CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) by muraee · Pull Request #8721 · openshift/hypershift

muraee · 2026-06-11T16:22:39Z

Summary

Backport of CPO changes from #8537 to release-4.22. Only CPO and support changes are included — HO, sharedingress, and nodepool changes are excluded since they always run from main.

This enables the control plane operator to detect Azure topology and private connectivity settings through per-cluster API fields instead of the global MANAGED_SERVICE environment variable — critical for correctness when a management cluster hosts both ARO HCP and self-managed Azure clusters.

Changes

API types: Add AzurePrivateTypeSwift, AzureSwiftSpec to support Swift as a private connectivity mechanism
Visibility functions (support/util/visibility.go): Add UseSwiftNetworkingHCP/HC, IsAroHCPByHCP/HC, UseSharedIngressHCP/HC, SwiftPodNetworkInstanceHCP; update IsPrivateHCP/HC with Phase 1 fallback for empty Azure topology; update LabelHCPRoutes to use API-driven detection
Azure util (support/azureutil/): Add IsAroHCPByHCP/HC wrappers
CPO source (~25 files): Replace azureutil.IsAroHCP() with per-cluster azureutil.IsAroHCPByHCP(hcp); replace sharedingress.UseSharedIngress() with util.UseSharedIngressHCP(hcp); replace annotation-based Swift detection with util.UseSwiftNetworkingHCP(hcp)

What is NOT included (runs from main)

hypershift-operator/ changes
sharedingress-config-generator/ changes
hypershift-operator/controllers/nodepool/ changes
support/netutil/ package move (functions kept in support/util/)
PublicEndpointExposed condition (not referenced by CPO)

Test plan

go build ./control-plane-operator/... passes
go build ./support/... passes
go build ./hypershift-operator/... passes (no regressions)
go test ./support/util/... passes
go test ./support/azureutil/... passes
go test ./control-plane-operator/controllers/hostedcontrolplane/... passes
go test ./control-plane-operator/hostedclusterconfigoperator/... passes

/cc @enxebre

🤖 Generated with Claude Code

… (Phase 1) Backport CPO changes from PR openshift#8537 to release-4.22. This enables the control plane operator to detect Azure topology and private connectivity settings through per-cluster API fields instead of the global MANAGED_SERVICE environment variable — critical for correctness when a management cluster hosts both ARO HCP and self-managed Azure clusters. Key changes: - Add AzurePrivateTypeSwift and AzureSwiftSpec API types - Add per-cluster detection functions (IsAroHCPByHCP, UseSwiftNetworkingHCP, UseSharedIngressHCP, SwiftPodNetworkInstanceHCP) to support/util - Replace azureutil.IsAroHCP() with azureutil.IsAroHCPByHCP(hcp) across all CPO components (~25 files) - Replace sharedingress.UseSharedIngress() with util.UseSharedIngressHCP(hcp) - Update IsPrivateHCP/HC with Phase 1 fallback for empty Azure topology - Update LabelHCPRoutes to use API-driven shared ingress/Swift detection HO and sharedingress changes are excluded as they always run from main. Signed-off-by: Mulham Raee <11375280+muraee@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-merge-bot · 2026-06-11T16:22:42Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-06-11T16:22:48Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7f729d0f-bae1-4f62-9841-8905e54cb9b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-06-11T16:52:37Z

Codecov Report

❌ Patch coverage is 68.59504% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 35.47%. Comparing base (5cb8735) to head (1d5982e).
⚠️ Report is 7 commits behind head on release-4.22.

Files with missing lines	Patch %	Lines
...controllers/hostedcontrolplane/v2/storage/azure.go	0.00%	6 Missing ⚠️
...lplane/v2/cloud_controller_manager/azure/config.go	0.00%	3 Missing and 2 partials ⚠️
...ne/v2/cloud_controller_manager/azure/deployment.go	0.00%	3 Missing ⚠️
...rconfigoperator/controllers/resources/resources.go	25.00%	2 Missing and 1 partial ⚠️
...ostedcontrolplane/hostedcontrolplane_controller.go	0.00%	1 Missing and 1 partial ⚠️
...ane/v2/cloud_controller_manager/azure/component.go	0.00%	2 Missing ⚠️
...controlplane/v2/controlplaneoperator/deployment.go	0.00%	2 Missing ⚠️
...rollers/hostedcontrolplane/v2/router/deployment.go	0.00%	2 Missing ⚠️
...r/controllers/hostedcontrolplane/ingress/router.go	50.00%	0 Missing and 1 partial ⚠️
...controllers/hostedcontrolplane/v2/cno/component.go	0.00%	1 Missing ⚠️
... and 11 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-4.22    #8721      +/-   ##
================================================
+ Coverage         35.45%   35.47%   +0.02%     
================================================
  Files               767      767              
  Lines             93724    93754      +30     
================================================
+ Hits              33226    33258      +32     
+ Misses            57785    57783       -2     
  Partials           2713     2713

Files with missing lines	Coverage Δ
...ator/controllers/hostedcontrolplane/infra/infra.go	`50.54% <100.00%> (ø)`
.../controllers/hostedcontrolplane/kas/healthcheck.go	`100.00% <100.00%> (ø)`
...ator/controllers/hostedcontrolplane/kas/service.go	`39.81% <100.00%> (ø)`
...trollers/hostedcontrolplane/v2/router/util/util.go	`100.00% <100.00%> (ø)`
support/azureutil/azureutil.go	`43.58% <100.00%> (+0.73%)`	⬆️
support/util/visibility.go	`98.54% <100.00%> (+2.14%)`	⬆️
...r/controllers/hostedcontrolplane/ingress/router.go	`52.17% <50.00%> (ø)`
...controllers/hostedcontrolplane/v2/cno/component.go	`5.08% <0.00%> (ø)`
...ontrollers/hostedcontrolplane/v2/cno/deployment.go	`0.00% <0.00%> (ø)`
...hostedcontrolplane/v2/controlplaneoperator/role.go	`0.00% <0.00%> (ø)`
... and 17 more

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

openshift-ci-robot · 2026-06-11T21:17:34Z

@muraee: This pull request references CNTRLPLANE-3619 which is a valid jira issue.

Details

In response to this:

Summary

Backport of CPO changes from #8537 to release-4.22. Only CPO and support changes are included — HO, sharedingress, and nodepool changes are excluded since they always run from main.

This enables the control plane operator to detect Azure topology and private connectivity settings through per-cluster API fields instead of the global MANAGED_SERVICE environment variable — critical for correctness when a management cluster hosts both ARO HCP and self-managed Azure clusters.

Changes

API types: Add AzurePrivateTypeSwift, AzureSwiftSpec to support Swift as a private connectivity mechanism

Visibility functions (support/util/visibility.go): Add UseSwiftNetworkingHCP/HC, IsAroHCPByHCP/HC, UseSharedIngressHCP/HC, SwiftPodNetworkInstanceHCP; update IsPrivateHCP/HC with Phase 1 fallback for empty Azure topology; update LabelHCPRoutes to use API-driven detection

Azure util (support/azureutil/): Add IsAroHCPByHCP/HC wrappers

CPO source (~25 files): Replace azureutil.IsAroHCP() with per-cluster azureutil.IsAroHCPByHCP(hcp); replace sharedingress.UseSharedIngress() with util.UseSharedIngressHCP(hcp); replace annotation-based Swift detection with util.UseSwiftNetworkingHCP(hcp)

What is NOT included (runs from main)

hypershift-operator/ changes

sharedingress-config-generator/ changes

hypershift-operator/controllers/nodepool/ changes

support/netutil/ package move (functions kept in support/util/)

PublicEndpointExposed condition (not referenced by CPO)

Test plan

go build ./control-plane-operator/... passes

go build ./support/... passes

go build ./hypershift-operator/... passes (no regressions)

go test ./support/util/... passes

go test ./support/azureutil/... passes

go test ./control-plane-operator/controllers/hostedcontrolplane/... passes

go test ./control-plane-operator/hostedclusterconfigoperator/... passes

/cc @enxebre

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

muraee · 2026-06-12T09:22:43Z

/test e2e-aks

…Swift tests The new two-way CEL validation rule requires privateLink config when type is PrivateLink. Update the existing test expectation from "should pass" to "should fail" with the appropriate error message, and add privateLink config to the controlPlaneOperator identity guard test cases. Also add the new Swift private networking validation test cases from PR openshift#8537. Signed-off-by: Mulham Raee <11375280+muraee@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

muraee · 2026-06-15T10:06:44Z

/test e2e-aks

muraee · 2026-06-16T09:36:57Z

/test e2e-aks

muraee · 2026-06-16T12:00:11Z

/test e2e-aks

muraee · 2026-06-16T12:00:57Z

/test images

celebdor · 2026-06-17T08:56:19Z

/retest-required

openshift-ci-robot · 2026-06-17T21:39:26Z

@zgalor: The /verified command must be used with one of the following actions: by, later, remove, or bypass. See https://docs.ci.openshift.org/docs/architecture/jira/#premerge-verification for more information.

Details

In response to this:

/verified zgalor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

zgalor · 2026-06-17T21:39:33Z

/lgtm

zgalor · 2026-06-17T21:40:08Z

/verified by zgalor

openshift-ci-robot · 2026-06-17T21:40:20Z

@zgalor: This PR has been marked as verified by zgalor.

Details

In response to this:

/verified by zgalor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

enxebre · 2026-06-18T09:06:24Z

/approve

muraee · 2026-06-23T12:05:45Z

/retest

muraee · 2026-06-23T12:06:23Z

/pipeline-required

muraee · 2026-06-23T12:08:06Z

/pipeline required

openshift-merge-bot · 2026-06-23T12:08:10Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

openshift-merge-bot · 2026-06-23T16:52:26Z

/retest-required

Remaining retests: 0 against base HEAD e3ad989 and 2 for PR HEAD 1d5982e in total

saschagrunert · 2026-06-24T06:01:33Z

 //
-// +kubebuilder:validation:XValidation:rule="self.type != 'PrivateLink' ? !has(self.privateLink) : true",message="privateLink is forbidden when type is not PrivateLink"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.type) || self.type == oldSelf.type",message="type is immutable"
+// +kubebuilder:validation:XValidation:rule="self.type == 'PrivateLink' ? has(self.privateLink) : !has(self.privateLink)",message="privateLink is required when type is PrivateLink, and forbidden otherwise"


This tightens validation. The old rule allowed type: PrivateLink without privateLink being set; the new rule requires it. Since PrivateLink AzurePrivateLinkSpec uses json:"privateLink,omitzero" and all its fields are optional, a zero-valued AzurePrivateLinkSpec{} will not serialize the key into the object. So any existing HostedCluster created with type: PrivateLink but no privateLink subfields populated will fail validation on any subsequent update.

The test rename at line 551 of the test suite ("should pass" -> "should fail") confirms this is intentional. Either add a ratcheting test proving existing objects survive updates, or confirm that no cluster exists in this state. Per API conventions, validation tightening requires ensuring writes to existing objects continue to work.

thanks @saschagrunert . This is just a backport so old code can reuse the new APIs. in Prod our CRDs are always deployed from main where the original PR was introduced and has all the tests.

saschagrunert

LGTM. API changes follow conventions, union discrimination and immutability rules are correct, Phase 1 fallback logic preserves existing behavior, test coverage is comprehensive.

openshift-ci · 2026-06-24T11:34:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, muraee, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre,muraee]
~~api/OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-06-26T00:46:29Z

/retest-required

Remaining retests: 0 against base HEAD f1fe6c1 and 1 for PR HEAD 1d5982e in total

openshift-ci · 2026-06-26T03:51:51Z

@muraee: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

….0-4.22.3 Add azure CPO image overrides for 4.22 to backport API-driven Azure topology and private connectivity (CNTRLPLANE-3619, PR openshift#8721) and etcd data re-encryption after encryption key rotation (CNTRLPLANE-3656, PR openshift#8790). 4.22.4 does not need an override: both PRs merged 2026-06-26, before the 4.22.4 development cutoff (2026-07-01). - 4.22.0-4.22.3: CNTRLPLANE-3619 (PR openshift#8721), CNTRLPLANE-3656 (PR openshift#8790) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add Azure CPO image overrides to fix KMS key rotation (OCPBUGS-98220, PR #8972) and ARO HCP ingress LB scope (OCPBUGS-98627, PR #8998). This supersedes the previous CNTRLPLANE-3619/3656 overrides for 4.22.0-4.22.3: the new Konflux image (commit fb3b1a3) includes all four PRs (#8721, #8790, #8972, #8998). 4.22.7 does not need an override: all PRs merged before the development cutoff (2026-07-22). Refs: OCPBUGS-98695 Signed-off-by: Antoni Segura Puimedon <antoni@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)

….0-4.22.3 Add azure CPO image overrides for 4.22 to backport API-driven Azure topology and private connectivity (CNTRLPLANE-3619, PR openshift#8721) and etcd data re-encryption after encryption key rotation (CNTRLPLANE-3656, PR openshift#8790). 4.22.4 does not need an override: both PRs merged 2026-06-26, before the 4.22.4 development cutoff (2026-07-01). - 4.22.0-4.22.3: CNTRLPLANE-3619 (PR openshift#8721), CNTRLPLANE-3656 (PR openshift#8790) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add Azure CPO image overrides to fix KMS key rotation (OCPBUGS-98220, PR openshift#8972) and ARO HCP ingress LB scope (OCPBUGS-98627, PR openshift#8998). This supersedes the previous CNTRLPLANE-3619/3656 overrides for 4.22.0-4.22.3: the new Konflux image (commit fb3b1a3) includes all four PRs (openshift#8721, openshift#8790, openshift#8972, openshift#8998). 4.22.7 does not need an override: all PRs merged before the development cutoff (2026-07-22). Refs: OCPBUGS-98695 Signed-off-by: Antoni Segura Puimedon <antoni@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)

openshift-ci Bot requested a review from enxebre June 11, 2026 16:22

celebdor changed the title ~~fix(cpo): backport API-driven Azure topology and private connectivity (Phase 1)~~ CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) Jun 11, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 11, 2026

enxebre reviewed Jun 12, 2026

View reviewed changes

Comment thread api/hypershift/v1beta1/azure.go

muraee force-pushed the backport-8537-cpo-release-4.22 branch from b9572e9 to 1d5982e Compare June 12, 2026 09:26

openshift-ci Bot assigned zgalor Jun 17, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 17, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jun 17, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 18, 2026

enxebre added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jun 22, 2026

muraee changed the title ~~CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1)~~ [release-4.22] CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) Jun 22, 2026

celebdor added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jun 22, 2026

celebdor changed the title ~~[release-4.22] CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1)~~ CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) Jun 22, 2026

saschagrunert reviewed Jun 24, 2026

View reviewed changes

saschagrunert approved these changes Jun 24, 2026

View reviewed changes

openshift-ci Bot assigned saschagrunert Jun 24, 2026

openshift-merge-bot Bot merged commit 76d3035 into openshift:release-4.22 Jun 26, 2026
35 checks passed

celebdor mentioned this pull request Jul 2, 2026

CNTRLPLANE-3619: add azure CPO overrides for 4.22.0-4.22.3 #8908

Merged

4 tasks

This was referenced Jul 15, 2026

OCPBUGS-98695: add Azure CPO overrides for 4.22 #9010

Merged

OCPBUGS-98695: add AWS CPO overrides for 4.22 #9009

Closed

Uh oh!

Conversation

muraee commented Jun 11, 2026

Summary

Changes

What is NOT included (runs from main)

Test plan

Uh oh!

openshift-merge-bot Bot commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codecov Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

openshift-ci-robot commented Jun 11, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

What is NOT included (runs from main)

Test plan

Uh oh!

Uh oh!

muraee commented Jun 12, 2026

Uh oh!

muraee commented Jun 15, 2026

Uh oh!

muraee commented Jun 16, 2026

Uh oh!

muraee commented Jun 16, 2026

Uh oh!

muraee commented Jun 16, 2026

Uh oh!

celebdor commented Jun 17, 2026

Uh oh!

openshift-ci-robot commented Jun 17, 2026

Uh oh!

zgalor commented Jun 17, 2026

Uh oh!

zgalor commented Jun 17, 2026

Uh oh!

openshift-ci-robot commented Jun 17, 2026

Uh oh!

enxebre commented Jun 18, 2026

Uh oh!

muraee commented Jun 23, 2026

Uh oh!

muraee commented Jun 23, 2026

Uh oh!

muraee commented Jun 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jun 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jun 23, 2026

Uh oh!

saschagrunert Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

muraee Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jun 24, 2026

Uh oh!

openshift-merge-bot Bot commented Jun 26, 2026

Uh oh!

Uh oh!

openshift-ci Bot commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

codecov Bot commented Jun 11, 2026 •

edited

Loading

openshift-ci-robot commented Jun 11, 2026 •

edited by openshift-ci Bot

Loading