Skip to content

CNTRLPLANE-1331: Get self-managed Azure working again #6703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 8 commits into from
Sep 23, 2025
Merged

CNTRLPLANE-1331: Get self-managed Azure working again #6703

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cd7652a
refactor(azure): Extract Azure credentials setup into dedicated package
bryan-cox Aug 5, 2025
d054ca4
feat(cli,azure): add workload identities support and new flag for sel…
bryan-cox Aug 5, 2025
339bd29
feat(azure): Add control plane operator credentials for self-managed …
bryan-cox Aug 5, 2025
d501978
feat(api): Add Network workload identity to AzureWorkloadIdentities
bryan-cox Aug 5, 2025
7954efd
feat(azure): enable token-minter for self-managed workload identity
bryan-cox Aug 5, 2025
7f803f6
test(unit): unblock `make unit` by fixing failing tests and build issues
bryan-cox Sep 3, 2025
5c9d7d2
fix(hcco): delete registry management state VAP/VAPB on cluster delet…
bryan-cox Sep 19, 2025
5d4cc72
refactor(operators): consolidate secret creation into shared helper
bryan-cox Sep 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions api/hypershift/v1beta1/azure.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,6 +520,11 @@ type AzureWorkloadIdentities struct {
// workload identity authentication.
// +required
CloudProvider WorkloadIdentity `json:"cloudProvider"`

// network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
Comment thread
bryan-cox marked this conversation as resolved.
// workload identity authentication.
// +required
Network WorkloadIdentity `json:"network"`
}
Comment thread
bryan-cox marked this conversation as resolved.

// ManagedIdentity contains the client ID, and its certificate name, of a managed identity. This managed identity is
Expand Down
1 change: 1 addition & 0 deletions api/hypershift/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

22 changes: 22 additions & 0 deletions ...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4061,6 +4061,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4088,6 +4109,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ....featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4099,6 +4099,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4126,6 +4147,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
Comment thread
coderabbitai[bot] marked this conversation as resolved.
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ...manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4072,6 +4072,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4099,6 +4120,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ...gated-crd-manifests/hostedclusters.hypershift.openshift.io/DynamicResourceAllocation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4073,6 +4073,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4100,6 +4121,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ...rated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4388,6 +4388,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4415,6 +4436,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ...ests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4542,6 +4542,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
Comment thread
bryan-cox marked this conversation as resolved.
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4569,6 +4590,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ...turegated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4070,6 +4070,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
Comment thread
coderabbitai[bot] marked this conversation as resolved.
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4097,6 +4118,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
required:
Expand Down
22 changes: 22 additions & 0 deletions ...turegated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4128,6 +4128,27 @@ spec:
required:
- clientID
type: object
network:
description: |-
network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.
properties:
clientID:
description: clientID is client ID of a federated
managed identity used in workload identity authentication
maxLength: 36
minLength: 36
pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
type: string
x-kubernetes-validations:
- message: the client ID of a managed identity
must be a valid UUID. It should be 5 groups
of hyphen separated hexadecimal characters
in the form 8-4-4-4-12.
rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
required:
- clientID
type: object
nodePoolManagement:
description: |-
nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
Expand Down Expand Up @@ -4155,6 +4176,7 @@ spec:
- file
- imageRegistry
- ingress
- network
- nodePoolManagement
type: object
Comment thread
bryan-cox marked this conversation as resolved.
required:
Expand Down
Loading