Skip to content

Conversation

@patrickdillon
Copy link
Contributor

This fixes a bug on Azure where when we run openshift-install destroy bootstrap (after stopping the installer during an install) we get the error:

time="2025-12-05T00:53:58Z" level=fatal msg="error destroying bootstrap resources failed to run capi system: failed to run controller \"azure infrastructure provider\": failed to install controller \"azure infrastructure provider\" manifests in local control plane: unable to create CRD instances: CustomResourceDefinition.apiextensions.k8s.io \"extensions.kubernetesconfiguration.azure.com\" is invalid: status.storedVersions[1]: Invalid value: \"v1api20241101storage\": missing from spec.versions; v1api20241101storage was previously a storage version, and must remain in spec.versions until a storage migration ensures no data remains persisted in v1api20241101storage and removes v1api20241101storage from status.storedVersions"   

The reason we are getting this error is because there are conflicting CRDs between the azure-infrastructure-components.yaml file and azureaso-infrastructure-components.yaml.

CAPZ filters and includes ASO CRDs into its own CRDs:

https://github.com/kubernetes-sigs/cluster-api-provider-azure/blob/1d1291ce3d3b1982eb61cab0f0b381ff023ebda6/Makefile#L568-L577

The issue we are seeing is because CAPZ introduces additional CRDs that conflict with ASO CRDs. Specifically from the error the CRD extensions.kubernetesconfiguration.azure.com is included in both the CAPZ and ASO CRDs, but the ASO CRD includes the v1api20241101storage version which CAPZ does not.

When wer run the installer, Azure CRDs are installed and then ASO CRDs are installed. Because the ASO CRD (which includes the extra version) is installed second, it works. But when we run destroy bootstrap the ASO CRDs are restored from the etcd backup, and when envtest tries to re-install the Azure CRDs they conflict and we get the error.

The solution is to filter the ASO CRDs in the same manner as Azure. That way we can ensure the CRDs shared between the two components are compatible. In order to do this, we will need to use the existing ./hack/verify-capi-crds.sh script to generate ASO CRDs.

This PR also fixes some outstanding issues with that script. Most notably generating Nutanix CRDs has been troublesome, so this moves to downloading Nutanix CRDs.

cc @jhixson74 @rna-afk @sadasu (N.B. we must now use this script for ASO CRDS)

@openshift-ci-robot openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jan 13, 2026
@openshift-ci-robot
Copy link
Contributor

@patrickdillon: This pull request references Jira Issue OCPBUGS-69734, which is invalid:

  • expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This fixes a bug on Azure where when we run openshift-install destroy bootstrap (after stopping the installer during an install) we get the error:

time="2025-12-05T00:53:58Z" level=fatal msg="error destroying bootstrap resources failed to run capi system: failed to run controller \"azure infrastructure provider\": failed to install controller \"azure infrastructure provider\" manifests in local control plane: unable to create CRD instances: CustomResourceDefinition.apiextensions.k8s.io \"extensions.kubernetesconfiguration.azure.com\" is invalid: status.storedVersions[1]: Invalid value: \"v1api20241101storage\": missing from spec.versions; v1api20241101storage was previously a storage version, and must remain in spec.versions until a storage migration ensures no data remains persisted in v1api20241101storage and removes v1api20241101storage from status.storedVersions"   

The reason we are getting this error is because there are conflicting CRDs between the azure-infrastructure-components.yaml file and azureaso-infrastructure-components.yaml.

CAPZ filters and includes ASO CRDs into its own CRDs:

https://github.com/kubernetes-sigs/cluster-api-provider-azure/blob/1d1291ce3d3b1982eb61cab0f0b381ff023ebda6/Makefile#L568-L577

The issue we are seeing is because CAPZ introduces additional CRDs that conflict with ASO CRDs. Specifically from the error the CRD extensions.kubernetesconfiguration.azure.com is included in both the CAPZ and ASO CRDs, but the ASO CRD includes the v1api20241101storage version which CAPZ does not.

When wer run the installer, Azure CRDs are installed and then ASO CRDs are installed. Because the ASO CRD (which includes the extra version) is installed second, it works. But when we run destroy bootstrap the ASO CRDs are restored from the etcd backup, and when envtest tries to re-install the Azure CRDs they conflict and we get the error.

The solution is to filter the ASO CRDs in the same manner as Azure. That way we can ensure the CRDs shared between the two components are compatible. In order to do this, we will need to use the existing ./hack/verify-capi-crds.sh script to generate ASO CRDs.

This PR also fixes some outstanding issues with that script. Most notably generating Nutanix CRDs has been troublesome, so this moves to downloading Nutanix CRDs.

cc @jhixson74 @rna-afk @sadasu (N.B. we must now use this script for ASO CRDS)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@patrickdillon
Copy link
Contributor Author

This made some changes to ASH CRDs, which I can't test locally right now. Will see how they go here...

@patrickdillon
Copy link
Contributor Author

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jan 13, 2026
@openshift-ci-robot
Copy link
Contributor

@patrickdillon: This pull request references Jira Issue OCPBUGS-69734, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jinyunma

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested a review from jinyunma January 13, 2026 21:48
@jhixson74
Copy link
Member

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 14, 2026
@jhixson74
Copy link
Member

/approve

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 14, 2026
We have not been able to reliably automate the generation of the
nutanix CRDs. Instead, download them from the release.
CAPZ filters ASO CRDs so it only includes a small subset of ASO CRDs.
Prior to this commit, we were not filtering ASO CRDs, which leads to
a bug when ASO and CAPZ create conflicting CRDs. By filtering the ASO
CRDs in the same manner as CAPZ we can avoid the bug.
Bumps to v2.13 to be consistent with version used by CAPZ.
Regenerate Azure CRDs, after updating script to trim duplicate
CRDs from ASO.
@patrickdillon patrickdillon force-pushed the OCPBUGS-69734-az-destroy-bootstrap branch from ae5fc25 to e858af4 Compare January 14, 2026 20:46
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 14, 2026
@patrickdillon
Copy link
Contributor Author

/test ?

@patrickdillon
Copy link
Contributor Author

/test verify-cluster-api-manifests

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 14, 2026

@patrickdillon: The following commands are available to trigger required jobs:

/test artifacts-images
/test e2e-agent-compact-ipv4
/test e2e-aws-ovn
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-upi
/test e2e-azure-nat-gateway-single-zone
/test e2e-azure-ovn
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test gofmt
/test golint
/test govet
/test images
/test integration-tests
/test integration-tests-nodejoiner
/test okd-scos-images
/test openstack-manifests
/test shellcheck
/test unit
/test verify-codegen
/test verify-deps
/test verify-vendor
/test yaml-lint

The following commands are available to trigger optional jobs:

/test aws-private
/test azure-ovn-marketplace-images
/test azure-private
/test e2e-agent-4control-ipv4
/test e2e-agent-5control-ipv4
/test e2e-agent-compact-ipv4-appliance-diskimage
/test e2e-agent-compact-ipv4-iso-no-registry
/test e2e-agent-compact-ipv4-none-platform
/test e2e-agent-compact-ipv6-minimaliso
/test e2e-agent-ha-dualstack
/test e2e-agent-sno-ipv4-pxe
/test e2e-agent-sno-ipv6
/test e2e-agent-two-node-fencing-ipv4
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-custom-dns-techpreview
/test e2e-aws-default-config
/test e2e-aws-overlay-mtu-ovn-1200
/test e2e-aws-ovn-custom-iam-profile
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-proxy
/test e2e-aws-ovn-public-ipv4-pool
/test e2e-aws-ovn-public-ipv4-pool-disabled
/test e2e-aws-ovn-public-subnets
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-upgrade
/test e2e-aws-upi-proxy
/test e2e-azure-confidential-trustedlaunch
/test e2e-azure-custom-dns-techpreview
/test e2e-azure-default-config
/test e2e-azure-ovn-multidisk-techpreview
/test e2e-azure-ovn-resourcegroup
/test e2e-azure-ovn-shared-vpc
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-upi
/test e2e-azurestack
/test e2e-azurestack-upi
/test e2e-crc
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-gcp-custom-dns
/test e2e-gcp-custom-endpoints
/test e2e-gcp-default-config
/test e2e-gcp-ovn-byo-vpc
/test e2e-gcp-ovn-heterogeneous
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-xpn
/test e2e-gcp-secureboot
/test e2e-gcp-upgrade
/test e2e-gcp-upi-xpn
/test e2e-gcp-xpn-dedicated-dns-project
/test e2e-ibmcloud-ovn
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-ovn-two-node-arbiter
/test e2e-metal-ovn-two-node-fencing
/test e2e-metal-single-node-live-iso
/test e2e-nutanix-ovn
/test e2e-openstack-ccpmso
/test e2e-openstack-ccpmso-zone
/test e2e-openstack-dualstack
/test e2e-openstack-dualstack-upi
/test e2e-openstack-externallb
/test e2e-openstack-nfv-intel
/test e2e-openstack-proxy
/test e2e-openstack-singlestackv6
/test e2e-powervs-capi-ovn
/test e2e-vsphere-externallb-ovn
/test e2e-vsphere-host-groups-ovn-techpreview
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn-disk-setup-techpreview
/test e2e-vsphere-ovn-hybrid-env
/test e2e-vsphere-ovn-multi-disk
/test e2e-vsphere-ovn-multi-network
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-upi-zones
/test e2e-vsphere-ovn-zones
/test e2e-vsphere-ovn-zones-techpreview
/test e2e-vsphere-static-ovn
/test gcp-custom-endpoints-proxy-wif
/test gcp-private
/test okd-scos-e2e-aws-ovn

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-installer-main-artifacts-images
pull-ci-openshift-installer-main-azure-ovn-marketplace-images
pull-ci-openshift-installer-main-azure-private
pull-ci-openshift-installer-main-e2e-azure-default-config
pull-ci-openshift-installer-main-e2e-azure-ovn
pull-ci-openshift-installer-main-e2e-azure-ovn-shared-vpc
pull-ci-openshift-installer-main-e2e-azurestack
pull-ci-openshift-installer-main-e2e-gcp-custom-dns
pull-ci-openshift-installer-main-e2e-gcp-custom-endpoints
pull-ci-openshift-installer-main-e2e-gcp-default-config
pull-ci-openshift-installer-main-e2e-gcp-ovn
pull-ci-openshift-installer-main-e2e-gcp-ovn-byo-vpc
pull-ci-openshift-installer-main-e2e-gcp-ovn-xpn
pull-ci-openshift-installer-main-e2e-gcp-secureboot
pull-ci-openshift-installer-main-e2e-gcp-xpn-dedicated-dns-project
pull-ci-openshift-installer-main-gcp-custom-endpoints-proxy-wif
pull-ci-openshift-installer-main-gcp-private
pull-ci-openshift-installer-main-gofmt
pull-ci-openshift-installer-main-golint
pull-ci-openshift-installer-main-govet
pull-ci-openshift-installer-main-images
pull-ci-openshift-installer-main-okd-scos-images
pull-ci-openshift-installer-main-shellcheck
pull-ci-openshift-installer-main-unit
pull-ci-openshift-installer-main-verify-codegen
pull-ci-openshift-installer-main-verify-deps
pull-ci-openshift-installer-main-verify-vendor
pull-ci-openshift-installer-main-yaml-lint
Details

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 14, 2026

@patrickdillon: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test artifacts-images
/test e2e-agent-compact-ipv4
/test e2e-aws-ovn
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-upi
/test e2e-azure-nat-gateway-single-zone
/test e2e-azure-ovn
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test gofmt
/test golint
/test govet
/test images
/test integration-tests
/test integration-tests-nodejoiner
/test okd-scos-images
/test openstack-manifests
/test shellcheck
/test unit
/test verify-codegen
/test verify-deps
/test verify-vendor
/test yaml-lint

The following commands are available to trigger optional jobs:

/test aws-private
/test azure-ovn-marketplace-images
/test azure-private
/test e2e-agent-4control-ipv4
/test e2e-agent-5control-ipv4
/test e2e-agent-compact-ipv4-appliance-diskimage
/test e2e-agent-compact-ipv4-iso-no-registry
/test e2e-agent-compact-ipv4-none-platform
/test e2e-agent-compact-ipv6-minimaliso
/test e2e-agent-ha-dualstack
/test e2e-agent-sno-ipv4-pxe
/test e2e-agent-sno-ipv6
/test e2e-agent-two-node-fencing-ipv4
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-custom-dns-techpreview
/test e2e-aws-default-config
/test e2e-aws-overlay-mtu-ovn-1200
/test e2e-aws-ovn-custom-iam-profile
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-proxy
/test e2e-aws-ovn-public-ipv4-pool
/test e2e-aws-ovn-public-ipv4-pool-disabled
/test e2e-aws-ovn-public-subnets
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-upgrade
/test e2e-aws-upi-proxy
/test e2e-azure-confidential-trustedlaunch
/test e2e-azure-custom-dns-techpreview
/test e2e-azure-default-config
/test e2e-azure-ovn-multidisk-techpreview
/test e2e-azure-ovn-resourcegroup
/test e2e-azure-ovn-shared-vpc
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-upi
/test e2e-azurestack
/test e2e-azurestack-upi
/test e2e-crc
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-gcp-custom-dns
/test e2e-gcp-custom-endpoints
/test e2e-gcp-default-config
/test e2e-gcp-ovn-byo-vpc
/test e2e-gcp-ovn-heterogeneous
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-xpn
/test e2e-gcp-secureboot
/test e2e-gcp-upgrade
/test e2e-gcp-upi-xpn
/test e2e-gcp-xpn-dedicated-dns-project
/test e2e-ibmcloud-ovn
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-ovn-two-node-arbiter
/test e2e-metal-ovn-two-node-fencing
/test e2e-metal-single-node-live-iso
/test e2e-nutanix-ovn
/test e2e-openstack-ccpmso
/test e2e-openstack-ccpmso-zone
/test e2e-openstack-dualstack
/test e2e-openstack-dualstack-upi
/test e2e-openstack-externallb
/test e2e-openstack-nfv-intel
/test e2e-openstack-proxy
/test e2e-openstack-singlestackv6
/test e2e-powervs-capi-ovn
/test e2e-vsphere-externallb-ovn
/test e2e-vsphere-host-groups-ovn-techpreview
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn-disk-setup-techpreview
/test e2e-vsphere-ovn-hybrid-env
/test e2e-vsphere-ovn-multi-disk
/test e2e-vsphere-ovn-multi-network
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-upi-zones
/test e2e-vsphere-ovn-zones
/test e2e-vsphere-ovn-zones-techpreview
/test e2e-vsphere-static-ovn
/test gcp-custom-endpoints-proxy-wif
/test gcp-private
/test okd-scos-e2e-aws-ovn

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-installer-main-artifacts-images
pull-ci-openshift-installer-main-azure-ovn-marketplace-images
pull-ci-openshift-installer-main-azure-private
pull-ci-openshift-installer-main-e2e-azure-default-config
pull-ci-openshift-installer-main-e2e-azure-ovn
pull-ci-openshift-installer-main-e2e-azure-ovn-shared-vpc
pull-ci-openshift-installer-main-e2e-azurestack
pull-ci-openshift-installer-main-e2e-gcp-custom-dns
pull-ci-openshift-installer-main-e2e-gcp-custom-endpoints
pull-ci-openshift-installer-main-e2e-gcp-default-config
pull-ci-openshift-installer-main-e2e-gcp-ovn
pull-ci-openshift-installer-main-e2e-gcp-ovn-byo-vpc
pull-ci-openshift-installer-main-e2e-gcp-ovn-xpn
pull-ci-openshift-installer-main-e2e-gcp-secureboot
pull-ci-openshift-installer-main-e2e-gcp-xpn-dedicated-dns-project
pull-ci-openshift-installer-main-gcp-custom-endpoints-proxy-wif
pull-ci-openshift-installer-main-gcp-private
pull-ci-openshift-installer-main-gofmt
pull-ci-openshift-installer-main-golint
pull-ci-openshift-installer-main-govet
pull-ci-openshift-installer-main-images
pull-ci-openshift-installer-main-okd-scos-images
pull-ci-openshift-installer-main-shellcheck
pull-ci-openshift-installer-main-unit
pull-ci-openshift-installer-main-verify-codegen
pull-ci-openshift-installer-main-verify-deps
pull-ci-openshift-installer-main-verify-vendor
pull-ci-openshift-installer-main-yaml-lint
Details

In response to this:

/test verify-cluster-api-manifests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@jhixson74
Copy link
Member

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 15, 2026
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 15, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhixson74

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jinyunma
Copy link
Contributor

jinyunma commented Jan 15, 2026

pre-merge tested, command "./openshift-install destroy bootstrap" works well, all related resources are deleted with this command.
And also did regression test, installation on Azure Stack, Azure Gov Cloud and several different configurations on Azure public cloud are all passed.

/verified by jima

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jan 15, 2026
@openshift-ci-robot
Copy link
Contributor

@jinyunma: This PR has been marked as verified by jima.

Details

In response to this:

pre-merge tested, installation on Azure Stack, Azure Gov Cloud and several different configurations on Azure public cloud are all passed.

/verified by jima

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 15d1d85 and 2 for PR HEAD e858af4 in total

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 15, 2026

@patrickdillon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-azurestack e858af4 link false /test e2e-azurestack
ci/prow/gcp-private e858af4 link false /test gcp-private
ci/prow/e2e-gcp-ovn-byo-vpc e858af4 link false /test e2e-gcp-ovn-byo-vpc
ci/prow/e2e-gcp-custom-dns e858af4 link false /test e2e-gcp-custom-dns

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit 4044020 into openshift:main Jan 15, 2026
25 of 29 checks passed
@openshift-ci-robot
Copy link
Contributor

@patrickdillon: Jira Issue Verification Checks: Jira Issue OCPBUGS-69734
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-69734 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

This fixes a bug on Azure where when we run openshift-install destroy bootstrap (after stopping the installer during an install) we get the error:

time="2025-12-05T00:53:58Z" level=fatal msg="error destroying bootstrap resources failed to run capi system: failed to run controller \"azure infrastructure provider\": failed to install controller \"azure infrastructure provider\" manifests in local control plane: unable to create CRD instances: CustomResourceDefinition.apiextensions.k8s.io \"extensions.kubernetesconfiguration.azure.com\" is invalid: status.storedVersions[1]: Invalid value: \"v1api20241101storage\": missing from spec.versions; v1api20241101storage was previously a storage version, and must remain in spec.versions until a storage migration ensures no data remains persisted in v1api20241101storage and removes v1api20241101storage from status.storedVersions"   

The reason we are getting this error is because there are conflicting CRDs between the azure-infrastructure-components.yaml file and azureaso-infrastructure-components.yaml.

CAPZ filters and includes ASO CRDs into its own CRDs:

https://github.com/kubernetes-sigs/cluster-api-provider-azure/blob/1d1291ce3d3b1982eb61cab0f0b381ff023ebda6/Makefile#L568-L577

The issue we are seeing is because CAPZ introduces additional CRDs that conflict with ASO CRDs. Specifically from the error the CRD extensions.kubernetesconfiguration.azure.com is included in both the CAPZ and ASO CRDs, but the ASO CRD includes the v1api20241101storage version which CAPZ does not.

When wer run the installer, Azure CRDs are installed and then ASO CRDs are installed. Because the ASO CRD (which includes the extra version) is installed second, it works. But when we run destroy bootstrap the ASO CRDs are restored from the etcd backup, and when envtest tries to re-install the Azure CRDs they conflict and we get the error.

The solution is to filter the ASO CRDs in the same manner as Azure. That way we can ensure the CRDs shared between the two components are compatible. In order to do this, we will need to use the existing ./hack/verify-capi-crds.sh script to generate ASO CRDs.

This PR also fixes some outstanding issues with that script. Most notably generating Nutanix CRDs has been troublesome, so this moves to downloading Nutanix CRDs.

cc @jhixson74 @rna-afk @sadasu (N.B. we must now use this script for ASO CRDS)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@tthvo
Copy link
Member

tthvo commented Jan 15, 2026

/cherry-pick release-4.21

@openshift-cherrypick-robot

@tthvo: Failed to get PR patch from GitHub. This PR will need to be manually cherrypicked.

Error messagestatus code 406 not one of [200], body: {"message":"Sorry, the diff exceeded the maximum number of files (300). Consider using 'List pull requests files' API or locally cloning the repository instead.","errors":[{"resource":"PullRequest","field":"diff","code":"too_large"}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#list-pull-requests-files","status":"406"}
Details

In response to this:

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-merge-robot
Copy link
Contributor

Fix included in accepted release 4.22.0-0.nightly-2026-01-19-085729

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants