Repository: openshift/aws-vpce-operator
Pull request #289: OSD-29372 Support New CAPI AWS Tag Key Naming Format
Author: login: dustman9000
Labels: name: lgtm
description: Indicates that a PR is ready to be merged.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
Created: 2025-04-08T19:30:57Z | Merged: 2025-04-08T21:46:49Z

Introduced in 4.16 was a CAPI change in the aws tag key naming format. From `kubernetes.io/cluster/${infraID}` to `sigs.k8s.io/cluster-api-provider-aws/cluster/${infraID}`.
This change supports both the old ("legacy") format while also supporting the new CAPI naming scheme. This also adds additional logging and unit testing.

Fixes [OSD-29372](https://issues.redhat.com//browse/OSD-29372)


Diff:
diff --git a/Makefile b/Makefile
index ee6243d1..f9f06506 100644
--- a/Makefile
+++ b/Makefile
@@ -3,6 +3,9 @@ FIPS_ENABLED=true
 # needed for FR operators as boilerplate checks commercial app-interface saas file hashes
 export SKIP_SAAS_FILE_CHECKS=y
 
+# TODO: Remove once OSD-29374 is fixed
+export TESTTARGETS=./...
+
 include boilerplate/generated-includes.mk
 
 SHELL := /usr/bin/env bash
diff --git a/controllers/vpcendpoint/helpers.go b/controllers/vpcendpoint/helpers.go
index d11eb0c5..91095f85 100644
--- a/controllers/vpcendpoint/helpers.go
+++ b/controllers/vpcendpoint/helpers.go
@@ -80,7 +80,7 @@ func (r *VpcEndpointReconciler) parseClusterInfo(ctx context.Context, vpce *avov
 		}
 	}
 
-	clusterTag, err := util.GetClusterTagKey(vpce.Status.InfraId)
+	clusterTag, err := util.GetClusterLegacyTagKey(vpce.Status.InfraId)
 	if err != nil {
 		return err
 	}
diff --git a/controllers/vpcendpoint/helpers_test.go b/controllers/vpcendpoint/helpers_test.go
index a05e0933..935e0a44 100644
--- a/controllers/vpcendpoint/helpers_test.go
+++ b/controllers/vpcendpoint/helpers_test.go
@@ -109,7 +109,7 @@ func TestVpcEndpointReconciler_createMissingSecurityGroupTags(t *testing.T) {
 						Value: aws.String(util.OperatorTagValue),
 					},
 					{
-						Key:   aws.String(aws_client.MockClusterTag),
+						Key:   aws.String(aws_client.MockLegacyClusterTag),
 						Value: aws.String("owned"),
 					},
 					{
@@ -119,7 +119,7 @@ func TestVpcEndpointReconciler_createMissingSecurityGroupTags(t *testing.T) {
 				},
 			},
 			clusterInfo: &clusterInfo{
-				clusterTag: aws_client.MockClusterTag,
+				clusterTag: aws_client.MockLegacyClusterTag,
 			},
 			resource: &avov1alpha2.VpcEndpoint{
 				ObjectMeta: metav1.ObjectMeta{
@@ -142,7 +142,7 @@ func TestVpcEndpointReconciler_createMissingSecurityGroupTags(t *testing.T) {
 				},
 			},
 			clusterInfo: &clusterInfo{
-				clusterTag: aws_client.MockClusterTag,
+				clusterTag: aws_client.MockLegacyClusterTag,
 			},
 			resource: &avov1alpha2.VpcEndpoint{
 				ObjectMeta: metav1.ObjectMeta{
@@ -345,7 +345,7 @@ func TestVpcEndpointReconciler_findOrCreateVpcEndpoint(t *testing.T) {
 				},
 			},
 			clusterInfo: &clusterInfo{
-				clusterTag: aws_client.MockClusterTag,
+				clusterTag: aws_client.MockLegacyClusterTag,
 			},
 			expectErr: false,
 		},
diff --git a/controllers/vpcendpoint/validation.go b/controllers/vpcendpoint/validation.go
index b6dea646..1bc12db3 100644
--- a/controllers/vpcendpoint/validation.go
+++ b/controllers/vpcendpoint/validation.go
@@ -59,15 +59,18 @@ func (r *VpcEndpointReconciler) validateSecurityGroup(ctx context.Context, resou
 
 	sg, err := r.findOrCreateSecurityGroup(ctx, resource)
 	if err != nil {
+		r.log.V(0).Error(err, "failed to find or create security groups")
 		return err
 	}
 
 	if err := r.createMissingSecurityGroupTags(ctx, sg, resource); err != nil {
+		r.log.V(0).Error(err, "failed to create missing security group tags")
 		return err
 	}
 
 	ingressInput, egressInput, err := r.generateMissingSecurityGroupRules(ctx, sg, resource)
 	if err != nil {
+		r.log.V(0).Error(err, "failed to generate missing security group rules")
 		return err
 	}
 
diff --git a/controllers/vpcendpoint/validation_test.go b/controllers/vpcendpoint/validation_test.go
index 0407deed..8d5c3249 100644
--- a/controllers/vpcendpoint/validation_test.go
+++ b/controllers/vpcendpoint/validation_test.go
@@ -86,7 +86,7 @@ func TestVPCEndpointReconciler_validateSecurityGroup(t *testing.T) {
 			awsClient: aws_client.NewMockedAwsClientWithSubnets(),
 			log:       testr.New(t),
 			clusterInfo: &clusterInfo{
-				clusterTag: aws_client.MockClusterTag,
+				clusterTag: aws_client.MockLegacyClusterTag,
 			},
 			Recorder: record.NewFakeRecorder(1),
 		}
@@ -142,7 +142,7 @@ func TestVPCEndpointReconciler_validateVPCEndpoint(t *testing.T) {
 			awsClient: aws_client.NewMockedAwsClientWithSubnets(),
 			log:       testr.New(t),
 			clusterInfo: &clusterInfo{
-				clusterTag: aws_client.MockClusterTag,
+				clusterTag: aws_client.MockLegacyClusterTag,
 			},
 		}
 
diff --git a/pkg/aws_client/mock.go b/pkg/aws_client/mock.go
index ac88bd26..0f946edd 100644
--- a/pkg/aws_client/mock.go
+++ b/pkg/aws_client/mock.go
@@ -19,6 +19,7 @@ package aws_client
 import (
 	"context"
 	"fmt"
+
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	ec2Types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
@@ -28,7 +29,8 @@ import (
 )
 
 const (
-	MockClusterTag             = "kubernetes.io/cluster/mock-12345"
+	MockLegacyClusterTag       = "kubernetes.io/cluster/mock-12345"
+	MockCapiClusterTag         = "sigs.k8s.io/cluster-api-provider-aws/cluster/mock-54321"
 	MockClusterNameTag         = "mock-12345-vpce"
 	MockHostedZoneId           = "R53HZ12345"
 	MockPublicSubnetId         = "subnet-pub12345"
@@ -69,7 +71,7 @@ var mockSubnets = []*ec2Types.Subnet{
 				Value: nil,
 			},
 			{
-				Key:   aws.String(MockClusterTag),
+				Key:   aws.String(MockLegacyClusterTag),
 				Value: aws.String("shared"),
 			},
 		},
@@ -174,6 +176,20 @@ func (m *MockedEC2) DescribeSecurityGroups(ctx context.Context, params *ec2.Desc
 						},
 					},
 				}, nil
+			} else if *filter.Name == "Tag:Name" {
+				return &ec2.DescribeSecurityGroupsOutput{
+					SecurityGroups: []ec2Types.SecurityGroup{
+						{
+							GroupId: aws.String(MockSecurityGroupId),
+							Tags: []ec2Types.Tag{
+								{
+									Key:   aws.String("Name"),
+									Value: aws.String(filter.Values[0]),
+								},
+							},
+						},
+					},
+				}, nil
 			}
 		}
 	}
diff --git a/pkg/aws_client/security_group.go b/pkg/aws_client/security_group.go
index 3c74563a..78c69c6c 100644
--- a/pkg/aws_client/security_group.go
+++ b/pkg/aws_client/security_group.go
@@ -32,7 +32,12 @@ import (
 // FilterClusterNodeSecurityGroupsByDefaultTags describes the security groups attached to the cluster nodes
 // by filtering by the clusterTag and expected Name tags
 func (c *AWSClient) FilterClusterNodeSecurityGroupsByDefaultTags(ctx context.Context, infraName string) (*ec2.DescribeSecurityGroupsOutput, error) {
-	clusterTag, err := util.GetClusterTagKey(infraName)
+	clusterLegacyTag, err := util.GetClusterLegacyTagKey(infraName)
+	if err != nil {
+		return nil, err
+	}
+
+	clusterCapiTag, err := util.GetClusterCapiTagKey(infraName)
 	if err != nil {
 		return nil, err
 	}
@@ -47,7 +52,11 @@ func (c *AWSClient) FilterClusterNodeSecurityGroupsByDefaultTags(ctx context.Con
 		Filters: []types.Filter{
 			{
 				Name:   aws.String("tag-key"),
-				Values: []string{clusterTag},
+				Values: []string{clusterLegacyTag},
+			},
+			{
+				Name:   aws.String("tag-key"),
+				Values: []string{clusterCapiTag},
 			},
 			{
 				Name:   aws.String("tag:Name"),
@@ -60,7 +69,7 @@ func (c *AWSClient) FilterClusterNodeSecurityGroupsByDefaultTags(ctx context.Con
 // FilterSecurityGroupByDefaultTags describes the security group attached to the VPC Endpoint this operator manages
 // by filtering by the clusterTag and operator tag
 func (c *AWSClient) FilterSecurityGroupByDefaultTags(ctx context.Context, infraName, sgNameTag string) (*ec2.DescribeSecurityGroupsOutput, error) {
-	clusterTag, err := util.GetClusterTagKey(infraName)
+	clusterTag, err := util.GetClusterLegacyTagKey(infraName)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/aws_client/security_group_test.go b/pkg/aws_client/security_group_test.go
index 6ba5ba3d..a25a9dd5 100644
--- a/pkg/aws_client/security_group_test.go
+++ b/pkg/aws_client/security_group_test.go
@@ -25,11 +25,21 @@ import (
 
 func TestAWSClient_FilterClusterNodeSecurityGroupsByDefaultTags(t *testing.T) {
 	tests := []struct {
+		infraName string
 		tagKey    string
+		tagValue  string
 		expectErr bool
 	}{
 		{
-			tagKey:    MockClusterTag,
+			infraName: "mock-12345",
+			tagKey:    MockLegacyClusterTag,
+			tagValue:  "owned",
+			expectErr: false,
+		},
+		{
+			infraName: "mock-12345",
+			tagKey:    MockCapiClusterTag,
+			tagValue:  "owned",
 			expectErr: false,
 		},
 	}
@@ -37,7 +47,7 @@ func TestAWSClient_FilterClusterNodeSecurityGroupsByDefaultTags(t *testing.T) {
 	client := NewMockedAwsClient()
 
 	for _, test := range tests {
-		_, err := client.FilterClusterNodeSecurityGroupsByDefaultTags(context.TODO(), test.tagKey)
+		_, err := client.FilterClusterNodeSecurityGroupsByDefaultTags(context.TODO(), test.infraName)
 		if test.expectErr {
 			assert.Error(t, err)
 		} else {
@@ -53,7 +63,7 @@ func TestAWSClient_FilterSecurityGroupByDefaultTags(t *testing.T) {
 		expectErr bool
 	}{
 		{
-			tagKey:    MockClusterTag,
+			tagKey:    MockLegacyClusterTag,
 			nameTag:   MockSecurityGroupId,
 			expectErr: false,
 		},
@@ -98,7 +108,7 @@ func TestAWSClient_FilterSecurityGroupById(t *testing.T) {
 func TestAWSClient_CreateDeleteSecurityGroup(t *testing.T) {
 	client := NewMockedAwsClient()
 
-	resp, err := client.CreateSecurityGroup(context.TODO(), "name", MockVpcId, MockClusterTag)
+	resp, err := client.CreateSecurityGroup(context.TODO(), "name", MockVpcId, MockLegacyClusterTag)
 	assert.NoError(t, err)
 
 	_, err = client.DeleteSecurityGroup(context.TODO(), *resp.GroupId)
diff --git a/pkg/aws_client/subnet_test.go b/pkg/aws_client/subnet_test.go
index 9de76533..0e25d8e2 100644
--- a/pkg/aws_client/subnet_test.go
+++ b/pkg/aws_client/subnet_test.go
@@ -27,7 +27,7 @@ func TestAWSClient_DescribeSubnets(t *testing.T) {
 		expectErr  bool
 	}{
 		{
-			clusterTag: MockClusterTag,
+			clusterTag: MockLegacyClusterTag,
 			expectErr:  false,
 		},
 		{
diff --git a/pkg/aws_client/vpc_endpoint_test.go b/pkg/aws_client/vpc_endpoint_test.go
index 6e70a937..a53d7ade 100644
--- a/pkg/aws_client/vpc_endpoint_test.go
+++ b/pkg/aws_client/vpc_endpoint_test.go
@@ -87,14 +87,14 @@ func TestAWSClient_DescribeSingleVPCEndpointById(t *testing.T) {
 func TestAWSClient_FilterVPCEndpointByDefaultTags(t *testing.T) {
 	client := NewMockedAwsClient()
 
-	_, err := client.FilterVPCEndpointByDefaultTags(context.TODO(), MockClusterTag, MockClusterNameTag)
+	_, err := client.FilterVPCEndpointByDefaultTags(context.TODO(), MockLegacyClusterTag, MockClusterNameTag)
 	assert.NoError(t, err)
 }
 
 func TestCreateDeleteVPCEndpoint(t *testing.T) {
 	client := NewMockedAwsClient()
 
-	resp, err := client.CreateDefaultInterfaceVPCEndpoint(context.TODO(), "name", MockVpcId, MockVpcEndpointServiceName, MockClusterTag)
+	resp, err := client.CreateDefaultInterfaceVPCEndpoint(context.TODO(), "name", MockVpcId, MockVpcEndpointServiceName, MockLegacyClusterTag)
 	assert.NoError(t, err)
 
 	_, err = client.DeleteVPCEndpoint(context.TODO(), *resp.VpcEndpoint.VpcEndpointId)
diff --git a/pkg/util/naming.go b/pkg/util/naming.go
index e72e5a2f..453f0c33 100644
--- a/pkg/util/naming.go
+++ b/pkg/util/naming.go
@@ -31,6 +31,8 @@ const (
 	RedHatManagedTagKey      = "red-hat-managed"
 	RedHatManagedTagValue    = "true"
 	SecurityGroupDescription = "Managed by AWS VPCE Operator"
+	LegacyClusterTagPrefix   = "kubernetes.io/cluster"
+	CapiClusterTagPrefix     = "sigs.k8s.io/cluster-api-provider-aws/cluster"
 )
 
 // These are the expected security group suffixes available in the VPC based on the cluster's infra id.
@@ -80,13 +82,22 @@ func GenerateAwsTagsAsMap(name, clusterTagKey string) (map[string]string, error)
 	return tagsMap, nil
 }
 
-// GetClusterTagKey returns the tag assigned to all AWS resources for the given cluster
-func GetClusterTagKey(infraName string) (string, error) {
+// GetClusterLegacyTagKey returns the tag assigned to all AWS resources for the given cluster
+func GetClusterLegacyTagKey(infraName string) (string, error) {
 	if infraName == "" {
-		return "", errors.New("failed to GetClusterTagKey: infraName must be specified")
+		return "", errors.New("failed to GetClusterLegacyTagKey: infraName must be specified")
 	}
 
-	return fmt.Sprintf("kubernetes.io/cluster/%s", infraName), nil
+	return fmt.Sprintf("%s/%s", LegacyClusterTagPrefix, infraName), nil
+}
+
+// GetClusterCapiTagKey returns the tag assigned to all AWS resources for the given cluster in CAPI format
+func GetClusterCapiTagKey(infraName string) (string, error) {
+	if infraName == "" {
+		return "", errors.New("failed to GetClusterCapiTagKey: infraName must be specified")
+	}
+
+	return fmt.Sprintf("%s/%s", CapiClusterTagPrefix, infraName), nil
 }
 
 // GenerateSecurityGroupName generates a name for a security group given a cluster name
diff --git a/pkg/util/naming_test.go b/pkg/util/naming_test.go
index dea05a54..14f217ed 100644
--- a/pkg/util/naming_test.go
+++ b/pkg/util/naming_test.go
@@ -37,7 +37,7 @@ func TestGenerateAwsTags(t *testing.T) {
 		},
 		{
 			name:          "cluster",
-			clusterTagKey: "kubernetes.io/cluster/infra",
+			clusterTagKey: LegacyClusterTagPrefix + "/infra",
 			expectErr:     false,
 		},
 	}
@@ -66,12 +66,12 @@ func TestGenerateAwsTagsAsMap(t *testing.T) {
 		},
 		{
 			name:          "cluster",
-			clusterTagKey: "kubernetes.io/cluster/infra",
+			clusterTagKey: LegacyClusterTagPrefix + "/mock-12345",
 			expectErr:     false,
 			expected: map[string]string{
-				"Name":                        "cluster",
-				"kubernetes.io/cluster/infra": "owned",
-				OperatorTagKey:                OperatorTagValue,
+				"Name":                                 "cluster",
+				LegacyClusterTagPrefix + "/mock-12345": "owned",
+				OperatorTagKey:                         OperatorTagValue,
 			},
 		},
 	}
@@ -91,7 +91,7 @@ func TestGenerateAwsTagsAsMap(t *testing.T) {
 	}
 }
 
-func TestGetClusterTagKey(t *testing.T) {
+func TestGetClusterLegacyTagKey(t *testing.T) {
 	tests := []struct {
 		infraName string
 		expected  string
@@ -102,14 +102,42 @@ func TestGetClusterTagKey(t *testing.T) {
 			expectErr: true,
 		},
 		{
-			infraName: "infra",
-			expected:  "kubernetes.io/cluster/infra",
+			infraName: "mock-12345",
+			expected:  LegacyClusterTagPrefix + "/mock-12345",
 			expectErr: false,
 		},
 	}
 
 	for _, test := range tests {
-		actual, err := GetClusterTagKey(test.infraName)
+		actual, err := GetClusterLegacyTagKey(test.infraName)
+		if test.expectErr {
+			assert.NotNil(t, err)
+		} else {
+			assert.Nil(t, err)
+			assert.Equal(t, test.expected, actual)
+		}
+	}
+}
+
+func TestGetClusterCapiTagKey(t *testing.T) {
+	tests := []struct {
+		infraName string
+		expected  string
+		expectErr bool
+	}{
+		{
+			infraName: "",
+			expectErr: true,
+		},
+		{
+			infraName: "mock-12345",
+			expected:  CapiClusterTagPrefix + "/mock-12345",
+			expectErr: false,
+		},
+	}
+
+	for _, test := range tests {
+		actual, err := GetClusterCapiTagKey(test.infraName)
 		if test.expectErr {
 			assert.NotNil(t, err)
 		} else {


Reviews:
user: login: joshbranham
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T21:33:30Z
user: login: joshbranham
body: /lgtm
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T21:36:39Z

Review comments:
diff_hunk: @@ -80,13 +82,22 @@ func GenerateAwsTagsAsMap(name, clusterTagKey string) (map[string]string, error)
 	return tagsMap, nil
 }
 
-// GetClusterTagKey returns the tag assigned to all AWS resources for the given cluster
-func GetClusterTagKey(infraName string) (string, error) {
+// GetClusterLegacyTagKey returns the tag assigned to all AWS resources for the given cluster
+func GetClusterLegacyTagKey(infraName string) (string, error) {
 	if infraName == "" {
 		return "", errors.New("failed to GetClusterTagKey: infraName must be specified")
path: pkg/util/naming.go
user: login: joshbranham
body: ```suggestion
		return "", errors.New("failed to GetClusterLegacyTagKey: infraName must be specified")
```
created_at: 2025-04-08T21:32:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -80,13 +82,22 @@ func GenerateAwsTagsAsMap(name, clusterTagKey string) (map[string]string, error)
 	return tagsMap, nil
 }
 
-// GetClusterTagKey returns the tag assigned to all AWS resources for the given cluster
-func GetClusterTagKey(infraName string) (string, error) {
+// GetClusterLegacyTagKey returns the tag assigned to all AWS resources for the given cluster
+func GetClusterLegacyTagKey(infraName string) (string, error) {
 	if infraName == "" {
 		return "", errors.New("failed to GetClusterTagKey: infraName must be specified")
 	}
 
-	return fmt.Sprintf("kubernetes.io/cluster/%s", infraName), nil
+	return fmt.Sprintf("%s/%s", LegacyClusterTagPrefix, infraName), nil
+}
+
+// GetClusterCapiTagKey returns the tag assigned to all AWS resources for the given cluster in CAPI format
+func GetClusterCapiTagKey(infraName string) (string, error) {
+	if infraName == "" {
+		return "", errors.New("failed to GetClusterTagKey: infraName must be specified")
path: pkg/util/naming.go
user: login: joshbranham
body: ```suggestion
		return "", errors.New("failed to GetClusterCapiTagKey: infraName must be specified")
```
created_at: 2025-04-08T21:32:39Z
author_association: CONTRIBUTOR

PR comments:
user: login: openshift-ci[bot]
created_at: 2025-04-08T19:31:45Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/openshift/aws-vpce-operator/pull/289#" title="Author self-approved">dustman9000</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=openshift%2Faws-vpce-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/openshift/aws-vpce-operator/blob/main/OWNERS)~~ [dustman9000]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: codecov-commenter
created_at: 2025-04-08T19:40:40Z
body: ## [Codecov](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) Report
Attention: Patch coverage is `43.75000%` with `18 lines` in your changes missing coverage. Please review.
> Project coverage is 38.68%. Comparing base [(`ad66401`)](https://app.codecov.io/gh/openshift/aws-vpce-operator/commit/ad66401d16ace1fba390edb646bcca1bb5832c21?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) to head [(`9cff1fe`)](https://app.codecov.io/gh/openshift/aws-vpce-operator/commit/9cff1fe62c8cad38a8741f050a9a6c0094b729ca?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift).
> Report is 2 commits behind head on main.

| [Files with missing lines](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) | Patch % | Lines |
|---|---|---|
| [pkg/aws\_client/mock.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=pkg%2Faws_client%2Fmock.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-cGtnL2F3c19jbGllbnQvbW9jay5nbw==) | 0.00% | [11 Missing and 1 partial :warning: ](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) |
| [controllers/vpcendpoint/validation.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=controllers%2Fvpcendpoint%2Fvalidation.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-Y29udHJvbGxlcnMvdnBjZW5kcG9pbnQvdmFsaWRhdGlvbi5nbw==) | 0.00% | [3 Missing :warning: ](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) |
| [pkg/aws\_client/security\_group.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=pkg%2Faws_client%2Fsecurity_group.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-cGtnL2F3c19jbGllbnQvc2VjdXJpdHlfZ3JvdXAuZ28=) | 77.77% | [1 Missing and 1 partial :warning: ](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) |
| [controllers/vpcendpoint/helpers.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=controllers%2Fvpcendpoint%2Fhelpers.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-Y29udHJvbGxlcnMvdnBjZW5kcG9pbnQvaGVscGVycy5nbw==) | 0.00% | [1 Missing :warning: ](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) |

<details><summary>Additional details and impacted files</summary>


[![Impacted file tree graph](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289/graphs/tree.svg?width=650&height=150&src=pr&token=8PYKYKDZY5&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift)](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift)

```diff
@@            Coverage Diff             @@
##             main     #289      +/-   ##
==========================================
- Coverage   38.76%   38.68%   -0.09%     
==========================================
  Files          31       31              
  Lines        1999     2024      +25     
==========================================
+ Hits          775      783       +8     
- Misses       1136     1151      +15     
- Partials       88       90       +2     
```

| [Files with missing lines](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift) | Coverage Δ | |
|---|---|---|
| [pkg/util/naming.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=pkg%2Futil%2Fnaming.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-cGtnL3V0aWwvbmFtaW5nLmdv) | `72.30% <100.00%> (+1.81%)` | :arrow_up: |
| [controllers/vpcendpoint/helpers.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=controllers%2Fvpcendpoint%2Fhelpers.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-Y29udHJvbGxlcnMvdnBjZW5kcG9pbnQvaGVscGVycy5nbw==) | `38.40% <0.00%> (ø)` | |
| [pkg/aws\_client/security\_group.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=pkg%2Faws_client%2Fsecurity_group.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-cGtnL2F3c19jbGllbnQvc2VjdXJpdHlfZ3JvdXAuZ28=) | `71.42% <77.77%> (-0.37%)` | :arrow_down: |
| [controllers/vpcendpoint/validation.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=controllers%2Fvpcendpoint%2Fvalidation.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-Y29udHJvbGxlcnMvdnBjZW5kcG9pbnQvdmFsaWRhdGlvbi5nbw==) | `10.43% <0.00%> (-0.12%)` | :arrow_down: |
| [pkg/aws\_client/mock.go](https://app.codecov.io/gh/openshift/aws-vpce-operator/pull/289?src=pr&el=tree&filepath=pkg%2Faws_client%2Fmock.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=openshift#diff-cGtnL2F3c19jbGllbnQvbW9jay5nbw==) | `84.18% <0.00%> (-5.50%)` | :arrow_down: |

</details>
<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
author_association: NONE
user: login: openshift-ci[bot]
created_at: 2025-04-08T21:42:22Z
body: @dustman9000: all tests **passed!**


[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=aws-vpce-operator&pr=289). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:dustman9000).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: CONTRIBUTOR