fix: OCPBUGS-58422: Allow disabling Ingress without Console in HyperShift by stefanonardo · Pull Request #8933 · openshift/hypershift

stefanonardo · 2026-07-06T11:13:50Z

Summary

Remove the validation that requires Console capability to be disabled when Ingress capability is disabled. The console-operator now handles ingress-disabled gracefully (openshift/console-operator#1182), so this constraint is no longer needed.

Changes

api/hypershift/v1beta1/hostedcluster_types.go: Remove the kubebuilder CEL validation rule that enforced Ingress disabled → Console disabled
cmd/cluster/core/create.go: Remove the corresponding CLI validation
cmd/cluster/core/create_test.go: Update tests — cases that expected failure now expect success
Generated CRD manifests updated accordingly

Depends on

OCPBUGS-58422: Handle disabled Ingress capability in HyperShift console-operator#1182 (must merge first)

Test plan

go test ./cmd/cluster/core/ -run TestValidate passes — all ingress-related test cases pass
Verified on a HyperShift hosted cluster on AWS: after patching both CRDs to remove the validation, a hosted cluster with --disable-cluster-capabilities Ingress (Console enabled) was created and the console-operator ran without errors

Summary by CodeRabbit

Bug Fixes
- Relaxed validation of cluster capability disabling rules, allowing Ingress to be disabled independently of Console.
- Cluster creation now accepts these previously rejected capability combinations.
Tests
- Updated validation tests to reflect the new accepted capability behavior.

openshift-merge-bot · 2026-07-06T11:13:52Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-06T11:13:57Z

@stefanonardo: This pull request references Jira Issue OCPBUGS-58422, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (yapei@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove the validation that requires Console capability to be disabled when Ingress capability is disabled. The console-operator now handles ingress-disabled gracefully (openshift/console-operator#1182), so this constraint is no longer needed.

Changes

api/hypershift/v1beta1/hostedcluster_types.go: Remove the kubebuilder CEL validation rule that enforced Ingress disabled → Console disabled

cmd/cluster/core/create.go: Remove the corresponding CLI validation

cmd/cluster/core/create_test.go: Update tests — cases that expected failure now expect success

Generated CRD manifests updated accordingly

Depends on

OCPBUGS-58422: Handle disabled Ingress capability in HyperShift console-operator#1182 (must merge first)

Test plan

go test ./cmd/cluster/core/ -run TestValidate passes — all ingress-related test cases pass

Verified on a HyperShift hosted cluster on AWS: after patching both CRDs to remove the validation, a hosted cluster with --disable-cluster-capabilities Ingress (Console enabled) was created and the console-operator ran without errors

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-06T11:14:13Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stefanonardo
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS
api/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-06T11:14:18Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 34708099-3e90-4bba-976a-f68400e52e00

📥 Commits

Reviewing files that changed from the base of the PR and between a6096ed and 50191c7.

⛔ Files ignored due to path filters (34)

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.capabilities.testsuite.yaml is excluded by !cmd/install/assets/**/*.yaml
cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (3)

api/hypershift/v1beta1/hostedcluster_types.go
cmd/cluster/core/create.go
cmd/cluster/core/create_test.go

💤 Files with no reviewable changes (1)

api/hypershift/v1beta1/hostedcluster_types.go

🚧 Files skipped from review as they are similar to previous changes (2)

cmd/cluster/core/create.go
cmd/cluster/core/create_test.go

📝 Walkthrough

Walkthrough

This change removes the validation rule that required Console to be disabled when Ingress was disabled. The restriction was removed from both the API schema validation on Capabilities.Disabled and the CLI create-time capability validation. Two TestValidate cases were updated to expect success for disabling Ingress alone or alongside other capabilities without Console.

Changes

Area	Change
API types	Removed the `XValidation` rule tying Ingress disablement to Console disablement
CLI validation	Removed the special-case rejection in `validateCapabilities`
Tests	Updated two table-driven cases to expect successful validation

Related PRs: None identified.

Suggested labels: api-review, ok-to-test

Suggested reviewers: None identified.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: relaxing HyperShift validation to allow disabling Ingress without Console.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The updated tests use fixed, human-readable names only; I found no Ginkgo titles or dynamically generated identifiers in the changed test cases.
Test Structure And Quality	✅ Passed	The added/updated tests are table-driven validation cases only: no cluster resources, waits, or cleanup concerns, and they match existing repo patterns.
Topology-Aware Scheduling Compatibility	✅ Passed	Touched code/manifests only remove Ingress/Console capability validation; no new affinity, nodeSelector, spread, replica, or topology-aware scheduling logic appears.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; changes are validation logic, unit tests, and generated manifests, so the IPv6/disconnected-network check is not applicable.
No-Weak-Crypto	✅ Passed	PASS: The diff only removes Ingress/Console validation; no crypto code or secret comparisons were added, and DES-CBC3-SHA appears in unchanged manifest lines.
Container-Privileges	✅ Passed	The PR only removes a capability-validation rule and updates CRD/test schemas; no changed file adds privileged, hostPID/Network/IPC, allowPrivilegeEscalation, or root container settings.
No-Sensitive-Data-In-Logs	✅ Passed	The patch only removes capability validation and updates tests; it adds no new log statements or sensitive-data-bearing messages.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

stefanonardo · 2026-07-06T11:14:31Z

/hold depends on openshift/console-operator#1182

openshift-ci-robot · 2026-07-06T11:16:45Z

@stefanonardo: This pull request references Jira Issue OCPBUGS-58422, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (yapei@redhat.com), skipping review request.

Details

In response to this:

Summary

Remove the validation that requires Console capability to be disabled when Ingress capability is disabled. The console-operator now handles ingress-disabled gracefully (openshift/console-operator#1182), so this constraint is no longer needed.

Changes

api/hypershift/v1beta1/hostedcluster_types.go: Remove the kubebuilder CEL validation rule that enforced Ingress disabled → Console disabled

cmd/cluster/core/create.go: Remove the corresponding CLI validation

cmd/cluster/core/create_test.go: Update tests — cases that expected failure now expect success

Generated CRD manifests updated accordingly

Depends on

OCPBUGS-58422: Handle disabled Ingress capability in HyperShift console-operator#1182 (must merge first)

Test plan

go test ./cmd/cluster/core/ -run TestValidate passes — all ingress-related test cases pass

Verified on a HyperShift hosted cluster on AWS: after patching both CRDs to remove the validation, a hosted cluster with --disable-cluster-capabilities Ingress (Console enabled) was created and the console-operator ran without errors

Summary by CodeRabbit

Bug Fixes

Relaxed capability validation so clusters can disable Ingress without also disabling Console.

Cluster creation now accepts these capability combinations instead of rejecting them.

Tests

Updated validation coverage to match the new accepted capability settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-07-06T11:20:31Z

@stefanonardo: This pull request references Jira Issue OCPBUGS-58422, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (yapei@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Remove the validation that requires Console capability to be disabled when Ingress capability is disabled. The console-operator now handles ingress-disabled gracefully (openshift/console-operator#1182), so this constraint is no longer needed.

Changes

api/hypershift/v1beta1/hostedcluster_types.go: Remove the kubebuilder CEL validation rule that enforced Ingress disabled → Console disabled

cmd/cluster/core/create.go: Remove the corresponding CLI validation

cmd/cluster/core/create_test.go: Update tests — cases that expected failure now expect success

Generated CRD manifests updated accordingly

Depends on

OCPBUGS-58422: Handle disabled Ingress capability in HyperShift console-operator#1182 (must merge first)

Test plan

go test ./cmd/cluster/core/ -run TestValidate passes — all ingress-related test cases pass

Verified on a HyperShift hosted cluster on AWS: after patching both CRDs to remove the validation, a hosted cluster with --disable-cluster-capabilities Ingress (Console enabled) was created and the console-operator ran without errors

Summary by CodeRabbit

Bug Fixes

Relaxed capability validation so clusters can disable Ingress without also disabling Console.

Cluster creation now accepts these capability combinations instead of rejecting them.

Tests

Updated validation coverage to match the new accepted capability settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

codecov · 2026-07-06T11:31:04Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.36%. Comparing base (9b3e234) to head (50191c7).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8933      +/-   ##
==========================================
- Coverage   43.36%   43.36%   -0.01%     
==========================================
  Files         771      771              
  Lines       95567    95563       -4     
==========================================
- Hits        41444    41440       -4     
  Misses      51240    51240              
  Partials     2883     2883

Files with missing lines	Coverage Δ
cmd/cluster/core/create.go	`61.58% <ø> (-0.17%)`	⬇️

Flag	Coverage Δ
cmd-support	`36.87% <ø> (-0.01%)`	⬇️
cpo-hostedcontrolplane	`45.31% <ø> (ø)`
cpo-other	`45.10% <ø> (ø)`
hypershift-operator	`53.65% <ø> (ø)`
other	`31.68% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Remove the validation that requires Console to be disabled when Ingress is disabled. The console-operator now handles ingress-disabled gracefully (openshift/console-operator#1182). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci · 2026-07-06T12:44:24Z

@stefanonardo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	`50191c7`	link	true	`/test images`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

hypershift-jira-solve-ci · 2026-07-06T12:49:54Z

I now have complete evidence for the root cause. Let me produce the final report.

Test Failure Analysis Complete

Job Information

Prow Job: pull-ci-openshift-hypershift-main-images
Build ID: 2074106625819414528
Target: [images] (container image builds: hypershift-operator, hypershift, hypershift-tests, hypershift-cli)
PR: #8933 — fix: OCPBUGS-58422: Allow disabling Ingress without Console in HyperShift

Test Failure Analysis

Error

Error: Failed to download metadata for repo 'packages-microsoft-com-prod': repomd.xml GPG signature verification error: Bad GPG signature
Ignoring repositories: packages-microsoft-com-prod
No match for argument: azure-cli
Error: Unable to find a match: azure-cli

Summary

The hypershift-tests image build (Dockerfile.e2e) failed during the dnf install -y azure-cli step because Microsoft's packages-microsoft-com-prod RPM repository is returning invalid GPG signatures on its repomd.xml metadata. DNF ignored the repository due to the signature error, making the azure-cli package unfindable. This is an upstream Microsoft infrastructure issue — completely unrelated to the code changes in PR #8933, which modifies HyperShift API types and reconciliation logic (not Dockerfiles). The other three image targets (hypershift-operator, hypershift, hypershift-cli) all built successfully.

Root Cause

The failure chain is:

Dockerfile.e2e step 17/19 runs dnf install -y azure-cli to install the Azure CLI for e2e tests.
Before installing, DNF must download repository metadata from https://packages.microsoft.com/rhel/9/prod/ (the packages-microsoft-com-prod repo configured by packages-microsoft-prod.rpm).
Microsoft's repo is returning a repomd.xml with a bad GPG signature — DNF performs GPG verification of repo metadata and rejects it: repomd.xml GPG signature verification error: Bad GPG signature.
DNF ignores the entire repository, so the azure-cli package cannot be found: No match for argument: azure-cli.
The build fails with DockerBuildFailed.

This is a transient upstream issue with Microsoft's RPM package infrastructure. The Dockerfile.e2e previously had the azure-cli pinned to version 2.72.0 (commit 286c6051796), but that pin was reverted on June 2, 2026 (commit bf3ba1b081e). Even with the pin, the same GPG signature error would prevent installation since the entire repository metadata is rejected before any package resolution occurs.

PR #8933 does not modify Dockerfile.e2e or any Dockerfile — the changed files are API types (hostedcluster_types.go), CRD manifests, and reconciliation logic. This failure would affect any PR triggering the images job while Microsoft's repo has this GPG issue.

Recommendations

Retry the job — This is a transient upstream issue with Microsoft's package repository GPG signatures. A retry may succeed if Microsoft has fixed the signing issue.
If retries continue to fail, consider a temporary workaround in Dockerfile.e2e:
- Option A: Add --nogpgcheck to the dnf install command for the Microsoft repo (reduces security but unblocks CI):
```
dnf install -y --repo packages-microsoft-com-prod --nogpgcheck azure-cli
```
- Option B: Install azure-cli via pip install azure-cli instead of RPM.
- Option C: Cache or vendor the azure-cli RPM in a CI-controlled location.
Long-term: Pin the azure-cli version again (as was done before the revert in commit bf3ba1b081e) and consider adding a fallback mechanism in the Dockerfile for when Microsoft's repo is unavailable.
This failure is not a blocker for PR review — the code changes can be reviewed independently of this CI infrastructure issue.

Evidence

Evidence	Detail
Failed image	`hypershift-tests-amd64` (from `Dockerfile.e2e`)
Successful images	`hypershift-operator-amd64` (5m0s), `hypershift-amd64` (3m51s), `hypershift-cli-amd64` (2m5s)
Failing Dockerfile step	`[2/2] STEP 17/19: RUN rpm --import ... && dnf install -y azure-cli && dnf clean all`
GPG error	`Failed to download metadata for repo 'packages-microsoft-com-prod': repomd.xml GPG signature verification error: Bad GPG signature`
Package error	`No match for argument: azure-cli` / `Error: Unable to find a match: azure-cli`
Build failure reason	`DockerBuildFailed: Dockerfile build strategy has failed` (after 9m7s)
PR modifies Dockerfile?	No — PR #8933 modifies API types, CRD manifests, and reconciliation logic only
Prior azure-cli fix	Commit `286c6051796` pinned to `azure-cli-2.72.0`; reverted by `bf3ba1b081e` on June 2, 2026
Upstream issue	Microsoft `packages-microsoft-com-prod` RPM repo serving `repomd.xml` with invalid GPG signature

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 6, 2026

openshift-ci Bot added do-not-merge/needs-area needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 6, 2026

openshift-ci Bot added the area/api Indicates the PR includes changes for the API label Jul 6, 2026

openshift-ci Bot added area/cli Indicates the PR includes changes for CLI and removed do-not-merge/needs-area labels Jul 6, 2026

openshift-ci Bot requested review from devguyio and muraee July 6, 2026 11:14

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 6, 2026

stefanonardo mentioned this pull request Jul 6, 2026

OCPBUGS-58422: Handle disabled Ingress capability in HyperShift openshift/console-operator#1182

Open

2 tasks

stefanonardo force-pushed the OCPBUGS-58422 branch from b8f45ab to a6096ed Compare July 6, 2026 11:18

openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 6, 2026

stefanonardo changed the title ~~OCPBUGS-58422: Allow disabling Ingress without Console in HyperShift~~ fix: OCPBUGS-58422: Allow disabling Ingress without Console in HyperShift Jul 6, 2026

stefanonardo force-pushed the OCPBUGS-58422 branch from a6096ed to 50191c7 Compare July 6, 2026 12:22

This was referenced Jul 6, 2026

OCPBUGS-63720: orphan machines when managed identity is invalid on clus… #8296

Merged

OCPBUGS-54776: fix(ignition-server): log MCS output on HTTP request failures #8936

Merged

ARO-24037: gate cloud config on hash to prevent serving stale content #8946

Merged

Uh oh!

Conversation

stefanonardo commented Jul 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Depends on

Test plan

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 6, 2026

Uh oh!

openshift-ci-robot commented Jul 6, 2026

Summary

Changes

Depends on

Test plan

Uh oh!

openshift-ci Bot commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

stefanonardo commented Jul 6, 2026

Uh oh!

openshift-ci-robot commented Jul 6, 2026

Summary

Changes

Depends on

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 6, 2026

Summary

Changes

Depends on

Test plan

Summary by CodeRabbit

Uh oh!

codecov Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

openshift-ci Bot commented Jul 6, 2026

Uh oh!

hypershift-jira-solve-ci Bot commented Jul 6, 2026

Test Failure Analysis Complete

Job Information

Test Failure Analysis

Error

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stefanonardo commented Jul 6, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

codecov Bot commented Jul 6, 2026 •

edited

Loading