OCPBUGS-105398: docs: clarify Azure workload identity token file by damdo · Pull Request #1586 · openshift/cluster-ingress-operator

damdo · 2026-09-11T11:29:17Z

What does this PR do?

Clarifies the FederatedTokenFile documentation in the Azure DNS client.
The comment now explicitly states that the token file is used for Azure
workload identity when no client secret is available.

Why is this needed?

This follow-up addresses review feedback from cluster-ingress-operator#1575:

#1575 (comment)

The wording keeps the relationship between FederatedTokenFile and Azure
workload identity explicit without implying that workload identity is used
without a token file.

openshift-merge-bot · 2026-09-11T11:29:20Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-11T11:29:24Z

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What does this PR do?

Clarifies the FederatedTokenFile documentation in the Azure DNS client.
The comment now explicitly states that the token file is used for Azure
workload identity when no client secret is available.

Why is this needed?

This follow-up addresses review feedback from cluster-ingress-operator#1575:

#1575 (comment)

The wording keeps the relationship between FederatedTokenFile and Azure
workload identity explicit without implying that workload identity is used
without a token file.

Related:

OCPBUGS-105398: refactor: remove Azure workload identity feature gate #1575

https://redhat.atlassian.net/browse/OCPBUGS-105398

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-11T11:29:32Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 604ee6e0-7c3b-4fab-aa40-abdffa5cb1ba

📥 Commits

Reviewing files that changed from the base of the PR and between a875f2c and 75a46f2.

📒 Files selected for processing (1)

pkg/dns/azure/client/client.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

Walkthrough

Updated FederatedTokenFile documentation to state that the token file supports Azure workload identity when no client secret is available. No code behavior changed.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 75a46

This documentation-only change introduces no merge-blocking product or production risk.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description directly explains the documentation change and its relationship to Azure workload identity.
Title check	✅ Passed	The title clearly identifies the documentation change for the Azure workload identity token file and includes the related issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The review-scoped diff changes only a comment in `pkg/dns/azure/client/client.go`. It adds no Ginkgo tests or test titles, so it introduces no unstable or dynamic test name.
Test Structure And Quality	✅ Passed	PASS: The review-scoped diff changes only two comment lines in `pkg/dns/azure/client/client.go`. It adds no Ginkgo test, resource setup, wait, or assertion code. Therefore none of the stated test qual…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only two documentation lines in `pkg/dns/azure/client/client.go`. The diff adds no Ginkgo tests or other test code, so the MicroShift test compatibility check does not a…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only two lines in the `FederatedTokenFile` documentation in `pkg/dns/azure/client/client.go`. It adds no Ginkgo e2e tests or other test constructs, so the SNO multi-node compa…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The authoritative diff changes only two comment lines in `pkg/dns/azure/client/client.go`. It does not add or modify deployment manifests, controllers, replicas, affinity, topology spread, node …
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only two documentation lines in `pkg/dns/azure/client/client.go`. It adds no stdout writes and does not change `main`, suite setup, initializers, or other process-level …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS. The pull request changes only a comment in `pkg/dns/azure/client/client.go`. It adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	PASS. The review-scoped diff changes only two comment lines in `pkg/dns/azure/client/client.go`. The patch adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret-comparison c…
Container-Privileges	✅ Passed	The pull request changes only two comment lines in `pkg/dns/azure/client/client.go`. The file is Go source, not a container or Kubernetes manifest, and the changed content adds no privilege-related se…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request changes only two comment lines in `pkg/dns/azure/client/client.go`. The patch adds no logging or runtime behavior. The changed comment mentions a token file but does not expose a toke…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

damdo · 2026-09-11T11:30:53Z

/skip

damdo · 2026-09-11T11:31:14Z

/assign @davidesalerno @Miciah

davidesalerno

/approve
/lgtm

openshift-merge-bot · 2026-09-17T07:08:49Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-azure-operator
/test e2e-gcp-operator
/test e2e-hypershift
/test e2e-vsphere-static-metallb-operator-gwapi
/test e2e-vsphere-static-metallb-operator-gwapi-techpreview
/test hypershift-e2e-aks

openshift-ci · 2026-09-17T07:08:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidesalerno

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [davidesalerno]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

davidesalerno · 2026-09-17T07:18:07Z

/override test

openshift-ci · 2026-09-17T07:18:26Z

@davidesalerno: /override requires failed status contexts, check run or a prowjob name to operate on.
The following unknown contexts/checkruns were given:

test

Only the following failed contexts/checkruns were expected:

CodeRabbit
ci/prow/e2e-aws-operator
ci/prow/e2e-aws-ovn
ci/prow/e2e-aws-ovn-hypershift-conformance
ci/prow/e2e-aws-ovn-serial-1of2
ci/prow/e2e-aws-ovn-serial-2of2
ci/prow/e2e-aws-ovn-upgrade
ci/prow/e2e-azure-operator
ci/prow/e2e-gcp-operator
ci/prow/e2e-hypershift
ci/prow/e2e-vsphere-static-metallb-operator-gwapi
ci/prow/e2e-vsphere-static-metallb-operator-gwapi-techpreview
ci/prow/hypershift-e2e-aks
ci/prow/images
ci/prow/okd-scos-images
ci/prow/unit
ci/prow/verify
ci/prow/verify-deps
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-operator
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-hypershift-conformance
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-serial-1of2
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-serial-2of2
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-upgrade
pull-ci-openshift-cluster-ingress-operator-master-e2e-azure-operator
pull-ci-openshift-cluster-ingress-operator-master-e2e-gcp-operator
pull-ci-openshift-cluster-ingress-operator-master-e2e-hypershift
pull-ci-openshift-cluster-ingress-operator-master-e2e-vsphere-static-metallb-operator-gwapi
pull-ci-openshift-cluster-ingress-operator-master-e2e-vsphere-static-metallb-operator-gwapi-techpreview
pull-ci-openshift-cluster-ingress-operator-master-hypershift-e2e-aks
pull-ci-openshift-cluster-ingress-operator-master-images
pull-ci-openshift-cluster-ingress-operator-master-okd-scos-images
pull-ci-openshift-cluster-ingress-operator-master-unit
pull-ci-openshift-cluster-ingress-operator-master-verify
pull-ci-openshift-cluster-ingress-operator-master-verify-deps
tide

If you are trying to override a checkrun that has a space in it, you must put a double quote on the context.

Details

In response to this:

/override test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

davidesalerno · 2026-09-17T07:37:40Z

/override ci/prow/e2e-aws
/override ci/prow/e2e-aws-ovn
/override ci/prow/e2e-aws-ovn-single-node
/override ci/prow/e2e-azure
/override ci/prow/e2e-gcp
/override ci/prow/e2e-metal-ipi
/override ci/prow/e2e-vsphere

openshift-ci · 2026-09-17T07:37:58Z

@davidesalerno: /override requires failed status contexts, check run or a prowjob name to operate on.
The following unknown contexts/checkruns were given:

ci/prow/e2e-aws
ci/prow/e2e-aws-ovn-single-node
ci/prow/e2e-azure
ci/prow/e2e-gcp
ci/prow/e2e-metal-ipi
ci/prow/e2e-vsphere

Only the following failed contexts/checkruns were expected:

CodeRabbit
ci/prow/e2e-aws-operator
ci/prow/e2e-aws-ovn
ci/prow/e2e-aws-ovn-hypershift-conformance
ci/prow/e2e-aws-ovn-serial-1of2
ci/prow/e2e-aws-ovn-serial-2of2
ci/prow/e2e-aws-ovn-upgrade
ci/prow/e2e-azure-operator
ci/prow/e2e-gcp-operator
ci/prow/e2e-hypershift
ci/prow/e2e-vsphere-static-metallb-operator-gwapi
ci/prow/e2e-vsphere-static-metallb-operator-gwapi-techpreview
ci/prow/hypershift-e2e-aks
ci/prow/images
ci/prow/okd-scos-images
ci/prow/unit
ci/prow/verify
ci/prow/verify-deps
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-operator
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-hypershift-conformance
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-serial-1of2
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-serial-2of2
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-upgrade
pull-ci-openshift-cluster-ingress-operator-master-e2e-azure-operator
pull-ci-openshift-cluster-ingress-operator-master-e2e-gcp-operator
pull-ci-openshift-cluster-ingress-operator-master-e2e-hypershift
pull-ci-openshift-cluster-ingress-operator-master-e2e-vsphere-static-metallb-operator-gwapi
pull-ci-openshift-cluster-ingress-operator-master-e2e-vsphere-static-metallb-operator-gwapi-techpreview
pull-ci-openshift-cluster-ingress-operator-master-hypershift-e2e-aks
pull-ci-openshift-cluster-ingress-operator-master-images
pull-ci-openshift-cluster-ingress-operator-master-okd-scos-images
pull-ci-openshift-cluster-ingress-operator-master-unit
pull-ci-openshift-cluster-ingress-operator-master-verify
pull-ci-openshift-cluster-ingress-operator-master-verify-deps
tide

If you are trying to override a checkrun that has a space in it, you must put a double quote on the context.

Details

In response to this:

/override ci/prow/e2e-aws
/override ci/prow/e2e-aws-ovn
/override ci/prow/e2e-aws-ovn-single-node
/override ci/prow/e2e-azure
/override ci/prow/e2e-gcp
/override ci/prow/e2e-metal-ipi
/override ci/prow/e2e-vsphere

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

davidesalerno · 2026-09-17T12:51:18Z

/override ci/prow/hypershift-e2e-aks

openshift-ci · 2026-09-17T12:52:38Z

@davidesalerno: Overrode contexts on behalf of davidesalerno: ci/prow/hypershift-e2e-aks

Details

In response to this:

/override ci/prow/hypershift-e2e-aks

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

damdo · 2026-09-17T12:56:08Z

/label docs-approved
/label px-approved
/verified by ci

openshift-ci-robot · 2026-09-17T12:56:22Z

@damdo: This PR has been marked as verified by ci.

Details

In response to this:

/label docs-approved
/label px-approved
/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-17T13:20:05Z

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-09-17T13:23:09Z

@damdo: Jira Issue OCPBUGS-105398: Some pull requests linked via external trackers have merged:

openshift/machine-api-provider-azure#207

The following pull request, linked via external tracker, has not merged:

openshift/api#3018 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-105398 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

What does this PR do?

Clarifies the FederatedTokenFile documentation in the Azure DNS client.
The comment now explicitly states that the token file is used for Azure
workload identity when no client secret is available.

Why is this needed?

This follow-up addresses review feedback from cluster-ingress-operator#1575:

#1575 (comment)

The wording keeps the relationship between FederatedTokenFile and Azure
workload identity explicit without implying that workload identity is used
without a token file.

Related:

OCPBUGS-105398: refactor: remove Azure workload identity feature gate #1575

https://redhat.atlassian.net/browse/OCPBUGS-105398

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

docs: clarify Azure workload identity token file

75a46f2

openshift-ci Bot requested review from Miciah and davidesalerno September 11, 2026 11:29

openshift-ci Bot assigned davidesalerno and Miciah Sep 11, 2026

davidesalerno approved these changes Sep 17, 2026

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 17, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 17, 2026

openshift-ci Bot added docs-approved Signifies that Docs has signed off on this PR px-approved Signifies that Product Support has signed off on this PR labels Sep 17, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 17, 2026

openshift-merge-bot Bot merged commit 0bbb283 into openshift:master Sep 17, 2026
19 checks passed

Conversation

damdo commented Sep 11, 2026

What does this PR do?

Why is this needed?

Uh oh!

openshift-merge-bot Bot commented Sep 11, 2026

Uh oh!

openshift-ci-robot commented Sep 11, 2026

What does this PR do?

Why is this needed?

Uh oh!

coderabbitai Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

damdo commented Sep 11, 2026

Uh oh!

damdo commented Sep 11, 2026

Uh oh!

davidesalerno left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

davidesalerno commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

davidesalerno commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

davidesalerno commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

damdo commented Sep 17, 2026

Uh oh!

openshift-ci-robot commented Sep 17, 2026

Uh oh!

openshift-ci Bot commented Sep 17, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 17, 2026

What does this PR do?

Why is this needed?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading