Add hosted mode support for addon template (#182)

[mikeshng]

Add hosted mode support for addon template enhancement proposal

For #182

Summary by CodeRabbit

• Documentation
  • Added a new design proposal for enabling Hosted Mode in addon templates.
  • Documented how install mode-aware behavior, manifest placement, and hosted/managed cluster deployment flow should work.
  • Included expected status handling, cleanup behavior, examples, and rollout guidance.
  • Added enhancement metadata with ownership, status, and related references.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mikeshng
Once this PR has been reviewed and has the lgtm label, please assign qiujian16 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

@mikeshng, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 56 minutes and 31 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a580c5cd-cd49-4922-868b-d8b3a4cc5d6c

📥 Commits

Reviewing files that changed from the base of the PR and between ff5306e and df18d53.

📒 Files selected for processing (2)

• enhancements/sig-architecture/182-addontemplate-hosted-mode/README.md
• enhancements/sig-architecture/182-addontemplate-hosted-mode/metadata.yaml

Walkthrough

This PR adds an enhancement proposal and metadata for Hosted Mode support in AddOnTemplate-based addons. It describes the template-agent and rendering changes, hosted-manifest placement rules, deployment and registration behavior, validation coverage, rollout criteria, compatibility behavior, and alternatives.

Changes

Hosted Mode design proposal

Layer / File(s)	Summary
Proposal framing and design enhancements/sig-architecture/182-addontemplate-hosted-mode/README.md	Adds the checklist, scope, non-goals, HostedModeEnabled, and INSTALL_MODE rendering behavior.
Examples, validation, and rollout enhancements/sig-architecture/182-addontemplate-hosted-mode/README.md	Adds hosted-manifest placement examples, test plan, graduation criteria, compatibility behavior, and alternatives.
Enhancement metadata enhancements/sig-architecture/182-addontemplate-hosted-mode/metadata.yaml	Adds front matter with authorship, status, timestamps, and related enhancement links.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• open-cluster-management-io/enhancements issue 182 — The PR documents Hosted Mode support for AddOnTemplate, matching the issue topic.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding hosted mode support for AddOnTemplate-based addons.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mikeshng]

/assign @kahirokunn @tesshuflower

[mikeshng]

This enhancement assumes AddOnTemplate is already promoted to v1beta1. That work should be quite trivial compare to this enhancement.

[kahirokunn]

@mikeshng Thank you for the great proposal!

After reviewing it, I think there are still some challenges when trying to express hosted addons like managed-serviceaccount or cluster-proxy using AddOnTemplate.

First, it's unresolved how to provide the kubeconfig that the agent running on the hosting cluster uses to access the managed cluster. Currently, managed-serviceaccount has its own provisioner on the addon side and generates/updates a managed kubeconfig using a least-privilege ServiceAccount token, but this seems less like something specific to managed-serviceaccount and more like a challenge common to hosted addons in general.

For this reason, how about giving this responsibility to AddOnTemplate or the addon-framework side? For example, a mechanism that provisions, for the agent on the hosting cluster, a kubeconfig for accessing the managed cluster with least privilege. If it could handle generating the kubeconfig using a ServiceAccount token on the managed cluster side, placing it into a Secret on the hosting cluster side, refresh, and cleanup, then each addon wouldn't need to have its own provisioner.

On top of that, how to reflect the prepared managed kubeconfig into the AddOnTemplate manifests is also a challenge. The proposal adds INSTALL_MODE, but since AddOnTemplate is basically simple value substitution, it's difficult to selectively output parts of the YAML or entire resources depending on the install mode. For example, adding kubeconfig volume/args/RBAC only in the Hosted case, creating additional ServiceAccount/Role/Deployment, or not creating hosted-only resources in the Default case. Since hosted-manifest-location determines the placement target in the Hosted case, handling both Default/Hosted with a single AddOnTemplate would also seem to require this kind of install-mode-dependent manifest selection.

With these two things in place, hosted addons like managed-serviceaccount and cluster-proxy could likely be expressed with AddOnTemplate as well.

[mikeshng]

@kahirokunn what you said is all true. It's a huge amount of work to get it fully functioning.

[kahirokunn]

Exactly... I think it will take a significant amount of time for both design and implementation to get it fully functioning. 😂