OCPBUGS-105398: refactor: remove AzureWorkloadIdentity feature gate

[damdo]

Summary

• Remove the AzureWorkloadIdentity feature gate, which is now GA and enabled by default upstream (see openshift/api features.go), making the gate check in this repo a permanent no-op.
• Drop the AzureWorkloadIdentityEnabled plumbing through cmd/manager/main.go, the machine Actuator, the machineset Reconciler, and MachineScope.
• Simplify the credential selection in MachineScope.updateFromSecret to depend only on whether a client secret is present (workload identity is used whenever no client secret is configured, same effective behavior as before since the gate was always enabled).

Introduced originally in #55.

Test plan

• make build
• go vet ./...
• make fmt (no diff beyond intended changes)
• make test (./pkg/cloud/azure/actuators/...) — all suites pass
• golangci-lint run on changed packages — no new findings introduced

Summary by CodeRabbit

• Changes
  • Removed the Azure Workload Identity feature gate and related configuration controls.
  • Azure workload identity credentials are now selected automatically when no client secret is provided.
  • Simplified Azure machine and MachineSet configuration without changing reconciliation behavior.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d5750eea-604e-421f-b98b-b6e7cd115d65

📥 Commits

Reviewing files that changed from the base of the PR and between 4ff6c6b and 07bd616.

📒 Files selected for processing (4)

• cmd/manager/main.go
• pkg/cloud/azure/actuators/machine/actuator.go
• pkg/cloud/azure/actuators/machine_scope.go
• pkg/cloud/azure/actuators/machineset/controller.go

💤 Files with no reviewable changes (1)

• pkg/cloud/azure/actuators/machineset/controller.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The change removes the Azure Workload Identity feature gate and its enabled-state plumbing. Machine scope credential selection now uses workload identity when no client secret is set.

Changes

Azure Workload Identity removal

Layer / File(s)	Summary
Machine scope credential selection pkg/cloud/azure/actuators/machine_scope.go	MachineScopeParams no longer contains the enablement flag. Blank client secrets select workload identity credentials.
Machine actuator plumbing pkg/cloud/azure/actuators/machine/actuator.go	The actuator no longer stores or forwards the flag during machine operations.
Manager and MachineSet wiring cmd/manager/main.go, pkg/cloud/azure/actuators/machineset/controller.go	The manager no longer registers or initializes the feature gate. MachineSet reconciler configuration no longer exposes or forwards the flag.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 07bd6

This refactor removes obsolete feature-gate plumbing while preserving credential-selection behavior and required event-recorder compatibility; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only four production Go files and changes no *_test.go files. The parent-to-HEAD diff adds or modifies no It(), Describe(), Context(), When(), Entry(), or `S…
Test Structure And Quality	✅ Passed	PASS. The pull request changes only four production Go files and changes no *_test.go file or Ginkgo test construct. Therefore it introduces no test-structure or test-quality violation. The existing…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only four production Go files. The verified diff adds no *_test.go files and no e2e, test, or tests paths. Therefore, it adds no new Ginkgo e2e tests that could violate …
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only four production Go files. The commit adds no test or e2e files, no Ginkgo constructs, and no topology-sensitive test logic. The SNO compatibility check is therefore…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The parent-to-HEAD diff changes only Azure feature-gate and credential plumbing in four Go files. It adds no deployment manifests, replica logic, pod anti-affinity, topology spread constraints,…
Ote Binary Stdout Contract	✅ Passed	PASS. The PR adds no stdout write in main(), init(), or test-suite setup. The only changed logging in cmd/manager/main.go removes a klog.Infof call. The manager still calls `klog.InitFlags(nil…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified. The pull request changes only four implementation files. Added lines contain no hardcoded IPv4 values, IPv4-only parsing, external hosts, registry pulls, or…
No-Weak-Crypto	✅ Passed	PASS. The commit changes four files and only removes the Azure Workload Identity feature-gate plumbing. The only added condition is strings.TrimSpace(clientSecret) == ""; the same secret-presence ch…
Container-Privileges	✅ Passed	The PR changes only four Go files and adds no container or Kubernetes manifest settings. The diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation …
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The commit changes no logging statements or log arguments. It removes feature-gate logging and credential plumbing. The remaining credential-related log messages report missing field names, secr…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: removal of the AzureWorkloadIdentity feature gate.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only four production Go files and changes no *_test.go files. The parent-to-HEAD diff adds or modifies no It(), Describe(), Context(), When(), Entry(), or Specify() declarations. Therefore, it introduces no unstable or overly specific Ginkgo test name.

Full details: Test Structure And Quality

Explanation

PASS. The pull request changes only four production Go files and changes no *_test.go file or Ginkgo test construct. Therefore it introduces no test-structure or test-quality violation. The existing MachineSet Ginkgo suite already uses BeforeEach/AfterEach and explicit timeouts for Eventually calls.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only four production Go files. The verified diff adds no *_test.go files and no e2e, test, or tests paths. Therefore, it adds no new Ginkgo e2e tests that could violate MicroShift compatibility requirements.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only four production Go files. The commit adds no test or e2e files, no Ginkgo constructs, and no topology-sensitive test logic. The SNO compatibility check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The parent-to-HEAD diff changes only Azure feature-gate and credential plumbing in four Go files. It adds no deployment manifests, replica logic, pod anti-affinity, topology spread constraints, node selectors or affinity, tolerations, or PDBs. The only behavior change selects Azure workload identity when the client secret is empty. Therefore, the pull request introduces no scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The PR adds no stdout write in main(), init(), or test-suite setup. The only changed logging in cmd/manager/main.go removes a klog.Infof call. The manager still calls klog.InitFlags(nil) and sets logtostderr=true before its remaining logs. The direct fmt.Printf calls are unchanged reconciliation code, not process-level setup.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

No Ginkgo e2e tests were added or modified. The pull request changes only four implementation files. Added lines contain no hardcoded IPv4 values, IPv4-only parsing, external hosts, registry pulls, or external URL access. The check does not apply.

Full details: No-Weak-Crypto

Explanation

PASS. The commit changes four files and only removes the Azure Workload Identity feature-gate plumbing. The only added condition is strings.TrimSpace(clientSecret) == ""; the same secret-presence check already existed in the parent commit. No added weak-crypto API, algorithm, mode, custom cryptography, or secret/token equality comparison appears in the diff.

Full details: Container-Privileges

Explanation

The PR changes only four Go files and adds no container or Kubernetes manifest settings. The diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation declarations. The repository has no such checked settings outside vendor content. The unchanged Dockerfiles only build and copy binaries, so this PR does not introduce a listed container privilege condition.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The commit changes no logging statements or log arguments. It removes feature-gate logging and credential plumbing. The remaining credential-related log messages report missing field names, secret reference names, environment-variable names, or a default token-file path; they do not print secret, token, or credential values. The existing ProviderSpec log prints a provider specification that contains SecretReference metadata, not Secret data, and that log is unchanged.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove the AzureWorkloadIdentity feature gate, which is now GA and enabled by default upstream (see openshift/api features.go), making the gate check in this repo a permanent no-op.
• Drop the AzureWorkloadIdentityEnabled plumbing through cmd/manager/main.go, the machine Actuator, the machineset Reconciler, and MachineScope.
• Simplify the credential selection in MachineScope.updateFromSecret to depend only on whether a client secret is present (workload identity is used whenever no client secret is configured, same effective behavior as before since the gate was always enabled).

Introduced originally in #55.

Test plan

• make build
• go vet ./...
• make fmt (no diff beyond intended changes)
• make test (./pkg/cloud/azure/actuators/...) — all suites pass
• golangci-lint run on changed packages — no new findings introduced

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[damdo]

/assign @dlom

[damdo]

/assign @theobarberbany

[damdo]

/pipeline auto

[openshift-merge-bot]

Pipeline controller notification

The pipeline-auto label has been added to this PR. Second-stage tests will be triggered automatically when all first-stage tests pass.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-azure-operator

[openshift-ci]

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[mdbooth]

/lgtm
/approve

[mdbooth]

/verified by CI

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mdbooth

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mdbooth]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@mdbooth: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[mdbooth]

/jira refresh

[openshift-ci-robot]

@mdbooth: This pull request references Jira Issue OCPBUGS-105398, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[mdbooth]

/tide refresh

[openshift-ci-robot]

@damdo: Jira Issue OCPBUGS-105398: Some pull requests linked via external trackers have merged:

• openshift/machine-api-provider-azure#207

The following pull request, linked via external tracker, has not merged:

• openshift/api#3018 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-105398 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

Summary

• Remove the AzureWorkloadIdentity feature gate, which is now GA and enabled by default upstream (see openshift/api features.go), making the gate check in this repo a permanent no-op.
• Drop the AzureWorkloadIdentityEnabled plumbing through cmd/manager/main.go, the machine Actuator, the machineset Reconciler, and MachineScope.
• Simplify the credential selection in MachineScope.updateFromSecret to depend only on whether a client secret is present (workload identity is used whenever no client secret is configured, same effective behavior as before since the gate was always enabled).

Introduced originally in #55.

Test plan

• make build
• go vet ./...
• make fmt (no diff beyond intended changes)
• make test (./pkg/cloud/azure/actuators/...) — all suites pass
• golangci-lint run on changed packages — no new findings introduced

Summary by CodeRabbit

• Changes
• Removed the Azure Workload Identity feature gate and related configuration controls.
• Azure workload identity credentials are now selected automatically when no client secret is provided.
• Simplified Azure machine and MachineSet configuration without changing reconciliation behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.