ROSAENG-61403 | refactor: remove unused OCM-role API

[andclt]

PR Summary

Removes unused CAPA-targeted API from pkg/ocmrole.

Detailed Description of the Issue

CAPA made a decision not to leverage the exposed OCM API from ROSA CLI (kubernetes-sigs/cluster-api-provider-aws#6055). This PR removes the unused public API.

Related Issues and PRs

• Jira: ROSAENG-61403
• Related PR(s): ROSAENG-59417 | refactor: expose CreateOCMRole to CAPA #3262 (original refactoring that added the CAPA API)
• Related Jira: ROSAENG-59417

Type of Change

• feat - adds a new user-facing capability.
• fix - resolves an incorrect behavior or bug.
• docs - updates documentation only.
• style - formatting or naming changes with no logic impact.
• refactor - code restructuring with no behavior change.
• test - adds or updates tests only.
• chore - maintenance work (tooling, housekeeping, non-product code).
• build - changes build system, packaging, or dependencies for build output.
• ci - changes CI pipelines, jobs, or automation workflows.
• perf - improves performance without changing intended behavior.

Previous Behavior

The codebase contained exported API functions in pkg/ocmrole/ that were intended for external CAPA consumption but are not being used.

Behavior After This Change

Removed:

• pkg/ocmrole/api.go- GetOrCreateOCMRole() function and re-exported types
• pkg/ocmrole/api_test.go - test suite for the public API

Changed::

• Made createPermissionPolicy() lowercase (package-private) since it's only used within the internal package

How to Test (Step-by-Step)

Preconditions

Test Steps

1. make build
2. make test

Expected Results

• Build succeeds
• All tests pass

Proof of the Fix

Test output:
✓ make rosa - build successful
✓ make test - all tests pass

Breaking Changes

• No breaking changes
• Yes, this PR introduces a breaking change (describe impact and migration plan below)

The removed API was never consumed externally. Only internal package structure changed, which is not part of the public API.

Breaking Change Details / Migration Plan

Developer Verification Checklist

• Commit subject/title follows [JIRA-TICKET] | [TYPE]: <MESSAGE>.
• PR description clearly explains both what changed and why.
• Relevant Jira/GitHub issues and related PRs are linked.
• make install-hooks has been run in this clone.
• Tests were added/updated where appropriate.
• I manually tested the change.
• make test passes.
• make lint passes.
• make rosa passes.
• Documentation or repo-local agent guidance was added/updated where appropriate.
• Any risk, limitation, or follow-up work is documented.

Summary by CodeRabbit

• Chores
  • Removed a set of public role-management entry points and related test coverage.
  • Simplified internal permission-policy handling while keeping behavior unchanged for role setup.
  • This change reduces the exposed API surface and may require updates for any code integrating with these role helpers.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Walkthrough

The change renames the exported function CreatePermissionPolicy in internal/ocmrole/core.go to an unexported createPermissionPolicy, updating its four call sites within CreateRolesInternal for the standard, admin, and no-console profile branches. Additionally, pkg/ocmrole/api.go is removed entirely, eliminating the exported RoleProfile type alias, profile constants (ProfileStandard, ProfileAdmin, ProfileNoConsole), and the GetOrCreateOCMRole function. The corresponding test file pkg/ocmrole/api_test.go is also removed.

Changes

Cohort / File(s)	Summary
Unexport permission policy helper — internal/ocmrole/core.go	Renames CreatePermissionPolicy to unexported createPermissionPolicy; updates four call sites
Remove public API — pkg/ocmrole/api.go	Removes RoleProfile alias, profile constants, and GetOrCreateOCMRole function
Remove tests — pkg/ocmrole/api_test.go	Removes TestOCMRoleAPI and associated test cases

Related PRs: None specified.

Suggested labels: api-change, breaking-change

Suggested reviewers: None specified.

Poem: A rabbit hopped through code so neat,
Turned "Create" to lowercase feet,
The public door was shut for good,
Tests packed up as they should,
A quieter API, understood.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The only changed test file was deleted, and its Ginkgo titles are static/descriptive with no dynamic values.
Test Structure And Quality	✅ Passed	No Ginkgo tests were added or modified; the only test file in the PR was deleted, so the quality criteria are not applicable.
Microshift Test Compatibility	✅ Passed	The commit only deletes the pkg/ocmrole Ginkgo suite and does not add new tests or MicroShift-incompatible APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR removes pkg/ocmrole/api_test.go and adds no new Ginkgo tests, so SNO compatibility checks are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only removes pkg/ocmrole API/tests and renames an internal IAM helper; no manifests, controllers, or topology-sensitive scheduling code are introduced.
Ote Binary Stdout Contract	✅ Passed	No stdout writes were added in process-level code; internal/ocmrole has only a plain RunSpecs, and the renamed helper contains no Print/klog/log output.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new e2e tests were added; the PR only removes pkg/ocmrole/api_test.go and renames an internal helper. Existing Ginkgo unit tests in internal/ocmrole show no IPv4 or external-network assumptions.
No-Weak-Crypto	✅ Passed	No weak-crypto primitives or secret-comparison code appear in the PR diff; it only renames/removes OCM role API code.
Container-Privileges	✅ Passed	The PR only changes Go files (internal/ocmrole/core.go, pkg/ocmrole/api.go, pkg/ocmrole/api_test.go); no container/K8s manifests or privilege fields were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only renames a helper and deletes public API/tests; no added logs contain passwords, tokens, PII, or hostnames.
Title check	✅ Passed	It follows the required ticket/type format and clearly summarizes removing the unused OCM-role API.
Description check	✅ Passed	It covers the required sections with issue context, changes, testing, and related links; only minor template fields are left generic.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 28.33%. Comparing base (37982ff) to head (6badc7d).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3337      +/-   ##
==========================================
- Coverage   28.38%   28.33%   -0.05%     
==========================================
  Files         334      333       -1     
  Lines       36730    36688      -42     
==========================================
- Hits        10424    10397      -27     
+ Misses      25549    25539      -10     
+ Partials      757      752       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[olucasfreitas]

@andclt is this ready for review ?

[andclt]

@andclt is this ready for review ?

Yes!

[olucasfreitas]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andclt, olucasfreitas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [olucasfreitas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@andclt: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.