NO-JIRA: test Claude Code WIF auth in GitHub Actions - #359
Closed
bryan-cox wants to merge 22 commits into
Closed
Conversation
The ValidateKubeAPIServerAllowedCIDRs test fails on v2 Azure self-managed clusters because KAS uses Route publishing strategy (via external-dns-domain), not LoadBalancer. Two fixes: 1. Wait for the downstream LB service (router or KAS LB) to have its LoadBalancerSourceRanges updated by the CPO before asserting KAS reachability. The target service is determined by the HC's APIServer publishing strategy. 2. Create a fresh kubeclient per poll iteration to prevent HTTP/2 connection reuse. Go's HTTP/2 transport multiplexes all requests over a single persistent TCP connection — if a prior request succeeded before Azure NSG rules took effect, subsequent requests bypass the restriction on the same connection. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add validateExternalDNSDomain() that detects when the external DNS domain would shadow *.apps.<name>.<baseDomain> resolution, causing TLS certificate mismatches via the Two Routers Problem. The check runs during `hypershift create cluster azure` validation. Signed-off-by: Bryan Cox <brcox@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)
…service hostnames Add webhook validation that rejects HostedCluster creation when any service hostname would shadow the cluster apps domain (*.apps.<name>. <baseDomain>). This prevents the Two Routers Problem where the PE IP routes to private-router (HAProxy) instead of router-default, causing TLS cert mismatches for apps traffic. Signed-off-by: Bryan Cox <brcox@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)
…shadows cluster domain Add shadowing detection guard in reconcileBaseDomainDNS() that sets a BaseDomainShadowsClusterDomain degraded condition and skips *.apps wildcard creation when the base domain zone would shadow cluster DNS. This is defense-in-depth for pre-existing misconfigured clusters that bypass the webhook. Signed-off-by: Bryan Cox <brcox@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)
Expand Azure private cluster docs to explain why externalDNSDomain must not overlap with the cluster apps domain. Document the Two Routers Problem (PE IP routes to HAProxy, not router-default) and why the controller cannot self-heal (data-plane IP not discoverable). Signed-off-by: Bryan Cox <brcox@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1. - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.19.0...v5.19.1) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…c in request overrides The resource-request-override annotation only sets requests, but extended resources like aro.openshift.io/swift-nic require limits equal to requests. The API server rejects pods where an extended resource has a request without a matching limit. When the override includes aro.openshift.io/swift-nic, automatically set the limit to the same value as the request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The enterprise contract check requires the prefetch-dependencies-oci-ta task to have enable-package-registry-proxy set to true. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update 38 Tekton task bundle references across pipeline files to their latest versions, including 3 version bumps and 32 digest-only updates. Version bumps: - build-image-index: 0.2 -> 0.3 (removed deprecated COMMIT_SHA and IMAGE_EXPIRES_AFTER params per migration notes) - clamav-scan: 0.3 -> 0.3.1 - rpms-signature-scan: 0.2 -> 0.2.1 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
NO-JIRA: Update Konflux Tekton task bundles
…s/hack/tools/github.com/go-git/go-git/v5-5.19.1 NO-JIRA: build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /hack/tools
quay.io/hypershift/sleep:multiarch is a private image that requires auth not available in CI pull secrets, causing ImagePullBackOff. Use registry.access.redhat.com/ubi10/ubi-minimal:10.1 which is public and multi-arch. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Max Cao <macao@redhat.com>
CNTRLPLANE-3371: Fix AllowedCIDRs e2e test for Route-based KAS
…alidation OCPBUGS-85351: fix(azure): prevent externalDNSDomain from shadowing cluster apps domain
Update logic of CertificateRevocationController to request a requeue when encountering stale total-client-ca bundle cache.
…it-override OCPBUGS-86238: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift
NO-JIRA: fix(e2e): use public multi-arch image for ARM64 karpenter test
Point GOCACHE at the read-only EFS mount (/cache/go-build) instead of copying the entire cache into /tmp at job start. Go's build cache handles read-only directories gracefully by skipping writes. This eliminates the per-job cp -a overhead that was adding ~2 minutes to every CI job since the EFS cache was introduced. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the per-job `cp -a` of the entire EFS cache with a fuse-overlayfs mount. This gives Go a writable view over the read-only EFS PVC with zero copy overhead — reads hit the EFS mount directly and writes go to a tmpfs upper layer. Falls back to `cp -a` if fuse-overlayfs or /dev/fuse is unavailable, and to an empty cache if both fail. Adds fuse-overlayfs to the runner image. On OpenShift 4.15+ /dev/fuse is available to unprivileged pods without cluster config changes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ache-directly CNTRLPLANE-3329: Use fuse-overlayfs for build cache instead of full copy
…ondition_ca_bundle OCPBUGS-86310: Handle CA bundle aggregation delay by requeuing revocation
bryan-cox
force-pushed
the
test-arc-runners
branch
from
May 26, 2026 18:23
690af6c to
3d3a94c
Compare
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bryan-cox
force-pushed
the
test-arc-runners
branch
from
May 26, 2026 18:37
3d3a94c to
20e6157
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
🤖 Generated with Claude Code