OCPBUGS-74498: Add UserAgent telemetry to CPO Azure SDK clients

[hypershift-jira-solve-ci]

What this PR does / why we need it:

This PR adds the TelemetryOptions.ApplicationID to Azure SDK client options when the Control Plane Operator (CPO) creates Azure ARM SDK clients. This ensures Azure API requests from the CPO include proper application identification ("hypershift-cpo") in the User-Agent header for request tracing and telemetry purposes.

Changes:

1. support/azureutil/azureutil.go:

   • Added CPOUserAgent constant for application identification
   • Added NewARMClientOptions helper function that creates Azure ARM client options with proper cloud configuration and telemetry settings
   • Updated GetVnetInfoFromVnetID, GetNetworkSecurityGroupInfo, and GetResourceGroupInfo functions to accept a cloudName parameter and use proper telemetry options

2. control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go:

   • Updated validateAzureKMSConfig to include telemetry options when creating the Azure Key Vault keys client
   • Updated verifyResourceGroupLocationsMatch to pass the cloud name to the updated azureutil functions

3. support/azureutil/azureutil_test.go:

   • Added unit tests for the new NewARMClientOptions function

Which issue(s) this PR fixes:

Fixes OCPBUGS-74498

Special notes for your reviewer:

• The ApplicationID has a 24-character limit in the Azure SDK, so "hypershift-cpo" (14 chars) was chosen to be concise yet descriptive
• The telemetry options include both the cloud configuration (for proper endpoint selection) and the ApplicationID (for request attribution)
• This change is backward compatible - existing behavior is preserved, just with added telemetry

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

---

🤖 Generated with Claude Code via /jira-solve OCPBUGS-74498 origin --ci

Always review AI generated responses prior to use.

[openshift-ci-robot]

@hypershift-jira-solve-ci[bot]: This pull request references Jira Issue OCPBUGS-74498, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wewang58

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

This PR adds the TelemetryOptions.ApplicationID to Azure SDK client options when the Control Plane Operator (CPO) creates Azure ARM SDK clients. This ensures Azure API requests from the CPO include proper application identification ("hypershift-cpo") in the User-Agent header for request tracing and telemetry purposes.

Changes:

1. support/azureutil/azureutil.go:

• Added CPOUserAgent constant for application identification
• Added NewARMClientOptions helper function that creates Azure ARM client options with proper cloud configuration and telemetry settings
• Updated GetVnetInfoFromVnetID, GetNetworkSecurityGroupInfo, and GetResourceGroupInfo functions to accept a cloudName parameter and use proper telemetry options

2. control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go:

• Updated validateAzureKMSConfig to include telemetry options when creating the Azure Key Vault keys client
• Updated verifyResourceGroupLocationsMatch to pass the cloud name to the updated azureutil functions

3. support/azureutil/azureutil_test.go:

• Added unit tests for the new NewARMClientOptions function

Which issue(s) this PR fixes:

Fixes OCPBUGS-74498

Special notes for your reviewer:

• The ApplicationID has a 24-character limit in the Azure SDK, so "hypershift-cpo" (14 chars) was chosen to be concise yet descriptive
• The telemetry options include both the cloud configuration (for proper endpoint selection) and the ApplicationID (for request attribution)
• This change is backward compatible - existing behavior is preserved, just with added telemetry

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

---

🤖 Generated with Claude Code via /jira-solve OCPBUGS-74498 origin --ci

Always review AI generated responses prior to use.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

Added cloud-aware Azure ARM client options and telemetry to Key Vault KMS client construction and resource validation. Extended Azure utility functions to accept a cloudName and create ARM clients with cloud-specific options. Added a unit test for the new ARM client options behavior.

Changes

Cohort / File(s)	Summary
Controller: KMS & validation control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go	Passes cloud-aware arm.ClientOptions (including TelemetryOptions) when creating the Azure Key Vault keys client; threads cloudName and cached credentials into resource-group/location verification logic and passes cloudName to resource lookups.
Azure utilities support/azureutil/azureutil.go	Introduces NewARMClientOptions(cloud.Configuration) *arm.ClientOptions and CPOUserAgent constant. Updates client-creation sites to use NewARMClientOptions and changes signatures to accept cloudName for: GetVnetInfoFromVnetID, getFullVnetInfo, GetNetworkSecurityGroupInfo, and GetResourceGroupInfo.
Tests support/azureutil/azureutil_test.go	Adds TestNewARMClientOptions verifying NewARMClientOptions sets cloud host and telemetry ApplicationID for AzurePublic, AzureGovernment, and AzureChina configurations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[hypershift-jira-solve-ci]

/auto-cc

[openshift-ci]

Hi @hypershift-jira-solve-ci[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bryan-cox]

Why not use NewARMClientOptions here for the clientOptions?

[hypershift-jira-solve-ci]

Good question! The NewARMClientOptions function returns *arm.ClientOptions, which is specifically designed for Azure Resource Manager (ARM) clients like armnetwork, armresources, etc.

However, azkeys.NewClient expects *azkeys.ClientOptions, which is a different type - it's for Key Vault clients rather than ARM clients. While both types embed azcore.ClientOptions, they are distinct and not interchangeable:

• arm.ClientOptions → for ARM SDK clients (armnetwork.NewVirtualNetworksClient, etc.)
• azkeys.ClientOptions → for Key Vault SDK clients (azkeys.NewClient)

The common configuration (cloud config and telemetry) is the same between them, but the container types differ.

I could create a similar helper function like NewKeyVaultClientOptions(cloudConfig) in the azureutil package to provide the same consistent pattern - would that be preferred? Alternatively, we could create a lower-level helper that returns azcore.ClientOptions which both ARM and KeyVault client options could embed.

---

AI-assisted response via Claude Code

[bryan-cox]

Oh no that's ok. I missed that part. No changes requested.

[hypershift-jira-solve-ci]

Great, thanks for confirming! 👍

---

AI-assisted response via Claude Code

[bryan-cox]

/assign @bryan-cox

[bryan-cox]

/ok-to-test
/test verify
/test unit

[celebdor]

/cherry-pick release-4.21
/cherry-pick release-4.20

[openshift-cherrypick-robot]

@celebdor: once the present PR merges, I will cherry-pick it on top of release-4.20, release-4.21 in new PRs and assign them to you.

Details

In response to this:

/cherry-pick release-4.21
/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bryan-cox]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, hypershift-jira-solve-ci[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/retest

[bryan-cox]

/retest

[bryan-cox]

hypershift-jira-solve-ci - rebase the PR to fix the konflux issues

[hypershift-jira-solve-ci]

@bryan-cox Done. Rebased the PR onto the latest main (was 199 commits behind). The branch is now up to date — both commits (fd6dcef07 and c279efc41) replay cleanly with no conflicts. Konflux CI should pick up the updated base.

---

AI-assisted response via Claude Code

[hypershift-jira-solve-ci]

Done. Rebased onto the latest main (now at 12a6c6ca4) to pick up the latest Konflux pipeline changes. No conflicts.

---

AI-assisted response via Claude Code

[bryan-cox]

hypershift-jira-solve-ci - the unit tests are failing. You need to fix this.

[bryan-cox]

/test review-agent-single-pr

[hypershift-jira-solve-ci]

@bryan-cox I investigated the unit test failure. The failing test is TestSeekOverride/if_registry_override_partial_coincidence_is_found,_and_using_ID in support/util/imagemetadata_test.go — this is not related to the changes in this PR.

This test connects to external registries (quay.io) to verify image reference overrides and fails intermittently due to network conditions in CI. It passes locally and is a pre-existing flaky test.

The files changed by this PR (support/azureutil/azureutil.go, support/azureutil/azureutil_test.go, and control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go) all compile and pass their unit tests successfully.

A /retest should resolve the CI failure.

---

AI-assisted response via Claude Code

[bryan-cox]

/test unit

[jparrill]

/lgtm

[bryan-cox]

/verified later @wewang58

[openshift-ci-robot]

@bryan-cox: This PR has been marked to be verified later by @wewang58.

Details

In response to this:

/verified later @wewang58

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bryan-cox]

/test verify-deps

[bryan-cox]

/test all

[jparrill]

/lgtm

[openshift-ci-robot]

Scheduling required tests:
/test verify-deps

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

[openshift-ci]

@hypershift-jira-solve-ci[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@hypershift-jira-solve-ci[bot]: Jira Issue OCPBUGS-74498: All pull requests linked via external trackers have merged:

• openshift/hypershift#7620

This pull request has the verified-later tag and will need to be manually moved to VERIFIED after testing. Jira Issue OCPBUGS-74498 has been moved to the MODIFIED state.

Details

In response to this:

What this PR does / why we need it:

This PR adds the TelemetryOptions.ApplicationID to Azure SDK client options when the Control Plane Operator (CPO) creates Azure ARM SDK clients. This ensures Azure API requests from the CPO include proper application identification ("hypershift-cpo") in the User-Agent header for request tracing and telemetry purposes.

Changes:

1. support/azureutil/azureutil.go:

• Added CPOUserAgent constant for application identification
• Added NewARMClientOptions helper function that creates Azure ARM client options with proper cloud configuration and telemetry settings
• Updated GetVnetInfoFromVnetID, GetNetworkSecurityGroupInfo, and GetResourceGroupInfo functions to accept a cloudName parameter and use proper telemetry options

2. control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go:

• Updated validateAzureKMSConfig to include telemetry options when creating the Azure Key Vault keys client
• Updated verifyResourceGroupLocationsMatch to pass the cloud name to the updated azureutil functions

3. support/azureutil/azureutil_test.go:

• Added unit tests for the new NewARMClientOptions function

Which issue(s) this PR fixes:

Fixes OCPBUGS-74498

Special notes for your reviewer:

• The ApplicationID has a 24-character limit in the Azure SDK, so "hypershift-cpo" (14 chars) was chosen to be concise yet descriptive
• The telemetry options include both the cloud configuration (for proper endpoint selection) and the ApplicationID (for request attribution)
• This change is backward compatible - existing behavior is preserved, just with added telemetry

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

---

🤖 Generated with Claude Code via /jira-solve OCPBUGS-74498 origin --ci

Always review AI generated responses prior to use.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@celebdor: new pull request created: #7685

Details

In response to this:

/cherry-pick release-4.21
/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@celebdor: #7620 failed to apply on top of branch "release-4.20":

Applying: feat(support/azureutil): Add UserAgent telemetry for Azure ARM clients
Using index info to reconstruct a base tree...
M	support/azureutil/azureutil.go
M	support/azureutil/azureutil_test.go
Falling back to patching base and 3-way merge...
Auto-merging support/azureutil/azureutil_test.go
CONFLICT (content): Merge conflict in support/azureutil/azureutil_test.go
Auto-merging support/azureutil/azureutil.go
CONFLICT (content): Merge conflict in support/azureutil/azureutil.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 feat(support/azureutil): Add UserAgent telemetry for Azure ARM clients

Details

In response to this:

/cherry-pick release-4.21
/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.