CNTRLPLANE-4004: test(envtest): add CEL validation tests for AWS resource tag types

[michaelryanmcneill]

What this PR does / why we need it:

Adds CEL validation envtests for the AWS resource tag XValidation regex rules introduced in #9152. These tests run against Kubernetes 1.30–1.35 via the envtest framework to ensure the tag key/value regex constraints are enforced at the CRD level across supported versions.

10 new tests across 3 CRDs:

CRD	Positive	Negative	Total
HostedCluster	3 (overridePolicy Allow, Deny, unset)	2 (invalid key, invalid value)	5
NodePool	1 (valid tags)	2 (invalid key, invalid value)	3
AWSEndpointService	0 (1 already existed)	2 (invalid key, invalid value)	2

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-4004

Special notes for your reviewer:

Follow-up to #9152 which split AWSResourceTag into per-API types (AWSClusterResourceTag, AWSNodePoolResourceTag, AWSEndpointServiceResourceTag) and added per-tag overridePolicy. That PR added the XValidation rules but did not include envtest coverage — this PR fills that gap.

Negative tests use ! (key) and # (value) as invalid characters to trigger the regex rejection: "key must only contain letters, digits, and the characters _ . : / = + - @".

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@michaelryanmcneill: This pull request references CNTRLPLANE-4004 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Adds CEL validation envtests for the AWS resource tag XValidation regex rules introduced in #9152. These tests run against Kubernetes 1.30–1.35 via the envtest framework to ensure the tag key/value regex constraints are enforced at the CRD level across supported versions.

10 new tests across 3 CRDs:

CRD	Positive	Negative	Total
HostedCluster	3 (overridePolicy Allow, Deny, unset)	2 (invalid key, invalid value)	5
NodePool	1 (valid tags)	2 (invalid key, invalid value)	3
AWSEndpointService	0 (1 already existed)	2 (invalid key, invalid value)	2

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-4004

Special notes for your reviewer:

Follow-up to #9152 which split AWSResourceTag into per-API types (AWSClusterResourceTag, AWSNodePoolResourceTag, AWSEndpointServiceResourceTag) and added per-tag overridePolicy. That PR added the XValidation rules but did not include envtest coverage — this PR fills that gap.

Negative tests use ! (key) and # (value) as invalid characters to trigger the regex rejection: "key must only contain letters, digits, and the characters _ . : / = + - @".

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (3)

• cmd/install/assets/crds/hypershift-operator/tests/awsendpointservices.hypershift.openshift.io/stable.awsendpointservices.aws.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml
• cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.aws.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml
• cmd/install/assets/crds/hypershift-operator/tests/nodepools.hypershift.openshift.io/stable.nodepools.aws.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8d1d299d-2797-4b1f-91cc-98405c394019

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: michaelryanmcneill
Once this PR has been reviewed and has the lgtm label, please assign jparrill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.03%. Comparing base (47574c0) to head (7e8b385).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9375      +/-   ##
==========================================
+ Coverage   45.97%   46.03%   +0.06%     
==========================================
  Files         781      781              
  Lines       98056    98181     +125     
==========================================
+ Hits        45079    45200     +121     
- Misses      49905    49910       +5     
+ Partials     3072     3071       -1     

see 8 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	39.27% <ø> (+0.10%)	⬆️
cpo-hostedcontrolplane	48.29% <ø> (+0.07%)	⬆️
cpo-other	46.11% <ø> (+0.10%)	⬆️
hypershift-operator	57.17% <ø> (+0.01%)	⬆️
other	34.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[michaelryanmcneill]

/verified by envtest-ocp

[openshift-ci-robot]

@michaelryanmcneill: This PR has been marked as verified by envtest-ocp.

Details

In response to this:

/verified by envtest-ocp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@michaelryanmcneill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.