OCPBUGS-83751: add missing RBAC for webhook configurations

[jparrill]

Summary

• Add cluster-scoped RBAC rule for mutatingwebhookconfigurations and validatingwebhookconfigurations with get, list, watch, update verbs to the hypershift-operator ClusterRole
• The webhookcerts controller (PR CNTRLPLANE-2207: feat(install): self-manage webhook certs instead of relying on service-ca #8174, CNTRLPLANE-2207) uses Client.Get()/Client.Update() on these resources via the cached client, which triggers lazy informer creation requiring list/watch permissions at cluster scope
• Add unit tests verifying both the new cluster-scoped rule and the pre-existing scoped delete rule

Bug

Closes https://issues.redhat.com/browse/OCPBUGS-83751

Test plan

• Unit tests pass (go test -race ./cmd/install/assets/ -run TestHyperShiftOperatorClusterRole_WebhookRBAC)
• Build passes (go build ./cmd/install/...)
• Deploy with hypershift install and verify no reflector RBAC errors in operator logs

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests

  • Added test coverage for HyperShift operator webhook configuration permissions.

• Chores

  • Enhanced HyperShift operator role-based access control permissions to support webhook configuration management. Operator can now get, list, watch, and update mutating and validating webhook configurations as needed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request adds RBAC (Role-Based Access Control) permissions to the HyperShift operator cluster role. Specifically, it introduces a new policy rule in HyperShiftOperatorClusterRole.Build() that grants permissions on webhook configuration resources in the admissionregistration.k8s.io API group, including mutatingwebhookconfigurations and validatingwebhookconfigurations with verbs get, list, watch, and update. An existing delete permission for validatingwebhookconfigurations remains unchanged. A corresponding test is added to verify the new RBAC rule is correctly present in the cluster role.

🚥 Pre-merge checks | ✅ 8 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Microshift Test Compatibility	❓ Inconclusive	Unable to assess Ginkgo e2e test compatibility due to inability to access pull request files.	Please provide access to the actual test files or verify the pull request content directly.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Stable And Deterministic Test Names	✅ Passed	The test name TestHyperShiftOperatorClusterRole_WebhookRBAC is stable and deterministic, using only static descriptive text without dynamic values.
Test Structure And Quality	✅ Passed	Test demonstrates single responsibility, appropriate use of assertions with messages, and consistency with codebase testing patterns.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds only a standard Go unit test validating RBAC ClusterRole policy rules, not a Ginkgo e2e test. The check explicitly applies only to Ginkgo e2e tests (It(), Describe(), Context(), When()) that might assume specific cluster topologies.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only RBAC authorization rules, not scheduling constraints. No pod affinity, topology spread, replica counts, node selectors, or scheduling behavior changes present.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes detected. Files contain only RBAC configuration methods and unit test code without improper logging.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request does not add any Ginkgo e2e tests. The new test is a standard Go unit test using testing.T and Gomega assertions with t.Run() subtests, not Ginkgo constructs, and contains no network operations or IPv4 assumptions.
Title check	✅ Passed	The title accurately summarizes the main change: adding missing RBAC permissions for webhook configurations to the hypershift-operator ClusterRole.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@jparrill: This pull request references Jira Issue OCPBUGS-83751, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Add cluster-scoped RBAC rule for mutatingwebhookconfigurations and validatingwebhookconfigurations with get, list, watch, update verbs to the hypershift-operator ClusterRole
• The webhookcerts controller (PR CNTRLPLANE-2207: feat(install): self-manage webhook certs instead of relying on service-ca #8174, CNTRLPLANE-2207) uses Client.Get()/Client.Update() on these resources via the cached client, which triggers lazy informer creation requiring list/watch permissions at cluster scope
• Add unit tests verifying both the new cluster-scoped rule and the pre-existing scoped delete rule

Bug

Closes https://issues.redhat.com/browse/OCPBUGS-83751

Test plan

• Unit tests pass (go test -race ./cmd/install/assets/ -run TestHyperShiftOperatorClusterRole_WebhookRBAC)
• Build passes (go build ./cmd/install/...)
• Deploy with hypershift install and verify no reflector RBAC errors in operator logs

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@jparrill: This pull request references Jira Issue OCPBUGS-83751, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

• Add cluster-scoped RBAC rule for mutatingwebhookconfigurations and validatingwebhookconfigurations with get, list, watch, update verbs to the hypershift-operator ClusterRole
• The webhookcerts controller (PR CNTRLPLANE-2207: feat(install): self-manage webhook certs instead of relying on service-ca #8174, CNTRLPLANE-2207) uses Client.Get()/Client.Update() on these resources via the cached client, which triggers lazy informer creation requiring list/watch permissions at cluster scope
• Add unit tests verifying both the new cluster-scoped rule and the pre-existing scoped delete rule

Bug

Closes https://issues.redhat.com/browse/OCPBUGS-83751

Test plan

• Unit tests pass (go test -race ./cmd/install/assets/ -run TestHyperShiftOperatorClusterRole_WebhookRBAC)
• Build passes (go build ./cmd/install/...)
• Deploy with hypershift install and verify no reflector RBAC errors in operator logs

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests

• Added test coverage for HyperShift operator webhook configuration permissions.

• Chores

• Enhanced HyperShift operator role-based access control permissions to support webhook configuration management. Operator can now get, list, watch, and update mutating and validating webhook configurations as needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.93%. Comparing base (ad1df60) to head (fc17f23).
⚠️ Report is 12 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8276      +/-   ##
==========================================
+ Coverage   35.62%   35.93%   +0.31%     
==========================================
  Files         767      767              
  Lines       93333    93338       +5     
==========================================
+ Hits        33248    33543     +295     
+ Misses      57396    57103     -293     
- Partials     2689     2692       +3     

Files with missing lines	Coverage Δ
cmd/install/assets/hypershift_operator.go	43.61% <100.00%> (+14.92%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[enxebre]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

[jparrill]

/test e2e-aws

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-aws | Build: 2046129308816117760 | Cost: $1.3299217500000005 | Failed step: hypershift-aws-run-e2e-nested

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[celebdor]

/cherry-pick release-4.22

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed | Build: 2046129309512372224 | Cost: $1.671184 | Failed step: hypershift-azure-run-e2e-self-managed

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[openshift-cherrypick-robot]

@celebdor: once the present PR merges, I will cherry-pick it on top of release-4.22 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[cwbotbot]

Test Results

e2e-aks

• Status: ✅ PASS
• Started: 2026-04-20T07:30:48Z
• View Job
• View Job History

e2e-aws

• Status: ✅ PASS
• Started: 2026-04-20T11:27:29Z
• View Job
• View Job History

[jparrill]

/verified by e2e artifacts

Looking at one random e2e test, we can see the issue is not happening anymore:

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_hypershift/8276/pull-ci-openshift-hypershift-main-e2e-aks/2046129308761591808/artifacts/e2e-aks/hypershift-azure-run-e2e/artifacts/TestCreateCluster/namespaces/hypershift/core/pods/logs/operator-6fbf786c47-vpbgl-operator.log

[openshift-ci-robot]

@jparrill: This PR has been marked as verified by e2e artifacts.

Details

In response to this:

/verified by e2e artifacts

Looking at one random e2e test, we can see the issue is not happening anymore:

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_hypershift/8276/pull-ci-openshift-hypershift-main-e2e-aks/2046129308761591808/artifacts/e2e-aks/hypershift-azure-run-e2e/artifacts/TestCreateCluster/namespaces/hypershift/core/pods/logs/operator-6fbf786c47-vpbgl-operator.log

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 80615ba and 2 for PR HEAD fc17f23 in total

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-aws | Build: 2046140740668493824 | Cost: $2.6521719499999996 | Failed step: hypershift-aws-run-e2e-nested

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[jparrill]

/test e2e-azure-self-managed

[jparrill]

/test e2e-aws

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed | Build: 2046165520520056832 | Cost: $2.2533630000000007 | Failed step: hypershift-azure-run-e2e-self-managed

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 5c06422 and 1 for PR HEAD fc17f23 in total

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed | Build: 2046205681974906880 | Cost: $1.4847752999999997 | Failed step: hypershift-azure-run-e2e-self-managed

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 3097f65 and 0 for PR HEAD fc17f23 in total

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed | Build: 2046250873423663104 | Cost: $1.4967250000000003 | Failed step: hypershift-azure-run-e2e-self-managed

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[hypershift-jira-solve-ci]

I now have all the evidence needed for a complete analysis. Here is the final report:

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed
• Build ID: 2046250873423663104
• Target: e2e-azure-self-managed
• PR: #8276 — OCPBUGS-83751: add missing RBAC for webhook configurations
• Test Results: 110 tests, 8 skipped, 19 failures (all from a single root cause)

Test Failure Analysis

Error

Container openshift-oauth-apiserver in pod openshift-oauth-apiserver-8b7d5b77f-t4dlj has a restartCount > 0 (2)
Container router in pod router-58c59d8ff9-48h9r has a restartCount > 0 (1)
--- FAIL: TestNodePool/HostedCluster2/ValidateHostedCluster/EnsureNoCrashingPods (0.11s)
--- FAIL: TestNodePool/HostedCluster0/ValidateHostedCluster/EnsureNoCrashingPods (0.11s)
--- FAIL: TestUpgradeControlPlane/ValidateHostedCluster/EnsureNoCrashingPods (0.18s)
--- FAIL: TestCreateCluster/ValidateHostedCluster/EnsureNoCrashingPods (0.08s)
--- FAIL: TestAzureOAuthLoadBalancer/ValidateHostedCluster/EnsureNoCrashingPods (0.13s)
--- FAIL: TestAzurePrivateTopology/ValidateHostedCluster/EnsureNoCrashingPods (0.22s)

Summary

All 19 test failures are caused by the EnsureNoCrashingPods validation detecting low restart counts (1–2) in openshift-oauth-apiserver and router containers across 5 of 6 hosted clusters. The test uses a defaultCrashToleration of 0 for Azure (non-KubeVirt), so even a single transient restart triggers failure. This is a pre-existing flaky test unrelated to PR #8276, which only adds a single additive RBAC rule to the HyperShift Operator's management-cluster ClusterRole and cannot affect hosted cluster pod lifecycle. TestAutoscaling's hosted cluster passed the same check with zero restarts, confirming the non-deterministic nature of the restarts.

Root Cause

This is a pre-existing flaky test, not a regression caused by PR #8276.

The openshift-oauth-apiserver and router containers in hosted cluster control plane namespaces experience occasional transient restarts (1–2) during cluster bootstrap on Azure. The EnsureNoCrashingPods test check uses a defaultCrashToleration of 0 for Azure platform, making it extremely sensitive to any single container restart.

Why PR #8276 cannot cause these failures:

• The PR modifies only cmd/install/assets/hypershift_operator.go and its test file
• It adds a single RBAC PolicyRule to the HyperShift Operator's ClusterRole granting get/list/watch/update on mutatingwebhookconfigurations and validatingwebhookconfigurations
• This is a management-cluster-level RBAC change that does not touch any hosted cluster component, deployment, or resource
• RBAC changes do not cause pod restarts — the API server evaluates RBAC rules on each request without requiring pod restarts

Why these restarts happen:

• Neither openshift-oauth-apiserver nor router are in the podCrashTolerations exception map, despite having similar transient startup behavior to other excepted components (e.g., ingress-operator: 20, network-node-identity: 1)
• The restart pattern is non-deterministic: 5 of 6 hosted clusters showed restarts, but TestAutoscaling's cluster had zero restarts and passed
• Restart counts are very low (1–2), consistent with startup timing issues (readiness probe races, leader election, dependency ordering)

Recommendations

1. Retry the job — this failure is not caused by the PR and is expected to pass on retry
2. Consider adding crash tolerations — openshift-oauth-apiserver and router could be added to the podCrashTolerations map in test/e2e/util/util.go with a toleration of 1–2 to avoid false failures from transient startup restarts, similar to existing entries for ingress-operator, network-node-identity, dns-operator, and other components
3. Track the underlying restart issue — the recurring openshift-oauth-apiserver and router transient restarts on Azure hosted clusters could be investigated in a separate issue to understand the root cause of the startup timing problem

Evidence

Evidence	Detail
Failing sub-test	EnsureNoCrashingPods across 6 tests (TestNodePool×2, TestUpgradeControlPlane, TestCreateCluster, TestAzureOAuthLoadBalancer, TestAzurePrivateTopology)
Crashing containers	openshift-oauth-apiserver (restartCount 1–2) and router (restartCount 1) in hosted cluster HCP namespaces
Passing test	TestAutoscaling's EnsureNoCrashingPods PASSED with zero restarts, proving non-deterministic behavior
Crash toleration	defaultCrashToleration = 0 for Azure platform; neither container is in the podCrashTolerations exception map
PR #8276 scope	Adds 1 RBAC PolicyRule to HyperShift Operator ClusterRole (admissionregistration.k8s.io webhook configs); modifies 0 hosted cluster resources
CI analyzer verdict	The job's own hypershift-analyze-e2e-failure step confirmed: "Pre-existing flaky test — low restart counts are a transient environmental issue unrelated to this PR"
Test results	110 tests, 8 skipped, 19 failures — all 19 failures cascade from the 6 EnsureNoCrashingPods sub-test failures

---

[openshift-merge-bot]

/hold

Revision fc17f23 was retested 3 times: holding

[jparrill]

/test e2e-azure-self-managed

[jparrill]

/hold cancel

[openshift-ci]

@jparrill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@jparrill: Jira Issue Verification Checks: Jira Issue OCPBUGS-83751
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-83751 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

• Add cluster-scoped RBAC rule for mutatingwebhookconfigurations and validatingwebhookconfigurations with get, list, watch, update verbs to the hypershift-operator ClusterRole
• The webhookcerts controller (PR CNTRLPLANE-2207: feat(install): self-manage webhook certs instead of relying on service-ca #8174, CNTRLPLANE-2207) uses Client.Get()/Client.Update() on these resources via the cached client, which triggers lazy informer creation requiring list/watch permissions at cluster scope
• Add unit tests verifying both the new cluster-scoped rule and the pre-existing scoped delete rule

Bug

Closes https://issues.redhat.com/browse/OCPBUGS-83751

Test plan

• Unit tests pass (go test -race ./cmd/install/assets/ -run TestHyperShiftOperatorClusterRole_WebhookRBAC)
• Build passes (go build ./cmd/install/...)
• Deploy with hypershift install and verify no reflector RBAC errors in operator logs

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests

• Added test coverage for HyperShift operator webhook configuration permissions.

• Chores

• Enhanced HyperShift operator role-based access control permissions to support webhook configuration management. Operator can now get, list, watch, and update mutating and validating webhook configurations as needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@celebdor: new pull request created: #8295

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-robot]

Fix included in release 5.0.0-0.nightly-2026-04-21-191046