CNTRLPLANE-3008: Azure web identity webhook 4.20 by enxebre · Pull Request #7998 · openshift/hypershift

enxebre · 2026-03-18T12:33:28Z

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

Deploy the Azure workload identity webhook as a sidecar container in the KAS deployment for Azure platform clusters, mirroring the existing AWS pod identity webhook pattern. This enables customer workloads to authenticate to Azure services via annotated ServiceAccounts. Changes: - Add serving certificate PKI reconciliation for the webhook - Add webhook sidecar container to KAS deployment (port 9443, health 9440) - Add kubeconfig generation for the webhook service account - Register webhook kubeconfig manifest adapter in KAS component - Create guest cluster RBAC (ClusterRole/ClusterRoleBinding) and MutatingWebhookConfiguration via HCCO - Add unit tests for all new functions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Wrap EnsureAzureWorkloadIdentityWebhookMutation in a t.Run subtest with AtLeast(Version422) so the test is skipped on older versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot · 2026-03-18T12:33:32Z

@enxebre: This pull request references CNTRLPLANE-3005 which is a valid jira issue.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-18T12:33:34Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7a3726f5-4d9b-4b77-9f92-4a7aac4ae159

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-03-18T12:36:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-03-18T12:39:55Z

@enxebre: This pull request references CNTRLPLANE-3008 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.z" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

xiuwang · 2026-03-19T11:51:53Z

/verified by @xiuwang

openshift-ci-robot · 2026-03-19T11:52:05Z

@xiuwang: This PR has been marked as verified by @xiuwang.

Details

In response to this:

/verified by @xiuwang

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

xiuwang · 2026-03-20T03:15:22Z

+
+func EnsureAzureWorkloadIdentityWebhookMutation(t *testing.T, ctx context.Context, guestClient crclient.Client) {
+	t.Run("EnsureAzureWorkloadIdentityWebhookMutation", func(t *testing.T) {
+		AtLeast(t, Version422)


Need remove this line

The e2e test added in this PR runs against main, where the azure workload identity webhook feature is not yet available. Remove the test call and its implementation file until the feature is present in the version used for e2e. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

jparrill · 2026-03-20T11:53:39Z

/lgtm

celebdor · 2026-03-20T14:06:11Z

/retest-required

celebdor · 2026-03-20T14:14:53Z

/retest

openshift-ci · 2026-03-20T14:37:18Z

@enxebre: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws	`7f108d2`	link	true	`/test e2e-aws`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

…4.20 The Azure workload identity webhook was originally implemented for 4.22 (PR openshift#7867) but was subsequently backported to 4.20 (PR openshift#7998) and 4.21 (PR openshift#7997). Update the e2e test version gate from Version422 to Version420 so the test runs against all supported versions. Refs: CNTRLPLANE-3093, CNTRLPLANE-3096 Signed-off-by: Antoni Segura Puimedon <antoni@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

csrwng and others added 2 commits March 18, 2026 13:30

fix(e2e): gate Azure workload identity webhook test to 4.22+

bf50884

Wrap EnsureAzureWorkloadIdentityWebhookMutation in a t.Run subtest with AtLeast(Version422) so the test is skipped on older versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 18, 2026

openshift-ci Bot added the do-not-merge/needs-area label Mar 18, 2026

openshift-ci Bot requested review from hasueki and sjenning March 18, 2026 12:36

celebdor changed the title ~~CNTRLPLANE-3005: Azure web identity webhook 4.20~~ CNTRLPLANE-3008: Azure web identity webhook 4.20 Mar 18, 2026

bennerv mentioned this pull request Mar 18, 2026

test(e2e): use workload identity webhook label instead of manual injection Azure/ARO-HCP#4515

Closed

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 19, 2026

xiuwang reviewed Mar 20, 2026

View reviewed changes

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Mar 20, 2026

celebdor added verified Signifies that the PR passed pre-merge verification criteria jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Mar 20, 2026

openshift-ci Bot assigned jparrill Mar 20, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 20, 2026

enxebre added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Mar 20, 2026

enxebre merged commit 53f45be into openshift:release-4.20 Mar 20, 2026
16 of 18 checks passed

celebdor mentioned this pull request Mar 20, 2026

CNTRLPLANE-3041: Override ARO/HCP 4.20 CPO with Azure Pod Identity backport #8025

Merged

4 tasks

celebdor mentioned this pull request Apr 23, 2026

CNTRLPLANE-3093,CNTRLPLANE-3096,CNTRLPLANE-3095,CNTRLPLANE-3098: lower Azure WI webhook test version gate to 4.20 #8323

Merged

4 tasks

Uh oh!

Conversation

enxebre commented Mar 18, 2026

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-ci-robot commented Mar 18, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

coderabbitai Bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci Bot commented Mar 18, 2026

Uh oh!

openshift-ci-robot commented Mar 18, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

xiuwang commented Mar 19, 2026

Uh oh!

openshift-ci-robot commented Mar 19, 2026

Uh oh!

xiuwang Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

jparrill commented Mar 20, 2026

Uh oh!

celebdor commented Mar 20, 2026

Uh oh!

celebdor commented Mar 20, 2026

Uh oh!

openshift-ci Bot commented Mar 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

openshift-ci-robot commented Mar 18, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Mar 18, 2026 •

edited

Loading

openshift-ci-robot commented Mar 18, 2026 •

edited by openshift-ci Bot

Loading