OCPBUGS-76410: Stop serving admissionregistration.k8s.io/v1beta1.

[benluddy]

We missed the 4.20 removal of this GV on Hypershift in the course of https://issues.redhat.com/browse/OCPBUGS-55465:

$ kubectl get --raw /apis/admissionregistration.k8s.io/
{
  "kind": "APIGroup",
  "apiVersion": "v1",
  "name": "admissionregistration.k8s.io",
  "versions": [
    {
      "groupVersion": "admissionregistration.k8s.io/v1",
      "version": "v1"
    },
    {
      "groupVersion": "admissionregistration.k8s.io/v1beta1",
      "version": "v1beta1"
    }
  ],
  "preferredVersion": {
    "groupVersion": "admissionregistration.k8s.io/v1",
    "version": "v1"
  }
}

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Removed enforcement and runtime-config wiring for the ValidatingAdmissionPolicy feature gate from KAS config generation; tests and fixtures updated to remove admissionregistration.k8s.io/v1beta1=true from default runtime-config. StructuredAuthenticationConfiguration enforcement remains.

Changes

Cohort / File(s)	Summary
KAS config logic control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go	Removed enforcement of the ValidatingAdmissionPolicy feature gate and the conditional insertion of admissionregistration.k8s.io/v1beta1=true into apiServerArguments.runtime-config.
Unit tests control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go	Removed/updated tests asserting wiring for ValidatingAdmissionPolicy; expectations updated so default runtime-config no longer contains admissionregistration.k8s.io/v1beta1.
Fixtures — kas config ConfigMaps control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/.../zz_fixture_TestControlPlaneComponents_kas_config_configmap.yaml	Updated embedded config.json to change apiServerArguments.runtime-config from ["admissionregistration.k8s.io/v1beta1=true"] to [].
Fixtures — kube-apiserver Deployments (annotation updates) control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/.../zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml	Updated component.hypershift.openshift.io/config-hash annotation values in multiple test fixtures; changes are metadata-only (hash values).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

• Check config.go for any callers or integrations that relied on the removed runtime-config entry.
• Verify config_test.go still fully exercises StructuredAuthenticationConfiguration behavior.
• Confirm fixture JSON and YAML edits are syntactically correct and that deployment annotation hash changes are intentional.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch stop-serving-admissionregistration-v1beta1

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[csrwng]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benluddy, csrwng

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [csrwng]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between dea6d2f and 605745b.

📒 Files selected for processing (1)

• control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

• control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go

🔇 Additional comments (2)

control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go (2)

237-248: LGTM - Runtime config correctly updated.

The removal of the conditional block that added admissionregistration.k8s.io/v1beta1=true to runtime-config (based on the ValidatingAdmissionPolicy feature gate) correctly achieves the PR objective of stopping serving the v1beta1 API. The remaining conditional blocks follow the same pattern for other features.

---

334-334: Confirm that keeping ValidatingAdmissionPolicy admission plugin enabled is intentional.

The ValidatingAdmissionPolicy admission plugin remains in the enabled list even though the feature gate is no longer enforced and the v1beta1 API is not being served. This appears correct since the plugin can work with the v1 API, but please confirm this is the intended behavior.

[bertinatto]

/retest

[bryan-cox]

@benluddy looks like UPDATE=true go test ./... needs run and the changes from that committed to pass unit

[benluddy]

/retest-required

[benluddy]

Rebased, but it looks like the verify presubmit started permafailing sometime in the last day.

[bryan-cox]

/test verify

[bryan-cox]

@benluddy we just did fix it a few min ago

[bryan-cox]

Are we wanting this PR to target the release-4.20 branch instead of main? Or does this PR need backported from 4.22 back to 4.20?

[bryan-cox]

/test verify

[benluddy]

/retitle OCPBUGS-76410: Stop serving admissionregistration.k8s.io/v1beta1.

[openshift-ci-robot]

@benluddy: This pull request references Jira Issue OCPBUGS-76410, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (yli2@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

We missed the 4.20 removal of this GV on Hypershift in the course of https://issues.redhat.com/browse/OCPBUGS-55465:

$ kubectl get --raw /apis/admissionregistration.k8s.io/
{
 "kind": "APIGroup",
 "apiVersion": "v1",
 "name": "admissionregistration.k8s.io",
 "versions": [
   {
     "groupVersion": "admissionregistration.k8s.io/v1",
     "version": "v1"
   },
   {
     "groupVersion": "admissionregistration.k8s.io/v1beta1",
     "version": "v1beta1"
   }
 ],
 "preferredVersion": {
   "groupVersion": "admissionregistration.k8s.io/v1",
   "version": "v1"
 }
}

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[benluddy]

Are we wanting this PR to target the release-4.20 branch instead of main? Or does this PR need backported from 4.22 back to 4.20?

It will need to be backported. Just linked a fresh issue to track this.

[bryan-cox]

Can you please update the release notes and the target backport versions on the Jira ticket?

[benluddy]

/verified by @benluddy

[openshift-ci-robot]

@benluddy: This PR has been marked as verified by @benluddy.

Details

In response to this:

/verified by @benluddy

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@benluddy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aks	82cae5a	link	true	/test e2e-aks
ci/prow/e2e-aws	82cae5a	link	true	/test e2e-aws
ci/prow/e2e-azure-self-managed	dd6719d	link	true	/test e2e-azure-self-managed
ci/prow/unit	dd6719d	link	true	/test unit
ci/prow/verify-workflows	dd6719d	link	true	/test verify-workflows
ci/prow/security	dd6719d	link	true	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

Stale PRs are closed after 21d of inactivity.

If this PR is still relevant, comment to refresh it or remove the stale label.
Mark the PR as fresh by commenting /remove-lifecycle stale.

If this PR is safe to close now please do so with /close.

/lifecycle stale

[openshift-ci]

Stale PRs rot after 14d of inactivity.

Mark the PR as fresh by commenting /remove-lifecycle rotten.
Rotten PRs close after an additional 7d of inactivity.

If this PR is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[hypershift-jira-solve-ci]

Now I have the complete picture. Let me compile the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-security
• Build ID: 2053897841180413952
• PR: #7270 — OCPBUGS-76410: Stop serving admissionregistration.k8s.io/v1beta1.
• PR Branch: stop-serving-admissionregistration-v1beta1 (commit dd6719d)
• Base SHA: f16ca0d2 (Merge of PR NO-JIRA: Document CEL over webhooks policy for AI agents #8478)
• Tide Status: Error — "Not mergeable. PR has a merge conflict."

Test Failure Analysis

Error

Auto-merging control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
CONFLICT (content): Merge conflict in ...GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
CONFLICT (content): Merge conflict in ...IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
CONFLICT (content): Merge conflict in ...TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
CONFLICT (content): Merge conflict in ...kube-apiserver/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
Automatic merge failed; fix conflicts and then commit the result.
# Error: exit status 1
# Final SHA: 
# Total runtime: 0s

Summary

Both failures — ci/prow/security (state: failure) and tide (state: error) — share a single root cause: the PR branch has merge conflicts with the current main branch. The CI job failed during the initial git clone/merge phase before any test or security scan code could execute. The PR was created on 2025-11-20 and has not been rebased since; it now carries the needs-rebase and lifecycle/rotten labels. Six additional e2e/verify jobs are stuck in pending ("Waiting for pipeline condition") because they are gated behind the failing security check.

Root Cause

The PR branch (dd6719d) modifies kube-apiserver deployment test fixture files to stop serving admissionregistration.k8s.io/v1beta1. Meanwhile, the main branch has diverged significantly — most recently PR #8478 ("NO-JIRA: Document CEL over webhooks policy for AI agents", merged 2026-05-11) also modified the same kube-apiserver deployment fixture files.

Git cannot automatically merge both sets of changes, resulting in content conflicts in 4 files under control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/:

1. GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
2. IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
3. TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
4. zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml

Because the merge fails at the git level (exit status 1, Final SHA: is empty, Total runtime: 0s), the CI job never progresses to building, scanning, or testing. No security vulnerability or code defect exists — this is purely a stale branch problem. Tide independently reports the same root cause: "Not mergeable. PR has a merge conflict."

Recommendations

1. Rebase the PR branch onto current main — resolve the merge conflicts in the 4 kube-apiserver deployment fixture YAML files, then force-push. These are generated test fixtures (zz_fixture_*), so they likely need to be regenerated by running the test generator after rebasing.
2. Re-trigger CI — once the rebase is pushed, the ci/prow/security job will re-run with a clean merge, and the 6 pending e2e/verify jobs will unblock automatically.
3. Address staleness — the PR is over 7 months old (lifecycle/rotten). Given the significant drift from main, verify that the approach in this PR is still the correct way to remove v1beta1 serving, and that no other PRs have already addressed OCPBUGS-76410.

Evidence

Evidence	Detail
Build log line 134	git merge --no-ff dd6719d... exits with merge conflicts
Build log line 143	Automatic merge failed; fix conflicts and then commit the result.
Build log line 144-146	Error: exit status 1, Final SHA: (empty), Total runtime: 0s — no CI steps executed
Conflicting files	4 files under control-plane-operator/.../testdata/kube-apiserver/
Conflicting commit on main	PR #8478 (f16ca0d2) — "Document CEL over webhooks policy for AI agents" (merged 2026-05-11)
PR labels	needs-rebase, lifecycle/rotten — confirms stale branch with known conflicts
GitHub merge state	mergeStateStatus: DIRTY, mergeable: CONFLICTING
Tide status message	"Not mergeable. PR has a merge conflict."
Pending jobs	6 e2e/verify jobs blocked — gated behind failing security check
PR age	Created 2025-11-20, last code push 2026-02-06 — over 4 months without rebase

---

[openshift-ci]

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

[openshift-ci]

@openshift-ci[bot]: Closed this PR.

Details

In response to this:

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@benluddy: This pull request references Jira Issue OCPBUGS-76410. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

Details

In response to this:

We missed the 4.20 removal of this GV on Hypershift in the course of https://issues.redhat.com/browse/OCPBUGS-55465:

$ kubectl get --raw /apis/admissionregistration.k8s.io/
{
 "kind": "APIGroup",
 "apiVersion": "v1",
 "name": "admissionregistration.k8s.io",
 "versions": [
   {
     "groupVersion": "admissionregistration.k8s.io/v1",
     "version": "v1"
   },
   {
     "groupVersion": "admissionregistration.k8s.io/v1beta1",
     "version": "v1beta1"
   }
 ],
 "preferredVersion": {
   "groupVersion": "admissionregistration.k8s.io/v1",
   "version": "v1"
 }
}

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.