Skip to content

ROSAENG-62105: PercentageValidator must require value greater than 0 and less than 1#3398

Open
nephomaniac wants to merge 1 commit into
openshift:masterfrom
nephomaniac:ROSAENG-62105/fix-utilization-threshold-validation
Open

ROSAENG-62105: PercentageValidator must require value greater than 0 and less than 1#3398
nephomaniac wants to merge 1 commit into
openshift:masterfrom
nephomaniac:ROSAENG-62105/fix-utilization-threshold-validation

Conversation

@nephomaniac

@nephomaniac nephomaniac commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Align PercentageValidator bounds to match the cluster-autoscaler-operator webhook and OCP documentation
  • Change number < 0 to number <= 0 and number > 1 to number >= 1 — value must be strictly between 0 and 1
  • Add test cases for 0 and 1 being rejected

Context

The ROSA CLI accepted --scale-down-utilization-threshold 0, storing "0.000000" in OCM. The cluster-autoscaler-operator's validating admission webhook rejects this value, causing Hive to enter a permanent patch rejection loop and blocking cluster upgrades.

The OCP 4.18 documentation states the value "must be a value greater than 0 but less than 1." Additionally, setting the threshold to 0 silently disables scale-down in the upstream Kubernetes autoscaler (kubernetes/autoscaler#2221).

Jira: https://redhat.atlassian.net/browse/ROSAENG-62105

Summary by CodeRabbit

  • Bug Fixes
    • Percentage validation now requires values strictly greater than 0 and less than 1.
    • Boundary values of 0 and 1 are now rejected with a clearer validation message.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 18, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 18, 2026

Copy link
Copy Markdown

@nephomaniac: This pull request references ROSAENG-62105 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Align PercentageValidator bounds to match the cluster-autoscaler-operator webhook and OCP documentation
  • Change number < 0 to number <= 0 and number > 1 to number >= 1 — value must be strictly between 0 and 1
  • Add test cases for 0 and 1 being rejected

Context

The ROSA CLI accepted --scale-down-utilization-threshold 0, storing "0.000000" in OCM. The cluster-autoscaler-operator's validating admission webhook rejects this value, causing Hive to enter a permanent patch rejection loop and blocking cluster upgrades.

The OCP 4.18 documentation states the value "must be a value greater than 0 but less than 1." Additionally, setting the threshold to 0 silently disables scale-down in the upstream Kubernetes autoscaler (kubernetes/autoscaler#2221).

Jira: https://redhat.atlassian.net/browse/ROSAENG-62105

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: nephomaniac
Once this PR has been reviewed and has the lgtm label, please assign robpblake for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 18, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

The percentage validator now accepts only values strictly greater than 0 and less than 1, with an updated validation error message. Tests were added to verify that exact boundary inputs "0" and "1" return errors.

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description has summary and context, but omits most required template sections like type, behavior, testing, and verification. Add the missing template sections: detailed issue, related items, type of change, prior/after behavior, test steps, proof, breaking changes, and verification checklist.
Test Structure And Quality ⚠️ Warning New validator tests are fine structurally, but all expectations lack failure messages, which this check requires. Add concise diagnostic messages to each Expect in validators_test.go (e.g., include input and expected outcome), or use a helper that reports them.
✅ Passed checks (13 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly states the validator bound change and matches the main code and test updates.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The only added Ginkgo titles are static literals in validators_test.go; none include generated or variable values.
Microshift Test Compatibility ✅ Passed Only pure validator unit tests were added; they don’t use OpenShift APIs or MicroShift-unsupported features.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The added Ginkgo specs are unit tests for validators, with no node/topology/scheduling assumptions or SNO-specific behavior.
Topology-Aware Scheduling Compatibility ✅ Passed Only percentage validators/tests changed; no deployment, controller, or scheduling/topology code was added or modified.
Ote Binary Stdout Contract ✅ Passed Changed files only tighten percentage bounds and add tests; no stdout writes or process-level logging were added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Only unit tests in pkg/ocm were changed; no e2e tests, IPv4-only logic, or external connectivity appear in the diff.
No-Weak-Crypto ✅ Passed PR only tightens numeric bounds in PercentageValidator and adds boundary tests; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges ✅ Passed No container/K8s manifests were changed; the PR only modifies Go validators and tests, so the privilege check is not applicable.
No-Sensitive-Data-In-Logs ✅ Passed The PR only tightens percentage validation and adds tests; it introduces no logging or new sensitive-data exposure paths.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/ocm/validators.go`:
- Around line 71-72: Update the numeric validation guard in the visible
validator to explicitly reject NaN by incorporating math.IsNaN(number) alongside
the existing bounds checks, while preserving rejection of values outside the
open (0,1) interval. Add a validator test covering the "NaN" input in the
existing test suite.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 35276561-b701-431e-8a50-90f9ef8c276f

📥 Commits

Reviewing files that changed from the base of the PR and between 3bb1e1a and 2c6664b.

📒 Files selected for processing (2)
  • pkg/ocm/validators.go
  • pkg/ocm/validators_test.go

Comment thread pkg/ocm/validators.go
Comment on lines +71 to +72
if number >= 1 || number <= 0 {
return fmt.Errorf("Expecting a floating-point number greater than 0 and less than 1.")

@coderabbitai coderabbitai Bot Jul 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- pkg/ocm/validators.go ---'
cat -n pkg/ocm/validators.go | sed -n '1,180p'

printf '\n%s\n' '--- tests mentioning ParseFloat or NaN in pkg/ocm ---'
rg -n "ParseFloat|NaN|floating-point number greater than 0 and less than 1|validator" pkg/ocm -g '*_test.go' -A3 -B3

Repository: openshift/rosa

Length of output: 3968


🏁 Script executed:

#!/bin/bash
set -euo pipefail

cat -n pkg/ocm/validators_test.go | sed -n '1,220p'

Repository: openshift/rosa

Length of output: 3886


Reject NaN explicitly. strconv.ParseFloat accepts NaN, and this bounds check still returns nil because both comparisons are false. Add math.IsNaN(number) to the guard and cover "NaN" in pkg/ocm/validators_test.go.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/ocm/validators.go` around lines 71 - 72, Update the numeric validation
guard in the visible validator to explicitly reject NaN by incorporating
math.IsNaN(number) alongside the existing bounds checks, while preserving
rejection of values outside the open (0,1) interval. Add a validator test
covering the "NaN" input in the existing test suite.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree the CLI still accepts NaN, so the validator does not yet fully enforce its own 0 < x < 1 contract. The same comparison pattern exists in the operator and Terraform provider, so if we address it here we should also track sibling follow-ups instead of treating it as a CLI-only nit.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@olucasfreitas Agreed. The CLI change should explicitly reject NaN in this PR, while the operator and Terraform provider should receive separate follow-ups so their open-interval validation is consistent as well.

Would you like me to open GitHub issues for those two sibling follow-ups, assigned to you, with links back to this PR and discussion?


✏️ Learnings added
Learnt from: olucasfreitas
Repo: openshift/rosa PR: 3398
File: pkg/ocm/validators.go:71-72
Timestamp: 2026-07-20T18:45:56.541Z
Learning: `pkg/ocm/validators.go` in the ROSA CLI must reject `NaN` as well as values outside the open interval `(0, 1)` in `PercentageValidator`; `strconv.ParseFloat` accepts `NaN`, and ordinary ordered comparisons do not reject it. Equivalent percentage-validation comparison patterns also exist in the cluster-autoscaler operator and Terraform provider, so cross-component fixes should be tracked separately rather than treated as a CLI-only concern.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

@openshift-ci

openshift-ci Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

@nephomaniac: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/commits 2c6664b link true /test commits
ci/prow/security 2c6664b link false /test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

})

It("raises an error if got exactly 1", func() {
Expect(PercentageValidator("1")).ToNot(BeNil())

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The unit test update is good, but the higher-level autoscaler tests still encode the old contract: they expect the old error string and still use 1 as a successful threshold. Since this PR changes user-visible validation behavior, please update the e2e cases so the broader suite reflects the new open interval.

Comment thread pkg/ocm/validators.go
if number > 1 || number < 0 {
return fmt.Errorf("Expecting a floating-point number between 0 and 1.")
if number >= 1 || number <= 0 {
return fmt.Errorf("Expecting a floating-point number greater than 0 and less than 1.")

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that 0 and 1 are rejected, the flag help should say 'greater than 0 and less than 1' instead of 'between 0 and 1'. That keeps CLI help aligned with the validator and the OCP docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dco-signoff: yes jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants