NO-JIRA: De-duplicate Azure self-managed documentation#8566
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@bryan-cox: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughThis PR removes the standalone Azure Workload Identity guide and consolidates its content into an expanded Create Azure IAM Resources how-to. The new guide documents a two-step persistent-RG workflow: configure an OIDC issuer (ccoctl) and create workload identities (hypershift create iam azure) with a --resource-group-name, --oidc-issuer-url, and optional --enable-kms. It adds verification commands, updated command references, and an end-to-end example. The self-managed cluster guide and site navigation are updated to reference the consolidated guide and the infra/cluster workflow now uses hypershift create infra azure -> hypershift create cluster azure with --infra-json; mkdocs nav is adjusted. Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
approved
|
/uncc @sjenning |
|
/cc @Nirshal |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/how-to/azure/create-iam-separately.md`:
- Line 57: Replace fenced code blocks (the triple-backtick markers like ```bash)
with indented code blocks to satisfy markdownlint MD046: remove the ``` lines
and indent each line of the code block by four spaces (preserving blank lines),
and apply this change to every occurrence of fenced blocks in the document
(e.g., the ```bash blocks noted). Ensure the language marker is removed and that
the surrounding text spacing remains correct so Markdown renders the indented
code blocks as before.
In `@docs/content/how-to/azure/create-self-managed-azure-cluster.md`:
- Line 49: Replace the fenced bash code blocks (the ```bash markers) with
indented code block style to satisfy markdownlint MD046; specifically convert
the fenced blocks at the instances referenced (the ```bash markers around the
code at the noted locations) into the standard 4-space (or tab) indented lines
so the content is formatted as indented code blocks instead of fenced ones.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2cf9c577-c811-4867-b209-eab146491fce
📒 Files selected for processing (7)
docs/content/how-to/azure/azure-workload-identity-setup.mddocs/content/how-to/azure/create-iam-separately.mddocs/content/how-to/azure/create-self-managed-azure-cluster.mddocs/content/how-to/azure/index.mddocs/content/how-to/azure/self-managed-azure-index.mddocs/content/reference/infrastructure/azure-self-managed.mddocs/mkdocs.yml
💤 Files with no reviewable changes (2)
- docs/content/how-to/azure/azure-workload-identity-setup.md
- docs/mkdocs.yml
|
|
||
| Before creating workload identities, you need an OIDC issuer URL. Use the Cloud Credential Operator (CCO) tool to create one: | ||
|
|
||
| ```bash |
There was a problem hiding this comment.
Fix markdown code block style to match repository lint config.
These blocks are fenced, but markdownlint reports MD046 expecting indented style at these lines.
Also applies to: 91-91, 134-134, 233-233
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 57-57: Code block style
Expected: indented; Actual: fenced
(MD046, code-block-style)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/content/how-to/azure/create-iam-separately.md` at line 57, Replace
fenced code blocks (the triple-backtick markers like ```bash) with indented code
blocks to satisfy markdownlint MD046: remove the ``` lines and indent each line
of the code block by four spaces (preserving blank lines), and apply this change
to every occurrence of fenced blocks in the document (e.g., the ```bash blocks
noted). Ensure the language marker is removed and that the surrounding text
spacing remains correct so Markdown renders the indented code blocks as before.
| In Red Hat environments, a periodic Azure resource "reaper" deletes resources that are not properly tagged or not located in an approved resource group. We frequently use the `os4-common` resource group for shared, long-lived assets (for example, public DNS zones) to avoid accidental cleanup. If you are not in Red Hat infrastructure, set `PERSISTENT_RG_NAME` to any long-lived resource group in your subscription that will not be automatically reaped, or ensure your organization's required tags/policies are applied. The name does not have to be `os4-common`—use whatever persistent resource group fits your environment. | ||
| Create the Azure infrastructure using the HyperShift CLI: | ||
|
|
||
| ```bash |
There was a problem hiding this comment.
Normalize code block style for markdownlint compliance.
markdownlint reports MD046 on these code blocks (expected indented style, found fenced style).
Also applies to: 85-85, 349-349
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 49-49: Code block style
Expected: indented; Actual: fenced
(MD046, code-block-style)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/content/how-to/azure/create-self-managed-azure-cluster.md` at line 49,
Replace the fenced bash code blocks (the ```bash markers) with indented code
block style to satisfy markdownlint MD046; specifically convert the fenced
blocks at the instances referenced (the ```bash markers around the code at the
noted locations) into the standard 4-space (or tab) indented lines so the
content is formatted as indented code blocks instead of fenced ones.
| @@ -245,43 +354,49 @@ hypershift create infra azure \ | |||
| --workload-identities-file workload-identities.json \ | |||
| --output-file infra-output.yaml | |||
There was a problem hiding this comment.
The end-to-end workflow here is missing --assign-identity-roles and --dns-zone-rg-name on the create infra azure command, but create-self-managed-azure-cluster.md includes both flags in its infra command. Without --assign-identity-roles, role assignments would need to be done manually, which could trip up users who follow this workflow as-is.
Should these be added here for consistency?
There was a problem hiding this comment.
Done. Added --assign-identity-roles and --dns-zone-rg-name to the create infra azure command in the end-to-end workflow for consistency with create-self-managed-azure-cluster.md.
AI-assisted response via Claude Code
|
Nice cleanup — the de-duplication makes the flow much clearer. One question: the |
Merge azure-workload-identity-setup.md into create-iam-separately.md so there is a single canonical page for OIDC issuer and workload identity setup. Rewrite create-self-managed-azure-cluster.md to use `hypershift create infra azure` instead of manual az CLI commands, eliminating overlap with create-infra-separately.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bryan-cox
force-pushed
the
fix-azure-docs-2
branch
from
908643d to
1912079
Compare
|
@Nirshal Good question — they're different flag names on different subcommands but they all control the same underlying
So AI-assisted response via Claude Code |
|
/lgtm |
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/how-to/azure/create-iam-separately.md`:
- Line 239: The docs incorrectly suggest an identity-name ordering of
`${INFRA_ID}-disk`; update the how-to text to reflect the actual implementation
which builds identityName as identityName := opts.Name + def.IdentityNameSuffix
(i.e., `<clusterName>-disk-<infraID>`) and keep the verification example
`--identity-name "${CLUSTER_NAME}-disk-${INFRA_ID}"`; also change the INFRA_ID
example to avoid duplicating the cluster name (e.g., use only a random suffix
like `$(openssl rand -hex 4)` or another short unique suffix) so you don’t end
up with names like `my-cluster-disk-my-cluster-abc123`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 9cbd53ef-fb56-41ed-ab95-0b6d4852adbc
⛔ Files ignored due to path filters (1)
docs/content/reference/aggregated-docs.mdis excluded by!docs/content/reference/aggregated-docs.md
📒 Files selected for processing (7)
docs/content/how-to/azure/azure-workload-identity-setup.mddocs/content/how-to/azure/create-iam-separately.mddocs/content/how-to/azure/create-self-managed-azure-cluster.mddocs/content/how-to/azure/index.mddocs/content/how-to/azure/self-managed-azure-index.mddocs/content/reference/infrastructure/azure-self-managed.mddocs/mkdocs.yml
💤 Files with no reviewable changes (2)
- docs/content/how-to/azure/azure-workload-identity-setup.md
- docs/mkdocs.yml
✅ Files skipped from review due to trivial changes (3)
- docs/content/reference/infrastructure/azure-self-managed.md
- docs/content/how-to/azure/self-managed-azure-index.md
- docs/content/how-to/azure/index.md
|
|
||
| # Verify federated credentials for one identity | ||
| az identity federated-credential list \ | ||
| --identity-name "${CLUSTER_NAME}-disk-${INFRA_ID}" \ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find the identity naming logic in the hypershift codebase
# Search for Azure identity creation patterns in create iam command
rg -nP --type=go -C5 'userAssignedIdentities.*disk|ManagedIdentity.*disk'Repository: openshift/hypershift
Length of output: 5963
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show relevant parts of the docs around INFRA_ID and the identity-name snippet.
doc="docs/content/how-to/azure/create-iam-separately.md"
if [ -f "$doc" ]; then
echo "=== Docs around INFRA_ID (lines ~70-110) ==="
nl -ba "$doc" | sed -n '70,120p'
echo "=== Docs around identity-name snippet (lines ~220-260) ==="
nl -ba "$doc" | sed -n '220,260p'
fi
# 2) Find the implementation of `hypershift create iam azure`.
echo "=== Search for create iam azure implementation ==="
rg -n --hidden --glob='*.go' "create iam.*azure|create-iam|iam azure" . | head -n 50
# 3) Search for identity naming templates and infraID/INFRA_ID usage.
echo "=== Search for infraID/INFRA_ID and disk identity naming ==="
rg -n --hidden --glob='*.go' "infra[_-]?id|INFRA_ID|identity[-_]?name|disk.*identity|disk.*(UserAssigned|ManagedIdentity)|userAssignedIdentities.*disk" . | head -n 200
# 4) Search for "azure-disk-controller" mentioned in API types; then follow usages.
echo "=== Search for azure-disk-controller usage ==="
rg -n --hidden --glob='*.go' "azure-disk-controller" . | head -n 100
# 5) Find where `Disk` managed identity is constructed (look for json:"disk" usage in templates/construction).
echo "=== Search for ManagedIdentity.*Disk construction ==="
rg -n --hidden --glob='*.go' "Disk:.*ManagedIdentity|Disk.*ManagedIdentityApplyConfiguration|ManagedIdentity{.*disk|CredentialsSecretName: \"disk" . | head -n 200Repository: openshift/hypershift
Length of output: 170
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show relevant parts of the docs around INFRA_ID and the identity-name snippet.
doc="docs/content/how-to/azure/create-iam-separately.md"
if [ -f "$doc" ]; then
echo "=== Docs around INFRA_ID (lines ~70-110) ==="
nl -ba "$doc" | sed -n '70,120p'
echo "=== Docs around identity-name snippet (lines ~220-260) ==="
nl -ba "$doc" | sed -n '220,260p'
fi
# 2) Find the implementation of `hypershift create iam azure`.
echo "=== Search for create iam azure implementation ==="
rg -n --hidden --glob='*.go' "create iam.*azure|create-iam|iam azure" . | head -n 50
# 3) Search for identity naming templates and infraID/INFRA_ID usage.
echo "=== Search for infraID/INFRA_ID and disk identity naming ==="
rg -n --hidden --glob='*.go' "infra[_-]?id|INFRA_ID|identity[-_]?name|disk.*identity|disk.*(UserAssigned|ManagedIdentity)|userAssignedIdentities.*disk" . | head -n 200
# 4) Search for "azure-disk-controller" mentioned in API types; then follow usages.
echo "=== Search for azure-disk-controller usage ==="
rg -n --hidden --glob='*.go' "azure-disk-controller" . | head -n 100
# 5) Find where `Disk` managed identity is constructed (look for json:"disk" usage in templates/construction).
echo "=== Search for ManagedIdentity.*Disk construction ==="
rg -n --hidden --glob='*.go' "Disk:.*ManagedIdentity|Disk.*ManagedIdentityApplyConfiguration|ManagedIdentity{.*disk|CredentialsSecretName: \"disk" . | head -n 200Repository: openshift/hypershift
Length of output: 170
🏁 Script executed:
#!/bin/bash
set -euo pipefail
doc="docs/content/how-to/azure/create-iam-separately.md"
if [ -f "$doc" ]; then
echo "=== Docs around INFRA_ID (lines ~70-120) ==="
nl -ba "$doc" | sed -n '70,120p'
echo "=== Docs around identity-name snippet (lines ~220-260) ==="
nl -ba "$doc" | sed -n '220,260p'
fi
echo "=== Search for create iam azure implementation ==="
rg -n --hidden --glob='*.go' "create iam.*azure|create-iam|iam azure" . | head -n 50
echo "=== Search for infraID/INFRA_ID and disk identity naming ==="
rg -n --hidden --glob='*.go' "infra[_-]?id|INFRA_ID|identity[-_]?name|disk.*identity|disk.*(UserAssigned|ManagedIdentity)|userAssignedIdentities.*disk" . | head -n 200
echo "=== Search for azure-disk-controller usage ==="
rg -n --hidden --glob='*.go' "azure-disk-controller" . | head -n 100
echo "=== Search for ManagedIdentity.*Disk construction ==="
rg -n --hidden --glob='*.go' "Disk:.*ManagedIdentity|Disk.*ManagedIdentityApplyConfiguration|ManagedIdentity{.*disk|CredentialsSecretName: \"disk" . | head -n 200Repository: openshift/hypershift
Length of output: 170
🏁 Script executed:
#!/bin/bash
set -euo pipefail
doc="docs/content/how-to/azure/create-iam-separately.md"
echo "=== Docs around INFRA_ID (lines ~80-120) ==="
sed -n '80,120p' "$doc" || true
echo "=== Docs around identity-name snippet (lines ~230-255) ==="
sed -n '230,260p' "$doc" || true
echo "=== Search for create iam azure implementation ==="
rg -n --hidden --glob='*.go' "create[- ]iam|createIam|create iam|iam azure|create.*iam.*azure|disk.*ManagedIdentity|userAssignedIdentities" . | head -n 200
echo "=== Search for disk managed identity naming templates ==="
rg -n --hidden --glob='*.go' "(infra[_-]?id|INFRA[_-]?ID|cluster[_-]?name|CLUSTER_NAME|identityName|identity[-_]?name|disk.*identity|disk.*managedidentity|userAssignedIdentities.*disk)" . | head -n 200Repository: openshift/hypershift
Length of output: 42575
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the IAM Azure create implementation
echo "=== Candidate files for create iam azure ==="
fd -t f -g 'create*.go' cmd product-cli | rg -n "iam/azure/create.go|cmd/iam/azure/create.go|product-cli/cmd/iam/azure/create.go|create_iam.*azure|create.*iam.*azure" || true
rg -n "hypershift create iam azure|create iam azure" cmd product-cli . -S | head -n 50 || true
# Inspect cmd/iam/azure/create.go if present
for f in cmd/iam/azure/create.go product-cli/cmd/iam/azure/create.go; do
if [ -f "$f" ]; then
echo "=== File: $f ==="
sed -n '1,220p' "$f" | head -n 220
rg -n "infra-id|INFRA[_-]?ID|identity[-_]?name|disk|Disk|ManagedIdentity" "$f" || true
fi
done
# Search across repo for disk identity name formatting involving infra-id
echo "=== Repo-wide search for disk identity-name formatting ==="
rg -n --hidden --glob='*.go' "(disk.*(identity|Identity)|ManagedIdentity.*disk|disk.*ManagedIdentity|\"disk\".*infra|infra.*\"disk\"|infra.*disk.*name|identityName.*disk)" cmd product-cli hypershift-operator . | head -n 200
# Search for "workload-identities.json" schema usage
echo "=== Search for workload-identities.json usage in Go ==="
rg -n --hidden --glob='*.go' "workload-identities\.json|workload identities" cmd product-cli . | head -n 200
# Search for "infra-id" usage in Azure IAM create path
echo "=== Search for --infra-id usage around IAM create ==="
rg -n --hidden --glob='*.go' "infra-id" cmd/iam cmd/infra product-cli/cmd/iam . | head -n 200Repository: openshift/hypershift
Length of output: 41487
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la cmd/infra/azure | head
# File sizes for targeted reading
wc -l cmd/infra/azure/create_iam.go cmd/infra/azure/identities.go cmd/infra/azure/destroy_iam.go 2>/dev/null || true
echo "=== rg 'disk' in cmd/infra/azure ==="
rg -n --glob='*.go' "disk" cmd/infra/azure | head -n 200
echo "=== rg identity name patterns in cmd/infra/azure ==="
rg -n --glob='*.go' "(identity.?name|IdentityName|userAssignedIdentities|federatedIdentityCredentials|federated.?credential)" cmd/infra/azure | head -n 200
echo "=== rg infra-id usage in cmd/infra/azure ==="
rg -n --glob='*.go' "InfraID" cmd/infra/azure | head -n 200Repository: openshift/hypershift
Length of output: 12980
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la cmd/infra/azure | head
wc -l cmd/infra/azure/create_iam.go cmd/infra/azure/identities.go cmd/infra/azure/destroy_iam.go 2>/dev/null || true
echo "=== rg 'disk' in cmd/infra/azure ==="
rg -n --glob='*.go' "disk" cmd/infra/azure | head -n 200
echo "=== rg identity name patterns in cmd/infra/azure ==="
rg -n --glob='*.go' "(identity.?name|IdentityName|userAssignedIdentities|federatedIdentityCredentials|federated.?credential)" cmd/infra/azure | head -n 200
echo "=== rg infra-id usage in cmd/infra/azure ==="
rg -n --glob='*.go' "InfraID" cmd/infra/azure | head -n 200Repository: openshift/hypershift
Length of output: 12980
🏁 Script executed:
#!/bin/bash
set -euo pipefail
f="cmd/infra/azure/identities.go"
echo "=== identities.go (resourceNamePrefix + naming helpers) ==="
sed -n '80,180p' "$f" | sed -e 's/\t/ /g'
echo "=== identities.go (disk identity block) ==="
sed -n '155,230p' "$f" | sed -e 's/\t/ /g'
echo "=== identities.go (any identity output naming for disk) ==="
sed -n '230,310p' "$f" | sed -e 's/\t/ /g'
echo "=== create_iam.go ==="
sed -n '1,200p' cmd/infra/azure/create_iam.go | sed -e 's/\t/ /g'Repository: openshift/hypershift
Length of output: 18184
Adjust the docs discussion: disk identity names are <clusterName>-disk-<infraID> in code
hypershift create iam azure creates the disk managed identity as <clusterName>-disk-<infraID> (in cmd/infra/azure/identities.go, it builds identityName := opts.Name + def.IdentityNameSuffix where the disk suffix is -disk, then appends "-" + opts.InfraID). That matches the docs’ verification example --identity-name "${CLUSTER_NAME}-disk-${INFRA_ID}", so the identity-name ordering suggestion (${INFRA_ID}-disk) doesn’t align with implementation.
The “duplicate cluster name” comes from the docs’ INFRA_ID="${CLUSTER_NAME}-$(openssl rand -hex 4)" definition (yielding names like my-cluster-disk-my-cluster-abc123). To avoid that, update the docs’ INFRA_ID example (e.g., use only the random suffix) rather than changing the identity-name template.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/content/how-to/azure/create-iam-separately.md` at line 239, The docs
incorrectly suggest an identity-name ordering of `${INFRA_ID}-disk`; update the
how-to text to reflect the actual implementation which builds identityName as
identityName := opts.Name + def.IdentityNameSuffix (i.e.,
`<clusterName>-disk-<infraID>`) and keep the verification example
`--identity-name "${CLUSTER_NAME}-disk-${INFRA_ID}"`; also change the INFRA_ID
example to avoid duplicating the cluster name (e.g., use only a random suffix
like `$(openssl rand -hex 4)` or another short unique suffix) so you don’t end
up with names like `my-cluster-disk-my-cluster-abc123`.
|
@bryan-cox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by @bryan-cox |
openshift-ci-robot
added
the
verified
|
@bryan-cox: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
I now have all the evidence needed. Both failures are the same Go build cache corruption issue hitting all PRs on this repo — completely unrelated to this docs-only PR. Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryBoth failures are caused by Go build cache corruption on the GitHub Actions runner — the error Root CauseThe root cause is corrupted Go build cache on the GitHub Actions runner, not anything in this PR. The Go toolchain caches compiled package files in Lint job: Verify job: This is a fleet-wide issue: The identical
The PR changes zero Go files — it only modifies 6 Markdown docs, 1 YAML nav file, and 1 aggregated-docs reference. The Go compilation and linting pipeline should not be affected by these changes at all. Recommendations
Evidence
|
|
/retest |
openshift-merge-bot
Bot
merged commit 048bebc
into
openshift:main
3 participants
Summary
azure-workload-identity-setup.mdintocreate-iam-separately.mdas the single canonical page for OIDC issuer and workload identity setupcreate-self-managed-azure-cluster.mdto usehypershift create infra azureinstead of manualazCLI commands, eliminating overlap withcreate-infra-separately.mdWhy
Downstream docs writer flagged that overlapping pages made it unclear which procedure users should follow:
azure-workload-identity-setup.mdandcreate-iam-separately.mdboth documentedhypershift create iam azurecreate-self-managed-azure-cluster.mdhad manualazCLI infra steps whilecreate-infra-separately.mddocumentedhypershift create infra azureWhat changed
create-iam-separately.mdazure-workload-identity-setup.mdcreate-iam-separately.mdcreate-self-managed-azure-cluster.mdazCLI infra withhypershift create infra azure, updated cluster creation to use--infra-jsonindex.md,self-managed-azure-index.md,azure-self-managed.mdmkdocs.ymlAll CLI command examples have been verified against the actual cobra flag registrations in the codebase.
Test plan
grep -r "azure-workload-identity-setup" docs/returns zero results (excluding auto-generatedaggregated-docs.md)make docs-aggregateregeneratesaggregated-docs.mdwithout the deleted pagecreate-iam-separately.mdis self-contained: OIDC → identities → verificationcreate-self-managed-azure-cluster.mdflow:create infra azure→create cluster azurewith--infra-json🤖 Generated with Claude Code
Summary by CodeRabbit