[release-4.20] CNTRLPLANE-2814: feat(aro): Swift support by muraee · Pull Request #7885 · openshift/hypershift

muraee · 2026-03-09T09:13:47Z

manual backport of #7826

Move infrastructure-related reconciliation logic from hostedcontrolplane_controller.go to the infra package for better code organization and testability. cherry-pick from openshift#7658

…nents Regenerate testdata for aro swift scenario

- Introduces ARO Swift annotation - isPrivate returns true now when ARO and swift. - Router component runs when is ARO and swift. It listens on 443 - Data plane HAProxy: Updates nodepool apiserver-haproxy to handle Swift scenarios with different ports and proxy protocol settings - Shared ingress: Modified to skip dataplane-kas-service backend when Swift is enabled - Add a bunch of unit tests In this PR we still support the no swift path to not break CI.

When a hosted cluster uses KMS etcd encryption with a Key Vault behind a private endpoint, the azure-kms-provider sidecar in the KAS pod cannot reach the Key Vault because CoreDNS on the AKS VNet does not have the privatelink.vaultcore.azure.net zone linked. The private router deployment already runs on the customer VNet (via Swift) and can reach the private endpoint. This commit adds a TCP passthrough relay: HAProxy on the private router forwards connections to the Key Vault via SNI routing on port 8443, and the KAS pod uses a hostAlias to redirect the Key Vault hostname to the private-router Service ClusterIP. TLS passes through end-to-end. Changes: - Add GetKeyVaultFQDN() to azureutil for shared FQDN construction - Add resolvers, SNI ACL, and keyvault backend to HAProxy template - Add hostAlias to KAS deployment pointing vault FQDN to router svc - Gate all changes behind azureutil.IsAroHCP() Signed-off-by: Mulham Raee <mulham.raee@gmail.com> Commit-Message-Assisted-by: Claude (via Claude Code)

…nents Add Azure KMS configuration to the ARO Swift test case in TestControlPlaneComponents and add a private-router service to the fake objects so the KAS deployment hostAlias logic can resolve it. Update all affected AROSwift test fixtures. Signed-off-by: Mulham Raee <mulham.raee@gmail.com> Commit-Message-Assisted-by: Claude (via Claude Code)

…ting Previously, private Key Vault routing was unconditionally enabled for all ARO HCP clusters via IsAroHCP(). This adds a new KeyVaultAccess field (Public/Private enum) to AzureKMSSpec so users can opt in to private Key Vault routing. The condition now requires both IsAroHCP() and IsPrivateKeyVault(hcp) to enable private router relay. Changes: - Add AzureKeyVaultAccessType enum and KeyVaultAccess field to AzureKMSSpec - Add CEL validation enforcing backupKey uses the same Key Vault as activeKey - Add IsPrivateKeyVault helper in azureutil with unit tests - Update KAS deployment and router config conditions - Rename router template param from IsAroHCP to HasPrivateKeyVault Controllers treat an empty/omitted KeyVaultAccess value the same as "Public", so no CRD schema default is set to avoid issues with existing objects in etcd. Signed-off-by: Mulham Raee <mulham.raee@gmail.com> Commit-Message-Assisted-by: Claude (via Claude Code) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot · 2026-03-09T09:13:52Z

@muraee: This pull request references CNTRLPLANE-2812 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.20.z" version, but no target version was set.

Details

In response to this:

manual backport of #7826

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-09T09:14:11Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: af91776d-9d64-4966-8a26-633fd1b2e86f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-03-09T09:14:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [muraee]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-03-09T09:14:29Z

@muraee: This pull request references CNTRLPLANE-2814 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.20.z" version, but no target version was set.

Details

In response to this:

manual backport of #7826

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…PI dependencies Move UseHCPRouter() to a shared util package to break the import cycle and allow infra.go to use it directly for determining whether router services should be deployed. This fixes an issue where router services were not deployed alongside the router deployment for private ARO clusters (Swift enabled). Additionally, remove the dependency of the router deployment on KAS and OAPI components, and add "router" to the list of components that are allowed to report not-found conditions without blocking overall status. Signed-off-by: Mulham Raee <mulham.raee@gmail.com> Commit-Message-Assisted-by: Claude (via Claude Code)

muraee · 2026-03-09T10:59:45Z

/test e2e-aks

rtheis · 2026-03-09T12:14:48Z

/uncc @rtheis

openshift-ci · 2026-03-09T12:40:51Z

@muraee: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws	`4afacf8`	link	true	`/test e2e-aws`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

enxebre and others added 6 commits March 9, 2026 09:51

chore(cpo): move infrastructure reconciliation to infra package

b2ef8e2

Move infrastructure-related reconciliation logic from hostedcontrolplane_controller.go to the infra package for better code organization and testability. cherry-pick from openshift#7658

feat(aro): Add auto generated test fixtures for TestControlPlaneCompo…

00b5187

…nents Regenerate testdata for aro swift scenario

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 9, 2026

openshift-ci bot added the do-not-merge/needs-area label Mar 9, 2026

openshift-ci bot requested review from rtheis and sjenning March 9, 2026 09:14

muraee changed the title ~~[release-4.20] CNTRLPLANE-2812: feat(aro): Swift support~~ [release-4.20] CNTRLPLANE-2814: feat(aro): Swift support Mar 9, 2026

muraee force-pushed the backport-swift-4.20 branch from a7efebc to 4afacf8 Compare March 9, 2026 09:42

openshift-ci bot removed the request for review from rtheis March 9, 2026 12:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release-4.20] CNTRLPLANE-2814: feat(aro): Swift support#7885

[release-4.20] CNTRLPLANE-2814: feat(aro): Swift support#7885
muraee wants to merge 7 commits intoopenshift:release-4.20from
muraee:backport-swift-4.20

muraee commented Mar 9, 2026

Uh oh!

openshift-ci-robot commented Mar 9, 2026 •

edited by openshift-ci bot

Loading

Uh oh!

coderabbitai bot commented Mar 9, 2026 •

edited

Loading

Review skipped

Uh oh!

openshift-ci bot commented Mar 9, 2026

Uh oh!

openshift-ci-robot commented Mar 9, 2026 •

edited by openshift-ci bot

Loading

Uh oh!

muraee commented Mar 9, 2026

Uh oh!

rtheis commented Mar 9, 2026

Uh oh!

openshift-ci bot commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

muraee commented Mar 9, 2026

Uh oh!

openshift-ci-robot commented Mar 9, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci bot commented Mar 9, 2026

Uh oh!

openshift-ci-robot commented Mar 9, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

muraee commented Mar 9, 2026

Uh oh!

rtheis commented Mar 9, 2026

Uh oh!

openshift-ci bot commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

openshift-ci-robot commented Mar 9, 2026 •

edited by openshift-ci bot

Loading

coderabbitai bot commented Mar 9, 2026 •

edited

Loading

openshift-ci-robot commented Mar 9, 2026 •

edited by openshift-ci bot

Loading