OCPBUGS-63698: feat(azure): add HYPERSHIFT_IMAGE env var for token-minter #643
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
/uncc @jsafrane |
|
/uncc @gnufied |
bryan-cox
changed the title
openshift-ci-robot
added
jira/severity-critical
|
@bryan-cox: This pull request references Jira Issue OCPBUGS-63698, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Add conditional logic to pass HYPERSHIFT_IMAGE environment variable to Azure Disk and Azure File CSI driver operators only when running on self-managed Azure HyperShift clusters. For ARO HCP deployments, the Secret Provider Class pattern is used instead of token-minter, so HYPERSHIFT_IMAGE is not needed. This change detects ARO HCP mode by checking for the presence of ARO_HCP_SECRET_PROVIDER_CLASS_FOR_* environment variables. Signed-off-by: Bryan Cox <brcox@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)
bryan-cox
force-pushed
the
OCPBUGS-63698-hypershift-image
branch
from
95b0b4f to
92095c9
Compare
|
/test all |
|
/test hypershift-e2e-aks |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@bryan-cox: This pull request references Jira Issue OCPBUGS-63698, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (wduan@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@bryan-cox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/payload-job-with-prs periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-ovn-hypershift-guest-f7 #643,openshift/csi-operator#461,openshift/hypershift#7157 |
|
@duanwei33: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info. |
|
/payload-job-with-prs periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-ovn-hypershift-guest-f7 openshift/csi-operator#461,openshift/hypershift#7157 |
|
@duanwei33: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info. |
|
/payload-job-with-prs help |
|
@duanwei33: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info. |
|
/payload-job-with-prs periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-ovn-hypershift-guest-f7 openshift/csi-operator#461 openshift/hypershift#7157 |
|
@duanwei33: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/7142dd10-d6fe-11f0-8d59-3afbbfee03e5-0 |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox, dfajmon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
7 participants
Summary
Adds conditional logic to pass
HYPERSHIFT_IMAGEenvironment variable to Azure Disk and Azure File CSI driver operator deployments in HyperShift mode for self-managed Azure clusters only. This enables the CSI driver operators to inject token-minter sidecars for Azure workload identity authentication.Problem
Azure Disk and File CSI drivers fail on Azure self-managed hosted clusters because the token-minter container image is not specified. The CSI driver operators use the
WithTokenMinter()deployment hook, but the HYPERSHIFT_IMAGE environment variable was never passed from cluster-storage-operator to the CSI driver operator pods.Solution
This PR adds runtime conditional logic in
hypershift_deployment_controller.gothat:ARO_HCP_SECRET_PROVIDER_CLASS_FOR_*environment variablesHYPERSHIFT_IMAGEto Azure CSI driver operators only when ARO HCP env vars are absent (self-managed Azure)HYPERSHIFT_IMAGEfor ARO HCP deployments (which use Secret Provider Class instead)The flow for self-managed Azure:
HYPERSHIFT_IMAGEon cluster-storage-operator deploymentWithTokenMinter()hook to inject token-minter containersThis matches the existing pattern used by AWS EBS CSI driver operator.
Changes
pkg/operator/csidriveroperator/hypershift_deployment_controller.go(lines 159-170)HYPERSHIFT_IMAGEto Azure Disk CSI driver operator only whenARO_HCP_SECRET_PROVIDER_CLASS_FOR_DISKis not setHYPERSHIFT_IMAGEto Azure File CSI driver operator only whenARO_HCP_SECRET_PROVIDER_CLASS_FOR_FILEis not setRelated PRs
References