CNTRLPLANE-4010: add Azure AKS external OIDC periodic and presubmit jobs for 4.22 and 5.0 by Nirshal · Pull Request #83045 · openshift/release

Nirshal · 2026-08-06T14:23:14Z

What this PR does / why we need it:

Adds the missing Azure AKS external OIDC periodic and presubmit test jobs to release-4.22 and release-5.0. These jobs already exist on release-4.20 and release-4.21 but were not propagated to newer branches because config-brancher runs with --skip-periodics.

The base External OIDC feature (ExternalOIDCWithUIDAndExtraClaimMappings) is GA since 4.20. The non-techpreview test exercises GA functionality and should exist in all active releases. The techpreview variant tests ExternalOIDCWithUpstreamParity, which remains TechPreview-only.

Jobs added:

Job	Type	4.22	5.0
`e2e-azure-aks-external-oidc`	Periodic (daily, `0 9 * * *`)	Added	Added
`e2e-azure-aks-external-oidc-techpreview`	Periodic (3x/month, `0 20 9,18,25 * *`)	Added	Added
`e2e-azure-aks-external-oidc`	Presubmit (`always_run: true`)	Added	Added
`e2e-azure-aks-external-oidc-techpreview`	Presubmit (`optional: true`)	Added	Already exists

All configurations mirror the existing release-4.21 setup. Both variants use Keycloak as OIDC provider via the idp-external-oidc-keycloak-aks-server CI step.

Pass rates on existing releases (Prow full history, ~5.5 months):

4.21: 87.4% (199 runs)
4.20: 84.3% (197 runs)

Once the periodic jobs accumulate enough runs on 4.22/5.0, they will be added as informing tests in the HO Konflux release gating pipeline, and later evaluated for promotion to blocking.

Special notes for your reviewer:

The AWS external OIDC variants are correctly propagated across all releases and are not modified by this PR. Only the Azure AKS variants are in scope.

Full investigation report: External OIDC Test Investigation

Which issue(s) this PR fixes:

CNTRLPLANE-4010 (relates to CNTRLPLANE-3790)

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

Summary by CodeRabbit

This PR restores Azure AKS external OIDC CI coverage for OpenShift HyperShift release-4.22 and release-5.0.

Adds daily non-techpreview periodic jobs.
Adds techpreview periodic jobs three times per month.
Adds always-run non-techpreview presubmit jobs.
Adds the optional techpreview presubmit for release-4.22.
Runs TestExternalOIDC with certificate authentication and certificate-rotation scaling.
Uses the Azure AKS external OIDC workflow with Keycloak.
Leaves AWS external OIDC jobs unchanged.

These jobs restore coverage omitted when config-brancher skipped periodic jobs.

openshift-ci-robot · 2026-08-06T14:23:18Z

@Nirshal: This pull request references CNTRLPLANE-4010 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Adds the missing Azure AKS external OIDC periodic and presubmit test jobs to release-4.22 and release-5.0. These jobs already exist on release-4.20 and release-4.21 but were not propagated to newer branches because config-brancher runs with --skip-periodics.

The base External OIDC feature (ExternalOIDCWithUIDAndExtraClaimMappings) is GA since 4.20. The non-techpreview test exercises GA functionality and should exist in all active releases. The techpreview variant tests ExternalOIDCWithUpstreamParity, which remains TechPreview-only.

Jobs added:

Job Type 4.22 5.0

e2e-azure-aks-external-oidc Periodic (daily, 0 9 * * *) Added Added

e2e-azure-aks-external-oidc-techpreview Periodic (3x/month, 0 20 9,18,25 * *) Added Added

e2e-azure-aks-external-oidc Presubmit (always_run: true) Added Added

e2e-azure-aks-external-oidc-techpreview Presubmit (optional: true) Added Already exists

All configurations mirror the existing release-4.21 setup. Both variants use Keycloak as OIDC provider via the idp-external-oidc-keycloak-aks-server CI step.

Pass rates on existing releases (Prow full history, ~5.5 months):

4.21: 87.4% (199 runs)

4.20: 84.3% (197 runs)

Once the periodic jobs accumulate enough runs on 4.22/5.0, they will be added as informing tests in the HO Konflux release gating pipeline, and later evaluated for promotion to blocking.

Special notes for your reviewer:

The AWS external OIDC variants are correctly propagated across all releases and are not modified by this PR. Only the Azure AKS variants are in scope.

Full investigation report: External OIDC Test Investigation

Which issue(s) this PR fixes:

CNTRLPLANE-4010 (relates to CNTRLPLANE-3790)

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-06T14:23:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8853d83f-23ee-476d-8821-19d8d08d1847

📥 Commits

Reviewing files that changed from the base of the PR and between 658e1ba and 05becce.

⛔ Files ignored due to path filters (4)

ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.22-periodics.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.22-presubmits.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (4)

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml

🚧 Files skipped from review as they are similar to previous changes (4)

ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22.yaml

Walkthrough

HyperShift 4.22 and 5.0 CI configurations now include Azure AKS External OIDC jobs. The changes add always-running jobs and periodic regular or TechPreview jobs with certificate authentication and certificate-rotation scaling.

Changes

Azure AKS External OIDC coverage

Layer / File(s)	Summary
Release job definitions `ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22.yaml`, `ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml`	Added always-running External OIDC jobs for HyperShift releases 4.22 and 5.0. Release 4.22 also adds an optional TechPreview job with `TECH_PREVIEW_NO_UPGRADE`.
Periodic job schedules `ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yaml`, `ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml`	Added daily regular jobs and scheduled TechPreview jobs. The jobs use certificate authentication, `TestExternalOIDC`, certificate-rotation scaling, and the Azure AKS External OIDC workflow. TechPreview jobs set `TECH_PREVIEW_NO_UPGRADE`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ironcladlou, enxebre

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❓ Inconclusive	Initial diff query returned no changes; the repository state needs a commit-level comparison before assessing sensitive logging.	Inspect the current commit and its parent, then review all added configuration and referenced CI steps for sensitive logging.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the added Azure AKS external OIDC periodic and presubmit jobs for releases 4.22 and 5.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only YAML CI configuration and generated job files. Added lines contain static job IDs and TestExternalOIDC selectors; no It, Describe, Context, When, or dynamic test titles were added.
Test Structure And Quality	✅ Passed	The PR changes only eight YAML CI configuration files and adds job definitions; it does not add or modify Ginkgo It blocks or test lifecycle code, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR adds only CI YAML and generated Prow jobs; it adds no Ginkgo test declarations or test source. The MicroShift compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit adds only YAML CI configurations and generated Prow jobs; it adds no Go files or new Ginkgo tests that could make multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only CI configuration and generated Prow job YAML; it adds no deployment manifests, operator/controller code, or topology scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only YAML job/config metadata and generated Prow jobs; no OTE binary source or process-level stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds only YAML CI declarations and generated Prow jobs; it adds no Ginkgo test source, IPv4 logic, or new external-network code.
No-Weak-Crypto	✅ Passed	The 8 changed files add only YAML job/config declarations; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	Added config and generated job manifests contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, securityContext, or runAs settings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-08-06T14:24:24Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Nirshal
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-08-06T14:28:17Z

@Nirshal: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

Nirshal · 2026-08-06T14:36:17Z

/jira refresh

openshift-ci-robot · 2026-08-06T14:36:21Z

@Nirshal: This pull request references CNTRLPLANE-4010 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…obs for 4.22 and 5.0 The Azure AKS external OIDC test jobs were not propagated when release-4.22 and release-5.0 branches were created, because config-brancher runs with --skip-periodics. Add the following jobs, mirroring the existing 4.21 configuration: - e2e-azure-aks-external-oidc periodic (daily) on 4.22 and 5.0 - e2e-azure-aks-external-oidc-techpreview periodic (3x/month) on 4.22 and 5.0 - e2e-azure-aks-external-oidc presubmit (always_run) on 4.22 and 5.0 - e2e-azure-aks-external-oidc-techpreview presubmit (optional) on 4.22 The techpreview presubmit on 5.0 already exists and is not modified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nirshal · 2026-08-06T15:00:38Z

/pj-rehearse

openshift-merge-bot · 2026-08-06T15:00:42Z

@Nirshal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai · 2026-08-06T15:00:43Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

openshift-merge-bot · 2026-08-06T15:03:48Z

[REHEARSALNOTIFIER]
@Nirshal: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-hypershift-release-4.22-e2e-azure-aks-external-oidc	openshift/hypershift	presubmit	Presubmit changed
pull-ci-openshift-hypershift-release-4.22-e2e-azure-aks-external-oidc-techpreview	openshift/hypershift	presubmit	Presubmit changed
pull-ci-openshift-hypershift-release-5.0-e2e-azure-aks-external-oidc	openshift/hypershift	presubmit	Presubmit changed
periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-azure-aks-external-oidc-techpreview	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-azure-aks-external-oidc	N/A	periodic	Periodic changed
periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc-techpreview	N/A	periodic	Periodic changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

openshift-ci · 2026-08-06T18:36:22Z

@Nirshal: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc-techpreview	`05becce`	link	unknown	`/pj-rehearse periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc-techpreview`
ci/rehearse/periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc	`05becce`	link	unknown	`/pj-rehearse periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-external-oidc`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 6, 2026

openshift-ci Bot requested review from enxebre and ironcladlou August 6, 2026 14:24

Nirshal force-pushed the CNTRLPLANE-4010/add-external-oidc-periodic branch from e5a2345 to 05becce Compare August 6, 2026 15:00

coderabbitai Bot mentioned this pull request Aug 6, 2026

Pre branching 5.0 -> 5.1 #83050

Merged

Uh oh!

Conversation

Nirshal commented Aug 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Special notes for your reviewer:

Which issue(s) this PR fixes:

Checklist:

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Aug 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Special notes for your reviewer:

Which issue(s) this PR fixes:

Checklist:

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 inconclusive)

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

Nirshal commented Aug 6, 2026

Uh oh!

openshift-ci-robot commented Aug 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Nirshal commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Nirshal commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Aug 6, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

openshift-ci-robot commented Aug 6, 2026 •

edited by atlassian Bot

Loading