CNTRLPLANE-4010: add Azure AKS external OIDC periodic and presubmit jobs for 4.22 and 5.0 by Nirshal · Pull Request #83045 · openshift/release

Nirshal · 2026-08-06T14:23:14Z

What this PR does / why we need it:

Adds the missing Azure AKS external OIDC periodic and presubmit test jobs to release-4.22, release-4.23 and release-5.0. These jobs already exist on release-4.20 and release-4.21 but were not propagated to newer branches because config-brancher runs with --skip-periodics.

The base External OIDC feature (ExternalOIDCWithUIDAndExtraClaimMappings) is GA since 4.20. The non-techpreview test exercises GA functionality and should exist in all active releases. The techpreview variant tests ExternalOIDCWithUpstreamParity, which remains TechPreview-only.

Jobs added:

Job	Type	4.22	4.23	5.0
`e2e-azure-aks-external-oidc`	Periodic (daily, `0 9 * * *`)	Added	Added	Added
`e2e-azure-aks-external-oidc-techpreview`	Periodic (3x/month, `0 20 9,18,25 * *`)	Added	Added	Added
`e2e-azure-aks-external-oidc`	Presubmit (second-stage, `pipeline_skip_if_only_changed`)	Added	Added	Added
`e2e-azure-aks-external-oidc-techpreview`	Presubmit (`optional: true`)	Added	Already exists	Already exists

All configurations mirror the existing release-4.21 setup. Both variants use Keycloak as OIDC provider via the idp-external-oidc-keycloak-aks-server CI step. Presubmits follow the second-stage pattern (same as e2e-aks).

Pass rates on existing releases (Prow full history, ~5.5 months):

4.21: 87.4% (199 runs)
4.20: 84.3% (197 runs)

Once the periodic jobs accumulate enough runs on 4.22/4.23/5.0, they will be added as informing tests in the HO Konflux release gating pipeline, and later evaluated for promotion to blocking.

Special notes for your reviewer:

The AWS external OIDC variants are correctly propagated across all releases and are not modified by this PR. Only the Azure AKS variants are in scope.

Full investigation report: External OIDC Test Investigation

Which issue(s) this PR fixes:

CNTRLPLANE-4010 (relates to CNTRLPLANE-3790)

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci-robot · 2026-08-06T14:23:18Z

@Nirshal: This pull request references CNTRLPLANE-4010 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Adds the missing Azure AKS external OIDC periodic and presubmit test jobs to release-4.22 and release-5.0. These jobs already exist on release-4.20 and release-4.21 but were not propagated to newer branches because config-brancher runs with --skip-periodics.

The base External OIDC feature (ExternalOIDCWithUIDAndExtraClaimMappings) is GA since 4.20. The non-techpreview test exercises GA functionality and should exist in all active releases. The techpreview variant tests ExternalOIDCWithUpstreamParity, which remains TechPreview-only.

Jobs added:

Job Type 4.22 5.0

e2e-azure-aks-external-oidc Periodic (daily, 0 9 * * *) Added Added

e2e-azure-aks-external-oidc-techpreview Periodic (3x/month, 0 20 9,18,25 * *) Added Added

e2e-azure-aks-external-oidc Presubmit (always_run: true) Added Added

e2e-azure-aks-external-oidc-techpreview Presubmit (optional: true) Added Already exists

All configurations mirror the existing release-4.21 setup. Both variants use Keycloak as OIDC provider via the idp-external-oidc-keycloak-aks-server CI step.

Pass rates on existing releases (Prow full history, ~5.5 months):

4.21: 87.4% (199 runs)

4.20: 84.3% (197 runs)

Once the periodic jobs accumulate enough runs on 4.22/5.0, they will be added as informing tests in the HO Konflux release gating pipeline, and later evaluated for promotion to blocking.

Special notes for your reviewer:

The AWS external OIDC variants are correctly propagated across all releases and are not modified by this PR. Only the Azure AKS variants are in scope.

Full investigation report: External OIDC Test Investigation

Which issue(s) this PR fixes:

CNTRLPLANE-4010 (relates to CNTRLPLANE-3790)

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-06T14:23:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a0985c75-4cdc-4e7b-a68e-8a7be35d43da

📥 Commits

Reviewing files that changed from the base of the PR and between da14de5 and 64b0a0c.

⛔ Files ignored due to path filters (6)

ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.22-periodics.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.22-presubmits.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (6)

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml

🚧 Files skipped from review as they are similar to previous changes (4)

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22.yaml

Walkthrough

Azure AKS External OIDC release and periodic jobs were added for HyperShift releases 4.22, 4.23, and 5.0. The jobs use certificate authentication, certificate-rotation scaling, and the External OIDC workflow.

Changes

Azure AKS External OIDC CI coverage

Layer / File(s)	Summary
Release job definitions `ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22.yaml`, `ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml`, `ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml`	Added required or non-optional `TestExternalOIDC` jobs. Release 4.22 also adds an optional TechPreview job with `TECH_PREVIEW_NO_UPGRADE`.
Periodic job schedules `ci-operator/config/openshift/hypershift/*__periodics.yaml`	Added daily standard jobs and scheduled TechPreview jobs for releases 4.22, 4.23, and 5.0. TechPreview jobs set `TECH_PREVIEW_NO_UPGRADE`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: rehearsals-ack

Suggested reviewers: enxebre, ironcladlou, bryan-cox

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	Added jobs activate a workflow whose e2e script enables xtrace before expanding the console client secret and 50 test-user passwords into the logged command.	Disable xtrace while constructing and running the OIDC test command, or redact secret-bearing arguments before writing command traces.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	Added Azure jobs run TestExternalOIDC through hypershift-azure-aks-external-oidc; its Keycloak setup downloads Helm/cert-manager and contacts Let's Encrypt public endpoints.	Add the prescribed IPv6/disconnected compatibility notice. Mirror dependencies or add [Skipped:Disconnected] if adaptation is not possible, then run the IPv6 CI job.
Topology-Aware Scheduling Compatibility	❓ Inconclusive	The repository has no visible diff, so pull-request causality cannot be verified from the available checkout.	Provide the pull request base and head diff to verify whether the YAML-only changes introduce any covered scheduling constraints.

✅ Passed checks (12 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The HEAD diff adds only YAML CI and generated Prow job configuration; it adds no Ginkgo It, Describe, Context, or When test titles or dynamic title expressions.
Test Structure And Quality	✅ Passed	The PR changes only 12 YAML CI configuration/job files. It adds no Ginkgo test code or It, setup, cleanup, wait, or assertion logic, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR changes only 12 YAML CI configuration/job files; it adds no Go/test files or Ginkgo declarations, so this check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR diff contains only 12 YAML CI configuration and generated job files; it adds no Go test files or Ginkgo constructs, so the SNO compatibility check is inapplicable.
Ote Binary Stdout Contract	✅ Passed	The PR changes only 12 YAML config/job files. It adds job settings and existing workflow references, with no Go, shell, or step implementation changes or process-level stdout writes.
No-Weak-Crypto	✅ Passed	The commit adds YAML job and generated Prow wiring only; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	The commit adds CI job references and generated Prow containers; added lines contain no privileged:true, hostPID/hostNetwork/hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root UID settings.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the added Azure AKS external OIDC periodic and presubmit jobs for releases 4.22 and 5.0.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-merge-bot · 2026-08-06T14:28:17Z

@Nirshal: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

Nirshal · 2026-08-06T14:36:17Z

/jira refresh

openshift-ci-robot · 2026-08-06T14:36:21Z

@Nirshal: This pull request references CNTRLPLANE-4010 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Nirshal · 2026-08-06T15:00:38Z

/pj-rehearse

openshift-merge-bot · 2026-08-06T15:00:42Z

@Nirshal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai · 2026-08-06T15:00:43Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

Nirshal · 2026-08-07T08:35:13Z

/retest

Nirshal · 2026-08-07T08:36:06Z

/pj-rehearse periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc-techpreview periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc

openshift-merge-bot · 2026-08-07T08:36:10Z

@Nirshal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai · 2026-08-10T14:47:56Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

bryan-cox · 2026-08-11T17:00:24Z

This is missing the 4.23 tests too.

…obs for 4.22, 4.23 and 5.0 The Azure AKS external OIDC test jobs were not propagated when release-4.22, release-4.23 and release-5.0 branches were created, because config-brancher runs with --skip-periodics. Add the following jobs, mirroring the existing 4.21 configuration: - e2e-azure-aks-external-oidc periodic (daily) on 4.22, 4.23 and 5.0 - e2e-azure-aks-external-oidc-techpreview periodic (3x/month) on 4.22, 4.23 and 5.0 - e2e-azure-aks-external-oidc presubmit (second-stage) on 4.22, 4.23 and 5.0 - e2e-azure-aks-external-oidc-techpreview presubmit (optional) on 4.22 The techpreview presubmit on 4.23 and 5.0 already exists and is not modified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

coderabbitai · 2026-08-12T15:06:42Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

openshift-merge-bot · 2026-08-12T15:14:33Z

[REHEARSALNOTIFIER]
@Nirshal: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-hypershift-release-4.22-e2e-azure-aks-external-oidc	openshift/hypershift	presubmit	Presubmit changed
pull-ci-openshift-hypershift-release-4.22-e2e-azure-aks-external-oidc-techpreview	openshift/hypershift	presubmit	Presubmit changed
pull-ci-openshift-hypershift-release-4.23-e2e-azure-aks-external-oidc	openshift/hypershift	presubmit	Presubmit changed
pull-ci-openshift-hypershift-release-5.0-e2e-azure-aks-external-oidc	openshift/hypershift	presubmit	Presubmit changed
periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-azure-aks-external-oidc-techpreview	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-azure-aks-external-oidc	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc-techpreview	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-azure-aks-external-oidc	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-azure-aks-external-oidc-techpreview	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc	N/A	periodic	Periodic changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

bryan-cox · 2026-08-12T15:36:45Z

/approve

Nirshal · 2026-08-12T15:55:57Z

/pj-rehearse ack

openshift-merge-bot · 2026-08-12T15:56:00Z

@Nirshal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

clebs · 2026-08-13T15:40:03Z

/lgtm

openshift-ci · 2026-08-13T15:43:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, clebs, Nirshal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/hypershift/OWNERS~~ [bryan-cox]
~~ci-operator/jobs/openshift/hypershift/OWNERS~~ [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-08-13T16:01:11Z

@Nirshal: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 6, 2026

openshift-ci Bot requested review from enxebre and ironcladlou August 6, 2026 14:24

Nirshal force-pushed the CNTRLPLANE-4010/add-external-oidc-periodic branch from e5a2345 to 05becce Compare August 6, 2026 15:00

coderabbitai Bot mentioned this pull request Aug 6, 2026

Pre branching 5.0 -> 5.1 #83050

Merged

Nirshal force-pushed the CNTRLPLANE-4010/add-external-oidc-periodic branch from 05becce to d0430db Compare August 10, 2026 14:47

Nirshal force-pushed the CNTRLPLANE-4010/add-external-oidc-periodic branch from d0430db to 64b0a0c Compare August 12, 2026 15:05

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 12, 2026

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Aug 12, 2026

coderabbitai Bot mentioned this pull request Aug 12, 2026

OCPBUGS-105871: For azure-kubernetes-kms swaping AWS e2e workflow with Azure AKS e2e workflow #83320

Merged

openshift-ci Bot assigned clebs Aug 13, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 13, 2026

openshift-merge-bot Bot merged commit 9bf14ea into openshift:main Aug 13, 2026
16 checks passed

Uh oh!

Conversation

Nirshal commented Aug 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Special notes for your reviewer:

Which issue(s) this PR fixes:

Checklist:

Uh oh!

openshift-ci-robot commented Aug 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Special notes for your reviewer:

Which issue(s) this PR fixes:

Checklist:

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 error, 1 warning, 1 inconclusive)

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

Nirshal commented Aug 6, 2026

Uh oh!

openshift-ci-robot commented Aug 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Nirshal commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026

Uh oh!

Nirshal commented Aug 7, 2026

Uh oh!

Nirshal commented Aug 7, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 7, 2026

Uh oh!

coderabbitai Bot commented Aug 10, 2026

Uh oh!

bryan-cox commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

bryan-cox commented Aug 12, 2026

Uh oh!

Nirshal commented Aug 12, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 12, 2026

Uh oh!

clebs commented Aug 13, 2026

Uh oh!

openshift-ci Bot commented Aug 13, 2026

Uh oh!

openshift-ci Bot commented Aug 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Nirshal commented Aug 6, 2026 •

edited by atlassian Bot

Loading

openshift-ci-robot commented Aug 6, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

openshift-ci-robot commented Aug 6, 2026 •

edited by atlassian Bot

Loading