v0.1.87

⏪ Reverts

• Reapply "CNTRLPLANE-3890 - Add product-cli unit tests for HCP create cluster"
• (ingressoperator) restore HAProxy 2.8 wiring removed by #9703 (TRT-3008)

♻️ Refactoring

• (hcco) extract RBAC resource reconciliation
• (hcco) preserve RBAC capability selection contract
• (hcco) reuse RBAC manifests
• (cli) inject management-cluster clients consistently
• (hypershift-operator) use explicit client acquisition
• (control-plane-operator) use explicit configmap client
• (hcco) extract cluster foundation configuration
• (e2e) remove unused internal workload helpers
• remove remaining deadcode candidates
• (podspec) move shared constants into constants.go
• (podspec) reuse existing constants block
• (support) centralize podspec constants
• move operand label/annotation to karpenter-operator repo
• decouple CAPI provider types into local packages
• remove the CAPI dependency from the provider modules
• remove remaining deadcode candidates
• (lint) Isolate utility analyzer configuration
• (lint) Share legacy utility package matching
• (tools) encapsulate API dependency allowlist loading
• (hypershift-operator) validate KubeVirt credentials in the existing reconcile flow

🐛 Bug Fixes

• (ci) install release workflow binaries to user-writable path
• (kubevirt) OCPBUGS-77307: override nmstate config for multus with IPv6
• (e2e) set NodePoolReplicas=1 for KubeVirt TestNodePool like OpenStack
• (hcco) preserve RBAC reconciliation behavior
• (ci) use runner.temp and detect arch for tool installs on ARC runner-set
• (ci) use GitHub App token for tag push and add manual dispatch
• (ci) compact yq JSON output for GITHUB_OUTPUT
• (ci) remove duplicate release trigger and draft mode
• move combined-pull-secret creation to top-level CPO
• (karpenter) defer default NodeClass to standalone operator
• (nodepool) validate KubeVirt additionalNetworks NAD namespace
• count only successful upsert updates
• (upsert) count successful ApplyManifest updates only
• (cpo) delete AWSEndpointServices before removing the HCP finalizer (#9718)
• (kubevirt) pin VMI architecture and inject kubernetes.io/arch node selector for multi-arch nodepools
• (kubevirt) support arch-specific NodePools on multi-arch infra clusters
• (kubevirt) reject unsupported arches in defaultImage and add missing arch/NodeSelector test cases
• (kubevirt) fix lint errors and regenerate aggregated docs
• (kubevirt) add coverage tests for arch-specific NodePool logic
• (kubevirt) cover archConflictError and PlatformValidation arch-conflict path
• (nodepool) propagate performance profile status changes
• (OCPBUGS-126889) preserve wrapped Azure credential reconcile errors
• (gcp) address workload identity webhook CI feedback
• (gcp) default workload identity audience to openshift
• (cli) align rebased command call sites
• (cli) honor kubeconfig in dump helpers
• (cli) preserve client injection and offline rendering
• (kas) enable DeviceTaintRule API on Kubernetes 1.36
• (api) validate Azure HostedCluster subnet ID
• (cpo) skip PodDisruptionBudgets for SingleReplica control planes
• (makefile) strip DWARF info from linter plugins to fix macOS dyld crash
• (etcdbackup) correctly classify Azure client-secret credentials from Velero BSL
• (karpenter) defer EC2NodeClass reconcile to standalone operator
• (karpenter) add ReleaseImageProvider to adaptDeployment test
• (e2e) ensure e2e v1 AWS OIDC providers are tagged with e2e metadata
• (azure) converge private DNS network links
• (azure) preserve sanitized private DNS provider causes
• (e2e) enable e2e v2 lifecycle tests for aws
• (cpo) report real KMS errors when guest cluster is unavailable
• (hypershift-operator) preserve configured scale-from-zero labels and taints
• (TestDialDirectWithProxy) intermittent timeout reading bytes because ignored bytes during proxy hijacking
• (etcd) use supplied TLS for unmanaged etcd
• OCPBUGS-93456: changes NodePortPublishingStrategy.Port (#9002)
• (cpo) bracket IPv6 API health-check endpoints
• (network) normalize literal endpoint authorities
• (cpo) scope IPv6 endpoint corrections to control plane
• (OCPBUGS-126895) preserve AWS API error details on AWSEndpointService reconcile
• rename MY_NAME to POD_NAME in standalone karpenter-operator deployment
• don't enable metrics in karpenter-adapter container
• add GA payload CPO overrides for azure 4.20/4.21
• (e2e) remove Platform.CreateArgs to make ClusterSpecs more declarative
• satisfy gci and gocyclo in the localize changes
• repoint the IP forwarding tests at the localized CAPI core
• (gcp) preserve role credentials for shared service accounts
• (hcco) use hash-based labelsSynced to re-sync labels on change
• (hcco) dedup taints by (key,effect) and clarify additive-only godoc
• (cpo) preserve previous CAs in client-ca bundle during rotation
• (e2e) Replace e2e v2 Platform.DeleteArgs with declarative ClusterSpec
• (karpenter) defer HCP lifecycle to standalone operator
• (gcp) GCP-1221 | address firewall reconciler review feedback
• (gcp) GCP-1221 | treat mixed 400 reasons as terminal
• (gcp) GCP-1221 | union both 400 reason surfaces, all must be transient
• (gcp) GCP-1221 | guard NewFirewallManager error path against generation race
• (gcp) GCP-1221 | require every operation error recoverable before degrading
• (gcp) GCP-1221 | fix lint failures in firewall manager
• (gcp) GCP-1221 | verify VPC before deleting an owned firewall rule
• (gcp) GCP-1221 | report pending instead of a stale GCPFirewallRulesReady
• (gcp) GCP-1221 | allow firewall deletion to proceed when WIF never recovers
• (gcp) GCP-1221 | base firewall cleanup skip on a durable provisioning marker
• (gcp) GCP-1221 | address review feedback on firewall rule cleanup
• (gcp) GCP-1221 | drop stale gophercloud indirect dep after rebase
• (cpo) omit in-guest kube-storage-version-migrator CVO manifests
• (awsprivatelink) exclude edge-zone subnets from endpoints
• (control-plane-operator) preserve subnet selection without a region
• (azure) make CI role assignment cleanup reproducible
• (etcd-recovery) detect and recover etcd pods on unreachable nodes
• (nodepool) address predictable rollout review feedback
• (nodepool) preserve rollout targets across migration and retries
• (nodepool) recover persisted rollout targets and honor release changes
• (e2e) skip managed DNS e2e below 5.1 and give its cluster the common args
• (kubevirt) sync CAPK install CRDs with release-5.1 API types
• (kubevirt) sync vendor CAPK types and condition status check
• (capi-sync) resolve CAPI packages with go list
• (tooling) match the tools module root in changed-package filtering
• (tooling) remove the deadcode analyzer executable override
• (tooling) shell-quote the deadcode artifact directory
• (karpenter) pass allocated UID to standalone karpenter-operator
• (e2e) persist mirror registry CA across setup calls
• (lint) Reject stale legacy utility exceptions
• (lint) Qualify legacy fields and methods by type
• (lint) Isolate legacy allowances by Ginkgo callback
• (lint) Harden utility analyzer and sync migration docs
• (build) refresh API vendor metadata after workspace sync
• (build) order CAPI refresh before verification readers
• (OCPBUGS-100035) add periodic resync and reduce backoff ceiling for HCCO resources controller
• (e2e-v2) gate TLS downgrade restart waits by component capability
• (lint) NO-JIRA | sync OSImageStream allowlist scopes
• (ci) ensure verify-ci runs lint
• set maxUnavailable=0 on HCP router Deployment to prevent availability loss during rollouts
• set maxUnavailable=0 on HCP router Deployment to prevent availability loss during rollouts
• prevent router from starting before backend service IPs are assigned
• address review feedback on ClusterIP gating
• address review feedback on comment verbosity and test naming
• address review feedback - simplify loop, rename function, add test coverage
• (api) preserve component route labels behind the preview gate
• (etcd) bound defrag requests and stop timed-out cycles
• (cli) document platform-dependent nodepool upgrade defaults
• (nodepool) publish compatible scale-from-zero capacity annotations
• (lint) preserve production provenance across test packages
• (lint) honor cross-package test exceptions
• (lint) handle explicit test exceptions and testing.T aliases
• (lint) resolve test structure review findings
• (lint) honor baselined reverse-cross tests
• remove CustomNoUpgrade CRDs as part of API generation
• regenerate CRDs
• remove CustomNoUpgrade feature-set tests
• tools: update crd-schema-check to check Default and TPNU manifests
• (hypershift-operator) stop gating NodePool rollout completion on upToDateReplicas
• (etcd-recovery) treat unstarted member as unhealthy instead of aborting
• (etcd-recovery) require the failing pod to be the unhealthy member
• (etcd-recovery) identify an unstarted member by its derived name
• (hypershift-operator) register relocated CAPI converters
• (hypershift-operator) validate external KubeVirt infrastructure kubeconfigs
• (hypershift-operator) preserve degraded reconciliation and report teardown credentials
• (hypershift-operator) propagate pause and honor custom keys for KubeVirt credentials
• (cpo) increase cluster autoscaler client rate limits
• (cpo) include named certificate CAs in root-ca trust bundle
• (e2e) use public-only networking for AWS v2 profiles

👷 CI

• (deps) bump actions/actions-runner from 2.337.0 to 2.338.0
• verify payload and mirrored CPO override images
• sync release branches to community fork
• (envtest) add OpenShift Kubernetes 1.37.1 coverage
• guard the localized CAPI type aliases before CI does
• build unvendored CAPI provider modules in readonly mode
• (deps) bump actions/create-github-app-token from 1.12.0 to 3.3.0
• run mirror registry fixture unit tests in other shard
• add a GitHub Actions deadcode gate
• (tekton) update trusted task bundles and artifact wiring
• (lint) enforce unit test structure policy
• (deps) bump astral-sh/setup-uv from 10.1.0 to 10.3.2

📖 Documentation

• (konflux) improve HO hotfix documentation and fix template
• fix stale N-2 version skew references to N-3
• update generated version skew references
• (gcp) explain workload identity webhook mutation
• explain user-configured labels for zonal scale-from-zero workloads
• correct August report attribution (CNTRLPLANE-4538)
• clarify NodePool status.osImageStream vs MCO OSImageStream status
• scope pre-PR validation to change risk
• align contributor validation guidance
• align PR template and onboarding validation
• regenerate aggregate for onboarding validation guidance
• (capi-image-overrides) Add new override for versions below 4.19
• (azure) document AutoNode setup for self-managed clusters
• describe Azure E2E worker diagnostic artifacts
• note the shared-module coupling left after CAPI decoupling
• (api) update NodeLabels and Taints godoc to reflect re-sync behavior
• (gcp) GCP-1221 | document effective NodePort range in worker firewall rule
• (gcp) GCP-1221 | fix control plane service account name in IAM docs
• (gcp) GCP-1221 | regenerate aggregated docs for worker firewall doc fixes
• (gcp) GCP-1221 | regenerate aggregated docs for firewall cleanup changes
• (aws) add managed DNS how-to
• Update etcd recovery docs with new unreachable node detection
• document deadcode reporting contract and limitations
• (lint) Explain the scope traversal invariant
• (lint) Describe the utility reference baseline accurately
• (lint) Clarify utility exception scopes and entries
• point agents at the harness-neutral restructure-commits skill
• (ai-skill) turn harness restructure-commits entries into adapters
• clarify expectedSet scope and IsRequestServing side-effect notes
• explain serial verification and CI delegation
• direct large-change feedback to Slack
• restore all HA etcd members from the same snapshot
• explain external KubeVirt credential validation and recovery
• CNTRLPLANE-4577 | regenerate API reference
• CNTRLPLANE-4576 | document serviceAnnotations validation
• (e2e) introduce a v1 to v2 test migration procedure
• (e2e) update guidance on blocking status of ported tests
• document existing Azure Karpenter identities
• Describe the HyperShift Operator nightly release stream
• add hosted cluster lifecycle roadmaps and observations

📦 Build

• (api) bump Kubernetes dependencies to 1.37
• Emit release-manifests/image-references from the operator build
• (images) align image references for Kubernetes 1.37
• (deps) prune unused etcd vendor modules
• (deps) bump the azure-github-dependencies group across 1 directory with 3 updates
• (deps) remove stale vendored files
• (deps) consolidate indirect requirements
• Zero pad the commit distance in derived nightly tags
• Set creationTimestamp in the operator image-references file
• harden CAPI generation against version skew and failures
• group the CAPI provider replace directives into one block
• read the API versions to sync from vendor_imports.go
• (deps) bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
• (deps) bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
• (deps) bump google.golang.org/grpc to 1.83.2 in tools
• order CAPI decoupling check after provider sync
• (api) align shared API dependencies
• (api) regenerate metadata against integrated main
• (api) refresh gated partials after upstream CSI additions
• (aws) update localized CAPA dependency to v2.13.1
• (verify) sequence conflicting CAPI checks before readers
• run image mirroring e2e v2 helper unit tests in test-e2ev2-unit
• (deps) bump core Cluster API to v1.14.3
• (capi) keep internal IPAM alpha types out of generated CRDs
• (images) CNTRLPLANE-4577 | advertise deterministic LB support
• (capi) align CAPK source pin with CI image

🚀 Features

• (api) add kubeClientQPS and kubeClientBurst to ClusterAutoscaling
• (control-plane-operator) add GCP workload identity webhook
• implement cpu options
• (karpenter-operator) monitor operand rollout status for version tracking
• (api) promote HCPUserFacingOperatorLogs feature gate to Default
• remove HAProxy 2.8 reference
• (featuregate) add DeterministicLBIP feature gate
• (gcp) GCP-504 NodePool platform conditions
• (machine-approver) plumb TLS curve preferences
• (azure) add opt-in IP forwarding for NodePools
• remove HAProxy 2.8 reference
• add managed ingress DNS for AWS hosted control planes (RFE-9235) (#9348)
• (hcco) propagate encryption condition to guest OpenShiftAPIServer
• (cli) capture Azure worker diagnostics during cluster dumps
• enable was in hypershift
• (gcp) propagate resource labels to PSC resources
• (cpov2) add WithGatedPreconditions to gate rollout on HCP conditions
• (api) add initialKMSKeyARN field for StorageClass KMS encryption
• (kms) propagate initialKMSKeyARN to hosted cluster ClusterCSIDriver
• (gcp) GCP-1221 | manage worker firewall rule in CPO
• (control-plane-operator) enable CRD compatibility requirements for preview clusters
• (nodepool) implement predictable rollout control and migration handling
• (tooling) add reporting-only whole-program deadcode analysis
• (CNTRLPLANE-4807) Add KubeletHAProxyRouting FeatureGate (TechPreviewNoUpgrade)
• (api) add loadBalancerClass and serviceAnnotations to LoadBalancerPublishingStrategy
• (gcp) reconcile load balancer resource labels in HCCO
• enable TLSGroupPreferences on TechPreviewNoUpgrade
• update haproxy image
• (lint) add unit test structure analyzer
• (CNTRLPLANE-4732) route kubelet through HAProxy on all public HCPs
• Generate Generic Controller Config with TLS Groups
• Filter out FIPS non approved groups
• (gcp) add resource tag support
• (cli) regenerate Azure CAPI CRDs for CAPZ v1.27.0
• (hypershift-operator) sync localized CAPZ types from v1.27.0
• (api) CNTRLPLANE-4577 | add DeterministicLBIPSupported condition
• (hypershift-operator) CNTRLPLANE-4577 | detect control plane operator deterministic LB skew
• (control-plane-operator) CNTRLPLANE-4577 | pass serviceAnnotations and loadBalancerClass to the KAS Services
• (api) CNTRLPLANE-4576 | validate serviceAnnotations allowlist and bounds
• (azure) accept an explicit Karpenter client ID

🧪 Testing

• (kubevirt) add e2e nmstate network config verification for multinet tests
• (control-plane-operator) refresh Kubernetes 1.37 scheduler fixtures
• (e2e) add Kubernetes 1.37 envtest coverage
• (product-cli) refresh cluster create fixtures
• (e2e) add GCP workload identity webhook coverage
• (gcp) address workload identity e2e feedback
• (gcp) add informing label to workload identity test
• (e2e) pass explicit clients through helpers
• (cli) cover injected management clients
• (cpo) seed PDB fields and tighten AdaptPodDisruptionBudget cases
• (e2e) deduplicate AWS v1 coverage
• (e2e) promote ingress and Azure OAuth checks
• (e2e) require GCP workload identity on 5.1 and later
• (e2e) refactor Karpenter v2 test helpers and harden upgrade test
• (backup-restore) wait for manual backup before scheduling
• (e2e-v2) skip control-plane-pki-operator TLS config tests on older operators
• (unit) Add tests for encryption condition propagation
• (CNTRLPLANE-4167) port scale-from-zero autoscaling test to v2 framework
• (CNTRLPLANE-4167) address review feedback for scale-from-zero v2 test
• (e2e) address scale-from-zero review feedback
• (e2e) use CAPI v1beta2 for autoscaling
• (e2e) collect and validate Azure machine diagnostics
• (e2e) add e2ev2 StorageClass KMS encryption test
• (gcp) GCP-1221 | e2e for CPO-managed worker firewall rule
• (gcp) GCP-1221 | classify worker firewall e2e as a lifecycle test
• (gcp) GCP-1221 | wait for and require 2 workers instead of skipping
• (unit) update cvo deployment test
• (e2e) Add Upgradeable=true check after upgrade test
• (e2e) cover AWS cross-cluster backup and restore
• (e2e) clarify cross-cluster restore failure diagnostics
• (e2e) address cross-cluster restore review feedback
• (e2e) restore target ExternalDNS after failed cross-cluster restore
• (unit) Fix kube-storage-version-migrator removal assertion
• (unit) Add tests for the new etcd-recovery from unreachable nodes
• (e2e) verify token rotation and credential updates after HO upgrade
• (nodepool) fix codespell in endpoint config test name
• (nodepool) cover KubeVirt live-migratable NodePool condition
• (e2e) make cross-major OSImageStream checks deterministic
• (e2e) add mirror registry fixture API skeleton
• (e2e) add mirror registry option validation
• (e2e) generate mirror registry TLS materials
• (e2e) add mirror registry resource builders
• (e2e) add job-based mirror registry image copier
• (e2e) clarify mirror registry Setup re-run semantics
• (e2e) orchestrate mirror registry setup and teardown
• (e2e) add AWS image-mirroring lifecycle variant
• (e2e) verify image mirroring propagation through independent paths
• (e2e) mark image mirroring specs informing and poll with Gomega
• (e2e) fail image-mirroring setup on empty image content sources
• (e2e) make mirror registry poll interval injectable
• (e2e) fix Gomega polling callback argument order
• (e2e) validate mirror request before withdrawing the registry route
• (e2e) clarify mirror registry endpoint probe
• (lint) Use keyed utility analyzer test cases
• (e2e-v2) improve TLS capability assertion diagnostics
• (e2e-v2) cover TLS downgrade restart gating and connectivity
• add predicate-level test for ClusterIP gating
• (cli) cover component route label persistence and gating
• (etcd) report defrag fixture cleanup errors
• (karpenter) wait for nodes before arbitrary subnet cleanup
• (e2e) detect multi-arch support for Karpenter ARM64 provisioning
• consolidate split unit test scenarios
• (e2e) verify workload pulls through the image mirror
• (e2e/v2) add GCP multi-cluster lifecycle platform config
• (cpo) cover managed ingress DNS zone deletion
• (etcd-recovery) correct spelling flagged by codespell
• (hypershift-operator) align KubeVirt tests with lint rules
• (e2e) CNTRLPLANE-4576 | cover serviceAnnotations allowlist and bounds
• (azure) pass an explicit Karpenter client ID through e2e options
• (unit) Add unit tests for named cert CAs
• (e2e) Add e2e test for external trust bundle
• (e2e) run v2 Karpenter tests on hosted clusters 4.22+

🧹 Chores

• (renovate) group Go dependencies by module
• (renovate) group API Go dependencies
• (api) regenerate Kubernetes 1.37 dependencies and CRDs
• (release) request v0.1.86 tag
• (owners) add CI operator config owners
• (gitignore) ignoring mise.toml
• (api) regenerate unmanaged etcd TLS docs
• (contrib) remove aws-leaked-resources
• (owners) Add Dan Mace to core-approvers
• (deps) update actions/upload-artifact action to v7.0.2
• (deps) update cloudflare/wrangler-action action to v4.1.3
• (api) regenerate CRDs, deepcopy, clients, and docs
• update Karpenter reviewers and approvers in OWNERS
• (tools) register and vendor the pinned deadcode analyzer
• (lint) drop WithoutConditionDump from e2eutil allowlist
• (e2e) Deny use of v1 e2e package code in new v2 e2e code
• (lint) Remove the unused Karpenter exclusion
• (docs) Update e2e v2 AGENTS.md
• (deps) update module go.mongodb.org/mongo-driver to v1.17.10
• (ai-skill) enforce component boundaries when restructuring commits
• (api) regenerate component route label schemas
• (aws) stop writing and prune deprecated aws-load-balancer-subnets annotation
• (deps) update actions/download-artifact action to v8.0.2
• Bump openshift/library-go
• Vendor github.com/openshift/api/features
• (api) regenerate CAPI v1.14.3 dependencies and CRDs
• (api) bump cluster-api-provider-azure to v1.27.0 and re-vendor
• (api) CNTRLPLANE-4577 | sync vendored API types
• (api) CNTRLPLANE-4576 | regenerate gated CRDs for serviceAnnotations validation
• (azure) refactor AutoNode flag description