CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) by muraee · Pull Request #8721 · openshift/hypershift

muraee · 2026-06-11T16:22:39Z

Summary

Backport of CPO changes from #8537 to release-4.22. Only CPO and support changes are included — HO, sharedingress, and nodepool changes are excluded since they always run from main.

This enables the control plane operator to detect Azure topology and private connectivity settings through per-cluster API fields instead of the global MANAGED_SERVICE environment variable — critical for correctness when a management cluster hosts both ARO HCP and self-managed Azure clusters.

Changes

API types: Add AzurePrivateTypeSwift, AzureSwiftSpec to support Swift as a private connectivity mechanism
Visibility functions (support/util/visibility.go): Add UseSwiftNetworkingHCP/HC, IsAroHCPByHCP/HC, UseSharedIngressHCP/HC, SwiftPodNetworkInstanceHCP; update IsPrivateHCP/HC with Phase 1 fallback for empty Azure topology; update LabelHCPRoutes to use API-driven detection
Azure util (support/azureutil/): Add IsAroHCPByHCP/HC wrappers
CPO source (~25 files): Replace azureutil.IsAroHCP() with per-cluster azureutil.IsAroHCPByHCP(hcp); replace sharedingress.UseSharedIngress() with util.UseSharedIngressHCP(hcp); replace annotation-based Swift detection with util.UseSwiftNetworkingHCP(hcp)

What is NOT included (runs from main)

hypershift-operator/ changes
sharedingress-config-generator/ changes
hypershift-operator/controllers/nodepool/ changes
support/netutil/ package move (functions kept in support/util/)
PublicEndpointExposed condition (not referenced by CPO)

Test plan

go build ./control-plane-operator/... passes
go build ./support/... passes
go build ./hypershift-operator/... passes (no regressions)
go test ./support/util/... passes
go test ./support/azureutil/... passes
go test ./control-plane-operator/controllers/hostedcontrolplane/... passes
go test ./control-plane-operator/hostedclusterconfigoperator/... passes

/cc @enxebre

🤖 Generated with Claude Code

… (Phase 1) Backport CPO changes from PR openshift#8537 to release-4.22. This enables the control plane operator to detect Azure topology and private connectivity settings through per-cluster API fields instead of the global MANAGED_SERVICE environment variable — critical for correctness when a management cluster hosts both ARO HCP and self-managed Azure clusters. Key changes: - Add AzurePrivateTypeSwift and AzureSwiftSpec API types - Add per-cluster detection functions (IsAroHCPByHCP, UseSwiftNetworkingHCP, UseSharedIngressHCP, SwiftPodNetworkInstanceHCP) to support/util - Replace azureutil.IsAroHCP() with azureutil.IsAroHCPByHCP(hcp) across all CPO components (~25 files) - Replace sharedingress.UseSharedIngress() with util.UseSharedIngressHCP(hcp) - Update IsPrivateHCP/HC with Phase 1 fallback for empty Azure topology - Update LabelHCPRoutes to use API-driven shared ingress/Swift detection HO and sharedingress changes are excluded as they always run from main. Signed-off-by: Mulham Raee <[email protected]> Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

openshift-merge-bot · 2026-06-11T16:22:42Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-06-11T16:22:48Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7f729d0f-bae1-4f62-9841-8905e54cb9b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-06-11T16:24:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: muraee
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [muraee]
api/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2026-06-11T16:52:37Z

Codecov Report

❌ Patch coverage is 68.59504% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 35.47%. Comparing base (5cb8735) to head (1d5982e).

Files with missing lines	Patch %	Lines
...controllers/hostedcontrolplane/v2/storage/azure.go	0.00%	6 Missing ⚠️
...lplane/v2/cloud_controller_manager/azure/config.go	0.00%	3 Missing and 2 partials ⚠️
...ne/v2/cloud_controller_manager/azure/deployment.go	0.00%	3 Missing ⚠️
...rconfigoperator/controllers/resources/resources.go	25.00%	2 Missing and 1 partial ⚠️
...ostedcontrolplane/hostedcontrolplane_controller.go	0.00%	1 Missing and 1 partial ⚠️
...ane/v2/cloud_controller_manager/azure/component.go	0.00%	2 Missing ⚠️
...controlplane/v2/controlplaneoperator/deployment.go	0.00%	2 Missing ⚠️
...rollers/hostedcontrolplane/v2/router/deployment.go	0.00%	2 Missing ⚠️
...r/controllers/hostedcontrolplane/ingress/router.go	50.00%	0 Missing and 1 partial ⚠️
...controllers/hostedcontrolplane/v2/cno/component.go	0.00%	1 Missing ⚠️
... and 11 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-4.22    #8721      +/-   ##
================================================
+ Coverage         35.45%   35.47%   +0.02%     
================================================
  Files               767      767              
  Lines             93724    93754      +30     
================================================
+ Hits              33226    33258      +32     
+ Misses            57785    57783       -2     
  Partials           2713     2713

Files with missing lines	Coverage Δ
...ator/controllers/hostedcontrolplane/infra/infra.go	`50.54% <100.00%> (ø)`
.../controllers/hostedcontrolplane/kas/healthcheck.go	`100.00% <100.00%> (ø)`
...ator/controllers/hostedcontrolplane/kas/service.go	`39.81% <100.00%> (ø)`
...trollers/hostedcontrolplane/v2/router/util/util.go	`100.00% <100.00%> (ø)`
support/azureutil/azureutil.go	`43.58% <100.00%> (+0.73%)`	⬆️
support/util/visibility.go	`98.54% <100.00%> (+2.14%)`	⬆️
...r/controllers/hostedcontrolplane/ingress/router.go	`52.17% <50.00%> (ø)`
...controllers/hostedcontrolplane/v2/cno/component.go	`5.08% <0.00%> (ø)`
...ontrollers/hostedcontrolplane/v2/cno/deployment.go	`0.00% <0.00%> (ø)`
...hostedcontrolplane/v2/controlplaneoperator/role.go	`0.00% <0.00%> (ø)`
... and 17 more

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

openshift-ci-robot · 2026-06-11T21:17:34Z

@muraee: This pull request references CNTRLPLANE-3619 which is a valid jira issue.

Details

In response to this:

Summary

Backport of CPO changes from #8537 to release-4.22. Only CPO and support changes are included — HO, sharedingress, and nodepool changes are excluded since they always run from main.

This enables the control plane operator to detect Azure topology and private connectivity settings through per-cluster API fields instead of the global MANAGED_SERVICE environment variable — critical for correctness when a management cluster hosts both ARO HCP and self-managed Azure clusters.

Changes

API types: Add AzurePrivateTypeSwift, AzureSwiftSpec to support Swift as a private connectivity mechanism

Visibility functions (support/util/visibility.go): Add UseSwiftNetworkingHCP/HC, IsAroHCPByHCP/HC, UseSharedIngressHCP/HC, SwiftPodNetworkInstanceHCP; update IsPrivateHCP/HC with Phase 1 fallback for empty Azure topology; update LabelHCPRoutes to use API-driven detection

Azure util (support/azureutil/): Add IsAroHCPByHCP/HC wrappers

CPO source (~25 files): Replace azureutil.IsAroHCP() with per-cluster azureutil.IsAroHCPByHCP(hcp); replace sharedingress.UseSharedIngress() with util.UseSharedIngressHCP(hcp); replace annotation-based Swift detection with util.UseSwiftNetworkingHCP(hcp)

What is NOT included (runs from main)

hypershift-operator/ changes

sharedingress-config-generator/ changes

hypershift-operator/controllers/nodepool/ changes

support/netutil/ package move (functions kept in support/util/)

PublicEndpointExposed condition (not referenced by CPO)

Test plan

go build ./control-plane-operator/... passes

go build ./support/... passes

go build ./hypershift-operator/... passes (no regressions)

go test ./support/util/... passes

go test ./support/azureutil/... passes

go test ./control-plane-operator/controllers/hostedcontrolplane/... passes

go test ./control-plane-operator/hostedclusterconfigoperator/... passes

/cc @enxebre

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

muraee · 2026-06-12T09:22:43Z

/test e2e-aks

…Swift tests The new two-way CEL validation rule requires privateLink config when type is PrivateLink. Update the existing test expectation from "should pass" to "should fail" with the appropriate error message, and add privateLink config to the controlPlaneOperator identity guard test cases. Also add the new Swift private networking validation test cases from PR openshift#8537. Signed-off-by: Mulham Raee <[email protected]> Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

muraee · 2026-06-15T10:06:44Z

/test e2e-aks

muraee · 2026-06-16T09:36:57Z

/test e2e-aks

muraee · 2026-06-16T12:00:11Z

/test e2e-aks

muraee · 2026-06-16T12:00:57Z

/test images

celebdor · 2026-06-17T08:56:19Z

/retest-required

openshift-ci · 2026-06-17T10:56:55Z

@muraee: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot requested a review from enxebre June 11, 2026 16:22

openshift-ci Bot added do-not-merge/needs-area area/api Indicates the PR includes changes for the API labels Jun 11, 2026

celebdor changed the title ~~fix(cpo): backport API-driven Azure topology and private connectivity (Phase 1)~~ CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) Jun 11, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 11, 2026

enxebre reviewed Jun 12, 2026

View reviewed changes

Comment thread api/hypershift/v1beta1/azure.go

muraee force-pushed the backport-8537-cpo-release-4.22 branch from b9572e9 to 1d5982e Compare June 12, 2026 09:26

Conversation

muraee commented Jun 11, 2026

Summary

Changes

What is NOT included (runs from main)

Test plan

Uh oh!

openshift-merge-bot Bot commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci Bot commented Jun 11, 2026

Uh oh!

codecov Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

openshift-ci-robot commented Jun 11, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

What is NOT included (runs from main)

Test plan

Uh oh!

Uh oh!

muraee commented Jun 12, 2026

Uh oh!

muraee commented Jun 15, 2026

Uh oh!

muraee commented Jun 16, 2026

Uh oh!

muraee commented Jun 16, 2026

Uh oh!

muraee commented Jun 16, 2026

Uh oh!

celebdor commented Jun 17, 2026

Uh oh!

openshift-ci Bot commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

codecov Bot commented Jun 11, 2026 •

edited

Loading

openshift-ci-robot commented Jun 11, 2026 •

edited by openshift-ci Bot

Loading