From f0f0516c14a5de50bfc717555661e0523df358c3 Mon Sep 17 00:00:00 2001
From: Massimo Federico Bonfigli <fbonfigl@redhat.com>
Date: Tue, 4 Aug 2026 09:27:18 +0200
Subject: [PATCH] Inject AWS IAM SetSecurityGroups perm on upgrades to 4.23

Fix to make sure to inject the missing
elasticloadbalancing:SetSecurityGroups permission also on cluster
upgrades from 4.x to 4.23 as the new feature requiring the permission
is present on 5.0/4.23.
---
 .../openshift-upgrade-aws-patch-master-iam-commands.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh
index c2783720bf848..4baee33f2fae1 100755
--- a/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh
+++ b/ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh
@@ -10,6 +10,7 @@ export KUBECONFIG="${SHARED_DIR}/kubeconfig"
 
 SOURCE_VERSION=$(oc get clusterversion version -o jsonpath='{.status.desired.version}')
 SOURCE_MAJOR=$(echo "${SOURCE_VERSION}" | cut -d. -f1)
+SOURCE_MINOR=$(echo "${SOURCE_VERSION}" | cut -d. -f2)
 
 TARGET_VERSION=$(oc adm release info "${OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE:-}" \
     --output=json 2>/dev/null | jq -r '.metadata.version') || {
@@ -17,13 +18,16 @@ TARGET_VERSION=$(oc adm release info "${OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE
     exit 0
 }
 TARGET_MAJOR=$(echo "${TARGET_VERSION}" | cut -d. -f1)
+TARGET_MINOR=$(echo "${TARGET_VERSION}" | cut -d. -f2)
 
-if [[ "${SOURCE_MAJOR}" != "4" || "${TARGET_MAJOR}" != "5" ]]; then
-    echo "Not a 4.x to 5.x upgrade (${SOURCE_VERSION} to ${TARGET_VERSION}), skipping."
+echo "Detected upgrade from ${SOURCE_VERSION} to ${TARGET_VERSION}, determining eligibility."
+if [[ "${SOURCE_MAJOR}" != "4" || "${SOURCE_MINOR}" -gt 22 ]] || \
+   ! [[ "${TARGET_MAJOR}" == "5" || ( "${TARGET_MAJOR}" == "4" && "${TARGET_MINOR}" == "23" ) ]]; then
+    echo "Not an upgrade from version <=4.22 to 4.23/5.x, skipping."
     exit 0
 fi
 
-echo "Detected 4.x to 5.x upgrade (${SOURCE_VERSION} to ${TARGET_VERSION}), patching master IAM role."
+echo "Detected upgrade from version <=4.22 to 4.23/5.x (${SOURCE_VERSION} to ${TARGET_VERSION}), patching master IAM role."
 
 export AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred"
 REGION="${LEASED_RESOURCE}"