CNTRLPLANE-3041: Override ARO/HCP 4.20 CPO with Azure Pod Identity backport by celebdor · Pull Request #8025 · openshift/hypershift

celebdor · 2026-03-20T15:44:44Z

What this PR does / why we need it:

Replaces all 4.20.x Azure CPO overrides with a Konflux build from the tip of release-4.20 (53f45be9d) that backports the Azure Pod Identity webhook as a KAS sidecar. This ensures all current 4.20.z versions and the upcoming 4.20.16 that won't contain the Azure Pod Identity webhook natively are covered.

The new image (quay.io/redhat-user-workloads/crt-redhat-acm-tenant/control-plane-operator-4-20@sha256:5bbbce615fb2103b900b9eadf79abae0c23b3ea14f8a5d46d3ff63879ded4058) is a multiarch (amd64 + arm64) OCI image index. It comes from build control-plane-operator-4-20-on-push-c75cr

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3041

Special notes for your reviewer:

Only the Azure platform overrides are changed; AWS overrides are untouched.
Version 4.20.7 was already absent before this change (intentional gap).
The image was verified to exist and to be built from the release-4.20 branch HEAD which includes PR CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998 (azure-web-identity-webhook-4.20).

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

This commit replaces all current 4.20.z and the upcoming 4.20.16 that won't contain the Azure Pod Identity webhook with a Konflux build that backports this functionality. Signed-off-by: Antoni Segura Puimedon <antoni@redhat.com>

openshift-ci-robot · 2026-03-20T15:44:47Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-03-20T15:44:50Z

@celebdor: This pull request references CNTRLPLANE-3041 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Replaces all 4.20.x Azure CPO overrides with a Konflux build from the tip of release-4.20 (53f45be9d) that backports the Azure Pod Identity webhook as a KAS sidecar. This ensures all current 4.20.z versions and the upcoming 4.20.16 that won't contain the Azure Pod Identity webhook natively are covered.

The new image (sha256:5bbbce615fb2103b900b9eadf79abae0c23b3ea14f8a5d46d3ff63879ded4058) is a multiarch (amd64 + arm64) OCI image index.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3041

Special notes for your reviewer:

Only the Azure platform overrides are changed; AWS overrides are untouched.

Version 4.20.7 was already absent before this change (intentional gap).

The image was verified to exist and to be built from the release-4.20 branch HEAD which includes PR CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998 (azure-web-identity-webhook-4.20).

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-20T15:44:52Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 8ecfbcd6-a934-4547-b091-ffd85e391415

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-03-20T15:45:00Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

enxebre · 2026-03-20T16:00:16Z

/approve
/lgtm

openshift-ci-robot · 2026-03-20T16:02:01Z

Scheduling required tests:
/test e2e-aks-cilium

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-21
/test e2e-aws-4-21

openshift-ci · 2026-03-20T16:02:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: celebdor, enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-03-20T16:09:31Z

@celebdor: This pull request references CNTRLPLANE-3041 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Replaces all 4.20.x Azure CPO overrides with a Konflux build from the tip of release-4.20 (53f45be9d) that backports the Azure Pod Identity webhook as a KAS sidecar. This ensures all current 4.20.z versions and the upcoming 4.20.16 that won't contain the Azure Pod Identity webhook natively are covered.

The new image (quay.io/redhat-user-workloads/crt-redhat-acm-tenant/control-plane-operator-4-20@sha256:5bbbce615fb2103b900b9eadf79abae0c23b3ea14f8a5d46d3ff63879ded4058) is a multiarch (amd64 + arm64) OCI image index.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3041

Special notes for your reviewer:

Only the Azure platform overrides are changed; AWS overrides are untouched.

Version 4.20.7 was already absent before this change (intentional gap).

The image was verified to exist and to be built from the release-4.20 branch HEAD which includes PR CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998 (azure-web-identity-webhook-4.20).

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-20T16:12:14Z

@celebdor: This pull request references CNTRLPLANE-3041 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Replaces all 4.20.x Azure CPO overrides with a Konflux build from the tip of release-4.20 (53f45be9d) that backports the Azure Pod Identity webhook as a KAS sidecar. This ensures all current 4.20.z versions and the upcoming 4.20.16 that won't contain the Azure Pod Identity webhook natively are covered.

The new image (quay.io/redhat-user-workloads/crt-redhat-acm-tenant/control-plane-operator-4-20@sha256:5bbbce615fb2103b900b9eadf79abae0c23b3ea14f8a5d46d3ff63879ded4058) is a multiarch (amd64 + arm64) OCI image index. It comes from build control-plane-operator-4-20-on-push-c75cr

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3041

Special notes for your reviewer:

Only the Azure platform overrides are changed; AWS overrides are untouched.

Version 4.20.7 was already absent before this change (intentional gap).

The image was verified to exist and to be built from the release-4.20 branch HEAD which includes PR CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998 (azure-web-identity-webhook-4.20).

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

xiuwang · 2026-03-23T05:05:39Z

/verified by @xiuwang

openshift-ci-robot · 2026-03-23T05:05:52Z

@xiuwang: This PR has been marked as verified by @xiuwang.

Details

In response to this:

/verified by @xiuwang

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

celebdor · 2026-03-23T10:21:09Z

/retest-required

celebdor · 2026-03-23T13:34:38Z

/pipeline required

openshift-ci-robot · 2026-03-23T13:34:41Z

Scheduling required tests:
/test e2e-aks-cilium

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-21
/test e2e-aws-4-21

celebdor · 2026-03-23T14:02:58Z

/retest-required

celebdor · 2026-03-24T01:48:56Z

/retest-required

openshift-ci · 2026-03-24T04:53:14Z

@celebdor: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-override	`58686d6`	link	true	`/test e2e-aws-override`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

enxebre · 2026-03-24T08:55:23Z

/override e2e-aws-override

openshift-ci · 2026-03-24T08:55:43Z

@enxebre: /override requires failed status contexts, check run or a prowjob name to operate on.
The following unknown contexts/checkruns were given:

e2e-aws-override

Only the following failed contexts/checkruns were expected:

CodeRabbit
ci/prow/e2e-aks-4-21
ci/prow/e2e-aks-cilium
ci/prow/e2e-aks-override
ci/prow/e2e-aws-4-21
ci/prow/e2e-aws-override
ci/prow/images
ci/prow/okd-scos-images
ci/prow/verify
ci/prow/verify-deps
pull-ci-openshift-hypershift-main-e2e-aks-4-21
pull-ci-openshift-hypershift-main-e2e-aks-override
pull-ci-openshift-hypershift-main-e2e-aws-4-21
pull-ci-openshift-hypershift-main-e2e-aws-override
pull-ci-openshift-hypershift-main-images
pull-ci-openshift-hypershift-main-okd-scos-images
pull-ci-openshift-hypershift-main-verify
pull-ci-openshift-hypershift-main-verify-deps
tide

If you are trying to override a checkrun that has a space in it, you must put a double quote on the context.

Details

In response to this:

/override e2e-aws-override

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

enxebre · 2026-03-24T08:57:07Z

/overide ci/prow/e2e-aws-override

celebdor · 2026-03-24T11:26:41Z

/overide ci/prow/e2e-aws-override

feat(ho): Override ARO/HCP 4.20 with Azure Pod Identity

58686d6

This commit replaces all current 4.20.z and the upcoming 4.20.16 that won't contain the Azure Pod Identity webhook with a Konflux build that backports this functionality. Signed-off-by: Antoni Segura Puimedon <antoni@redhat.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 20, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 20, 2026

openshift-ci Bot added do-not-merge/needs-area area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release and removed do-not-merge/needs-area labels Mar 20, 2026

openshift-ci Bot assigned enxebre Mar 20, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 20, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 20, 2026

celebdor marked this pull request as ready for review March 20, 2026 16:13

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 20, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 23, 2026

celebdor merged commit c8ae120 into openshift:main Mar 24, 2026
16 of 18 checks passed

Uh oh!

Conversation

celebdor commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-ci-robot commented Mar 20, 2026

Uh oh!

openshift-ci-robot commented Mar 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

coderabbitai Bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci Bot commented Mar 20, 2026

Uh oh!

enxebre commented Mar 20, 2026

Uh oh!

openshift-ci-robot commented Mar 20, 2026

Uh oh!

openshift-ci Bot commented Mar 20, 2026

Uh oh!

openshift-ci-robot commented Mar 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-ci-robot commented Mar 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

xiuwang commented Mar 23, 2026

Uh oh!

openshift-ci-robot commented Mar 23, 2026

Uh oh!

celebdor commented Mar 23, 2026

Uh oh!

celebdor commented Mar 23, 2026

Uh oh!

openshift-ci-robot commented Mar 23, 2026

Uh oh!

celebdor commented Mar 23, 2026

Uh oh!

celebdor commented Mar 24, 2026

Uh oh!

openshift-ci Bot commented Mar 24, 2026

Uh oh!

enxebre commented Mar 24, 2026

Uh oh!

openshift-ci Bot commented Mar 24, 2026

Uh oh!

enxebre commented Mar 24, 2026

Uh oh!

celebdor commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

celebdor commented Mar 20, 2026 •

edited

Loading

openshift-ci-robot commented Mar 20, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Mar 20, 2026 •

edited

Loading

openshift-ci-robot commented Mar 20, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Mar 20, 2026 •

edited by openshift-ci Bot

Loading