CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure by enxebre · Pull Request #6328 · openshift/hypershift

enxebre · 2025-06-27T11:33:49Z

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci · 2025-06-27T11:33:54Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

enxebre · 2025-06-27T11:33:57Z

/test e2e-aks

openshift-ci · 2025-06-27T11:34:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bryan-cox · 2025-06-27T11:34:54Z

 	t.Run("EnsureNetworkPolicies", func(t *testing.T) {
-		if hostedCluster.Spec.Platform.Type != hyperv1.AWSPlatform {
+		if hostedCluster.Spec.Platform.Type != hyperv1.AWSPlatform && hostedCluster.Spec.Platform.Type != hyperv1.AzurePlatform {
 			t.Skipf("test only supported on AWS platform, saw %s", hostedCluster.Spec.Platform.Type)


This needs updated

cwbotbot · 2025-06-27T13:30:02Z

Test Results

e2e-aks

Status: ❌ FAIL
Started: 2025-07-01T11:32:45Z
View Job
View Job History

Failed Tests

Total failed tests: 17

TestAzureScheduler
TestAzureScheduler/EnsureHostedCluster
TestAzureScheduler/EnsureHostedCluster/EnsureNetworkPolicies
TestAzureScheduler/EnsureHostedCluster/EnsureNetworkPolicies/EnsureLimitedEgressTrafficToManagementKAS
TestCreateCluster

... and 12 more failed tests

enxebre · 2025-06-30T10:48:25Z

/test e2e-aks

bryan-cox · 2025-06-30T12:46:58Z

 	"cloud-controller-manager",
 	"olm-collect-profiles",
 	"aws-ebs-csi-driver-operator",
+	"azure-disk-csi-driver-operator",


Confirmed with Jan Safranek this needed access to the management KAS here.

enxebre · 2025-07-01T11:32:18Z

/test e2e-aks

openshift-ci-robot · 2025-07-03T11:41:04Z

@enxebre: This pull request references CNTRLPLANE-1042 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.20.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bryan-cox · 2025-07-03T12:54:39Z

/test e2e-aks

bryan-cox · 2025-09-04T17:28:58Z

/test verify
/test e2e-aks

openshift-merge-robot · 2025-12-15T22:23:51Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2025-12-15T22:23:55Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-05-11T18:15:00Z

@enxebre: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-upgrade-hypershift-operator	`88deed6`	link	true	`/test e2e-aws-upgrade-hypershift-operator`
ci/prow/e2e-aws	`88deed6`	link	true	`/test e2e-aws`
ci/prow/e2e-kubevirt-aws-ovn-reduced	`88deed6`	link	true	`/test e2e-kubevirt-aws-ovn-reduced`
ci/prow/e2e-aks-4-20	`88deed6`	link	true	`/test e2e-aks-4-20`
ci/prow/e2e-aks	`88deed6`	link	true	`/test e2e-aks`
ci/prow/e2e-aws-4-20	`88deed6`	link	true	`/test e2e-aws-4-20`
ci/prow/verify	`88deed6`	link	true	`/test verify`
ci/prow/e2e-aks-4-21	`88deed6`	link	true	`/test e2e-aks-4-21`
ci/prow/e2e-aws-4-21	`88deed6`	link	true	`/test e2e-aws-4-21`
ci/prow/e2e-azure-self-managed	`88deed6`	link	true	`/test e2e-azure-self-managed`
ci/prow/unit	`88deed6`	link	true	`/test unit`
ci/prow/verify-workflows	`88deed6`	link	true	`/test verify-workflows`
ci/prow/security	`88deed6`	link	true	`/test security`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci · 2026-06-11T09:30:25Z

Stale PRs are closed after 21d of inactivity.

If this PR is still relevant, comment to refresh it or remove the stale label.
Mark the PR as fresh by commenting /remove-lifecycle stale.

If this PR is safe to close now please do so with /close.

/lifecycle stale

openshift-ci · 2026-06-25T10:01:12Z

Stale PRs rot after 14d of inactivity.

Mark the PR as fresh by commenting /remove-lifecycle rotten.
Rotten PRs close after an additional 7d of inactivity.

If this PR is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

hypershift-jira-solve-ci · 2026-06-25T10:40:11Z

Now I have all the information needed. Let me compile the final report.

Test Failure Analysis Complete

Job Information

Prow Jobs: All 7 CI jobs on PR CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure #6328
PR: [CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure #6328 — CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure](CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure #6328)
Branch: run-EnsureNetworkPolicies-on-azure
PR State: Draft, CONFLICTING, labels: needs-rebase, lifecycle/rotten, do-not-merge/work-in-progress

Job	Build ID	Result
`e2e-aws`	1966524731825852416	Merge conflict
`e2e-aws-upgrade-hypershift-operator`	1966524731955875840	Merge conflict
`e2e-kubevirt-aws-ovn-reduced`	1966524732027179008	Merge conflict
`e2e-aks`	1966524731611942912	Merge conflict
`verify`	1975645349007593472	Merge conflict
`unit`	2031422867052171264	Merge conflict
`security`	2053901566104047616	Merge conflict
`tide`	N/A	PR not mergeable

Test Failure Analysis

Error

Auto-merging test/e2e/util/util.go
CONFLICT (content): Merge conflict in test/e2e/util/util.go
Automatic merge failed; fix conflicts and then commit the result.
# Error: exit status 1

Summary

All 7 CI jobs failed identically during Prow's pre-test git merge phase — no builds, tests, or scans ever executed. When Prow attempted to merge the PR head commit (88deed62) into main, it encountered an unresolvable content conflict in test/e2e/util/util.go and aborted immediately with exit status 1. The Tide error is a direct consequence: it reports "Not mergeable. PR has a merge conflict." This is a stale-branch problem — PR #6328 is extremely outdated (current main has advanced past PR #8000+), and the single file the PR modifies (test/e2e/util/util.go, +3/−1) has been extensively changed on main in the intervening months.

Root Cause

The PR branch run-EnsureNetworkPolicies-on-azure has diverged significantly from main. The PR's changes to test/e2e/util/util.go conflict with changes that have since been merged to main (hundreds of PRs have landed since #6328 was opened).

Because the merge conflict occurs during Prow's initial git clone/merge step — before ci-operator even starts — every single CI job fails identically at the same point. No images are built, no clusters are provisioned, and no tests run. The GCS artifact buckets for most builds are empty or garbage-collected because no artifacts were ever produced.

The Tide error ("Not mergeable") is a downstream consequence of this same merge conflict — Tide correctly identifies that the PR cannot be automatically merged.

This is not a product bug, test flake, or infrastructure issue. It is purely a stale branch that needs rebasing.

Recommendations

Rebase the PR branch onto current main — resolve the conflict in test/e2e/util/util.go and force-push the updated branch. Given the age of this PR (PR CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure #6328 vs. current main at fix: add --self-signed-webhook-certs for non-OpenShift clusters #8000+), expect additional conflicts beyond test/e2e/util/util.go.
Consider the PR's current state — the PR is marked as a Draft with do-not-merge/work-in-progress and lifecycle/rotten labels. If the work is still relevant, a full rebase and review against current main is needed. If the work has been superseded, consider closing the PR.
After rebasing, all CI jobs will automatically re-trigger and the actual code changes (running EnsureNetworkPolicies on Azure) can be evaluated by CI for the first time.

Evidence

Evidence	Detail
Error message	`CONFLICT (content): Merge conflict in test/e2e/util/util.go` — identical across all 7 jobs
Failure phase	Git clone/merge step (before ci-operator starts)
PR mergeable status	`CONFLICTING` (GitHub API: `mergeStateStatus: DIRTY`)
PR labels	`needs-rebase`, `lifecycle/rotten`, `do-not-merge/work-in-progress`
PR state	Draft (`isDraft: true`)
Conflicting file	`test/e2e/util/util.go` (the only file modified by this PR: +3/−1)
Branch staleness	PR #6328 opened while `main` has advanced past PR #8000+
Artifacts	Most build artifacts garbage-collected (no artifacts were ever produced due to merge-phase failure)
Tide status	"Not mergeable. PR has a merge conflict."

openshift-ci · 2026-07-03T02:30:20Z

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

openshift-ci · 2026-07-03T02:31:29Z

@openshift-ci[bot]: Closed this PR.

Details

In response to this:

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 27, 2025

openshift-ci Bot added do-not-merge/needs-area area/testing Indicates the PR includes changes for e2e testing labels Jun 27, 2025

openshift-ci Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed do-not-merge/needs-area labels Jun 27, 2025

bryan-cox reviewed Jun 27, 2025

View reviewed changes

enxebre force-pushed the run-EnsureNetworkPolicies-on-azure branch from 2a9beb5 to a2e28a1 Compare June 30, 2025 10:20

Run EnsureNetworkPolicies on Azure

88deed6

enxebre force-pushed the run-EnsureNetworkPolicies-on-azure branch from a2e28a1 to 88deed6 Compare June 30, 2025 12:22

bryan-cox reviewed Jun 30, 2025

View reviewed changes

enxebre changed the title ~~Run EnsureNetworkPolicies on Azure~~ CNTRLPLANE-1042: Run EnsureNetworkPolicies on Azure Jul 3, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 3, 2025

bryan-cox mentioned this pull request Jul 3, 2025

Run ensure network policy on azure #6377

Closed

4 tasks

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 15, 2025

openshift-ci Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 11, 2026

openshift-ci Bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 25, 2026

openshift-ci Bot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Jun 25, 2026

openshift-ci Bot closed this Jul 3, 2026

Uh oh!

Conversation

enxebre commented Jun 27, 2025

Uh oh!

openshift-ci Bot commented Jun 27, 2025

Uh oh!

enxebre commented Jun 27, 2025

Uh oh!

openshift-ci Bot commented Jun 27, 2025

Uh oh!

bryan-cox Jun 27, 2025

Choose a reason for hiding this comment

Uh oh!

cwbotbot commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

e2e-aks

Uh oh!

enxebre commented Jun 30, 2025

Uh oh!

bryan-cox Jun 30, 2025

Choose a reason for hiding this comment

Uh oh!

enxebre commented Jul 1, 2025

Uh oh!

openshift-ci-robot commented Jul 3, 2025 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bryan-cox commented Jul 3, 2025

Uh oh!

bryan-cox commented Sep 4, 2025

Uh oh!

openshift-merge-robot commented Dec 15, 2025

Uh oh!

coderabbitai Bot commented Dec 15, 2025

Review skipped

Uh oh!

openshift-ci Bot commented May 11, 2026

Uh oh!

openshift-ci Bot commented Jun 11, 2026

Uh oh!

openshift-ci Bot commented Jun 25, 2026

Uh oh!

hypershift-jira-solve-ci Bot commented Jun 25, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Failure Analysis Complete

Job Information

Test Failure Analysis

Error

Summary

Uh oh!

openshift-ci Bot commented Jul 3, 2026

Uh oh!

openshift-ci Bot commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

cwbotbot commented Jun 27, 2025 •

edited

Loading

openshift-ci-robot commented Jul 3, 2025 •

edited by openshift-ci Bot

Loading

hypershift-jira-solve-ci Bot commented Jun 25, 2026 •

edited by openshift-ci Bot

Loading