test: new positive E2E - reuse managed MIs within cluster by mvacula02 · Pull Request #6141 · Azure/ARO-HCP

mvacula02 · 2026-07-17T10:31:31Z

What

adding a new positive E2E test case that reuses managed identities within a cluster. The test assigns the same managed identity resource ID to two different control plane operators (ingress and cluster-api-azure) and verifies that cluster creation completes successfully.

removing validation that prevents MI reuse within cluster.

Depends on https://gitlab.cee.redhat.com/service/aro-hcp-clusters-service/-/merge_requests/401

Why

MI reuse within a cluster is a valid scenario. This test demonstrates that a cluster provisions successfully when two operators share the same managed identity, providing justification to remove the validateManagedIdentitiesUniqueWithinCluster validation added in ~~#6082~~ #6121

Testing

The PR adds an E2E test for existing feature.

PR Checklist

If E2E tests are included:

E2E tests follow Principles of Good E2E Test Case Design
If new E2E use case is covered (via a new test or new check/verifier),
demonstrate that the test is able to detect a defect/error and fail with
proper error message and logs which communicates nature of the problem.

openshift-ci · 2026-07-17T10:31:42Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

mvacula02 · 2026-07-17T11:02:18Z

/test ?

mvacula02 · 2026-07-17T11:25:45Z

/test integration-e2e-parallel

mvacula02 · 2026-07-17T11:25:49Z

/test stage-e2e-parallel

mvacula02 · 2026-07-17T12:19:01Z

/test integration-e2e-parallel

mvacula02 · 2026-07-17T13:30:51Z

/test e2e-parallel

mvacula02 · 2026-07-17T14:17:50Z

Status update 17-07-2026:

added E2E test
removed validation that rejects MI reuse
blocked until 6082 replaces CS functionality

Action Items:

validate once 6082 merges
modify validateManagedIdentitiesUniqueWithinCluster, L747-777 in validate_cluster.go (6082)
revert mustFilter
regenerate fixtures

Jakob Gray (JakobGray) · 2026-07-17T18:07:04Z

mvacula02 Just as a heads up, 6082 replicates the check done in CS, but doesn't remove it from CS. So that will likely need to happen for this to pass.

The validation: https://gitlab.cee.redhat.com/service/aro-hcp-clusters-service/-/blob/master/cmd/clusters-service/servecmd/apiserver/validation_helpers_aro_hcp.go#L149

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

mvacula02 · 2026-07-27T09:49:51Z

/hold until https://gitlab.cee.redhat.com/service/aro-hcp-clusters-service/-/merge_requests/401 is merged

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

mvacula02 · 2026-09-03T09:37:22Z

/test e2e-parallel

Copilot

🟡 Changes recommended

The new E2E test currently risks nil-pointer panics when dereferencing identity profile entries and should add explicit assertions to fail cleanly.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

internal/validation/validate_cluster_comprehensive_test.go:784

This test case now expects no validation errors, but the case name still says "duplicate managed identity…" which reads like a failure scenario. Rename the case to reflect that identity reuse is allowed to keep the test intent clear.

			}(),
			expectErrors: []utils.ExpectedError{},

Files reviewed: 23/23 changed files
Comments generated: 2
Review effort level: Lite

+			By("reusing the same managed identity for all control plane operators")
+			cpOps := clusterParams.UserAssignedIdentitiesProfile.ControlPlaneOperators
+			sharedMI := cpOps["cluster-api-azure"]
+			for name := range cpOps {
+				if name == "cluster-api-azure" {
+					continue
+				}
+				originalMI := *cpOps[name]
+				cpOps[name] = sharedMI
+				if originalMI != *sharedMI {
+					delete(clusterParams.Identity.UserAssignedIdentities, originalMI)
+				}
+			}


 			}(),
-			expectErrors: []utils.ExpectedError{
-				{Message: "must be unique within the cluster", FieldPath: "customerProperties.platform.operatorsAuthentication.userAssignedIdentities.dataPlaneOperators"},
-			},
+			expectErrors: []utils.ExpectedError{},


mvacula02 · 2026-09-03T13:38:35Z

/test e2e-parallel

mvacula02 · 2026-09-04T07:30:50Z

/test e2e-parallel

mvacula02 · 2026-09-07T07:28:00Z

/test e2e-parallel

openshift-ci · 2026-09-07T07:43:17Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mvacula02
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

follow-up for Azure#6082, adding new negative E2E test case reusing MIs within a cluster.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

mvacula02 · 2026-09-07T07:54:53Z

/test e2e-parallel

mvacula02 · 2026-09-07T08:59:49Z

/test e2e-parallel

mvacula02 · 2026-09-08T09:32:34Z

/test e2e-parallel

openshift-ci · 2026-09-08T11:06:18Z

mvacula02: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/stage-e2e-parallel	`f6f9ea8`	link	false	`/test stage-e2e-parallel`
ci/prow/integration-e2e-parallel	`680d27e`	link	false	`/test integration-e2e-parallel`
ci/prow/bicep-lint	`8d2fd84`	link	true	`/test bicep-lint`
ci/prow/e2e-parallel	`3f731a7`	link	true	`/test e2e-parallel`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci · 2026-09-14T09:43:33Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci Bot added the do-not-merge/work-in-progress label Jul 17, 2026

mvacula02 force-pushed the mvacula/cluster-mi-reuse branch from 6181b03 to 5552a3f Compare July 17, 2026 10:32

mvacula02 changed the title ~~test: new negative E2E - reuse managed MIs within cluster~~ test: new positive E2E - reuse managed MIs within cluster Jul 17, 2026

openshift-ci Bot added the needs-rebase label Jul 17, 2026

mvacula02 force-pushed the mvacula/cluster-mi-reuse branch from 06c6c0a to dd100ee Compare July 24, 2026 11:51

openshift-ci Bot removed the needs-rebase label Jul 24, 2026

mvacula02 marked this pull request as ready for review July 27, 2026 09:16

Copilot AI lite review requested due to automatic review settings July 27, 2026 09:16

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 27, 2026

openshift-ci Bot requested review from Matthew Barnes (mbarnes) and Mike Gahagan (mgahagan73) July 27, 2026 09:17

Copilot AI reviewed Jul 27, 2026

openshift-ci Bot added the do-not-merge/hold label Jul 27, 2026

Copilot AI review requested due to automatic review settings July 27, 2026 14:16

Copilot AI reviewed Jul 27, 2026

Mike Gahagan (mgahagan73) reviewed Jul 30, 2026

View reviewed changes

Comment thread test/e2e/cluster_create_mi_reuse.go

mvacula02 force-pushed the mvacula/cluster-mi-reuse branch from 4f15578 to 1372819 Compare July 31, 2026 11:59

Copilot AI review requested due to automatic review settings July 31, 2026 11:59

Copilot AI reviewed Jul 31, 2026

openshift-ci Bot added the needs-rebase label Aug 3, 2026

mvacula02 force-pushed the mvacula/cluster-mi-reuse branch from 1372819 to bdf64ac Compare August 4, 2026 11:15

Copilot started reviewing on behalf of mvacula02 September 3, 2026 09:33 View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

openshift-ci Bot added needs-rebase and removed needs-rebase labels Sep 7, 2026

openshift-ci Bot added the needs-rebase label Sep 7, 2026

mvacula02 and others added 12 commits September 7, 2026 09:51

test: new negative E2E - reuse managed MIs within cluster

28cb845

follow-up for Azure#6082, adding new negative E2E test case reusing MIs within a cluster.

restructure as a positive test case

cdc3075

mustFilter

47847b9

fix experimental flag

e1e4bdc

remove MI reuse rejection validation

9ea10f0

restore temp tag, fix unit test

7736f65

rebase, update fixtures, remove MustFilter

89baf89

fix integration test

077c90a

chore: regenerate test suite fixtures after rebase

0038dd6

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

change test to reuse MI for all CPOs within cluster

d0efa3a

address copilot concern about in-use MI deletion

77706f1

temp: MustFilter and custom CS image testing

3f731a7

mvacula02 force-pushed the mvacula/cluster-mi-reuse branch from a86f006 to 3f731a7 Compare September 7, 2026 07:54

openshift-ci Bot removed the needs-rebase label Sep 7, 2026

openshift-ci Bot added the needs-rebase label Sep 14, 2026

Uh oh!

Conversation

mvacula02 commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Testing

PR Checklist

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

mvacula02 commented Jul 17, 2026

Uh oh!

mvacula02 commented Jul 17, 2026

Uh oh!

mvacula02 commented Jul 17, 2026

Uh oh!

mvacula02 commented Jul 17, 2026

Uh oh!

mvacula02 commented Jul 17, 2026

Uh oh!

mvacula02 commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Jakob Gray (JakobGray) commented Jul 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

mvacula02 commented Jul 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

mvacula02 commented Sep 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

mvacula02 commented Sep 3, 2026

Uh oh!

mvacula02 commented Sep 4, 2026

Uh oh!

mvacula02 commented Sep 7, 2026

Uh oh!

openshift-ci Bot commented Sep 7, 2026

Uh oh!

mvacula02 commented Sep 7, 2026

Uh oh!

mvacula02 commented Sep 7, 2026

Uh oh!

mvacula02 commented Sep 8, 2026

Uh oh!

openshift-ci Bot commented Sep 8, 2026

Uh oh!

openshift-ci Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mvacula02 commented Jul 17, 2026 •

edited

Loading

mvacula02 commented Jul 17, 2026 •

edited

Loading