HIVE-3205: TLS curves ("group preferences")

[2uasimojo]

Following on from HIVE-3007 / #2800, subsume the upstream addition to library-go that gleans TLS curves (aka "group preferences") from the APIServer into hiveadmission (the only component that directly does TLS).

Assisted-By: cursor/grok

Summary by CodeRabbit

• New Features

  • Added support for Azure sovereign cloud environments, GCP universe domains, IBM PowerVS and Transit Gateway services, and expanded IBM endpoint capacity.
  • AWS Network Load Balancers can use user-managed security groups.
  • Added node-exporter collectors for multipath, zoneinfo, NVMe, and interrupts, plus remote-write protocol selection.
  • Added Gateway API management configuration through a new Ingress resource.
  • Added GCP KMS IAM policy validation and support for centos-10 images.

• Improvements

  • Enhanced TLS profile handling, validation, and FIPS compatibility.
  • Improved Azure marketplace image and GCP sovereign-cloud detection.

[openshift-ci-robot]

@2uasimojo: This pull request references HIVE-3205 which is a valid jira issue.

Details

In response to this:

Following on from HIVE-3007 / #2800, subsume the upstream addition to library-go that gleans TLS curves (aka "group preferences") from the APIServer into hiveadmission (the only component that directly does TLS).

Assisted-By: cursor/grok

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

📝 Walkthrough

Walkthrough

This change refreshes OpenShift and cloud dependencies, adds OpenShift API contracts, updates Azure installer integration, adds GCP validation and KMS handling, extends TLS profile observation, and refreshes vendored Google and Azure clients.

Changes

OpenShift API and feature contracts

Layer / File(s)	Summary
Platform and validation updates apis/vendor/github.com/openshift/api/...	Adds IBM Cloud services, Azure US Sec Cloud, GCP universe-domain support, expanded endpoint limits, explicit validation rules, and unconditional vSphere and Route validation changes.
New operator and monitoring APIs apis/vendor/github.com/openshift/api/config/v1alpha1/..., apis/vendor/github.com/openshift/api/operator/v1alpha1/...	Adds node-exporter collector settings, remote-write message versions, and the Ingress API with Gateway API management modes.
Feature gates and generated metadata apis/vendor/github.com/openshift/api/features/..., apis/vendor/github.com/openshift/api/operator/...	Updates feature-gate profiles, CRD metadata, deep-copy methods, OpenAPI names, and Swagger documentation.
AWS load balancer configuration apis/vendor/github.com/openshift/api/operator/v1/...	Adds feature-gated AWS Network Load Balancer security groups with validation and deep-copy support.

Installer and TLS integration

Layer / File(s)	Summary
TLS profile observation pkg/operator/hive/hiveadmission.go, vendor/github.com/openshift/library-go/pkg/crypto/..., vendor/github.com/openshift/library-go/pkg/operator/configobserver/...	Observes TLS groups, filters groups for FIPS mode, maps groups to Go curve IDs, and passes valid curve preferences to the Hive admission container.
GCP installer validation vendor/github.com/openshift/installer/pkg/asset/installconfig/gcp/..., vendor/github.com/openshift/installer/pkg/types/gcp/...	Adds typed credential validation, sovereign-cloud region detection, KMS resource formatting, KMS service-agent IAM checks, and region-aware defaults.
Azure installer integration vendor/github.com/openshift/installer/pkg/asset/installconfig/azure/...	Switches marketplace image retrieval to the Azure Compute ARM client, exports Azure region metadata, and reads image properties from the new response shape.

Vendored cloud client refresh

Layer / File(s)	Summary
Azure Compute ARM v4 client vendor/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4/...	Adds generated Azure Compute clients, response types, pagers, pollers, client factories, metadata, documentation, and CI configuration.
Google Cloud telemetry and KMS clients vendor/cloud.google.com/go/..., vendor/github.com/googleapis/gax-go/v2/...	Adds transport telemetry, OpenTelemetry metrics and tracing, KMS retired-resource and delete operations, and long-running-operation tracing.
Generated Google API clients vendor/google.golang.org/api/...	Refreshes discovery documents and generated clients for DNS, IAM, Service Usage, Storage, Cloud Resource Manager, and Filestore APIs.

Dependency metadata

Layer / File(s)	Summary
Module and vendor updates go.mod, apis/go.mod, vendor/modules.txt, apis/vendor/modules.txt	Updates OpenShift, Installer, Google, Azure, Cluster API, Gomega, and supporting module versions. Adds the Azure Compute ARM v4 module.

Estimated code review effort: 5 (Critical) | ~120 minutes

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

[codecov]

Codecov Report

❌ Patch coverage is 55.55556% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.59%. Comparing base (f2be0d4) to head (2c3fa50).

Files with missing lines	Patch %	Lines
pkg/operator/hive/hiveadmission.go	55.55%	12 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2954   +/-   ##
=======================================
  Coverage   50.58%   50.59%           
=======================================
  Files         282      282           
  Lines       34668    34692   +24     
=======================================
+ Hits        17538    17553   +15     
- Misses      15754    15763    +9     
  Partials     1376     1376           

Files with missing lines	Coverage Δ
pkg/operator/hive/hiveadmission.go	6.19% <55.55%> (+6.19%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[2uasimojo]

/test e2e-vsphere

[openshift-ci]

@2uasimojo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/snyk	2c3fa50	link	false	/test snyk

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[2uasimojo]

/assign @dlom

[dlom]

/lgtm

[openshift-ci]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-azure
/test e2e-gcp

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: 2uasimojo, dlom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [2uasimojo,dlom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment