OCPBUGS-57603: Disallow cross subscription encryption sets#10335
Conversation
openshift-ci-robot
added
jira/severity-moderate
|
@rna-afk: This pull request references Jira Issue OCPBUGS-57603, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@rna-afk: This pull request references Jira Issue OCPBUGS-57603, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/verified by jima |
openshift-ci-robot
added
the
verified
|
@jinyunma: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
patrickdillon
left a comment
patrickdillon
left a comment
There was a problem hiding this comment.
Nice work figuring this out!
To summarize what we discussed: cross-subscription Disk Encryption Sets are not supported, but users can use a key vault from another subscription to create the DES.
Can you update the bug to indicate that as the recommended path for the bug reporter? It seems like that should immediately unblock them (although we will probably still need to deal with the managed key used to encrypt bootstrap ignition, but that is a separate bug).
I think there are a few more things we should do to improve the experience surrounding this API:
- I don't think we should deprecate the field (although I could be convinced), but we should generally discourage users from using it. Can you update the field doc text to indicate: "Azure does not support cross-subscription disk-encryption sets. By default, the subscription from the installer credentials will be used. Therefore, setting this field is unnecessary."
- Then we need to follow up on this promise of setting the defaults. We're already doing it in one place (more on that in a moment), but not in the machine manifests. Can you follow this pattern so that the default is set in the install config itself, and will be used everywhere:
Basically you just need to create an Azure finish function wherfe if disk encryption is set, and subscription is empty, add the subscription from the creds.
- Finally we can simplify the one code instance where the default is set, because it will be redundant:
installer/pkg/asset/manifests/clustercsidriver.go
Lines 75 to 82 in 435db5e
@patrickdillon I tested with az command, this is also disallowed in Azure. What I tested:
So look like that Azure doc is misleading, that's not TRUE! |
rna-afk
force-pushed
the
add_disk_encryption_validation
branch
from
2a64205 to
cdf725a
Compare
openshift-ci-robot
removed
the
verified
@jinyunma thank you for testing this crucial detail! |
| if err != nil { | ||
| return err | ||
| } | ||
| a.Config.Azure.DefaultMachinePlatform.OSDisk.SubscriptionID = session.Credentials.SubscriptionID |
There was a problem hiding this comment.
Currently, subscriptionID must be set, otherwise installer exited with error:
$ ./openshift-install create manifests --dir ipi4
INFO ipFamily is not specified in install-config; defaulting to "IPv4"
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: [controlPlane.platform.azure.defaultMachinePlatform.osDisk.diskEncryptionSet.subscriptionID: Required value: subscription ID is required, compute[0].platform.azure.defaultMachinePlatform.osDisk.diskEncryptionSet.subscriptionID: Required value: subscription ID is required]
cdf725a to
f1fe0d6
Compare
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAzure DiskEncryptionSet subscriptionId fields are now optional in the schema; InstallConfig defaulting fills missing Azure OSDisk subscription IDs from the Azure session; GetDiskEncryptionSet enforces same-subscription; validation gained region-aware DiskEncryptionSet checks; tests added for wrong-region DES cases. Changes
Sequence Diagram(s)sequenceDiagram
participant InstallConfig
participant finishAzure
participant AzureSession
participant AzureClient
participant Validator
InstallConfig->>finishAzure: call finishAzure()
finishAzure->>AzureSession: request session.subscriptionID
AzureSession-->>finishAzure: return session.subscriptionID
finishAzure->>InstallConfig: populate missing OSDisk.SubscriptionID fields
InstallConfig->>AzureClient: GetDiskEncryptionSet(requestedSubscriptionID)
AzureClient->>AzureSession: compare requestedSubscriptionID vs session.subscriptionID
alt mismatch
AzureClient-->>InstallConfig: error (cross-subscription not supported)
else match
AzureClient-->>InstallConfig: return DiskEncryptionSet resource
InstallConfig->>Validator: validateConfidentialDiskEncryptionSet(DES, clusterRegion)
Validator-->>InstallConfig: error if DES.location != clusterRegion
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| @@ -478,11 +478,11 @@ spec: | |||
| description: |- | |||
| SubscriptionID defines the Azure subscription the disk encryption | |||
| set is in. | |||
| Must be the same subscription ID as the resource group of the installer. | |||
There was a problem hiding this comment.
@patrickdillon this looks weird... should we just remove it? and maybe make it optional in the backports?
There was a problem hiding this comment.
Agreed it looks weird. Unfortunately we can't just remove it, particularly with strict unmarshaling being reintroduced because previously valid install configs would stop working. We could deprecate it and then remove it in a future release (perhaps even 5.0)...
|
@rna-afk: This pull request references Jira Issue OCPBUGS-57603, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/asset/installconfig/azure/client.go`:
- Around line 321-323: The check in the Azure DES validation incorrectly treats
an empty subscriptionID as a mismatch; update the condition in the block that
compares c.ssn.Credentials.SubscriptionID with subscriptionID (used by
GetDiskEncryptionSet/ValidateDiskEncryptionSet) to only perform the comparison
if subscriptionID is non-empty (e.g., if subscriptionID != "" &&
c.ssn.Credentials.SubscriptionID != subscriptionID) so validation is skipped
when subscriptionID is omitted (as noted in finishAzure/DefaultMachinePlatform
behavior).
In `@pkg/asset/installconfig/installconfig.go`:
- Around line 168-178: finishAzure() dereferences nested fields without nil
checks; update it to first guard that a.Config.Azure and
a.Config.Azure.DefaultMachinePlatform are non-nil and that OSDisk and its
embedded DiskEncryptionSet pointer exist before accessing SubscriptionID, and
apply the same logic to the control plane and each compute pool
(a.Config.Azure.ControlPlane and range over a.Config.Azure.Compute) so any
OSDisk.DiskEncryptionSet with an empty SubscriptionID is filled from a single
session (session, err := a.Azure.Session()) and return errors as before;
reference symbols: finishAzure, a.Config.Azure.DefaultMachinePlatform, OSDisk,
DiskEncryptionSet, a.Config.Azure.ControlPlane, and a.Config.Azure.Compute.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4c77b80e-3384-41cd-89d2-776d0942a22e
📒 Files selected for processing (5)
data/data/install.openshift.io_installconfigs.yamlpkg/asset/installconfig/azure/client.gopkg/asset/installconfig/installconfig.gopkg/types/azure/disk.gopkg/types/azure/validation/disk.go
💤 Files with no reviewable changes (1)
- pkg/types/azure/validation/disk.go
rna-afk
force-pushed
the
add_disk_encryption_validation
branch
from
f1fe0d6 to
e349614
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/asset/installconfig/azure/client.go`:
- Around line 321-323: The current raw string comparison between
c.ssn.Credentials.SubscriptionID and subscriptionID rejects identical UUIDs with
different hex casing; update the check in the function containing that logic to
perform a case-insensitive comparison using strings.EqualFold (replace the !=
comparison between c.ssn.Credentials.SubscriptionID and subscriptionID with
strings.EqualFold to determine inequality), ensuring you import the strings
package if not already imported and preserve the existing error message when the
comparison fails.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 60892231-fe72-4a9e-a547-269a2d97fdd1
📒 Files selected for processing (5)
data/data/install.openshift.io_installconfigs.yamlpkg/asset/installconfig/azure/client.gopkg/asset/installconfig/installconfig.gopkg/types/azure/disk.gopkg/types/azure/validation/disk.go
💤 Files with no reviewable changes (1)
- pkg/types/azure/validation/disk.go
🚧 Files skipped from review as they are similar to previous changes (1)
- data/data/install.openshift.io_installconfigs.yaml
rna-afk
force-pushed
the
add_disk_encryption_validation
branch
from
e349614 to
da76179
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
data/data/install.openshift.io_installconfigs.yaml (1)
477-482:⚠️ Potential issue | 🟡 MinorDocument the new defaulting behavior for optional
subscriptionId.These descriptions explain the same-subscription constraint, but not the fact that
subscriptionIdis now optional. Since the installer defaults an omitted value from the current Azure subscription, the schema/docs should say that explicitly; otherwise this still reads like a field users are expected to populate manually.Suggested wording
SubscriptionID defines the Azure subscription the disk encryption set is in. -Must be the same subscription ID as the resource group of the installer. +If omitted, the installer uses the subscription ID of the installer's resource group. +If set, it must match the subscription ID of the installer's resource group.Also applies to: 521-526, 2038-2043, 2083-2088, 3537-3542, 3581-3586, 5504-5509, 5548-5553
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@data/data/install.openshift.io_installconfigs.yaml` around lines 477 - 482, Update the subscriptionId schema descriptions to state that the field is optional and, if omitted, the installer will default it to the current Azure subscription ID; specifically change the description for the subscriptionId property (the YAML key "subscriptionId" in the installconfigs schema) to mention that it is optional and will be populated from the installer’s current Azure subscription and that it must match the resource group's subscription when provided; apply the same wording change to the other subscriptionId occurrences referenced in the comment (the repeated subscriptionId schema entries).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/asset/installconfig/installconfig.go`:
- Around line 169-193: finishAzure currently calls a.Azure.Session()
unconditionally which can surface Azure auth errors even when no
DiskEncryptionSet SubscriptionID needs defaulting; modify finishAzure to first
scan a.Config (check a.Config.Azure.DefaultMachinePlatform.OSDisk,
a.Config.ControlPlane.Platform.Azure.OSDisk, and each
compute.Platform.Azure.OSDisk) to detect any DiskEncryptionSet != nil with empty
SubscriptionID and only then call a.Azure.Session(); if no such target exists,
skip opening the session and return nil; when using session, set SubscriptionID
on the matching places exactly as done today.
---
Outside diff comments:
In `@data/data/install.openshift.io_installconfigs.yaml`:
- Around line 477-482: Update the subscriptionId schema descriptions to state
that the field is optional and, if omitted, the installer will default it to the
current Azure subscription ID; specifically change the description for the
subscriptionId property (the YAML key "subscriptionId" in the installconfigs
schema) to mention that it is optional and will be populated from the
installer’s current Azure subscription and that it must match the resource
group's subscription when provided; apply the same wording change to the other
subscriptionId occurrences referenced in the comment (the repeated
subscriptionId schema entries).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2af10a4f-88bf-4db5-a254-cfc40d1fb652
📒 Files selected for processing (5)
data/data/install.openshift.io_installconfigs.yamlpkg/asset/installconfig/azure/client.gopkg/asset/installconfig/installconfig.gopkg/types/azure/disk.gopkg/types/azure/validation/disk.go
💤 Files with no reviewable changes (1)
- pkg/types/azure/validation/disk.go
🚧 Files skipped from review as they are similar to previous changes (2)
- pkg/asset/installconfig/azure/client.go
- pkg/types/azure/disk.go
| func (a *InstallConfig) finishAzure() error { | ||
| defaultConfig := a.Config.Azure.DefaultMachinePlatform | ||
| session, err := a.Azure.Session() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if defaultConfig != nil && defaultConfig.OSDisk.DiskEncryptionSet != nil && | ||
| defaultConfig.OSDisk.DiskEncryptionSet.SubscriptionID == "" { | ||
| a.Config.Azure.DefaultMachinePlatform.OSDisk.SubscriptionID = session.Credentials.SubscriptionID | ||
| } | ||
|
|
||
| if a.Config.ControlPlane != nil && a.Config.ControlPlane.Platform.Azure != nil && | ||
| a.Config.ControlPlane.Platform.Azure.OSDisk.DiskEncryptionSet != nil { | ||
| if a.Config.ControlPlane.Platform.Azure.OSDisk.SubscriptionID == "" { | ||
| a.Config.ControlPlane.Platform.Azure.OSDisk.SubscriptionID = session.Credentials.SubscriptionID | ||
| } | ||
| } | ||
|
|
||
| for _, compute := range a.Config.Compute { | ||
| if compute.Platform.Azure != nil && compute.Platform.Azure.OSDisk.DiskEncryptionSet != nil && | ||
| compute.Platform.Azure.OSDisk.SubscriptionID == "" { | ||
| compute.Platform.Azure.OSDisk.SubscriptionID = session.Credentials.SubscriptionID | ||
| } | ||
| } | ||
| return nil |
There was a problem hiding this comment.
Defer Azure session creation until a DES subscription actually needs defaulting.
a.Azure.Session() is now called unconditionally on Line 171, but finish() invokes this helper before validation.ValidateInstallConfig() runs. That means an Azure auth/session failure can mask normal install-config validation errors even when no DES SubscriptionID needs to be filled. Please compute whether any target OSDisk has DiskEncryptionSet != nil && SubscriptionID == "" first, and only then open the session once.
Proposed fix
func (a *InstallConfig) finishAzure() error {
defaultConfig := a.Config.Azure.DefaultMachinePlatform
- session, err := a.Azure.Session()
- if err != nil {
- return err
- }
+ needsSession := defaultConfig != nil &&
+ defaultConfig.OSDisk.DiskEncryptionSet != nil &&
+ defaultConfig.OSDisk.SubscriptionID == ""
+
+ needsSession = needsSession || (a.Config.ControlPlane != nil &&
+ a.Config.ControlPlane.Platform.Azure != nil &&
+ a.Config.ControlPlane.Platform.Azure.OSDisk.DiskEncryptionSet != nil &&
+ a.Config.ControlPlane.Platform.Azure.OSDisk.SubscriptionID == "")
+
+ for _, compute := range a.Config.Compute {
+ needsSession = needsSession || (compute.Platform.Azure != nil &&
+ compute.Platform.Azure.OSDisk.DiskEncryptionSet != nil &&
+ compute.Platform.Azure.OSDisk.SubscriptionID == "")
+ }
+
+ if !needsSession {
+ return nil
+ }
+
+ session, err := a.Azure.Session()
+ if err != nil {
+ return err
+ }
if defaultConfig != nil && defaultConfig.OSDisk.DiskEncryptionSet != nil &&
defaultConfig.OSDisk.DiskEncryptionSet.SubscriptionID == "" {
a.Config.Azure.DefaultMachinePlatform.OSDisk.SubscriptionID = session.Credentials.SubscriptionID
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pkg/asset/installconfig/installconfig.go` around lines 169 - 193, finishAzure
currently calls a.Azure.Session() unconditionally which can surface Azure auth
errors even when no DiskEncryptionSet SubscriptionID needs defaulting; modify
finishAzure to first scan a.Config (check
a.Config.Azure.DefaultMachinePlatform.OSDisk,
a.Config.ControlPlane.Platform.Azure.OSDisk, and each
compute.Platform.Azure.OSDisk) to detect any DiskEncryptionSet != nil with empty
SubscriptionID and only then call a.Azure.Session(); if no such target exists,
skip opening the session and return nil; when using session, set SubscriptionID
on the matching places exactly as done today.
| @@ -318,6 +318,9 @@ func (c *Client) GetVirtualMachineSku(ctx context.Context, name, region string) | |||
|
|
|||
| // GetDiskEncryptionSet retrieves the specified disk encryption set. | |||
| func (c *Client) GetDiskEncryptionSet(ctx context.Context, subscriptionID, groupName, diskEncryptionSetName string) (*azenc.DiskEncryptionSet, error) { | |||
| if strings.EqualFold(c.ssn.Credentials.SubscriptionID, subscriptionID) { | |||
There was a problem hiding this comment.
typo? should be !strings.EqualFold() to check for mismatch?
There was a problem hiding this comment.
ugh yeah thanks! Fixed
rna-afk
force-pushed
the
add_disk_encryption_validation
branch
from
da76179 to
0a37f49
Compare
|
@rna-afk I did pre-merge test with the latest commit, all look good now except following issue. So DES and cluster should be in same region (also described in Azure doc), it's better to have validation for this case, wdyt? |
rna-afk
force-pushed
the
add_disk_encryption_validation
branch
from
0a37f49 to
1c17342
Compare
|
@rna-afk: This pull request references Jira Issue OCPBUGS-57603, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
pkg/asset/installconfig/installconfig.go (1)
169-174: Consider deferring session creation until actually needed.The Azure session is created unconditionally, but it's only needed when a
DiskEncryptionSetexists with an emptySubscriptionID. Creating the session eagerly could surface Azure auth errors even when no DES needs defaulting.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/asset/installconfig/installconfig.go` around lines 169 - 174, In finishAzure, avoid creating the Azure session unconditionally; only call a.Azure.Session() when you actually need it while defaulting DiskEncryptionSet subscription IDs. Move the session creation (a.Azure.Session()) into the branch where you detect a non-nil DiskEncryptionSet with an empty SubscriptionID (inspect a.Config.Azure.DefaultMachinePlatform and its DiskEncryptionSet entries), create the session there, and use it to look up the subscription ID; ensure proper error handling and that session is not referenced elsewhere before it's initialized.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/asset/installconfig/installconfig.go`:
- Around line 175-178: The code is assigning the subscription ID to
a.Config.Azure.DefaultMachinePlatform.OSDisk.SubscriptionID while the condition
and validation expect defaultConfig.OSDisk.DiskEncryptionSet.SubscriptionID;
update the assignment so it sets
a.Config.Azure.DefaultMachinePlatform.OSDisk.DiskEncryptionSet.SubscriptionID =
session.Credentials.SubscriptionID (i.e., assign into the
DiskEncryptionSet.SubscriptionID field of the default machine platform OSDisk
rather than the OSDisk.SubscriptionID field) so the populated value is used by
validation.
- Around line 180-185: The code is incorrectly assigning SubscriptionID to
a.Config.ControlPlane.Platform.Azure.OSDisk.SubscriptionID instead of to the
disk encryption set; change the assignment so that when
a.Config.ControlPlane.Platform.Azure.OSDisk.DiskEncryptionSet != nil you set
a.Config.ControlPlane.Platform.Azure.OSDisk.DiskEncryptionSet.SubscriptionID =
session.Credentials.SubscriptionID (keeping the existing nil checks and only
assigning when the DiskEncryptionSet.SubscriptionID is empty).
- Around line 187-192: The loop over a.Config.Compute mistakenly assigns
session.Credentials.SubscriptionID to
compute.Platform.Azure.OSDisk.SubscriptionID when DiskEncryptionSet is present;
instead, update compute.Platform.Azure.OSDisk.DiskEncryptionSet.SubscriptionID.
In the loop that checks compute.Platform.Azure.OSDisk.DiskEncryptionSet != nil,
change the condition and assignment to verify DiskEncryptionSet.SubscriptionID
== "" and set DiskEncryptionSet.SubscriptionID =
session.Credentials.SubscriptionID (keeping the existing null checks for
compute.Platform.Azure and OSDisk intact) so the encryption set gets the
subscription ID rather than the OSDisk.
---
Nitpick comments:
In `@pkg/asset/installconfig/installconfig.go`:
- Around line 169-174: In finishAzure, avoid creating the Azure session
unconditionally; only call a.Azure.Session() when you actually need it while
defaulting DiskEncryptionSet subscription IDs. Move the session creation
(a.Azure.Session()) into the branch where you detect a non-nil DiskEncryptionSet
with an empty SubscriptionID (inspect a.Config.Azure.DefaultMachinePlatform and
its DiskEncryptionSet entries), create the session there, and use it to look up
the subscription ID; ensure proper error handling and that session is not
referenced elsewhere before it's initialized.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3a241dc7-687f-47f6-853f-b9d02879ed58
📒 Files selected for processing (7)
data/data/install.openshift.io_installconfigs.yamlpkg/asset/installconfig/azure/client.gopkg/asset/installconfig/azure/validation.gopkg/asset/installconfig/azure/validation_test.gopkg/asset/installconfig/installconfig.gopkg/types/azure/disk.gopkg/types/azure/validation/disk.go
💤 Files with no reviewable changes (1)
- pkg/types/azure/validation/disk.go
🚧 Files skipped from review as they are similar to previous changes (3)
- pkg/types/azure/disk.go
- pkg/asset/installconfig/azure/client.go
- data/data/install.openshift.io_installconfigs.yaml
Since CAPZ does not support using encryption sets in a subscription not in the current subscription, adding a validation to return error if the subscriptions don't match. Also adding a check to see if the region matches with the install region.
rna-afk
force-pushed
the
add_disk_encryption_validation
branch
from
1c17342 to
ac4e89b
Compare
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: patrickdillon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/verified by jima |
openshift-ci-robot
added
the
verified
|
@jinyunma: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@rna-afk: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-merge-bot
Bot
merged commit a300d8c
into
openshift:main
|
@rna-afk: Jira Issue Verification Checks: Jira Issue OCPBUGS-57603 Jira Issue OCPBUGS-57603 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in accepted release 4.22.0-0.nightly-2026-03-19-202824 |
5 participants
Since CAPZ does not support using encryption sets in a subscription not in the current subscription, adding a validation to return error if the subscriptions don't match.