OCPBUGS-72555: Restrict CPMS boot image configuration to only AWS, GCP and Azure platforms

[djoshy]

- What I did
This PR adds a ValidatingAdmissionPolicy that limits addition of the CPMS MachineManager to the boot image configuration only for the AWS, GCP, Azure platforms.

- How to verify it
Note that this feature is still under techpreview, so it will need a cluster launched with that TP enabled. Attempt to add a boot image configuration for controlplanemachinesets:

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
  namespace: openshift-machine-config-operator
spec:
  logLevel: Normal
  operatorLogLevel: Normal
  managedBootImages:
    machineManagers:
      - resource: controlplanemachinesets
        apiGroup: machine.openshift.io
        selection:
          mode: All

The APIServer should permit this for the platforms mentioned above and reject it for any other platforms, including vsphere with an error message like:

The machineconfigurations "cluster" is invalid: : ValidatingAdmissionPolicy 'managed-bootimages-cpms-platform-check' with binding 'managed-bootimages-cpms-platform-check-binding' denied request: The control plane machineset boot image update feature is only supported on these platforms: GCP, AWS, Azure

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-72555, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

- What I did
This PR adds a ValidatingAdmissionPolicy that limits addition of the CPMS MachineManager to the boot image configuration only for the AWS, GCP, Azure platforms.

- How to verify it
Note that this feature is still under techpreview, so it will need a cluster launched with that TP enabled. Attempt to add a boot image configuration for controlplanemachinesets:

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
 name: cluster
 namespace: openshift-machine-config-operator
spec:
 logLevel: Normal
 operatorLogLevel: Normal
 managedBootImages:
   machineManagers:
     - resource: controlplanemachinesets
       apiGroup: machine.openshift.io
       selection:
         mode: All

The APIServer should permit this for the platforms mentioned above and reject it for any other platforms, including vsphere.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-72555, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

Details

In response to this:

- What I did
This PR adds a ValidatingAdmissionPolicy that limits addition of the CPMS MachineManager to the boot image configuration only for the AWS, GCP, Azure platforms.

- How to verify it
Note that this feature is still under techpreview, so it will need a cluster launched with that TP enabled. Attempt to add a boot image configuration for controlplanemachinesets:

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
 name: cluster
 namespace: openshift-machine-config-operator
spec:
 logLevel: Normal
 operatorLogLevel: Normal
 managedBootImages:
   machineManagers:
     - resource: controlplanemachinesets
       apiGroup: machine.openshift.io
       selection:
         mode: All

The APIServer should permit this for the platforms mentioned above and reject it for any other platforms, including vsphere with an error message like:

The machineconfigurations "cluster" is invalid: : ValidatingAdmissionPolicy 'managed-bootimages-cpms-platform-check' with binding 'managed-bootimages-cpms-platform-check-binding' denied request: The control plane machineset boot image update feature is only supported on these platforms: GCP, AWS, Azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/cherry-pick release-4.21

[openshift-cherrypick-robot]

@djoshy: once the present PR merges, I will cherry-pick it on top of release-4.21 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[isabella-janssen]

/lgtm

[isabella-janssen]

/lgtm

[djoshy]

/test all

[isabella-janssen]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: djoshy, isabella-janssen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [djoshy,isabella-janssen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sergiordlr]

Verified in IPI on AWS, GCP, Azure and Vsphere

We could configure controlplanemachineest without problems in AWS, GCP and Azure

In vsphere the configuration is forbidden

# * : ValidatingAdmissionPolicy 'managed-bootimages-cpms-platform-check' with binding 'managed-bootimages-cpms-platform-check-binding' denied request: The control plane machineset boot image update feature is only supported on these platforms: GCP, AWS, Azure

Test case "[sig-mco] MCO ControlPlaneMachineSet Author:sregidor-NonHyperShiftHOST-NonPreRelease-Medium-87023-MachineConfiguration status correctly reflects spec changes [Disruptive] [Serial]" was executed to make sure that other configurations can be applied

In vshpere the boot images update tests are passing too.

/verified by @sergiordlr

[openshift-ci-robot]

@sergiordlr: This PR has been marked as verified by @sergiordlr.

Details

In response to this:

Verified in IPI on AWS, GCP, Azure and Vsphere

We could configure controlplanemachineest without problems in AWS, GCP and Azure

In vsphere the configuration is forbidden

# * : ValidatingAdmissionPolicy 'managed-bootimages-cpms-platform-check' with binding 'managed-bootimages-cpms-platform-check-binding' denied request: The control plane machineset boot image update feature is only supported on these platforms: GCP, AWS, Azure

Test case "[sig-mco] MCO ControlPlaneMachineSet Author:sregidor-NonHyperShiftHOST-NonPreRelease-Medium-87023-MachineConfiguration status correctly reflects spec changes [Disruptive] [Serial]" was executed to make sure that other configurations can be applied

In vshpere the boot images update tests are passing too.

/verified by @sergiordlr

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/test all

[djoshy]

/retest-required

[djoshy]

/retest-required

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 7067ecb and 2 for PR HEAD e3841fb in total

[djoshy]

/retest-required

[djoshy]

/retest-required

[openshift-ci]

@djoshy: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-op-ocl	e3841fb	link	false	/test e2e-gcp-op-ocl

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@djoshy: Jira Issue Verification Checks: Jira Issue OCPBUGS-72555
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-72555 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

- What I did
This PR adds a ValidatingAdmissionPolicy that limits addition of the CPMS MachineManager to the boot image configuration only for the AWS, GCP, Azure platforms.

- How to verify it
Note that this feature is still under techpreview, so it will need a cluster launched with that TP enabled. Attempt to add a boot image configuration for controlplanemachinesets:

apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
 name: cluster
 namespace: openshift-machine-config-operator
spec:
 logLevel: Normal
 operatorLogLevel: Normal
 managedBootImages:
   machineManagers:
     - resource: controlplanemachinesets
       apiGroup: machine.openshift.io
       selection:
         mode: All

The APIServer should permit this for the platforms mentioned above and reject it for any other platforms, including vsphere with an error message like:

The machineconfigurations "cluster" is invalid: : ValidatingAdmissionPolicy 'managed-bootimages-cpms-platform-check' with binding 'managed-bootimages-cpms-platform-check-binding' denied request: The control plane machineset boot image update feature is only supported on these platforms: GCP, AWS, Azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@djoshy: #5540 failed to apply on top of branch "release-4.21":

Applying: add VAP for CPMS boot image updates
Using index info to reconstruct a base tree...
M	pkg/operator/sync.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/operator/sync.go
CONFLICT (content): Merge conflict in pkg/operator/sync.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 add VAP for CPMS boot image updates

Details

In response to this:

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-robot]

Fix included in accepted release 4.22.0-0.nightly-2026-01-31-004202