OCPBUGS-105398: refactor: remove Azure workload identity feature gate by damdo · Pull Request #1575 · openshift/cluster-ingress-operator

damdo · 2026-09-02T15:38:47Z

What does this PR do?

Removes the AzureWorkloadIdentity feature-gate dependency from the
cluster ingress operator.

The feature is GA and enabled by default, so the previously gated Azure
workload identity behavior is now unconditional when no client secret is
available.

Changes include:

Removing feature-gate observation and configuration plumbing.
Removing the Azure DNS provider/client boolean parameter.
Using workload identity whenever the Azure client secret is empty.

Why is this needed?

This must merge before openshift/api#3018, which removes the feature-gate
definition. Remaining .Enabled() consumers would panic once the gate is
removed from the cluster-served feature-gate list.

OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate api#3018

openshift-merge-bot · 2026-09-02T15:38:49Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-09-02T15:39:06Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6bbd906d-d429-4b2d-8b85-1e05fa41946c

📥 Commits

Reviewing files that changed from the base of the PR and between 8e5b7c7 and 823f9d5.

📒 Files selected for processing (1)

AGENTS.md

💤 Files with no reviewable changes (1)

AGENTS.md

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

Walkthrough

Azure workload identity selection now depends on whether ClientSecret is empty. The Azure client uses federated-token authentication when no client secret is configured. The public AzureWorkloadIdentityEnabled fields and parameters were removed from Azure client, provider, controller, and operator configuration. The operator no longer evaluates or passes the related feature-gate setting.

Merge Risk: ⚪ Minimal · up to 823f9

Azure workload identity authentication is selected when no client secret is configured, with obsolete feature-gate wiring removed. No current merge-readiness risk is identified.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the removal of the Azure workload identity feature gate, which is the main change.
Description check	✅ Passed	The description accurately explains the feature-gate removal, configuration changes, unconditional workload identity behavior, and merge dependency.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only Azure authentication/configuration plumbing and documentation. The parent-to-HEAD diff contains no test files and no added or removed Ginkgo declarations (`It`, `Describe…
Test Structure And Quality	✅ Passed	PASS: The pull request changes no test files and introduces no Ginkgo `It` blocks, cluster operations, `Eventually`/`Consistently` calls, setup, or cleanup logic. The affected Azure tests use `testing…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only six non-test files. The diff against origin/master adds no Ginkgo declarations and changes no test paths, so the MicroShift compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes six non-test files only. The patch adds no Ginkgo declarations and modifies no *_test.go, test/, or tests-extension/ files. Therefore it introduces no new e2e test with a mult…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The commit changes Azure authentication and removes feature-gate plumbing only. The complete diff changes six files and adds no anti-affinity, topology spread, node selector or affinity, tolera…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request changes Azure credential selection and removes feature-gate plumbing. It adds no `fmt.Print`, `log.Print`, `klog`, `os.Stdout`, Ginkgo setup, or stdout sink writes in process-…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS — The pull request changes six non-test files only. The diff adds no Ginkgo declarations, e2e tests, IPv4 assumptions, or external connectivity requirements. The custom check is therefore not app…
No-Weak-Crypto	✅ Passed	PASS: The PR changes Azure credential selection and removes feature-gate plumbing. The added code only checks whether `ClientSecret` is empty and selects `WorkloadIdentityCredential`; it does not comp…
Container-Privileges	✅ Passed	PASS: The pull request changes only Go and documentation files. It does not change any manifest, Dockerfile, or container security setting. The existing operator deployments set `runAsNonRoot: true`, …
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive-data logging was introduced. The diff changes Azure credential selection and removes feature-gate plumbing, but it adds no logging calls and does not pass client secrets, federated token …

Full details: Stable And Deterministic Test Names

Explanation

The pull request changes only Azure authentication/configuration plumbing and documentation. The parent-to-HEAD diff contains no test files and no added or removed Ginkgo declarations (It, Describe, Context, or When). Therefore, it introduces no unstable or overly specific test title.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes no test files and introduces no Ginkgo It blocks, cluster operations, Eventually/Consistently calls, setup, or cleanup logic. The affected Azure tests use testing.T and testify, and the implementation-only changes cannot introduce a Ginkgo test-structure violation under this check.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

The pull request changes six non-test files only. The patch adds no Ginkgo declarations and modifies no *_test.go, test/, or tests-extension/ files. Therefore it introduces no new e2e test with a multi-node assumption.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The commit changes Azure authentication and removes feature-gate plumbing only. The complete diff changes six files and adds no anti-affinity, topology spread, node selector or affinity, toleration, replica, update-strategy, or PDB settings. The existing replica wiring remains unchanged, and no deployment manifest changes are present. Therefore, the PR introduces no topology-sensitive scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request changes Azure credential selection and removes feature-gate plumbing. It adds no fmt.Print*, log.Print*, klog, os.Stdout, Ginkgo setup, or stdout sink writes in process-level code. The changed operator logging uses logr backed by Zap, whose development configuration writes to stderr. The newly reachable WorkloadIdentityCredential constructor also contains no stdout writes. The OTE binary is unchanged and does not import the changed operator or DNS packages.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS — The pull request changes six non-test files only. The diff adds no Ginkgo declarations, e2e tests, IPv4 assumptions, or external connectivity requirements. The custom check is therefore not applicable.

Full details: No-Weak-Crypto

Explanation

PASS: The PR changes Azure credential selection and removes feature-gate plumbing. The added code only checks whether ClientSecret is empty and selects WorkloadIdentityCredential; it does not compare secret or token values. The diff adds no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, constant-time comparison, or custom cryptographic implementation.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only Go and documentation files. It does not change any manifest, Dockerfile, or container security setting. The existing operator deployments set runAsNonRoot: true, allowPrivilegeEscalation: false, and drop all capabilities. No prohibited privilege setting is introduced.

Full details: No-Sensitive-Data-In-Logs

Explanation

No sensitive-data logging was introduced. The diff changes Azure credential selection and removes feature-gate plumbing, but it adds no logging calls and does not pass client secrets, federated token paths, credentials, or token values to logs. Existing DNS record and zone logging is unchanged from the parent revision.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-09-02T15:39:33Z

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What does this PR do?

Removes the AzureWorkloadIdentity feature-gate dependency from the
cluster ingress operator.

The feature is GA and enabled by default, so the previously gated Azure
workload identity behavior is now unconditional when no client secret is
available.

Changes include:

Removing feature-gate observation and configuration plumbing.

Removing the Azure DNS provider/client boolean parameter.

Using workload identity whenever the Azure client secret is empty.

Why is this needed?

This must merge before openshift/api#3018, which removes the feature-gate
definition. Remaining .Enabled() consumers would panic once the gate is
removed from the cluster-served feature-gate list.

Related:

OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate api#3018

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

damdo · 2026-09-02T15:56:24Z

/retest

damdo · 2026-09-02T15:56:54Z

/assign @Miciah @davidesalerno

damdo · 2026-09-02T16:20:00Z

/retest

Miciah · 2026-09-02T20:14:33Z

Thanks!

/approve

@damdo, the PR description is detailed, but the commit message is missing a body. Would you mind copying the description and a reference to https://redhat.atlassian.net/browse/OCPBUGS-105398 into the commit message?

Also, your PR might as well delete the reference to the featuregate in AGENTS.md:

cluster-ingress-operator/AGENTS.md

Line 330 in 8e5b7c7

- `features.FeatureGateAzureWorkloadIdentity` — Azure workload identity

Removes the AzureWorkloadIdentity feature-gate dependency from the cluster ingress operator. The feature is GA and enabled by default, so Azure workload identity is now used unconditionally when no client secret is available. This change removes the feature-gate observation and Azure DNS configuration plumbing, including the provider/client boolean parameter. https://redhat.atlassian.net/browse/OCPBUGS-105398 openshift/api#3018

damdo · 2026-09-03T09:20:47Z

@Miciah Thanks for the review and approval. I’ve updated the commit message with the PR description and the OCPBUGS-105398 reference, and removed the stale AzureWorkloadIdentity entry from AGENTS.md. The changes are now pushed.

damdo · 2026-09-04T12:57:55Z

/retest

damdo · 2026-09-04T12:59:19Z

/pipeline required

openshift-merge-bot · 2026-09-04T12:59:22Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-azure-operator
/test e2e-gcp-operator
/test e2e-hypershift
/test e2e-vsphere-static-metallb-operator-gwapi
/test e2e-vsphere-static-metallb-operator-gwapi-techpreview
/test hypershift-e2e-aks

damdo · 2026-09-04T14:12:37Z

/retest

damdo · 2026-09-04T14:48:27Z

/retest

damdo · 2026-09-04T16:48:13Z

/retest

damdo · 2026-09-05T10:55:05Z

/retest

damdo · 2026-09-08T07:18:23Z

/retest

damdo · 2026-09-08T13:24:17Z

/retest-required

damdo · 2026-09-08T18:46:40Z

/retest

damdo · 2026-09-09T08:02:48Z

/retest

Miciah · 2026-09-09T14:43:36Z

Thanks!

/approve
/lgtm

openshift-merge-bot · 2026-09-09T14:45:01Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator
/test e2e-aws-ovn
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-azure-operator
/test e2e-gcp-operator
/test e2e-vsphere-static-metallb-operator-gwapi
/test e2e-vsphere-static-metallb-operator-gwapi-techpreview

openshift-ci · 2026-09-09T14:45:05Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

damdo · 2026-09-09T19:20:49Z

/retest-required

damdo · 2026-09-10T08:53:51Z

/retest-required

davidesalerno · 2026-09-10T14:54:48Z

 	// if Azure workload identity is not used.
 	ClientSecret string
 	// FederatedTokenFile is the path to a file containing a workload
-	// identity token.  If FederatedTokenFile is specified and


This wording looks directionally right after removing the feature gate, but it may be clearer to keep the relationship to FederatedTokenFile explicit. As written, “If no client secret is available” could read as though workload identity is used unconditionally, even though this field specifically represents the token file path. Consider something like: “FederatedTokenFile is the path to a file containing a workload identity token. If no client secret is available, this token file is used for Azure workload identity.”

I will address this in a follow-up, I prefer not to lose all the green ci passes I have here :)

Follow-up PR here: #1575

davidesalerno

just one small nit about wording on a comment

damdo · 2026-09-11T06:48:53Z

/retest

damdo · 2026-09-11T08:38:26Z

/verified by ci

openshift-ci-robot · 2026-09-11T08:38:38Z

@damdo: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

damdo · 2026-09-11T08:38:54Z

/label docs-approved

/label px-approved

openshift-ci · 2026-09-11T09:57:22Z

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-09-11T10:00:42Z

@damdo: Jira Issue OCPBUGS-105398: Some pull requests linked via external trackers have merged:

openshift/machine-api-provider-azure#207

The following pull request, linked via external tracker, has not merged:

openshift/api#3018 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-105398 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

What does this PR do?

Removes the AzureWorkloadIdentity feature-gate dependency from the
cluster ingress operator.

The feature is GA and enabled by default, so the previously gated Azure
workload identity behavior is now unconditional when no client secret is
available.

Changes include:

Removing feature-gate observation and configuration plumbing.

Removing the Azure DNS provider/client boolean parameter.

Using workload identity whenever the Azure client secret is empty.

Why is this needed?

This must merge before openshift/api#3018, which removes the feature-gate
definition. Remaining .Enabled() consumers would panic once the gate is
removed from the cluster-served feature-gate list.

Related:

OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate api#3018

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

damdo changed the title ~~refactor: remove Azure workload identity feature gate~~ OCPBUGS-105398: refactor: remove Azure workload identity feature gate Sep 2, 2026

openshift-ci Bot requested review from miheer and rikatz September 2, 2026 15:39

openshift-ci Bot assigned davidesalerno and Miciah Sep 2, 2026

damdo mentioned this pull request Sep 2, 2026

OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate openshift/api#3018

Open

8 tasks

Miciah removed request for miheer and rikatz September 2, 2026 20:01

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 2, 2026

damdo force-pushed the remove-azure-workload-identity branch from 8e5b7c7 to 823f9d5 Compare September 3, 2026 09:19

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 9, 2026

davidesalerno reviewed Sep 10, 2026

View reviewed changes

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 11, 2026

openshift-ci Bot added docs-approved Signifies that Docs has signed off on this PR px-approved Signifies that Product Support has signed off on this PR labels Sep 11, 2026

openshift-merge-bot Bot merged commit a875f2c into openshift:master Sep 11, 2026
19 checks passed

damdo mentioned this pull request Sep 11, 2026

OCPBUGS-105398: docs: clarify Azure workload identity token file #1586

Merged

Conversation

damdo commented Sep 2, 2026

What does this PR do?

Why is this needed?

Uh oh!

openshift-merge-bot Bot commented Sep 2, 2026

Uh oh!

coderabbitai Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

openshift-ci-robot commented Sep 2, 2026

What does this PR do?

Why is this needed?

Uh oh!

damdo commented Sep 2, 2026

Uh oh!

damdo commented Sep 2, 2026

Uh oh!

damdo commented Sep 2, 2026

Uh oh!

Miciah commented Sep 2, 2026

Uh oh!

damdo commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

damdo commented Sep 4, 2026

Uh oh!

damdo commented Sep 4, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 4, 2026

Uh oh!

damdo commented Sep 4, 2026

Uh oh!

damdo commented Sep 4, 2026

Uh oh!

damdo commented Sep 4, 2026

Uh oh!

damdo commented Sep 5, 2026

Uh oh!

damdo commented Sep 8, 2026

Uh oh!

damdo commented Sep 8, 2026

Uh oh!

damdo commented Sep 8, 2026

Uh oh!

damdo commented Sep 9, 2026

Uh oh!

Miciah commented Sep 9, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 9, 2026

Uh oh!

openshift-ci Bot commented Sep 9, 2026

Uh oh!

damdo commented Sep 9, 2026

Uh oh!

damdo commented Sep 10, 2026

Uh oh!

davidesalerno Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

damdo Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

damdo Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

davidesalerno left a comment

Choose a reason for hiding this comment

Uh oh!

damdo commented Sep 11, 2026

Uh oh!

damdo commented Sep 11, 2026

Uh oh!

openshift-ci-robot commented Sep 11, 2026

Uh oh!

damdo commented Sep 11, 2026

Uh oh!

openshift-ci Bot commented Sep 11, 2026

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

damdo commented Sep 3, 2026 •

edited

Loading