Skip to content

[release-4.22] OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS #8865

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
twolff-gh wants to merge 3 commits into
base: release-4.22
Choose a base branch
from
Open

[release-4.22] OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS #8865

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0cd10f3
feat(azure): add ACR pull identity to worker cloud.conf and VMSS
twolff-gh Jun 30, 2026
ee6dbf7
feat(hypershift-operator): add ACR pull identity configured metric
twolff-gh Jul 21, 2026
c180cce
fix(hypershift-operator,ignition-server): gate cloud config on hash t…
twolff-gh Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 71 additions & 0 deletions api/hypershift/v1beta1/azure.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -469,6 +469,16 @@ type AzurePlatformSpec struct {
// +kubebuilder:validation:MaxLength=255
TenantID string `json:"tenantID"`

// containerRegistry configures how worker nodes authenticate to Azure Container Registry (ACR).
// When set, the managed identity is attached to worker virtual machines and its resource ID is
// written into the worker cloud provider config so kubelet's ACR credential provider can
// authenticate without image pull secrets.
// Changing this value will trigger a rollout for all existing NodePools in the cluster.
//
// +rollout
// +optional
ContainerRegistry AzureContainerRegistryConfig `json:"containerRegistry,omitzero"`

// topology specifies the network topology of the API server endpoint for the hosted cluster.
// - Public: The API server is accessible only via a public endpoint.
// - PublicAndPrivate: The API server is accessible via both public and private endpoints.
Expand Down Expand Up @@ -546,6 +556,67 @@ type AzureResourceManagedIdentities struct {
// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$`
type AzureClientID string

// AzureManagedIdentityResourceID is an ARM resource ID for a user-assigned managed identity
// in the format /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{name}.
//
// +kubebuilder:validation:XValidation:rule="self.lowerAscii().matches('^/subscriptions/[^/]+/resourcegroups/[^/]+/providers/microsoft\\\\.managedidentity/userassignedidentities/[^/]+$')",message="must be a user-assigned managed identity ARM resource ID in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}"
// +kubebuilder:validation:MinLength=131
// +kubebuilder:validation:MaxLength=345
type AzureManagedIdentityResourceID string

// UserAssignedManagedIdentity identifies a user-assigned managed identity by its ARM resource ID.
type UserAssignedManagedIdentity struct {
// resourceID is the ARM resource ID of the user-assigned managed identity
// in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}.
// The identity must have the AcrPull role on the target Azure Container Registry.
// It does not need to be in the same subscription or resource group as the HostedCluster,
// but it must be in the same Azure AD tenant.
//
// +required
ResourceID AzureManagedIdentityResourceID `json:"resourceID,omitempty"`
}

// AzureContainerRegistryConfig configures Azure Container Registry integration for a hosted cluster.
type AzureContainerRegistryConfig struct {
// credentials configures authentication for worker nodes pulling images from ACR
// using a user-assigned managed identity.
// The identity does not need to be in the same subscription or resource group as the
// HostedCluster, but it must be in the same Azure AD tenant. The management cluster's
// CAPZ identity must have Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action
// on the identity's scope to attach it to worker virtual machines at creation time.
//
// +required
Credentials AzureContainerRegistryCredentialConfig `json:"credentials,omitzero"`
}

// AzureContainerRegistryCredentialType identifies the type of credential used for ACR image pulls.
//
// +kubebuilder:validation:Enum=ManagedIdentity
type AzureContainerRegistryCredentialType string

const (
// AzureContainerRegistryCredentialManagedIdentity uses a user-assigned managed identity for ACR authentication.
AzureContainerRegistryCredentialManagedIdentity AzureContainerRegistryCredentialType = "ManagedIdentity"
)

// AzureContainerRegistryCredentialConfig configures authentication credentials for Azure Container Registry.
//
// +kubebuilder:validation:XValidation:rule="self.type == 'ManagedIdentity' ? has(self.managedIdentity) : !has(self.managedIdentity)",message="managedIdentity is required when type is ManagedIdentity, and forbidden otherwise"
// +union
type AzureContainerRegistryCredentialConfig struct {
// type specifies the credential type used for ACR image pulls.
//
// +required
// +unionDiscriminator
Type AzureContainerRegistryCredentialType `json:"type,omitempty"`

// managedIdentity identifies the user-assigned managed identity used for ACR image pulls.
//
// +optional
// +unionMember
ManagedIdentity UserAssignedManagedIdentity `json:"managedIdentity,omitzero"`
}

// AzureWorkloadIdentities is a struct that contains the client IDs of all the managed identities in self-managed Azure
// needing to authenticate with Azure's API.
type AzureWorkloadIdentities struct {
Expand Down
48 changes: 48 additions & 0 deletions api/hypershift/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

55 changes: 55 additions & 0 deletions ...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4982,6 +4982,61 @@ spec:
- AzureGermanCloud
- AzureStackCloud
type: string
containerRegistry:
description: |-
containerRegistry configures how worker nodes authenticate to Azure Container Registry (ACR).
When set, the managed identity is attached to worker virtual machines and its resource ID is
written into the worker cloud provider config so kubelet's ACR credential provider can
authenticate without image pull secrets.
Changing this value will trigger a rollout for all existing NodePools in the cluster.
properties:
credentials:
description: |-
credentials configures authentication for worker nodes pulling images from ACR
using a user-assigned managed identity.
The identity does not need to be in the same subscription or resource group as the
HostedCluster, but it must be in the same Azure AD tenant. The management cluster's
CAPZ identity must have Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action
on the identity's scope to attach it to worker virtual machines at creation time.
properties:
managedIdentity:
description: managedIdentity identifies the user-assigned
managed identity used for ACR image pulls.
properties:
resourceID:
description: |-
resourceID is the ARM resource ID of the user-assigned managed identity
in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}.
The identity must have the AcrPull role on the target Azure Container Registry.
It does not need to be in the same subscription or resource group as the HostedCluster,
but it must be in the same Azure AD tenant.
maxLength: 345
minLength: 131
type: string
x-kubernetes-validations:
- message: must be a user-assigned managed identity
ARM resource ID in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}
rule: self.lowerAscii().matches('^/subscriptions/[^/]+/resourcegroups/[^/]+/providers/microsoft\\.managedidentity/userassignedidentities/[^/]+$')
required:
- resourceID
type: object
type:
description: type specifies the credential type used
for ACR image pulls.
enum:
- ManagedIdentity
type: string
required:
- type
type: object
x-kubernetes-validations:
- message: managedIdentity is required when type is ManagedIdentity,
and forbidden otherwise
rule: 'self.type == ''ManagedIdentity'' ? has(self.managedIdentity)
: !has(self.managedIdentity)'
required:
- credentials
type: object
location:
description: |-
location is the Azure region in where all the cloud infrastructure resources will be created.
Expand Down
55 changes: 55 additions & 0 deletions ....featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5109,6 +5109,61 @@ spec:
- AzureGermanCloud
- AzureStackCloud
type: string
containerRegistry:
description: |-
containerRegistry configures how worker nodes authenticate to Azure Container Registry (ACR).
When set, the managed identity is attached to worker virtual machines and its resource ID is
written into the worker cloud provider config so kubelet's ACR credential provider can
authenticate without image pull secrets.
Changing this value will trigger a rollout for all existing NodePools in the cluster.
properties:
credentials:
description: |-
credentials configures authentication for worker nodes pulling images from ACR
using a user-assigned managed identity.
The identity does not need to be in the same subscription or resource group as the
HostedCluster, but it must be in the same Azure AD tenant. The management cluster's
CAPZ identity must have Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action
on the identity's scope to attach it to worker virtual machines at creation time.
properties:
managedIdentity:
description: managedIdentity identifies the user-assigned
managed identity used for ACR image pulls.
properties:
resourceID:
description: |-
resourceID is the ARM resource ID of the user-assigned managed identity
in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}.
The identity must have the AcrPull role on the target Azure Container Registry.
It does not need to be in the same subscription or resource group as the HostedCluster,
but it must be in the same Azure AD tenant.
maxLength: 345
minLength: 131
type: string
x-kubernetes-validations:
- message: must be a user-assigned managed identity
ARM resource ID in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}
rule: self.lowerAscii().matches('^/subscriptions/[^/]+/resourcegroups/[^/]+/providers/microsoft\\.managedidentity/userassignedidentities/[^/]+$')
required:
- resourceID
type: object
type:
description: type specifies the credential type used
for ACR image pulls.
enum:
- ManagedIdentity
type: string
required:
- type
type: object
x-kubernetes-validations:
- message: managedIdentity is required when type is ManagedIdentity,
and forbidden otherwise
rule: 'self.type == ''ManagedIdentity'' ? has(self.managedIdentity)
: !has(self.managedIdentity)'
required:
- credentials
type: object
location:
description: |-
location is the Azure region in where all the cloud infrastructure resources will be created.
Expand Down
Loading
Loading