OCPBUGS-105398: refactor: remove AzureWorkloadIdentity feature gate by damdo · Pull Request #1537 · openshift/machine-api-operator

damdo · 2026-08-31T08:40:56Z

Summary

Remove the AzureWorkloadIdentity map entry from the featuregates passed to the machine controllers in pkg/operator/operator.go — the gate is GA and enabled by default upstream (openshift/api), so this was always evaluating to true
Update test fixtures accordingly

Why

Once AzureWorkloadIdentity is deregistered from openshift/api (openshift/api#3018), the unconditional featureGates.Enabled(apifeatures.FeatureGateAzureWorkloadIdentity) call here panics, because library-go's FeatureGate.Enabled() panics when asked about a name that isn't part of the FeatureGate CR's known set. That panic crashes machine-api-operator, which cascades into control-plane machines never becoming ready (verified in a failing e2e-aws-ovn run on openshift/api#3018 — CI logs showed machine-api-operator panicking with feature "AzureWorkloadIdentity" is not registered in FeatureGates [...]).

Companion PR: openshift/machine-api-provider-azure#207 (already open, removes the same gate's plumbing from the Azure actuators).

Test plan

go build ./... succeeds
go test ./pkg/operator/... passes
No remaining references to AzureWorkloadIdentity outside vendor

Summary by CodeRabbit

Bug Fixes
- Removed the Azure Workload Identity feature gate from provider controller and MachineSet configuration.
- Updated operator test configuration to reflect the feature gate’s removal.

The gate is now GA and enabled by default upstream (openshift/api), so the unconditional featureGates.Enabled() call for it was always true. Once the gate is deregistered upstream, that call panics because library-go's FeatureGate.Enabled() panics for unknown feature names. Drop the map entry so the deployment no longer depends on the gate's registration status.

openshift-merge-bot · 2026-08-31T08:40:59Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-08-31T08:41:04Z

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is invalid:

expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove the AzureWorkloadIdentity map entry from the featuregates passed to the machine controllers in pkg/operator/operator.go — the gate is GA and enabled by default upstream (openshift/api), so this was always evaluating to true

Update test fixtures accordingly

Why

Once AzureWorkloadIdentity is deregistered from openshift/api (openshift/api#3018), the unconditional featureGates.Enabled(apifeatures.FeatureGateAzureWorkloadIdentity) call here panics, because library-go's FeatureGate.Enabled() panics when asked about a name that isn't part of the FeatureGate CR's known set. That panic crashes machine-api-operator, which cascades into control-plane machines never becoming ready (verified in a failing e2e-aws-ovn run on openshift/api#3018 — CI logs showed machine-api-operator panicking with feature "AzureWorkloadIdentity" is not registered in FeatureGates [...]).

Companion PR: openshift/machine-api-provider-azure#207 (already open, removes the same gate's plumbing from the Azure actuators).

Test plan

go build ./... succeeds

go test ./pkg/operator/... passes

No remaining references to AzureWorkloadIdentity outside vendor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-31T08:41:15Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5f9d7f84-73d8-4c05-b328-5900f16dac68

📥 Commits

Reviewing files that changed from the base of the PR and between 08e3154 and 3b54660.

📒 Files selected for processing (2)

pkg/operator/operator.go
pkg/operator/operator_test.go

💤 Files with no reviewable changes (2)

pkg/operator/operator.go
pkg/operator/operator_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The operator no longer passes or enables the Azure Workload Identity feature gate. The test operator configuration reflects the same removal.

Changes

Operator feature-gate configuration

Layer / File(s)	Summary
Remove Azure Workload Identity gate `pkg/operator/operator.go`, `pkg/operator/operator_test.go`	The operator no longer includes `FeatureGateAzureWorkloadIdentity` in the provider-controller and MachineSet feature map. The test configuration no longer enables the gate.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 3b546

This is a localized cleanup removing obsolete feature-gate plumbing and updating its fixtures; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing the AzureWorkloadIdentity feature gate. The Jira identifier does not affect the title's relevance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes only three feature-gate entries. It adds no Ginkgo test titles and changes no test names. The affected test file uses Go `testing`, not Ginkgo title APIs. The diff conta…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only two feature-gate map fixtures and removes one production map entry. The exact diff contains no added Ginkgo `It`, `BeforeEach`, `AfterEach`, `Eventually`, or `Consi…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The committed diff changes only two existing operator files and removes three feature-gate entries. The changed test file contains existing Go `Test...…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The diff only removes the AzureWorkloadIdentity feature-gate entry from `pkg/operator/operator.go` and updates test fixture data in `pkg/operator/opera…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The commit changes only the AzureWorkloadIdentity feature-gate map entry and related test fixtures. The exact diff contains no affinity, topology spread, replica, node selector, toleration, rol…
Ote Binary Stdout Contract	✅ Passed	The pull request changes only `pkg/operator/operator.go` and `pkg/operator/operator_test.go`. It removes Azure Workload Identity feature-gate entries and adds no stdout writes, logging configuration, …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds no code or tests. The exact diff contains only three deletions in `pkg/operator/operator.go` and `pkg/operator/operator_test.go`, with no new Ginkgo declarations. The IPv4 …
No-Weak-Crypto	✅ Passed	PASS: The pull request only removes the Azure Workload Identity feature-gate entry from production code and test fixtures. The changed lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypt…
Container-Privileges	✅ Passed	The pull request changes only feature-gate map and test-fixture entries. The parent-to-HEAD diff contains no `privileged`, `hostPID`, `hostNetwork`, `hostIPC`, `SYS_ADMIN`, or `allowPrivilegeEscalatio…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The commit contains only three deletions from feature-gate maps and test fixtures. It adds no logging statements, log fields, or sensitive-data output. Existing logging in pkg/operator/operator.…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

Full details: Stable And Deterministic Test Names

Explanation

PASS. The pull request changes only three feature-gate entries. It adds no Ginkgo test titles and changes no test names. The affected test file uses Go testing, not Ginkgo title APIs. The diff contains only deletions.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only two feature-gate map fixtures and removes one production map entry. The exact diff contains no added Ginkgo It, BeforeEach, AfterEach, Eventually, or Consistently code. pkg/operator/operator_test.go uses standard Go tests, and the existing wait already has a five-second timeout. No new resource setup, cleanup, or assertion was introduced, so none of the stated test-quality failure conditions applies.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The committed diff changes only two existing operator files and removes three feature-gate entries. The changed test file contains existing Go Test... unit tests, with no Ginkgo imports or It, Describe, Context, or When additions. The MicroShift test-compatibility check is therefore not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The diff only removes the AzureWorkloadIdentity feature-gate entry from pkg/operator/operator.go and updates test fixture data in pkg/operator/operator_test.go. The changed test file uses standard Test... functions and contains no new It, Describe, Context, or When constructs. Therefore, the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The commit changes only the AzureWorkloadIdentity feature-gate map entry and related test fixtures. The exact diff contains no affinity, topology spread, replica, node selector, toleration, rollout, or PDB changes. The existing control-plane node selector and tolerations are in unchanged code, so they are not caused by this pull request.

Full details: Ote Binary Stdout Contract

Explanation

The pull request changes only pkg/operator/operator.go and pkg/operator/operator_test.go. It removes Azure Workload Identity feature-gate entries and adds no stdout writes, logging configuration, OTE entry-point code, or suite setup code. The OTE binary remains unchanged, so this check has no introduced violation.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request adds no code or tests. The exact diff contains only three deletions in pkg/operator/operator.go and pkg/operator/operator_test.go, with no new Ginkgo declarations. The IPv4 and external-connectivity conditions do not apply.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request only removes the Azure Workload Identity feature-gate entry from production code and test fixtures. The changed lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison logic.

Full details: Container-Privileges

Explanation

The pull request changes only feature-gate map and test-fixture entries. The parent-to-HEAD diff contains no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation changes. Existing HostNetwork: true code and the SCC settings are unchanged; the SCC also has allowPrivilegedContainer: false, allowHostPID: false, and allowHostIPC: false. Therefore, the pull request does not introduce a container-privilege failure.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The commit contains only three deletions from feature-gate maps and test fixtures. It adds no logging statements, log fields, or sensitive-data output. Existing logging in pkg/operator/operator.go is unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

damdo · 2026-08-31T08:56:46Z

/pipeline auto

openshift-merge-bot · 2026-08-31T08:56:50Z

Pipeline controller notification

The pipeline-auto label has been added to this PR. Second-stage tests will be triggered automatically when all first-stage tests pass.

openshift-merge-bot · 2026-08-31T08:56:51Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-metal-ipi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-virtualmedia

openshift-merge-bot · 2026-08-31T08:57:12Z

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

damdo · 2026-08-31T13:03:22Z

/retest

openshift-merge-bot · 2026-08-31T15:27:13Z

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

mdbooth

/lgtm
/approve

mdbooth · 2026-09-01T07:38:01Z

/verified by CI

openshift-ci-robot · 2026-09-01T07:38:14Z

@mdbooth: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-01T07:39:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mdbooth

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [mdbooth]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mdbooth · 2026-09-01T07:43:09Z

/jira refresh

openshift-ci-robot · 2026-09-01T07:43:15Z

@mdbooth: This pull request references Jira Issue OCPBUGS-105398, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

damdo · 2026-09-01T08:02:35Z

/retest

openshift-ci · 2026-09-01T12:21:15Z

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-09-01T12:23:18Z

@damdo: Jira Issue OCPBUGS-105398: Some pull requests linked via external trackers have merged:

openshift/machine-api-provider-azure#207

The following pull request, linked via external tracker, has not merged:

openshift/api#3018 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-105398 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

Summary

Remove the AzureWorkloadIdentity map entry from the featuregates passed to the machine controllers in pkg/operator/operator.go — the gate is GA and enabled by default upstream (openshift/api), so this was always evaluating to true

Update test fixtures accordingly

Why

Once AzureWorkloadIdentity is deregistered from openshift/api (openshift/api#3018), the unconditional featureGates.Enabled(apifeatures.FeatureGateAzureWorkloadIdentity) call here panics, because library-go's FeatureGate.Enabled() panics when asked about a name that isn't part of the FeatureGate CR's known set. That panic crashes machine-api-operator, which cascades into control-plane machines never becoming ready (verified in a failing e2e-aws-ovn run on openshift/api#3018 — CI logs showed machine-api-operator panicking with feature "AzureWorkloadIdentity" is not registered in FeatureGates [...]).

Companion PR: openshift/machine-api-provider-azure#207 (already open, removes the same gate's plumbing from the Azure actuators).

Test plan

go build ./... succeeds

go test ./pkg/operator/... passes

No remaining references to AzureWorkloadIdentity outside vendor

Summary by CodeRabbit

Bug Fixes

Removed the Azure Workload Identity feature gate from provider controller and MachineSet configuration.

Updated operator test configuration to reflect the feature gate’s removal.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot requested review from mdbooth and theobarberbany August 31, 2026 08:41

openshift-merge-bot Bot added the pipeline-auto label Aug 31, 2026

mdbooth reviewed Sep 1, 2026

View reviewed changes

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 1, 2026

openshift-ci Bot assigned mdbooth Sep 1, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 1, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 1, 2026

mdbooth mentioned this pull request Sep 1, 2026

OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate openshift/api#3018

Open

3 tasks

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 1, 2026

openshift-merge-bot Bot merged commit ad641ef into openshift:main Sep 1, 2026
16 checks passed

Uh oh!

Conversation

damdo commented Aug 31, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Test plan

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Aug 31, 2026

Uh oh!

openshift-ci-robot commented Aug 31, 2026

Summary

Why

Test plan

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

damdo commented Aug 31, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 31, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 31, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 31, 2026

Uh oh!

damdo commented Aug 31, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 31, 2026

Uh oh!

mdbooth left a comment

Choose a reason for hiding this comment

Uh oh!

mdbooth commented Sep 1, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

mdbooth commented Sep 1, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Uh oh!

damdo commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Summary

Why

Test plan

Summary by CodeRabbit

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

damdo commented Aug 31, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading