ROSAENG-65904 | feat: OIDC e2e sanity and operator role lifecycle

[Alcamech]

PR Summary

Wire hyperfleet managed OIDC and operator-roles through sanity and day1 FVT: IAM OIDC provider is created before JSON output, v2 operator roles are listed/deleted via role_prefix tags with instance-profile cleanup, and e2e is split into hyperfleet-sanity vs hyperfleet-validated labels with on-demand node pools in sanity.

Detailed Description of the Issue

Hyperfleet v2 cluster lifecycle depends on managed OIDC configs and operator IAM roles, but e2e and handler paths still assumed OCM-style flows or incomplete AWS cleanup. Sanity tests manually created IAM resources; rosa list operator-roles missed v2 role naming; delete left instance profiles attached; and create oidc-config --output json skipped IAM OIDC provider creation. Day1 FVT needed the same managed-OIDC path without OCM role prep.

Related Issues and PRs

• Jira: ROSAENG-65904
• Builds on merged ROSAENG-65904 | fix: sync structure tests and CI fixes  #3531 (pathbind / structure-test groundwork)
• Related design/docs: guidelines/hyperfleet-guidelines.md

Type of Change

• feat - adds a new user-facing capability.
• fix - resolves an incorrect behavior or bug.
• docs - updates documentation only.
• style - formatting or naming changes with no logic impact.
• refactor - code restructuring with no behavior change.
• test - adds or updates tests only.
• chore - maintenance work (tooling, housekeeping, non-product code).
• build - changes build system, packaging, or dependencies for build output.
• ci - changes CI pipelines, jobs, or automation workflows.
• perf - improves performance without intended behavior change.

Previous Behavior

• Sanity e2e used manual IAM setup; Spot node pool blocked reliable runs.
• create oidc-config --output json could return before creating the IAM OIDC provider.
• ListOperatorRoles only matched OCM *-openshift/*-kube-system suffixes; v2 hyperfleet roles were invisible.
• DeleteOperatorRole did not remove instance profiles (blocked deletes for worker roles).
• Day1 handler still referred to "regional Platform API"; Makefile used FOCUS instead of ginkgo labels.
• rosa-hyperfleet profile had oidc_config: "" and skipped hyperfleet OIDC/operator-role prep.

Behavior After This Change

• Sanity (hyperfleet-sanity): full CLI/SDK lifecycle — login, managed OIDC create, IAM provider assertion, operator-roles create, cluster + two on-demand node pools, teardown.
• Day1 (hyperfleet-validated): profile-driven create with oidc_config: managed; skips OCM/user role prep when hyperfleet client is active.
• create oidc-config: IAM OIDC provider creation runs in PostResponse even with --output json.
• list operator-roles: discovers v2 roles via HypershiftPolicies + role_prefix tags.
• delete operator-roles: deletes instance profiles before role delete; --hosted-cp registered in structure tests.
• Makefile: LABEL_FILTER only (hyperfleet-validated default, hyperfleet-sanity for sanity).

How to Test (Step-by-Step)

Preconditions

• Ephemeral hyperfleet URL and AWS credentials in us-east-1 (or region matching URL).
• make install (or make install-hooks for pre-push).
• Branch built: make rosa.

Test Steps

1. Unit tests on touched packages:

   go test ./pkg/aws/ ./pkg/hyperfleet/ ./cmd/create/oidcconfig/ ./cmd/create/operatorroles/ ./cmd/dlt/operatorrole/ -count=1
   go test ./cmd/rosa/ -run TestCommandStructure -count=1
   make lint

2. Sanity e2e (~60–90 min):

   export HYPERFLEET_URL=https://<ephemeral-url>
   unset CLUSTER_NAME TEST_PROFILE
   make e2e-hyperfleet LABEL_FILTER=hyperfleet-sanity

3. Day1 FVT:

   export HYPERFLEET_URL=https://<ephemeral-url>
   unset CLUSTER_NAME
   make e2e-hyperfleet TEST_PROFILE=rosa-hyperfleet-basic LABEL_FILTER=hyperfleet-validated
   make e2e-hyperfleet TEST_PROFILE=rosa-hyperfleet-basic LABEL_FILTER='hyperfleet-validated && day1-readiness'

Expected Results

• Unit/lint/structure tests pass.
• Sanity: OIDC config + IAM provider created, operator roles created, cluster reaches Ready, both on-demand node pools reach Ready, cleanup completes.
• Day1: cluster created via profile with managed OIDC; readiness spec passes against persisted cluster detail.

Proof of the Fix

• Logs/CLI output:
  • Sanity reached cluster Ready and np1 Ready; OIDC IAM provider check passed after fix.
  • Day1 hyperfleet-validated run completed (cluster create path).
  • Pre-push: format, build, lint, coverage, full unit/integration suite passed on push.
• Unit tests added: oidcconfig/hyperfleet_test.go, operatorroles/hyperfleet_roles_test.go, dlt/operatorrole/hyperfleet_test.go, ListOperatorRoles v2 case in policies_test.go.

Breaking Changes

• No breaking changes
• Yes, this PR introduces a breaking change

Breaking Change Details / Migration Plan

N/A

Note: DeleteOperatorRole now calls DeleteInstanceProfilesForRole on the shared OCM + hyperfleet path. Intended fix (no-op when no profiles); affects all operator-role deletes.

Developer Verification Checklist

• Commit subject/title follows [JIRA-TICKET] | [TYPE]: <MESSAGE>.
• PR description clearly explains both what changed and why.
• Relevant Jira/GitHub issues and related PRs are linked.
• make install-hooks has been run in this clone.
• Tests were added/updated where appropriate.
• I manually tested the change.
• make test passes (via pre-push).
• make lint passes.
• make rosa passes (via pre-push build).
• Documentation or repo-local agent guidance was added/updated where appropriate.
• Any risk, limitation, or follow-up work is documented.

Follow-up / known limits: Spot node pools removed from sanity due to capacity flakes; Spot coverage remains in dedicated HCP machine pool specs. Orphaned hf-e2e-* AWS resources from failed runs may need manual cleanup if teardown is interrupted.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 81d37933-8bfb-4fb2-bc4a-45d1afc75a96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cdoan1]

/lgtm

[cdoan1]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Alcamech, cdoan1
Once this PR has been reviewed and has the lgtm label, please assign olucasfreitas for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment