OCPBUGS-67310: azure: allow hive to pass empty rhcos image string #10159

patrickdillon · 2025-12-11T17:52:48Z

hive does not know the rhcos image value and will pass an empty string for azure machines. In this case, we can leave the image empty so that it will use the default from MAPI.

patrickdillon · 2025-12-11T18:41:58Z

/hold

floating this to see if it helps hive, but I think hive prefers to pull the image off the worker machineset and then feed that into the function.

why not both may apply here

rna-afk · 2025-12-11T18:49:26Z

Linter error but otherwise lgtm

hive does not know the rhcos image value and will pass an empty string for azure machines. In this case, we can leave the image empty so that it will use the default from MAPI.

This also handles confidential VMs for hive, which would still use image galleries.

openshift-ci-robot · 2025-12-12T17:16:47Z

@patrickdillon: This pull request references Jira Issue OCPBUGS-67310, which is invalid:

expected the bug to target either version "4.22." or "openshift-4.22.", but it targets "4.21" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

hive does not know the rhcos image value and will pass an empty string for azure machines. In this case, we can leave the image empty so that it will use the default from MAPI.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

patrickdillon · 2025-12-12T17:17:38Z

/label tide/merge-method-squash

patrickdillon · 2025-12-12T18:50:18Z

/jira refresh

openshift-ci-robot · 2025-12-12T18:50:26Z

@patrickdillon: This pull request references Jira Issue OCPBUGS-67310, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @gpei

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-12-12T20:30:47Z

@patrickdillon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azurestack	`e4c1357`	link	false	`/test e2e-azurestack`
ci/prow/e2e-azure-ovn-shared-vpc	`e4c1357`	link	false	`/test e2e-azure-ovn-shared-vpc`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

patrickdillon · 2025-12-12T21:00:26Z

/hold cancel

Ok we do need this for hive

/cherry-pick release-4.21

openshift-cherrypick-robot · 2025-12-12T21:00:29Z

@patrickdillon: once the present PR merges, I will cherry-pick it on top of release-4.21 in a new PR and assign it to you.

Details

In response to this:

/hold cancel

Ok we do need this for hive

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

tthvo · 2025-12-12T23:16:44Z

/label acknowledge-critical-fixes-only

rna-afk · 2025-12-12T23:28:10Z

/lgtm

tthvo · 2025-12-12T23:30:54Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-confidential-trustedlaunch-mini-perm-f7

openshift-ci · 2025-12-12T23:30:58Z

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-confidential-trustedlaunch-mini-perm-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/9b72d4f0-d7b2-11f0-8a85-53e3601e5767-0

tthvo · 2025-12-12T23:31:07Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-confidentialvm-vmgueststateonly-f28-destructive

openshift-ci · 2025-12-12T23:31:10Z

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-ipi-confidentialvm-vmgueststateonly-f28-destructive

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a28c0040-d7b2-11f0-8210-22c3d8daf9d5-0

tthvo · 2025-12-12T23:56:24Z

pkg/asset/machines/azure/azuremachines.go

+	case rhcosImg == "" && !confidentialVM:
+		// hive calls the machines function, but may pass an empty
+		// string for rhcos. In which case, allow MAO to choose default.
+		return nil
+	default: // Installer-created image gallery, for OKD && confidential VMs.


❓ Would this break OKD install since OKD uses image gallery? 👇

installer/pkg/infrastructure/azure/azure.go

Lines 257 to 259 in 7169d1c

// Create a managed image, which is used for OKD or confidential VMs on OCP.

hasConfidentialVM := getMachinePoolSecurityType(installConfig) != ""

if (hasConfidentialVM || installConfig.IsOKD()) && platform.CloudName != aztypes.StackCloud {

I guess I am unsure whether rhcosImg is empty in the case of OKD...

I guess I am unsure whether rhcosImg is empty in the case of OKD...

It's not empty (rhcosImg does not seem like a great variable name in retrospect).

Oh thanks! That clears up my questions :D

gpei · 2025-12-13T07:21:32Z

@tthvo Thanks for the help to trigger the two confidential VM testing jobs, I see they both passed the installation step.

Although ASH's code path is unchanged, just to double confirm to provide more confidence. ASH installation is still relying on two more PRs to be merged into nightly.

/payload-job-with-prs periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-stack-ipi-f28 openshift/cloud-provider-azure#152 openshift/azure-disk-csi-driver#116

openshift-ci · 2025-12-13T07:21:37Z

@gpei: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-azure-stack-ipi-f28

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/5a43cbf0-d7f4-11f0-998d-1518920a4393-0

gpei · 2025-12-15T01:30:59Z

/payload-job periodic-ci-openshift-hive-master-periodic-e2e-azure-weekly

openshift-ci · 2025-12-15T01:31:03Z

@gpei: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-hive-master-periodic-e2e-azure-weekly

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b6457c20-d955-11f0-8aa1-9212e2b235b8-0

gpei · 2025-12-15T05:42:53Z

Seems the hive periodic job can't be started in this way.
From OCP on Azure installation side, no regression was found.
/verified by CI jobs

openshift-ci-robot · 2025-12-15T05:43:05Z

@gpei: This PR has been marked as verified by CI jobs.

Details

In response to this:

Seems the hive periodic job can't be started in this way.
From OCP on Azure installation side, no regression was found.
/verified by CI jobs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

patrickdillon · 2025-12-15T14:48:26Z

/approve

openshift-ci · 2025-12-15T14:49:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: patrickdillon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~pkg/asset/machines/azure/OWNERS~~ [patrickdillon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2025-12-15T14:52:42Z

@patrickdillon: Jira Issue Verification Checks: Jira Issue OCPBUGS-67310
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-67310 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

hive does not know the rhcos image value and will pass an empty string for azure machines. In this case, we can leave the image empty so that it will use the default from MAPI.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2025-12-15T14:53:46Z

@patrickdillon: new pull request created: #10163

Details

In response to this:

/hold cancel

Ok we do need this for hive

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

2uasimojo · 2025-12-15T15:31:13Z

Seems the hive periodic job can't be started in this way. From OCP on Azure installation side, no regression was found. /verified by CI jobs

Unfortunately true. However, we verified this by patching it into our vendor dir and running the job, which passed ✓

openshift-ci bot requested review from rna-afk and sadasu December 11, 2025 17:53

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 11, 2025

azure: allow hive to pass empty rhcos image string

ec85cea

hive does not know the rhcos image value and will pass an empty string for azure machines. In this case, we can leave the image empty so that it will use the default from MAPI.

patrickdillon force-pushed the az-hive-mktplace branch from 402caa4 to ec85cea Compare December 12, 2025 16:44

machines: allow confidential VMs on hive to use image galleries

e4c1357

This also handles confidential VMs for hive, which would still use image galleries.

patrickdillon changed the title ~~azure: allow hive to pass empty rhcos image string~~ OCPBUGS-67310: azure: allow hive to pass empty rhcos image string Dec 12, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 12, 2025

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Dec 12, 2025

openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Dec 12, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Dec 12, 2025

openshift-ci bot requested a review from gpei December 12, 2025 18:50

2uasimojo added a commit to dlom/hive that referenced this pull request Dec 12, 2025

DNM: Patch openshift/installer#10159

f916f6f

2uasimojo added a commit to dlom/hive that referenced this pull request Dec 12, 2025

DNM: Patch openshift/installer#10159

4183320

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 12, 2025

openshift-ci bot added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Dec 12, 2025

openshift-ci bot assigned rna-afk Dec 12, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 12, 2025

tthvo reviewed Dec 12, 2025

View reviewed changes

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Dec 15, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 15, 2025

openshift-merge-bot bot merged commit bbc0f9f into openshift:main Dec 15, 2025
19 of 21 checks passed

openshift-cherrypick-robot mentioned this pull request Dec 15, 2025

[release-4.21] OCPBUGS-68363: azure: allow hive to pass empty rhcos image string #10163

Merged

dlom pushed a commit to dlom/hive that referenced this pull request Dec 15, 2025

DNM: Patch openshift/installer#10159

da33dd5

	// Create a managed image, which is used for OKD or confidential VMs on OCP.
	hasConfidentialVM := getMachinePoolSecurityType(installConfig) != ""
	if (hasConfidentialVM \|\| installConfig.IsOKD()) && platform.CloudName != aztypes.StackCloud {

OCPBUGS-67310: azure: allow hive to pass empty rhcos image string #10159

OCPBUGS-67310: azure: allow hive to pass empty rhcos image string #10159

Uh oh!

Conversation

patrickdillon commented Dec 11, 2025

Uh oh!

patrickdillon commented Dec 11, 2025

Uh oh!

rna-afk commented Dec 11, 2025

Uh oh!

openshift-ci-robot commented Dec 12, 2025

Uh oh!

patrickdillon commented Dec 12, 2025

Uh oh!

patrickdillon commented Dec 12, 2025

Uh oh!

openshift-ci-robot commented Dec 12, 2025

Uh oh!

openshift-ci bot commented Dec 12, 2025

Uh oh!

patrickdillon commented Dec 12, 2025

Uh oh!

openshift-cherrypick-robot commented Dec 12, 2025

Uh oh!

tthvo commented Dec 12, 2025

Uh oh!

rna-afk commented Dec 12, 2025

Uh oh!

tthvo commented Dec 12, 2025

Uh oh!

openshift-ci bot commented Dec 12, 2025

Uh oh!

tthvo commented Dec 12, 2025

Uh oh!

openshift-ci bot commented Dec 12, 2025

Uh oh!

tthvo Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

patrickdillon Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

tthvo Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

gpei commented Dec 13, 2025

Uh oh!

openshift-ci bot commented Dec 13, 2025

Uh oh!

gpei commented Dec 15, 2025

Uh oh!

openshift-ci bot commented Dec 15, 2025

Uh oh!

gpei commented Dec 15, 2025

Uh oh!

openshift-ci-robot commented Dec 15, 2025

Uh oh!

patrickdillon commented Dec 15, 2025

Uh oh!

openshift-ci bot commented Dec 15, 2025

Uh oh!

Uh oh!

openshift-ci-robot commented Dec 15, 2025

Uh oh!

openshift-cherrypick-robot commented Dec 15, 2025

Uh oh!

2uasimojo commented Dec 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants