OCPBUGS-42434: Enable Managed Identity w/ Certificates in HyperShift Control Plane Components by bryan-cox · Pull Request #5160 · openshift/hypershift

bryan-cox · 2024-11-20T01:27:43Z

What this PR does / why we need it:
This PR enables components in the hosted control plane to authenticate with Azure Cloud through client certificate. These components include:

KMS
CPO
CAPZ
Cloud Provider

Which issue(s) this PR fixes:
Fixes OCPBUGS-42434

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci · 2024-11-20T01:27:47Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2024-11-20T01:28:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2024-11-20T01:29:23Z

✅ Deploy Preview for hypershift-docs ready!

Name	Link
🔨 Latest commit	`ef8852b`
🔍 Latest deploy log	https://app.netlify.com/sites/hypershift-docs/deploys/673dd254c493be0008a659e4
😎 Deploy Preview	https://deploy-preview-5160--hypershift-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

openshift-ci-robot · 2024-11-20T12:17:56Z

@bryan-cox: This pull request references Jira Issue OCPBUGS-42434, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @fxierh

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bryan-cox · 2024-12-03T02:25:14Z

/retest

enxebre · 2024-12-03T11:38:17Z

 	}

+	// Reconcile the SecretProviderClass
+	nodepoolMgmtSecretProviderClass := manifests.ManagedAzureSecretProviderClass(config.ManagedAzureNodePoolMgmtSecretProviderClassName, controlPlaneNamespace)


nit: nodePool

enxebre · 2024-12-03T11:45:23Z

/lgtm

openshift-ci-robot · 2024-12-03T12:28:15Z

/retest-required

Remaining retests: 0 against base HEAD e9fec4b and 2 for PR HEAD 33cebed in total

bryan-cox · 2024-12-03T13:47:30Z

/test e2e-aws-4-18

bryan-cox · 2024-12-03T15:13:48Z

/retest-required

bryan-cox · 2024-12-03T15:35:29Z

/retest-required

bryan-cox · 2024-12-03T16:07:41Z

/retest-required

bryan-cox · 2024-12-03T17:37:34Z

/retest-required

bryan-cox · 2024-12-03T20:21:50Z

/retest-required

openshift-ci-robot · 2024-12-03T23:53:33Z

/retest-required

Remaining retests: 0 against base HEAD e9fec4b and 2 for PR HEAD 33cebed in total

openshift-ci-robot · 2024-12-04T02:12:07Z

/retest-required

Remaining retests: 0 against base HEAD e9fec4b and 2 for PR HEAD 33cebed in total

openshift-ci · 2024-12-04T03:30:11Z

@bryan-cox: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-4-17	`ce31d49`	link	true	`/test e2e-aws-4-17`
ci/prow/e2e-aks	`33cebed`	link	false	`/test e2e-aks`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-12-04T13:07:44Z

/retest-required

Remaining retests: 0 against base HEAD e9fec4b and 2 for PR HEAD 33cebed in total

openshift-ci-robot · 2024-12-04T13:12:58Z

/retest-required

Remaining retests: 0 against base HEAD e9fec4b and 2 for PR HEAD 33cebed in total

enxebre · 2024-12-04T14:23:47Z

/override ci/prow/e2e-kubevirt-aws-ovn-reduced

openshift-ci · 2024-12-04T14:29:32Z

@enxebre: Overrode contexts on behalf of enxebre: ci/prow/e2e-kubevirt-aws-ovn-reduced

Details

In response to this:

/override ci/prow/e2e-kubevirt-aws-ovn-reduced

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2024-12-04T14:32:19Z

@bryan-cox: Jira Issue OCPBUGS-42434: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-42434 has been moved to the MODIFIED state.

Details

In response to this:

What this PR does / why we need it:
This PR enables components in the hosted control plane to authenticate with Azure Cloud through client certificate. These components include:

KMS

CPO

CAPZ

Cloud Provider

Which issue(s) this PR fixes:
Fixes OCPBUGS-42434

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bryan-cox · 2024-12-04T17:37:16Z

/cherry-pick release-4.18

openshift-cherrypick-robot · 2024-12-04T17:37:59Z

@bryan-cox: #5160 failed to apply on top of branch "release-4.18":

Applying: Authenticate Azure KMS with cert authentication
Applying: Reconcile SecretProvider for CPO on ARO HCP
Using index info to reconstruct a base tree...
M	cmd/infra/azure/create.go
M	control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
M	hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go
Falling back to patching base and 3-way merge...
Auto-merging hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
Auto-merging cmd/infra/azure/create.go
Applying: Update go.mod to include cert changes for CAPZ
Applying: Authenticate CAPZ with cert authentication
Using index info to reconstruct a base tree...
M	cmd/infra/azure/create.go
M	hypershift-operator/controllers/hostedcluster/internal/platform/azure/azure.go
Falling back to patching base and 3-way merge...
Auto-merging hypershift-operator/controllers/hostedcluster/internal/platform/azure/azure.go
Auto-merging cmd/infra/azure/create.go
CONFLICT (content): Merge conflict in cmd/infra/azure/create.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0004 Authenticate CAPZ with cert authentication

Details

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bryan-cox · 2024-12-04T17:39:32Z

/jira backport release-4.18

openshift-ci-robot · 2024-12-04T17:39:57Z

@bryan-cox: The following backport issues have been created:

OCPBUGS-45524 for branch release-4.18

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.18

Details

In response to this:

/jira backport release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2024-12-04T17:40:38Z

@openshift-ci-robot: #5160 failed to apply on top of branch "release-4.18":

Applying: Authenticate Azure KMS with cert authentication
Applying: Reconcile SecretProvider for CPO on ARO HCP
Using index info to reconstruct a base tree...
M	cmd/infra/azure/create.go
M	control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
M	hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go
Falling back to patching base and 3-way merge...
Auto-merging hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
Auto-merging cmd/infra/azure/create.go
Applying: Update go.mod to include cert changes for CAPZ
Applying: Authenticate CAPZ with cert authentication
Using index info to reconstruct a base tree...
M	cmd/infra/azure/create.go
M	hypershift-operator/controllers/hostedcluster/internal/platform/azure/azure.go
Falling back to patching base and 3-way merge...
Auto-merging hypershift-operator/controllers/hostedcluster/internal/platform/azure/azure.go
Auto-merging cmd/infra/azure/create.go
CONFLICT (content): Merge conflict in cmd/infra/azure/create.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0004 Authenticate CAPZ with cert authentication

Details

In response to this:

@bryan-cox: The following backport issues have been created:

OCPBUGS-45524 for branch release-4.18

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.18

In response to this:

/jira backport release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-12-04T19:08:54Z

[ART PR BUILD NOTIFIER]

Distgit: hypershift
This PR has been included in build ose-hypershift-container-v4.19.0-202412041809.p0.g857ccab.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 20, 2024

openshift-ci Bot added do-not-merge/needs-area area/api Indicates the PR includes changes for the API labels Nov 20, 2024

bryan-cox force-pushed the OCPBUGS-42434-combined branch 4 times, most recently from 7cdb04d to 3ce0090 Compare November 20, 2024 03:05

bryan-cox marked this pull request as ready for review November 20, 2024 03:05

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 20, 2024

openshift-ci Bot requested review from enxebre and hasueki November 20, 2024 03:06

bryan-cox force-pushed the OCPBUGS-42434-combined branch from 3ce0090 to ef8852b Compare November 20, 2024 12:13

bryan-cox changed the title ~~Ocpbugs 42434 combined~~ OCPBUGS-42434: Enable Managed Identity w/ Certificates in HyperShift Control Plane Components Nov 20, 2024

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Nov 20, 2024

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Nov 20, 2024

openshift-ci Bot requested a review from fxierh November 20, 2024 12:17

This was referenced Nov 20, 2024

OCPBUGS-42434: Reconcile SecretProvider for CPO on ARO HCP #4997

Closed

OCPBUGS-42434: Authenticate Azure KMS with cert authentication #5074

Closed

OCPBUGS-42434: Authenticate CAPZ with cert authentication on ARO HCP #5085

Closed

bryan-cox force-pushed the OCPBUGS-42434-combined branch from d3f443f to 33cebed Compare December 2, 2024 20:16

enxebre reviewed Dec 3, 2024

View reviewed changes

openshift-ci Bot assigned enxebre Dec 3, 2024

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Dec 3, 2024

openshift-merge-bot Bot merged commit 857ccab into openshift:main Dec 4, 2024

bryan-cox deleted the OCPBUGS-42434-combined branch December 4, 2024 14:52

bryan-cox mentioned this pull request Dec 4, 2024

[release-4.18] OCPBUGS-45524: Implement Managed Identities in HyperShift #5233

Merged

4 tasks

Conversation

bryan-cox commented Nov 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Nov 20, 2024

Uh oh!

openshift-ci Bot commented Nov 20, 2024

Uh oh!

netlify Bot commented Nov 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for hypershift-docs ready!

Uh oh!

openshift-ci-robot commented Nov 20, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

enxebre Dec 3, 2024

Choose a reason for hiding this comment

Uh oh!

enxebre commented Dec 3, 2024

Uh oh!

openshift-ci-robot commented Dec 3, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

bryan-cox commented Dec 3, 2024

Uh oh!

openshift-ci-robot commented Dec 3, 2024

Uh oh!

openshift-ci-robot commented Dec 4, 2024

Uh oh!

openshift-ci Bot commented Dec 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Dec 4, 2024

Uh oh!

openshift-ci-robot commented Dec 4, 2024

Uh oh!

enxebre commented Dec 4, 2024

Uh oh!

openshift-ci Bot commented Dec 4, 2024

Uh oh!

openshift-ci-robot commented Dec 4, 2024

Uh oh!

bryan-cox commented Dec 4, 2024

Uh oh!

openshift-cherrypick-robot commented Dec 4, 2024

Uh oh!

bryan-cox commented Dec 4, 2024

Uh oh!

openshift-ci-robot commented Dec 4, 2024

Uh oh!

openshift-cherrypick-robot commented Dec 4, 2024

Uh oh!

openshift-bot commented Dec 4, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

bryan-cox commented Nov 20, 2024 •

edited

Loading

netlify Bot commented Nov 20, 2024 •

edited

Loading

openshift-ci Bot commented Dec 4, 2024 •

edited

Loading