ARO-HCP: Fix healthcheck jobs after https://github.com/openshift/release/pull/80156

[roivaz]

The changes in #80156 broke #80138. This PR fixes it.

Summary by CodeRabbit

This PR restores functionality to ARO-HCP (Azure Red Hat OpenShift - Hosted Control Plane) healthcheck jobs that were affected by changes in a previous pull request.

The fixes involve three interconnected changes to the ARO-HCP CI infrastructure:

Lease Management Restructuring: The MSI mock service principal lease (aro-hcp-msi-mock-cs-sp-dev) is relocated from the provision environment step configuration to the local-e2e workflow level. This change makes the lease available throughout the entire workflow execution rather than scoping it to a single step, aligning with how the workflow is expected to access this resource.

Resilient Environment File Handling: The provision environment provisioning script is modified to gracefully handle the optional aro-hcp-slot.env file. Rather than failing hard when the file is missing, it now conditionally sources the file only if it exists, allowing the provisioning process to continue even when this file is unavailable. This makes the script more adaptable to different execution contexts.

Scope: These changes affect the ARO-HCP CI infrastructure, specifically the local end-to-end testing workflows and environment provisioning steps that depend on Azure managed identity mock service principal resources for testing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5990822d-7d2e-4662-b78d-3b480c1fb766

📥 Commits

Reviewing files that changed from the base of the PR and between dcaae87 and bf75c8e.

📒 Files selected for processing (3)

• ci-operator/step-registry/aro-hcp/local-e2e/aro-hcp-local-e2e-workflow.yaml
• ci-operator/step-registry/aro-hcp/provision/environment/aro-hcp-provision-environment-commands.sh
• ci-operator/step-registry/aro-hcp/provision/environment/aro-hcp-provision-environment-ref.yaml

💤 Files with no reviewable changes (1)

• ci-operator/step-registry/aro-hcp/provision/environment/aro-hcp-provision-environment-ref.yaml

---

Walkthrough

This PR refactors ARO-HCP lease provisioning by moving the aro-hcp-msi-mock-cs-sp-dev resource lease declaration from the environment provisioning step to the local-e2e workflow configuration, and makes the provisioning script resilient when the runtime slot environment file is unavailable.

Changes

ARO-HCP Lease Provisioning Refactoring

Layer / File(s)	Summary
Move lease provisioning to workflow level ci-operator/step-registry/aro-hcp/local-e2e/aro-hcp-local-e2e-workflow.yaml, ci-operator/step-registry/aro-hcp/provision/environment/aro-hcp-provision-environment-ref.yaml	The aro-hcp-msi-mock-cs-sp-dev lease mapping is added to the local-e2e workflow's leases section and removed from the environment provisioning config's leases section, relocating lease provisioning to the workflow orchestration level.
Improve slot environment file resilience ci-operator/step-registry/aro-hcp/provision/environment/aro-hcp-provision-environment-commands.sh	The provisioning script's handling of the runtime slot environment file is changed from a hard failure (required to exist) to best-effort loading, allowing the script to continue even when the file is absent.

Possibly Related PRs

• openshift/release#80138: Both PRs modify the ARO-HCP provisioning script around lease and MSI-mock-SP handling, including LEASED_MSI_MOCK_SP and lease-related environment behavior.
• openshift/release#80156: Both PRs coordinate the ARO-HCP e2e lease and slot flow by wiring or consuming the runtime aro-hcp-slot.env contract through lease lifecycle steps.

Suggested Labels

lgtm, approved, ok-to-test

Suggested Reviewers

• deads2k
• raelga
• bennerv

Estimated Code Review Effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: fixing healthcheck jobs affected by a prior pull request, with a reference to the specific PR that caused the issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only CI/operator YAML configs and bash provisioning scripts—no Ginkgo test files with test names to validate.
Test Structure And Quality	✅ Passed	PR contains no Ginkgo test code - only 2 YAML configs and 1 shell script for CI pipeline configuration. Check not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. Changes are limited to CI workflow configuration files and provisioning scripts, which are not subject to this MicroShift test compatibility check.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. Changes are limited to CI/CD configuration files (YAML) and shell scripts with no test code modifications.
Topology-Aware Scheduling Compatibility	✅ Passed	These are CI/CD configuration files, not deployment manifests or operator code. No Kubernetes scheduling constraints affecting cluster topologies are present in the PR.
Ote Binary Stdout Contract	✅ Passed	PR modifies only YAML workflow configs and bash scripts, not OTE binaries or Go code. Check is not applicable to infrastructure configuration changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR contains only CI/CD configuration changes to YAML and shell scripts. No new Ginkgo e2e tests were added, so IPv6/disconnected network compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	All three modified files contain no weak cryptography usage. The PR adds CI/CD configuration and provisioning scripts with no cryptographic algorithms, implementations, or operations.
Container-Privileges	✅ Passed	PR modifies CI pipeline configs (workflows, step refs, shell scripts), not container/K8s manifests. No privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings found.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only configuration and error handling, removing a printf error message. No new logging of passwords, tokens, API keys, PII, session IDs, hostnames, or customer data is introduced.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: roivaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/aro-hcp/local-e2e/OWNERS [roivaz]
• ci-operator/step-registry/aro-hcp/provision/environment/OWNERS [roivaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@roivaz: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-Azure-ARO-HCP-main-e2e-parallel	Azure/ARO-HCP	presubmit	Registry content changed
periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-westus3	N/A	periodic	Registry content changed
periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-centralus	N/A	periodic	Registry content changed
periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-canadacentral	N/A	periodic	Registry content changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[roivaz]

/pj-rehearse pull-ci-Azure-ARO-HCP-main-e2e-parallel

[openshift-merge-bot]

@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[roivaz]

/pj-rehearse periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-centralus

[openshift-merge-bot]

@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[roivaz]

/pj-rehearse periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-canadacentral

[openshift-merge-bot]

@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@roivaz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-canadacentral	bf75c8e	link	unknown	/pj-rehearse periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-canadacentral
ci/rehearse/periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-centralus	bf75c8e	link	unknown	/pj-rehearse periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-centralus

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.