[release-4.22] OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS by twolff-gh · Pull Request #8865 · openshift/hypershift

twolff-gh · 2026-06-29T23:29:50Z

What this PR does / why we need it:

Backports #8472 to release-4.22. Adds ACR pull identity support to worker cloud.conf and VMSS so kubelet's ACR credential provider can authenticate to Azure Container Registry using a managed identity instead of image pull secrets.
Also backports #8840 (ACR pull identity configured metric) and #8946 (gate cloud config on hash to prevent serving stale content).

Backports #8946 to release-4.22. Gates ignition server cloud config serving on a content hash so kubelet only re-fetches when the config actually changes, preventing stale credential provider configuration.

Backports #8840 to release-4.22. Adds a metric to report whether ACR pull identity is configured on hosted clusters, enabling alerting and dashboard visibility for the feature rollout.

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/OCPBUGS-86616
Fixes https://redhat.atlassian.net/browse/OCPBUGS-94518

Special notes for your reviewer:

Not a clean cherry-pick. Two conflicts resolved:

control-plane-operator/.../azure/config_test.go: k8sutil.SerializeResource → util.SerializeResource (the util → k8sutil rename from PR CNTRLPLANE-3343: Extract support/k8sutil package from support/util #8396 was never backported to release-4.22)
api/hypershift/v1beta1/hostedcluster_types.go and hosted_controlplane.go: git silently carried over the AutoNode/KarpenterConfig/KarpenterAWSConfig pointer→struct type changes from main. Reverted to pointers and regenerated deepcopy to match release-4.22.

Two additional commits added per reviewer guidance:

PR ARO-27360: Add ACR pull identity configured metric #8840 (metric): Adapted for release-4.22 monolithic metrics Collect() — main has decomposed per-cluster helpers.
PR ARO-24037: gate cloud config on hash to prevent serving stale content #8946 (cloud config hash gating): Adapted for release-4.22 ignition server structure — osStream parameter omitted (CNTRLPLANE-3553 not on 4.22), k8sutil → supportutil, hashing inlined with existing HashSimple instead of adding HashConfigMapData to support/util.

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-merge-bot · 2026-06-29T23:29:52Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci · 2026-06-29T23:29:54Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-06-29T23:29:58Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 74879ac2-0b8f-4153-be20-f062ba8ecb24

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-06-29T23:44:22Z

Codecov Report

❌ Patch coverage is 77.84431% with 37 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.32%. Comparing base (fb3b1a3) to head (b7af8eb).
⚠️ Report is 22 commits behind head on release-4.22.

Files with missing lines	Patch %	Lines
...ition-server/controllers/local_ignitionprovider.go	72.09%	9 Missing and 3 partials ⚠️
...ition-server/controllers/tokensecret_controller.go	73.33%	5 Missing and 3 partials ⚠️
...erator/controllers/nodepool/nodepool_controller.go	74.07%	6 Missing and 1 partial ⚠️
hypershift-operator/controllers/nodepool/azure.go	80.00%	2 Missing and 1 partial ⚠️
hypershift-operator/controllers/nodepool/config.go	90.00%	2 Missing and 1 partial ⚠️
hypershift-operator/controllers/nodepool/token.go	57.14%	2 Missing and 1 partial ⚠️
ignition-server/cmd/run_local_ignitionprovider.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##           release-4.22    #8865      +/-   ##
================================================
+ Coverage         35.89%   36.32%   +0.43%     
================================================
  Files               774      774              
  Lines             94808    95013     +205     
================================================
+ Hits              34027    34516     +489     
+ Misses            57998    57672     -326     
- Partials           2783     2825      +42

Files with missing lines	Coverage Δ
...lplane/v2/cloud_controller_manager/azure/config.go	`68.10% <100.00%> (+6.15%)`	⬆️
...rator/controllers/hostedcluster/metrics/metrics.go	`92.57% <100.00%> (+0.24%)`	⬆️
ignition-server/controllers/cache.go	`100.00% <ø> (ø)`
ignition-server/cmd/run_local_ignitionprovider.go	`0.00% <0.00%> (ø)`
hypershift-operator/controllers/nodepool/azure.go	`89.70% <80.00%> (-0.88%)`	⬇️
hypershift-operator/controllers/nodepool/config.go	`85.94% <90.00%> (+0.55%)`	⬆️
hypershift-operator/controllers/nodepool/token.go	`81.98% <57.14%> (-0.56%)`	⬇️
...erator/controllers/nodepool/nodepool_controller.go	`40.87% <74.07%> (+1.29%)`	⬆️
...ition-server/controllers/tokensecret_controller.go	`67.70% <73.33%> (+8.68%)`	⬆️
...ition-server/controllers/local_ignitionprovider.go	`15.81% <72.09%> (+3.99%)`	⬆️

... and 11 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

celebdor · 2026-06-30T22:17:29Z

/jira cherry-pick OCPBUGS-86616

openshift-ci-robot · 2026-06-30T22:18:39Z

@celebdor: Jira Issue OCPBUGS-86616 has been cloned as Jira Issue OCPBUGS-94518. Will retitle bug to link to clone.
/retitle OCPBUGS-94518: Cherry pick 8472 to release 4.22

Details

In response to this:

/jira cherry-pick OCPBUGS-86616

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-06-30T22:18:48Z

@twolff-gh: This pull request references Jira Issue OCPBUGS-94518, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Backports #8472 to release-4.22. Adds ACR pull identity support to worker cloud.conf and VMSS so kubelet's ACR credential provider can authenticate to Azure Container Registry using a managed identity instead of image pull secrets.

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/OCPBUGS-86616

Special notes for your reviewer:

Not a clean cherry-pick. Two conflicts resolved:

control-plane-operator/.../azure/config_test.go: k8sutil.SerializeResource → util.SerializeResource (the util → k8sutil rename from PR CNTRLPLANE-3343: Extract support/k8sutil package from support/util #8396 was never backported to release-4.22)

api/hypershift/v1beta1/hostedcluster_types.go and hosted_controlplane.go: git silently carried over the AutoNode/KarpenterConfig/KarpenterAWSConfig pointer→struct type changes from main. Reverted to pointers and regenerated deepcopy to match release-4.22.

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

celebdor · 2026-06-30T22:25:37Z

/jira refresh

openshift-ci-robot · 2026-06-30T22:25:45Z

@celebdor: This pull request references Jira Issue OCPBUGS-94518, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-86616 is in the state Verified, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-86616 targets the "5.0.0" version, which is one of the valid target versions: 5.0.0
bug has dependents

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

enxebre · 2026-07-01T10:13:05Z

Are both things the vm attachment and the cloud config propagated as a file for the payload generation needed for kubelet ACR pull to work?

If the premise above is true, current implementation doesn't guarantee the latter. Changes to the cloud config do not result in new payload generation and propagation to nodes disk. This might be a good candidate for https://redhat.atlassian.net/browse/OCPSTRAT-3299. With current code you'd get what you want for:

New nodePools
Existing nodePools if the cloud config doesn't change day 2
Existing nodepools if the cloud config change day 2 and something triggers a payload token regeneration

You don't get cloud config day2 changes alone propagated to the nodes disk

twolff-gh · 2026-07-23T18:39:46Z

/test e2e-aks-4-21
/test e2e-aws-4-21
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

twolff-gh · 2026-07-23T21:15:13Z

/test e2e-aks-4-21
/test e2e-aws-upgrade-hypershift-operator

twolff-gh · 2026-07-27T14:38:42Z

@jparrill Whenever you get a chance to approve, its ready for another review

Dropped a comment. Thanks!

jparrill · 2026-07-27T15:33:21Z

Thanks for addressing the omitzero on kms — confirmed it's no longer in the diff. 👍

One observation from comparing against the originals on main (#8472, #8840, #8946):

The HashConfigMapData() utility from #8946 wasn't backported (understandable since release-4.22 doesn't have it either), and the hashing logic is inlined in config.go:GetCloudConfigHash() and local_ignitionprovider.go:GetPayload() instead — functionally equivalent, so that's fine.

However, local_ignitionprovider_test.go changes from #8946 are missing in this backport. Specifically, the test cases that cover:

Cloud config hash match (should write cloud config file)
Cloud config hash mismatch (should return an error)

These tests exist in the original PR and cover the hash-gating logic added in GetPayload(). Would be good to include them for parity, even if the utility function itself stays inlined.

Not a blocker — the rest looks clean.

…o prevent serving stale content Backport of PR openshift#8946 (946d0f9, 077d180) from main, adapted for release-4.22. Hashing uses existing HashSimple inlined at call sites instead of adding HashConfigMapData to support/util. No osStream parameter (CNTRLPLANE-3553 not on this branch). Extracts writeCloudProviderConfig from GetPayload for testability and adds TestWriteCloudProviderConfig covering hash match, mismatch, missing configmap, and non-cloud provider paths. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

jparrill · 2026-07-28T15:17:49Z

/approve

jparrill · 2026-07-28T15:18:02Z

/label acknowledge-critical-fixes-only

bryan-cox

Several files are here that are not in the PR this backport was created from :

hypershift-operator/controllers/hostedcluster/metrics/metrics.go
hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go
hypershift-operator/controllers/nodepool/config.go
hypershift-operator/controllers/nodepool/config_test.go
hypershift-operator/controllers/nodepool/nodepool_controller.go
hypershift-operator/controllers/nodepool/nodepool_controller_test.go
hypershift-operator/controllers/nodepool/token.go
hypershift-operator/controllers/nodepool/token_test.go
ignition-server/cmd/run_local_ignitionprovider.go
ignition-server/controllers/cache.go
ignition-server/controllers/local_ignitionprovider.go
ignition-server/controllers/local_ignitionprovider_test.go
ignition-server/controllers/tokensecret_controller.go
ignition-server/controllers/tokensecret_controller_test.go

bryan-cox · 2026-07-31T15:40:00Z

/lgtm

openshift-merge-bot · 2026-07-31T15:44:12Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-21
/test e2e-aws-4-21
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

openshift-ci · 2026-07-31T15:44:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, JoelSpeed, jparrill, twolff-gh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox,jparrill]
~~api/OWNERS~~ [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

twolff-gh · 2026-07-31T21:05:33Z

/test e2e-aws

machi1990 · 2026-08-03T13:44:43Z

/verified by @machi1990

Verified using the CPO image: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/control-plane-operator-4-22:b7af8ebd065698241c44da905e3f17c09915e81c

The openshift-config cloud provider config, looks good to as expected

oc get cm -n openshift-config cloud-provider-config -o yaml                                     
apiVersion: v1
data:
  config: |-
    {
      "cloud": "AzurePublicCloud",
      "tenantId": "<redacted>",
      "useManagedIdentityExtension": true,
      "useFederatedWorkloadIdentityExtension": false,
      "subscriptionId": "<redacted>",
      "aadClientId": "",
      "aadClientSecret": "",
      "aadClientCertPath": "",
      "aadFederatedTokenFile": "",
      "aadMSIDataPlaneIdentityPath": "",
      "resourceGroup": "e2e_tests_mrg_namek8qdp",
      "location": "westus3",
      "vnetName": "pr-check-e2e-tests-vnet-pwxtk",
      "vnetResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
      "subnetName": "pr-check-e2e-tests-subnet-9jdqt",
      "securityGroupName": "pr-check-e2e-tests-nsg-twhkf",
      "securityGroupResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
      "routeTableName": "",
      "cloudProviderBackoff": true,
      "cloudProviderBackoffDuration": 6,
      "useInstanceMetadata": true,
      "loadBalancerSku": "standard",
      "disableOutboundSNAT": true,
      "loadBalancerName": "2rv3s5ufmri0blr6r3atc3bp0sjng5qf",
      "clusterServiceLoadBalancerHealthProbeMode": "shared",
      "userAssignedIdentityID": "/subscriptions/<redacted>/resourcegroups/pr-check-e2e-tests-resource-group-smckk/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-acr-pull-mi-cqn7r"
    }
kind: ConfigMap
metadata:
  creationTimestamp: "2026-08-03T12:44:38Z"
  labels:
    hypershift.openshift.io/managed: "true"
  name: cloud-provider-config
  namespace: openshift-config
  resourceVersion: "1643"
  uid: 07da476f-7c7f-47e6-9359-1c121e4244b7

The worker.conf lgtm

root@cs-ci-mzdjg-np-acr-d6nr9-2pdcz-wj8j5:/# cat /host/etc/kubernetes/cloud.conf 
{
  "cloud": "AzurePublicCloud",
  "tenantId": "<redacted>",
  "useManagedIdentityExtension": true,
  "useFederatedWorkloadIdentityExtension": false,
  "subscriptionId": "<redacted>",
  "aadClientId": "",
  "aadClientSecret": "",
  "aadClientCertPath": "",
  "aadFederatedTokenFile": "",
  "aadMSIDataPlaneIdentityPath": "",
  "resourceGroup": "e2e_tests_mrg_namek8qdp",
  "location": "westus3",
  "vnetName": "pr-check-e2e-tests-vnet-pwxtk",
  "vnetResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
  "subnetName": "pr-check-e2e-tests-subnet-9jdqt",
  "securityGroupName": "pr-check-e2e-tests-nsg-twhkf",
  "securityGroupResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
  "routeTableName": "",
  "cloudProviderBackoff": true,
  "cloudProviderBackoffDuration": 6,
  "useInstanceMetadata": true,
  "loadBalancerSku": "standard",
  "disableOutboundSNAT": true,
  "loadBalancerName": "2rv3s5ufmri0blr6r3atc3bp0sjng5qf",
  "clusterServiceLoadBalancerHealthProbeMode": "shared",
  "userAssignedIdentityID": "/subscriptions/<redacted>/resourcegroups/pr-check-e2e-tests-resource-group-smckk/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-acr-pull-mi-cqn7r"
}

And the VM has the identity attached

"identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
            "/subscriptions/<redacted>/resourcegroups/pr-check-e2e-tests-resource-group-smckk/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-acr-pull-mi-cqn7r": {
                "principalId": "5c8416e8-22a1-4d2a-9356-b2eb85a72189",
                "clientId": "9f0f8c55-98fe-47af-867d-50cf7721ee92"
            }
        }
    },

openshift-ci-robot · 2026-08-03T13:44:58Z

@machi1990: This PR has been marked as verified by @machi1990.

Details

In response to this:

/verified by @machi1990

Verified using the CPO image: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/control-plane-operator-4-22:b7af8ebd065698241c44da905e3f17c09915e81c

The openshift-config cloud provider config, looks good to as expected

oc get cm -n openshift-config cloud-provider-config -o yaml                                     
apiVersion: v1
data:
 config: |-
   {
     "cloud": "AzurePublicCloud",
     "tenantId": "64dc69e4-d083-49fc-9569-ebece1dd1408",
     "useManagedIdentityExtension": true,
     "useFederatedWorkloadIdentityExtension": false,
     "subscriptionId": "1d3378d3-5a3f-4712-85a1-2485495dfc4b",
     "aadClientId": "",
     "aadClientSecret": "",
     "aadClientCertPath": "",
     "aadFederatedTokenFile": "",
     "aadMSIDataPlaneIdentityPath": "",
     "resourceGroup": "e2e_tests_mrg_namek8qdp",
     "location": "westus3",
     "vnetName": "pr-check-e2e-tests-vnet-pwxtk",
     "vnetResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
     "subnetName": "pr-check-e2e-tests-subnet-9jdqt",
     "securityGroupName": "pr-check-e2e-tests-nsg-twhkf",
     "securityGroupResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
     "routeTableName": "",
     "cloudProviderBackoff": true,
     "cloudProviderBackoffDuration": 6,
     "useInstanceMetadata": true,
     "loadBalancerSku": "standard",
     "disableOutboundSNAT": true,
     "loadBalancerName": "2rv3s5ufmri0blr6r3atc3bp0sjng5qf",
     "clusterServiceLoadBalancerHealthProbeMode": "shared",
     "userAssignedIdentityID": "/subscriptions/1d3378d3-5a3f-4712-85a1-2485495dfc4b/resourcegroups/pr-check-e2e-tests-resource-group-smckk/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-acr-pull-mi-cqn7r"
   }
kind: ConfigMap
metadata:
 creationTimestamp: "2026-08-03T12:44:38Z"
 labels:
   hypershift.openshift.io/managed: "true"
 name: cloud-provider-config
 namespace: openshift-config
 resourceVersion: "1643"
 uid: 07da476f-7c7f-47e6-9359-1c121e4244b7

The worker.conf lgtm

root@cs-ci-mzdjg-np-acr-d6nr9-2pdcz-wj8j5:/# cat /host/etc/kubernetes/cloud.conf 
{
 "cloud": "AzurePublicCloud",
 "tenantId": "64dc69e4-d083-49fc-9569-ebece1dd1408",
 "useManagedIdentityExtension": true,
 "useFederatedWorkloadIdentityExtension": false,
 "subscriptionId": "1d3378d3-5a3f-4712-85a1-2485495dfc4b",
 "aadClientId": "",
 "aadClientSecret": "",
 "aadClientCertPath": "",
 "aadFederatedTokenFile": "",
 "aadMSIDataPlaneIdentityPath": "",
 "resourceGroup": "e2e_tests_mrg_namek8qdp",
 "location": "westus3",
 "vnetName": "pr-check-e2e-tests-vnet-pwxtk",
 "vnetResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
 "subnetName": "pr-check-e2e-tests-subnet-9jdqt",
 "securityGroupName": "pr-check-e2e-tests-nsg-twhkf",
 "securityGroupResourceGroup": "pr-check-e2e-tests-resource-group-smckk",
 "routeTableName": "",
 "cloudProviderBackoff": true,
 "cloudProviderBackoffDuration": 6,
 "useInstanceMetadata": true,
 "loadBalancerSku": "standard",
 "disableOutboundSNAT": true,
 "loadBalancerName": "2rv3s5ufmri0blr6r3atc3bp0sjng5qf",
 "clusterServiceLoadBalancerHealthProbeMode": "shared",
 "userAssignedIdentityID": "/subscriptions/1d3378d3-5a3f-4712-85a1-2485495dfc4b/resourcegroups/pr-check-e2e-tests-resource-group-smckk/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-acr-pull-mi-cqn7r"
}

And the VM has the identity attached

"identity": {
       "type": "UserAssigned",
       "userAssignedIdentities": {
           "/subscriptions/1d3378d3-5a3f-4712-85a1-2485495dfc4b/resourcegroups/pr-check-e2e-tests-resource-group-smckk/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-acr-pull-mi-cqn7r": {
               "principalId": "5c8416e8-22a1-4d2a-9356-b2eb85a72189",
               "clientId": "9f0f8c55-98fe-47af-867d-50cf7721ee92"
           }
       }
   },

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-03T14:07:16Z

@twolff-gh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-08-03T14:10:20Z

@twolff-gh: Jira Issue Verification Checks: Jira Issue OCPBUGS-94518
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-94518 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

What this PR does / why we need it:

Backports #8472 to release-4.22. Adds ACR pull identity support to worker cloud.conf and VMSS so kubelet's ACR credential provider can authenticate to Azure Container Registry using a managed identity instead of image pull secrets.
Also backports #8840 (ACR pull identity configured metric) and #8946 (gate cloud config on hash to prevent serving stale content).

Backports #8946 to release-4.22. Gates ignition server cloud config serving on a content hash so kubelet only re-fetches when the config actually changes, preventing stale credential provider configuration.

Backports #8840 to release-4.22. Adds a metric to report whether ACR pull identity is configured on hosted clusters, enabling alerting and dashboard visibility for the feature rollout.

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/OCPBUGS-86616
Fixes https://redhat.atlassian.net/browse/OCPBUGS-94518

Special notes for your reviewer:

Not a clean cherry-pick. Two conflicts resolved:

control-plane-operator/.../azure/config_test.go: k8sutil.SerializeResource → util.SerializeResource (the util → k8sutil rename from PR CNTRLPLANE-3343: Extract support/k8sutil package from support/util #8396 was never backported to release-4.22)

api/hypershift/v1beta1/hostedcluster_types.go and hosted_controlplane.go: git silently carried over the AutoNode/KarpenterConfig/KarpenterAWSConfig pointer→struct type changes from main. Reverted to pointers and regenerated deepcopy to match release-4.22.

Two additional commits added per reviewer guidance:

PR ARO-27360: Add ACR pull identity configured metric #8840 (metric): Adapted for release-4.22 monolithic metrics Collect() — main has decomposed per-cluster helpers.

PR ARO-24037: gate cloud config on hash to prevent serving stale content #8946 (cloud config hash gating): Adapted for release-4.22 ignition server structure — osStream parameter omitted (CNTRLPLANE-3553 not on 4.22), k8sutil → supportutil, hashing inlined with existing HashSimple instead of adding HashConfigMapData to support/util.

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2026-08-05T10:48:45Z

Fix included in release 4.22.0-0.nightly-2026-08-05-022950

Update azure CPO image overrides to include recent backports: - 4.20.0-4.20.32: PR #9055 (cherry-pick to release-4.20) Supersedes OCPBUGS-86567 image; extends range from 4.20.24 to 4.20.32. - 4.21.0-4.21.27: PR #9054 (cherry-pick to release-4.21) Supersedes OCPBUGS-86416 image; extends range from 4.21.18 to 4.21.27. - 4.22.0-4.22.8: PR #8865 (cherry-pick to release-4.22) Supersedes CNTRLPLANE-3619/3656/OCPBUGS-98627/98220 image; extends range from 4.22.6 to 4.22.8. All new images are verified to contain the previously overridden fixes. Next z-streams (4.20.33, 4.21.28, 4.22.9) do not need overrides: all PRs merged before their development cutoffs (2026-08-05). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 29, 2026

twolff-gh force-pushed the cherry-pick-8472-to-release-4.22 branch from e4513ac to 68f3b24 Compare June 30, 2026 14:42

twolff-gh marked this pull request as ready for review June 30, 2026 20:15

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 30, 2026

openshift-ci Bot requested review from devguyio and muraee June 30, 2026 20:16

openshift-ci Bot changed the title ~~Cherry pick 8472 to release 4.22~~ OCPBUGS-94518: Cherry pick 8472 to release 4.22 Jun 30, 2026

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 30, 2026

celebdor changed the title ~~OCPBUGS-94518: Cherry pick 8472 to release 4.22~~ [release-4.22] OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS Jun 30, 2026

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 30, 2026

twolff-gh force-pushed the cherry-pick-8472-to-release-4.22 branch from 00ba333 to c180cce Compare July 23, 2026 18:18

twolff-gh requested a review from jparrill July 23, 2026 19:06

twolff-gh force-pushed the cherry-pick-8472-to-release-4.22 branch from c180cce to b7af8eb Compare July 27, 2026 20:44

openshift-ci Bot added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Jul 28, 2026

csrwng added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jul 28, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2026

bryan-cox reviewed Jul 31, 2026

View reviewed changes

bryan-cox approved these changes Jul 31, 2026

View reviewed changes

openshift-ci Bot assigned bryan-cox Jul 31, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 3, 2026

openshift-merge-bot Bot merged commit 41cbcdf into openshift:release-4.22 Aug 3, 2026
37 checks passed

celebdor mentioned this pull request Aug 3, 2026

CNTRLPLANE-3874,CNTRLPLANE-3873,OCPBUGS-94518: update azure CPO overrides for 4.20, 4.21, 4.22 #9211

Merged

5 tasks

Uh oh!

Conversation

twolff-gh commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-merge-bot Bot commented Jun 29, 2026

Uh oh!

openshift-ci Bot commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codecov Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

celebdor commented Jun 30, 2026

Uh oh!

openshift-ci-robot commented Jun 30, 2026

Uh oh!

openshift-ci-robot commented Jun 30, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

celebdor commented Jun 30, 2026

Uh oh!

openshift-ci-robot commented Jun 30, 2026

Uh oh!

enxebre commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

twolff-gh commented Jul 23, 2026

Uh oh!

twolff-gh commented Jul 23, 2026

Uh oh!

twolff-gh commented Jul 27, 2026

Uh oh!

jparrill commented Jul 27, 2026

Uh oh!

jparrill commented Jul 28, 2026

Uh oh!

jparrill commented Jul 28, 2026

Uh oh!

bryan-cox left a comment

Choose a reason for hiding this comment

Uh oh!

bryan-cox commented Jul 31, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

twolff-gh commented Jul 31, 2026

Uh oh!

machi1990 commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Aug 3, 2026

Uh oh!

openshift-ci Bot commented Aug 3, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Aug 3, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-merge-robot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

twolff-gh commented Jun 29, 2026 •

edited

Loading

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading

codecov Bot commented Jun 29, 2026 •

edited

Loading

enxebre commented Jul 1, 2026 •

edited

Loading

machi1990 commented Aug 3, 2026 •

edited

Loading