From 0fc86fdfbb2ab6e4e0da24a36fdfbd648f996c18 Mon Sep 17 00:00:00 2001
From: Thuan Vo <thvo@redhat.com>
Date: Wed, 25 Feb 2026 22:25:54 -0800
Subject: [PATCH 1/2] OCPBUGS-77355: fix wavelength zone name regex

The correct regex should check for segment "-wlz", which is common for
all "known" wavelength zones.

One example where the old regex "wl\d\-.*$" would fail is us-east-1-foe-wlz-1a.
---
 pkg/asset/installconfig/aws/permissions.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkg/asset/installconfig/aws/permissions.go b/pkg/asset/installconfig/aws/permissions.go
index 42734e1e34c..58f6a812d67 100644
--- a/pkg/asset/installconfig/aws/permissions.go
+++ b/pkg/asset/installconfig/aws/permissions.go
@@ -739,8 +739,9 @@ func includesAssumeRole(installConfig *types.InstallConfig) bool {
 }
 
 func includesWavelengthZones(installConfig *types.InstallConfig) bool {
-	// Examples of WL zones: us-east-1-wl1-atl-wlz-1, eu-west-2-wl1-lon-wlz-1, eu-west-2-wl2-man-wlz1 ...
-	isWLZoneRegex := regexp.MustCompile(`wl\d\-.*$`)
+	// Examples of WL zones: us-east-1-wl1-atl-wlz-1, eu-west-2-wl1-lon-wlz-1, eu-west-2-wl2-man-wlz-1, etc
+	// https://docs.aws.amazon.com/wavelength/latest/developerguide/available-wavelength-zones.html
+	isWLZoneRegex := regexp.MustCompile(`-wlz.*$`)
 
 	for _, mpool := range installConfig.Compute {
 		if mpool.Name != types.MachinePoolEdgeRoleName || mpool.Platform.AWS == nil {

From eb7fe6262cb57b59e6df1a20a6acb2ef6c1a0c05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=98=BF=E7=94=B7?= <l.weinan@gmail.com>
Date: Thu, 26 Feb 2026 18:41:19 +0800
Subject: [PATCH 2/2] Add unit tests for new Wavelength Zone format

Add comprehensive test coverage for OCPBUGS-77355 fix that updates
the Wavelength Zone detection regex from 'wl\d\-.*$' to '-wlz.*$'.

Test cases added:
- Test traditional format WL zones (us-west-2-wl1-sea-wlz-1)
- Test new format WL zones (us-east-1-foe-wlz-1a) - PRIMARY FIX
- Test mixed traditional and new format zones
- Test only new format zones

The new regex correctly identifies all Wavelength Zone formats that
contain the '-wlz' segment, including the new format zones that were
previously not recognized by the old 'wl\d\-' pattern.
---
 .../installconfig/aws/permissions_test.go     | 34 ++++++++++++++-----
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/pkg/asset/installconfig/aws/permissions_test.go b/pkg/asset/installconfig/aws/permissions_test.go
index 68f5a2fa096..6a5baaab011 100644
--- a/pkg/asset/installconfig/aws/permissions_test.go
+++ b/pkg/asset/installconfig/aws/permissions_test.go
@@ -878,17 +878,33 @@ func TestIncludesAssumeRole(t *testing.T) {
 
 func TestIncludesWavelengthZones(t *testing.T) {
 	t.Run("Should be true when edge compute specified with WL zones", func(t *testing.T) {
-		ic := validBYOSubnetsInstallConfig()
-		ic.Compute = append(ic.Compute, types.MachinePool{
-			Name: "edge",
-			Platform: types.MachinePoolPlatform{
-				AWS: &aws.MachinePool{
-					Zones: []string{"us-west-2-pdx-1a", "us-west-2-wl1-sea-wlz-1"},
+		t.Run("with common wavelength zone format", func(t *testing.T) {
+			ic := validBYOSubnetsInstallConfig()
+			ic.Compute = append(ic.Compute, types.MachinePool{
+				Name: "edge",
+				Platform: types.MachinePoolPlatform{
+					AWS: &aws.MachinePool{
+						Zones: []string{"us-west-2-pdx-1a", "us-west-2-wl1-sea-wlz-1"},
+					},
 				},
-			},
+			})
+			requiredPerms := RequiredPermissionGroups(ic)
+			assert.Contains(t, requiredPerms, PermissionCarrierGateway)
+		})
+		// OCPBUGS-77355: for example, us-east-1-foe-wlz-1a
+		t.Run("with irregular wavelength zone format", func(t *testing.T) {
+			ic := validBYOSubnetsInstallConfig()
+			ic.Compute = append(ic.Compute, types.MachinePool{
+				Name: "edge",
+				Platform: types.MachinePoolPlatform{
+					AWS: &aws.MachinePool{
+						Zones: []string{"us-west-2-pdx-1a", "us-east-1-foe-wlz-1a", "eu-west-3-cmn-wlz-1a"},
+					},
+				},
+			})
+			requiredPerms := RequiredPermissionGroups(ic)
+			assert.Contains(t, requiredPerms, PermissionCarrierGateway)
 		})
-		requiredPerms := RequiredPermissionGroups(ic)
-		assert.Contains(t, requiredPerms, PermissionCarrierGateway)
 	})
 	t.Run("Should be false when", func(t *testing.T) {
 		t.Run("edge compute specified without WL zones", func(t *testing.T) {