WIP: chore(shared-ingress): Always allow /healthz KAS endpoint when AllowdCIDRBlocks

[muraee]

What this PR does / why we need it:
This allows CPO KAS rountrip health check through the shared proxy to always pass when even when AllowedCIDRBlocks is set.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [muraee]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-robot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@muraee: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-4-19	70a8e0f	link	true	/test e2e-aws-4-19
ci/prow/okd-scos-e2e-aws-ovn	70a8e0f	link	false	/test okd-scos-e2e-aws-ovn
ci/prow/e2e-aks-4-20	70a8e0f	link	true	/test e2e-aks-4-20
ci/prow/e2e-kubevirt-aws-ovn-reduced	70a8e0f	link	true	/test e2e-kubevirt-aws-ovn-reduced
ci/prow/e2e-aws	70a8e0f	link	true	/test e2e-aws
ci/prow/e2e-aws-upgrade-hypershift-operator	70a8e0f	link	true	/test e2e-aws-upgrade-hypershift-operator
ci/prow/e2e-aks	70a8e0f	link	true	/test e2e-aks
ci/prow/e2e-aws-4-20	70a8e0f	link	true	/test e2e-aws-4-20
ci/prow/verify	70a8e0f	link	true	/test verify
ci/prow/e2e-aws-4-21	70a8e0f	link	true	/test e2e-aws-4-21
ci/prow/e2e-aks-4-21	70a8e0f	link	true	/test e2e-aks-4-21
ci/prow/e2e-azure-self-managed	70a8e0f	link	true	/test e2e-azure-self-managed
ci/prow/unit	70a8e0f	link	true	/test unit
ci/prow/verify-workflows	70a8e0f	link	true	/test verify-workflows
ci/prow/security	70a8e0f	link	true	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

Stale PRs are closed after 21d of inactivity.

If this PR is still relevant, comment to refresh it or remove the stale label.
Mark the PR as fresh by commenting /remove-lifecycle stale.

If this PR is safe to close now please do so with /close.

/lifecycle stale

[openshift-ci]

Stale PRs rot after 14d of inactivity.

Mark the PR as fresh by commenting /remove-lifecycle rotten.
Rotten PRs close after an additional 7d of inactivity.

If this PR is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[hypershift-jira-solve-ci]

I now have all the evidence needed. Let me compile the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-{e2e-aws, e2e-aks, e2e-aws-upgrade-hypershift-operator, e2e-kubevirt-aws-ovn-reduced, verify, unit, security}
• Build IDs: 1966507632353087488, 1966507632269201408, 1966507632466333696, 1966507632495693824, 1975632313194647552, 2031421626477711360, 2053900911855538176
• PR: WIP: chore(shared-ingress): Always allow /healthz KAS endpoint when AllowdCIDRBlocks #6618 (exclude-healthz-allowed-cidr → main)
• PR State: Open, mergeable: false, mergeable_state: dirty

Test Failure Analysis

Error

CONFLICT (content): Merge conflict in sharedingress-config-generator/config.go
CONFLICT (content): Merge conflict in sharedingress-config-generator/router_config.template
CONFLICT (content): Merge conflict in sharedingress-config-generator/testdata/zz_fixture_TestGenerateConfig_When_there_s_two_HostedClusters_with_all_their_Routes_and_SVCs_it_should_generate_the_config_with_frontends_and_backends_for_both.cfg
Automatic merge failed; fix conflicts and then commit the result.
# Error: exit status 1
# Final SHA: 
# Total runtime: 0s
# FAILED

Summary

All 7 failing Prow jobs on PR #6618 fail for the same root cause: the PR branch (exclude-healthz-allowed-cidr, last commit 70a8e0fc from Aug 2025) has not been rebased onto main since it was created, and the three files it modifies in sharedingress-config-generator/ have since been changed on main. When Prow attempts git merge --no-ff of the PR onto current main, git reports content conflicts in all three modified files and aborts with exit status 1. No code is compiled, no tests run, and no security scans execute — every job fails at the "Environment setup" (source clone/merge) step with 0s runtime. The tide error is a downstream consequence: Tide cannot merge a PR whose mergeable state is dirty.

Root Cause

The PR branch exclude-healthz-allowed-cidr was created on 2025-08-07 and its last (and only) commit is 70a8e0fc. In the ~10 months since, the main branch of openshift/hypershift has received extensive changes to the same files this PR modifies:

1. sharedingress-config-generator/config.go — The PR adds an AllowedEndpoints field to externalDNSBackendDesc and sets it to "/healthz" for KAS routes. The main branch has received concurrent modifications to this file (e.g., PR NO-JIRA: Add CodeRabbit config to exclude autogenerated files #7905 from enxebre/coderabbit-config and others), creating content conflicts.

2. sharedingress-config-generator/router_config.template — The PR adds a new ACL rule (path_beg -i) to the HAProxy template. main has diverged in this template as well.

3. sharedingress-config-generator/testdata/zz_fixture_TestGenerateConfig_...cfg — The golden test fixture was updated in the PR to include the new ACL line, but the fixture on main has changed independently.

GitHub confirms the PR is currently not mergeable (mergeable: false) and not rebaseable (rebaseable: false) with mergeable_state: dirty.

Breakdown by job:

Job	Build ID	Artifacts Available	Failure
e2e-aws	1966507632353087488	❌ GC'd	Merge conflict (inferred from batch)
e2e-aks	1966507632269201408	❌ GC'd	Merge conflict (inferred from batch)
e2e-aws-upgrade	1966507632466333696	❌ GC'd	Merge conflict (inferred from batch)
e2e-kubevirt	1966507632495693824	❌ GC'd	Merge conflict (inferred from batch)
verify	1975632313194647552	❌ GC'd (32s runtime)	Merge conflict / infra failure
unit	2031421626477711360	✅	Confirmed: merge conflict
security	2053900911855538176	✅	Confirmed: merge conflict

The 4 oldest jobs (Aug 2025) had artifacts garbage-collected, but a sibling job (e2e-azure-self-managed, build 2031421621461323776) from the same PR with surviving artifacts shows the identical merge conflict pattern, confirming the batch-wide failure mode.

Recommendations

1. Rebase the PR branch onto current main: Run git fetch upstream && git rebase upstream/main on the exclude-healthz-allowed-cidr branch. Resolve the three conflicts in sharedingress-config-generator/ manually — the changes are localized (adding an AllowedEndpoints field, a template ACL rule, and a fixture line).

2. Verify the approach is still valid: Given 10 months of evolution on main, review whether the sharedingress-config-generator struct layout and HAProxy template structure still support the original approach. The concept (adding a path_beg ACL to bypass CIDR filtering for /healthz) is sound, but the implementation may need adaptation to current code.

3. Remove WIP status: The PR title starts with "WIP:" — once conflicts are resolved and the approach is verified, remove the WIP prefix to signal readiness for review.

4. Fix the typo in the PR title: "AllowdCIDRBlocks" → "AllowedCIDRBlocks".

5. Re-trigger all CI jobs after rebasing to get a clean signal on the actual code changes.

Evidence

Evidence	Detail
Unit job build log	git merge --no-ff fails with content conflicts in 3 files under sharedingress-config-generator/, exit status 1, 0s runtime
Security job build log	Identical merge conflict failure — same 3 files, same exit status 1, 0s runtime
e2e-azure-self-managed build log (sibling job, build 2031421621461323776)	Confirms same merge conflict pattern on the same PR at the same base SHA (cc479bcad)
GitHub API mergeable status	mergeable: false, mergeable_state: dirty, rebaseable: false, merge_commit_sha: null
PR age	Created 2025-08-07, last commit 70a8e0fc, unchanged for ~10 months while main evolved
Base SHA at failure	cc479bcad0b163a0ddcf6e8811b93f6506402120 ("Merge pull request #7905 from enxebre/coderabbit-config")
Conflicting files	config.go, router_config.template, zz_fixture_TestGenerateConfig_...cfg — all in sharedingress-config-generator/
Batch trigger	4 e2e jobs (aws, aks, upgrade, kubevirt) were triggered in the same batch from BaseSHA 141ae71a, all failed simultaneously

---

[openshift-ci]

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

[openshift-ci]

@openshift-ci[bot]: Closed this PR.

Details

In response to this:

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.