS-54692

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@dkhater-redhat: new pull request created: #5049

In response to this:

/cherry-pick release-4.18 release-4.17 release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-machine-config-operator
This PR has been included in build ose-machine-config-operator-container-v4.19.0-202505141514.p0.g18f1c3d.assembly.stream.el9.
All builds following this will include this PR.