ROSAENG-60886: improve hypershift-install Job robustness and RBAC

[theautoroboto]

Hardens the hypershift-install Job script and fixes upstream gaps:

• Use /bin/bash with set -euo pipefail for better error handling
• Fix OIDC variable syntax: $(VAR) → "${VAR}" (bug in origin/main)
• Capture hypershift install output and handle aws-iam-auth fork's known benign exit 2 error with namespace verification fallback
• Make external-dns flags conditional on externalDns.domain being set
• Add external-dns ClusterRole RBAC patch for discovery.k8s.io and networking.k8s.io API groups (missing in HyperShift's generated role)
• Improve external-dns deployment patch error handling with HTTP code capture and warning on failure instead of silent failure

These changes are independent of the Karpenter migration and improve Job reliability regardless of node provisioning method.

Summary by CodeRabbit

• Bug Fixes

  • Improved installation error handling and reporting.
  • Added validation to ensure required namespaces and post-install configuration are applied correctly.
  • Prevented external DNS settings from being applied when no domain is configured.

• Enhancements

  • External DNS role configuration is now applied automatically when configured.
  • Installation continues with a warning if optional external DNS updates cannot be completed.

[openshift-ci-robot]

@theautoroboto: This pull request references ROSAENG-60886 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Hardens the hypershift-install Job script and fixes upstream gaps:

• Use /bin/bash with set -euo pipefail for better error handling
• Fix OIDC variable syntax: $(VAR) → "${VAR}" (bug in origin/main)
• Capture hypershift install output and handle aws-iam-auth fork's known benign exit 2 error with namespace verification fallback
• Make external-dns flags conditional on externalDns.domain being set
• Add external-dns ClusterRole RBAC patch for discovery.k8s.io and networking.k8s.io API groups (missing in HyperShift's generated role)
• Improve external-dns deployment patch error handling with HTTP code capture and warning on failure instead of silent failure

These changes are independent of the Karpenter migration and improve Job reliability regardless of node provisioning method.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign psav for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6a9a7f4b-0dcb-42f3-b817-1b009dd08b48

📥 Commits

Reviewing files that changed from the base of the PR and between 7bf0af1 and 7a8f67b.

📒 Files selected for processing (1)

• argocd/config/management-cluster/hypershift/templates/05-job.yaml

---

📝 Walkthrough

Walkthrough

The Hypershift installer job now uses strict Bash execution, validates tolerated installation failures, and conditionally configures external-dns flags, deployment role assumptions, and ClusterRole permissions.

Changes

Hypershift installer flow

Layer / File(s)	Summary
Installer execution and failure validation argocd/config/management-cluster/hypershift/templates/05-job.yaml	The job uses strict Bash mode, configures AWS and Kubernetes credentials, captures the hypershift install status, and tolerates only the verified aws-iam-auth post-apply failure.
Conditional external-dns configuration argocd/config/management-cluster/hypershift/templates/05-job.yaml	External-dns flags and patches apply only when configuration exists. Deployment and ClusterRole patch failures produce warnings instead of failing the job.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels: review-ready

Suggested reviewers: typeid

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: improved hypershift-install Job robustness and RBAC.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[theautoroboto]

/test on-demand-e2e

[theautoroboto]

/retest

[theautoroboto]

/retest

[openshift-ci]

@theautoroboto: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/on-demand-e2e	7a8f67b	link	true	/test on-demand-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.