[release-4.22] OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS#8865
[release-4.22] OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS#8865twolff-gh wants to merge 3 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Skipping CI for Draft Pull Request. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
e4513ac to
68f3b24
Compare
|
/jira cherry-pick OCPBUGS-86616 |
|
@celebdor: Jira Issue OCPBUGS-86616 has been cloned as Jira Issue OCPBUGS-94518. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@twolff-gh: This pull request references Jira Issue OCPBUGS-94518, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@celebdor: This pull request references Jira Issue OCPBUGS-94518, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Are both things the vm attachment and the cloud config propagated as a file for the payload generation needed for kubelet ACR pull to work? If the premise above is true, current implementation doesn't guarantee the latter. Changes to the cloud config do not result in new payload generation and propagation to nodes disk. This might be a good candidate for https://redhat.atlassian.net/browse/OCPSTRAT-3299. With current code you'd get what you want for:
You don't get cloud config day2 changes alone propagated to the nodes disk |
I see what your saying. Makes sense. And later refactored for OCPSTRAT-3299? |
Actually changes to ContainerRegistry will always trigger the rollout because of the machine template changes. I think we just need to gate writeCloudProviderConfig on a hash of the cloud config similar to what we do here for others already to mitigate the race hypershift/ignition-server/controllers/local_ignitionprovider.go Lines 621 to 633 in 488ef0e hypershift/ignition-server/controllers/local_ignitionprovider.go Lines 189 to 190 in 488ef0e |
|
/approve for API |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: JoelSpeed, twolff-gh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Please fix the description to reflect the right bug which is fixing this PR: https://redhat.atlassian.net/browse/OCPBUGS-94518 |
|
Agreeing the review from Alberto, please take a look to these comments. Thanks! |
|
@twolff-gh mind updating the description to say Fixes https://redhat.atlassian.net/browse/OCPBUGS-94518 |
|
@twolff-gh: This pull request references Jira Issue OCPBUGS-94518, which is valid. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
@sdminonne Done! |
|
/uncc @devguyio |
|
/pipeline required |
|
Scheduling tests matching the |
1 similar comment
|
Scheduling tests matching the |
|
/test e2e-kubevirt-aws-ovn-reduced |
|
/test e2e-azure-self-managed |
|
/test e2e-aws-4-21 |
jparrill
left a comment
There was a problem hiding this comment.
Dropped a comment. Thanks!
Cherry-pick of openshift#8472 to release-4.22. Resolved cherry-pick conflict: reverted k8sutil back to util (the k8sutil rename from main was never backported) and regenerated deepcopy for release-4.22 struct-typed AutoNode/KarpenterConfig fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Backport of be7bd91 from main (PR openshift#8840), adapted for release-4.22 metrics file structure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
f67a269 to
00ba333
Compare
…o prevent serving stale content Backport of PR openshift#8946 (946d0f9, 077d180) from main, adapted for release-4.22. Hashing uses existing HashSimple inlined at call sites instead of adding HashConfigMapData to support/util. No osStream parameter (CNTRLPLANE-3553 not on this branch). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
00ba333 to
c180cce
Compare
|
/test e2e-aks-4-21 |
|
/test e2e-aks-4-21 |
|
@twolff-gh: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
What this PR does / why we need it:
Backports #8472 to release-4.22. Adds ACR pull identity support to worker cloud.conf and VMSS so kubelet's ACR credential provider can authenticate to Azure Container Registry using a managed identity instead of image pull secrets.
Which issue(s) this PR fixes:
Fixes https://redhat.atlassian.net/browse/OCPBUGS-86616
Fixes https://redhat.atlassian.net/browse/OCPBUGS-94518
Special notes for your reviewer:
Not a clean cherry-pick. Two conflicts resolved:
Two additional commits added per reviewer guidance:
Collect()— main has decomposed per-cluster helpers.osStreamparameter omitted (CNTRLPLANE-3553 not on 4.22),k8sutil→supportutil, hashing inlined with existingHashSimpleinstead of addingHashConfigMapDatatosupport/util.Checklist: