OCPBUGS-105398: refactor: remove Azure workload identity feature gate

[damdo]

Remove the AzureWorkloadIdentity feature-gate dependency from the Azure Disk CSI driver operator.

Azure workload identity is now enabled unconditionally, matching its GA/default-on behavior.

This change must precede openshift/api#3018 because the operator must stop referencing the feature gate before the API feature gate is removed.

Note: I removed the FeatureGate accessor as it was not in use anymore after the AzureWorkloadIdentity feature gate removal

Related: openshift/api#3018

Summary by CodeRabbit

• Changes
  • Workload identity is now consistently enabled during operator startup.
  • Removed feature-gate detection and configuration handling that is no longer used.
  • Cloud controller manager image replacement remains unchanged.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Remove the AzureWorkloadIdentity feature-gate dependency from the Azure Disk CSI driver operator.

Azure workload identity is now enabled unconditionally, matching its GA/default-on behavior.

This change must precede openshift/api#3018 because the operator must stop referencing the feature gate before the API feature gate is removed.

Related: openshift/api#3018

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ada30be4-c2d0-406e-9bb7-4c9015b7a87f

📥 Commits

Reviewing files that changed from the base of the PR and between f2d8d99 and f57cebf.

📒 Files selected for processing (1)

• pkg/operator/starter.go

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

Walkthrough

RunOperator no longer detects feature gates or configures workload identity conditionally. Asset replacement always enables Azure workload identity. Obsolete helper code, imports, and the operator image version constant were removed.

Changes

Azure workload identity configuration

Layer / File(s)	Summary
Always enable workload identity pkg/operator/starter.go	RunOperator sets ${ENABLE_AZURE_WORKLOAD_IDENTITY} to "true" without feature-gate initialization or timeout handling. The obsolete helper, imports, and unused constant were removed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to f57ce

The change is narrowly scoped to removing a feature-gate dependency, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only pkg/operator/starter.go. The exact commit diff removes feature-gate logic and adds a static asset replacement. It does not add or modify any Ginkgo test declarati…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only pkg/operator/starter.go; it adds no Ginkgo tests or other test code. The repository has no It, BeforeEach, AfterEach, Eventually, or Consistently calls …
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only pkg/operator/starter.go and adds no Ginkgo e2e tests or test files. The MicroShift test compatibility check therefore does not apply. The changed code enables Azu…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only pkg/operator/starter.go and adds no Ginkgo e2e tests. The changed file contains no It, Describe, Context, or When test constructs. Therefore, the SNO mult…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only pkg/operator/starter.go. It replaces the workload-identity placeholder with "true" and removes feature-gate detection. It does not add or modify scheduling cons…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request adds no stdout write or logging call. Its only added behavior is the asset replacement ${ENABLE_AZURE_WORKLOAD_IDENTITY} → true; it removes two process-level klog calls an…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS. The pull request changes only pkg/operator/starter.go; it adds no Ginkgo e2e tests or test-like files. The added code only replaces ${ENABLE_AZURE_WORKLOAD_IDENTITY} with "true". It introd…
No-Weak-Crypto	✅ Passed	The pull request changes only feature-gate handling and asset replacement in pkg/operator/starter.go. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token …
Container-Privileges	✅ Passed	PASS. The pull request changes only pkg/operator/starter.go. The added line replaces ${ENABLE_AZURE_WORKLOAD_IDENTITY} with true; it does not add a container privilege field. The existing `hostN…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The only changed file is pkg/operator/starter.go. Added code only replaces ${ENABLE_AZURE_WORKLOAD_IDENTITY} with the literal true. It adds no logging calls and does not log credentials, t…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: removing the Azure workload identity feature gate. It also includes the related bug identifier.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only pkg/operator/starter.go. The exact commit diff removes feature-gate logic and adds a static asset replacement. It does not add or modify any Ginkgo test declaration or test title. Therefore, the pull request introduces no unstable or overly-specific test name.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only pkg/operator/starter.go; it adds no Ginkgo tests or other test code. The repository has no It, BeforeEach, AfterEach, Eventually, or Consistently calls in *_test.go files. Therefore, the stated Ginkgo test quality requirements are not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only pkg/operator/starter.go and adds no Ginkgo e2e tests or test files. The MicroShift test compatibility check therefore does not apply. The changed code enables Azure workload identity in operator asset replacement; it does not introduce a test that references an unavailable MicroShift API, namespace, or feature.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only pkg/operator/starter.go and adds no Ginkgo e2e tests. The changed file contains no It, Describe, Context, or When test constructs. Therefore, the SNO multi-node test compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS. The pull request changes only pkg/operator/starter.go. It replaces the workload-identity placeholder with "true" and removes feature-gate detection. It does not add or modify scheduling constraints. Existing assets retain their prior scheduling settings: the controller uses preferred anti-affinity with maxUnavailable: 1, and the node DaemonSet uses maxUnavailable: 10%. The existing control-plane selector and tolerations are unchanged, so they are not pull-request-introduced failures under this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request adds no stdout write or logging call. Its only added behavior is the asset replacement ${ENABLE_AZURE_WORKLOAD_IDENTITY} → true; it removes two process-level klog calls and the related feature-gate code. The remaining klog calls and the main() implementation predate this pull request, so they do not establish pull-request causality for a new OTE stdout-contract failure.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS. The pull request changes only pkg/operator/starter.go; it adds no Ginkgo e2e tests or test-like files. The added code only replaces ${ENABLE_AZURE_WORKLOAD_IDENTITY} with "true". It introduces no IPv4 assumptions or external network connectivity.

Full details: No-Weak-Crypto

Explanation

The pull request changes only feature-gate handling and asset replacement in pkg/operator/starter.go. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token comparison. The custom check has no applicable weak-crypto failure condition.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only pkg/operator/starter.go. The added line replaces ${ENABLE_AZURE_WORKLOAD_IDENTITY} with true; it does not add a container privilege field. The existing hostNetwork: true fields and privileged: true fields in assets/controller.yaml and assets/node.yaml are identical in the parent revision. No changed line adds hostPID, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or an explicit root setting.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The only changed file is pkg/operator/starter.go. Added code only replaces ${ENABLE_AZURE_WORKLOAD_IDENTITY} with the literal true. It adds no logging calls and does not log credentials, tokens, identifiers, or customer data. The change removes the prior FeatureGates initialized log, which reported feature names, and the timeout error log. Existing logs are unchanged.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: damdo
Once this PR has been reviewed and has the lgtm label, please assign tsmetana for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[damdo]

/assign @jsafrane

[damdo]

/pipeline required

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the master branch

Use /test ? to see all available tests.

[damdo]

Closing this in favour of changes directly in openshift/csi-operator

[openshift-ci-robot]

@damdo: This pull request references Jira Issue OCPBUGS-105398. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

Remove the AzureWorkloadIdentity feature-gate dependency from the Azure Disk CSI driver operator.

Azure workload identity is now enabled unconditionally, matching its GA/default-on behavior.

This change must precede openshift/api#3018 because the operator must stop referencing the feature gate before the API feature gate is removed.

Note: I removed the FeatureGate accessor as it was not in use anymore after the AzureWorkloadIdentity feature gate removal

Related: openshift/api#3018

Summary by CodeRabbit

• Changes
• Workload identity is now consistently enabled during operator startup.
• Removed feature-gate detection and configuration handling that is no longer used.
• Cloud controller manager image replacement remains unchanged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.