OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate

[damdo]

Summary

• Remove the AzureWorkloadIdentity feature gate from features/features.go — it has been enabled by default across all profiles and feature sets and is no longer needed
• Regenerate payload feature gate manifests (8 files) to reflect the removal

Prerequisite PRs

The consumer changes below must merge before this PR. Otherwise, operators that
still call .Enabled("AzureWorkloadIdentity") can panic when the gate is no
longer present in the cluster-served feature-gate list.

Consumer PRs

• machine-api-provider-azure#207 (merged)
• cluster-ingress-operator#1575 (merged)
• azure-disk-csi-driver-operator#134 (opened)
• azure-file-csi-driver-operator#121 (opened)
• cloud-network-config-controller#266 (opened)

Merge order

• Merge all consumer PRs above
• Merge this PR after the consumer PRs have merged

Test plan

• make test-unit passes (including TestOKDHasAllDefaultFeatureGates)
• hack/verify-payload-featuregates.sh passes
• No remaining references to AzureWorkloadIdentity feature gate registration in the codebase

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @damdo! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e720d8af-ae0f-4247-b2e2-ec069afdf696

📥 Commits

Reviewing files that changed from the base of the PR and between c7d4aa1 and 80a61bd.

📒 Files selected for processing (10)

• features.md
• features/features.go
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

💤 Files with no reviewable changes (10)

• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
• features/features.go
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
• features.md

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The change removes the FeatureGateAzureWorkloadIdentity registration and its associated metadata and profiles. It also removes AzureWorkloadIdentity from enabled feature-gate lists in HyperShift and self-managed HA manifests for Default, DevPreviewNoUpgrade, OKD, and TechPreviewNoUpgrade configurations.

Merge Risk: ⚪ Minimal · up to 80a61

This PR removes an obsolete feature gate and updates its generated manifests and documentation; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only feature-gate declarations, documentation, and YAML manifests. The diff contains no added or modified test files and no Ginkgo title calls (It, Describe, `Contex…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only feature metadata, the Go feature-gate registration, and eight YAML manifests. The diff against origin/master contains no test files, Ginkgo blocks, cluster operatio…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The verified commit changes only feature metadata and eight YAML manifests, with 33 deletions and no added lines. Therefore, the MicroShift test compat…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only feature documentation, feature-gate registration, and eight feature-gate manifests. The exact diff contains no new Ginkgo or e2e tests, so the SNO multi-node compat…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The pull request only removes the AzureWorkloadIdentity registration, documentation row, and feature-gate list entries. The exact diff does not add or modify deployments, controllers, operato…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only feature-gate registration data and generated YAML/Markdown. All changes are deletions. No main, init, TestMain, or Ginkgo suite setup code changed. The removed init…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS — The pull request only removes a feature-gate declaration, documentation, and manifest entries. The exact diff adds no Ginkgo tests or test code, so it introduces no IPv4 assumptions or external…
No-Weak-Crypto	✅ Passed	PASS. The pull request only deletes the AzureWorkloadIdentity feature-gate registration, its documentation row, and eight manifest entries. The exact diff contains no MD5, SHA1, DES, RC4, Blowfish, EC…
Container-Privileges	✅ Passed	PASS: The pull request contains only deletions from feature metadata and FeatureGate status manifests. The diff has no added lines and no changes to container or Kubernetes security fields. The change…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only feature metadata and feature-gate manifests. The verified diff contains 33 deletions and no added lines. It removes the AzureWorkloadIdentity registration and manif…
Title check	✅ Passed	The title clearly and concisely identifies the main change: removing the AzureWorkloadIdentity feature gate.
Description check	✅ Passed	The description directly explains the feature-gate removal, manifest regeneration, prerequisite consumer changes, and test results.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove the AzureWorkloadIdentity feature gate from features/features.go — it has been enabled by default across all profiles and feature sets and is no longer needed
• Regenerate payload feature gate manifests (8 files) to reflect the removal

Test plan

• make test-unit passes (including TestOKDHasAllDefaultFeatureGates)
• hack/verify-payload-featuregates.sh passes
• No remaining references to AzureWorkloadIdentity feature gate registration in the codebase

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[damdo]

/hold

For openshift/machine-api-provider-azure#207 to merge first

[damdo]

/pipeline auto

[openshift-merge-bot]

Pipeline controller notification

The pipeline-auto label has been added to this PR. Second-stage tests will be triggered automatically when all first-stage tests pass.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[mdbooth]

/lgtm
/approve
/verified by CI

[openshift-ci-robot]

@mdbooth: This PR has been marked as verified by CI.

Details

In response to this:

/lgtm
/approve
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mdbooth
Once this PR has been reviewed and has the lgtm label, please assign everettraven for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mdbooth]

Tests are currently failing because openshift/machine-api-provider-azure#207 and openshift/machine-api-operator#1537 have not merged yet.

[damdo]

/test e2e-aws-ovn

[damdo]

/retest

[damdo]

/retest

[openshift-ci-robot]

@damdo: This pull request references Jira Issue OCPBUGS-105398, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

• Remove the AzureWorkloadIdentity feature gate from features/features.go — it has been enabled by default across all profiles and feature sets and is no longer needed
• Regenerate payload feature gate manifests (8 files) to reflect the removal

Prerequisite PRs

The consumer changes below must merge before this PR. Otherwise, operators that
still call .Enabled("AzureWorkloadIdentity") can panic when the gate is no
longer present in the cluster-served feature-gate list.

Consumer PRs

• machine-api-provider-azure#207 — merged
• cluster-ingress-operator#1575 — PR opened
• azure-disk-csi-driver-operator#134 — PR opened
• azure-file-csi-driver-operator#121 — PR opened
• cloud-network-config-controller#266 — PR opened

Merge order

• Merge all consumer PRs above
• Merge this PR after the consumer PRs have merged

Test plan

• make test-unit passes (including TestOKDHasAllDefaultFeatureGates)
• hack/verify-payload-featuregates.sh passes
• No remaining references to AzureWorkloadIdentity feature gate registration in the codebase

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[yuqi-zhang]

Probably non-blocking, but I think we are also good to remove this from https://github.com/openshift/api/blob/master/features/legacyfeaturegates.go#L14 and https://github.com/openshift/api/blob/master/payload-command/render/legacyfeaturegates.go#L16.

Also want to check, there are still some old references in various openshift repos, such as https://github.com/openshift/azure-file-csi-driver-operator/blob/main/pkg/operator/starter.go#L236 and https://github.com/openshift/cloud-network-config-controller/blob/main/pkg/cloudprovider/cloudprovider.go#L165 , and a bunch more. Should those be cleaned up before we complete the FG removal?

[yuqi-zhang]

/retest-required

Given that the referenced blocking PRs have merged

[JoelSpeed]

/retest

[redhat-chai-bot]

/override-sticky ci/prow/e2e-aws-ovn

Automated triage: This failure appears unrelated to the PR changes.

Job classification: Eligible long-running AWS OVN end-to-end/integration job. The Prow run lasted 3h45m, used the openshift-org-aws cluster profile, and executed the openshift-e2e-test step for 2h26m.
Revision check: Run 80a61bd6ab7b67133f84a3a2afc2fabebb769b37; current PR HEAD 80a61bd6ab7b67133f84a3a2afc2fabebb769b37; match.
Execution status: Tests executed. The suite reported 35 blocking failures, 1 informing failure, 2,205 passes, 0 flakes, and 2,111 skips. The build log contains repeated panic: failed to get kubernetes.default service errors caused by DNS lookup i/o timeout against the cluster DNS service, followed by mass failures across unrelated SIGs.
Completed supporting jobs: 23 checks passed, including build, unit, verify, integration, ci/prow/e2e-aws-ovn-hypershift, ci/prow/e2e-aws-ovn-techpreview, ci/prow/e2e-gcp, ci/prow/e2e-upgrade, and ci/prow/e2e-upgrade-out-of-change. Pending: ci/prow/e2e-aws-serial-2of2, ci/prow/e2e-aws-serial-techpreview-2of2, ci/prow/e2e-azure, and tide. The other failed check is ci/prow/e2e-aws-ovn-hypershift-conformance.
Fleet-wide failure rate: Across 21 recent runs of this job outside this PR, 10 passed and 11 failed (47.6% pass rate), affecting multiple PRs. Representative failing tests also pass at approximately 98.6% outside this run: [sig-api-machinery] API priority and fairness should ensure that requests can be classified by adding FlowSchema and PriorityLevelConfiguration (98.63%) and [sig-api-machinery] CustomResourcePublishOpenAPI [Privileged:ClusterAdmin] works for CRD with validation schema [Conformance] (98.57%).
Overlap assessment: The PR only removes AzureWorkloadIdentity from features.md, features/features.go, and eight feature-gate manifests. It does not modify AWS, OVN, DNS, networking, storage, or test implementation code. The failure is a cluster-wide API/DNS connectivity breakdown with failures scattered across unrelated SIGs, not a failure focused on the removed feature gate.
Missing-coverage risk: Low for this override: the cluster was provisioned and the full e2e suite ran for over two hours, with 2,205 passing tests; the failed result is attributable to infrastructure connectivity rather than a semantic assertion in the changed surface. A fresh run remains appropriate if additional confidence is required.
Rationale: The repeated cluster DNS lookup timeouts and broad mass-failure pattern are unrelated to this feature-gate removal, and the job is demonstrably unhealthy across other PRs.

If you disagree with this assessment, rerun the current job with /test e2e-aws-ovn.

---

AI-generated. Review for accuracy.

[openshift-ci]

@redhat-chai-bot: Overrode contexts on behalf of redhat-chai-bot: ci/prow/e2e-aws-ovn

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

/override-sticky ci/prow/e2e-aws-ovn

Automated triage: This failure appears unrelated to the PR changes.

Job classification: Eligible long-running AWS OVN end-to-end/integration job. The Prow run lasted 3h45m, used the openshift-org-aws cluster profile, and executed the openshift-e2e-test step for 2h26m.
Revision check: Run 80a61bd6ab7b67133f84a3a2afc2fabebb769b37; current PR HEAD 80a61bd6ab7b67133f84a3a2afc2fabebb769b37; match.
Execution status: Tests executed. The suite reported 35 blocking failures, 1 informing failure, 2,205 passes, 0 flakes, and 2,111 skips. The build log contains repeated panic: failed to get kubernetes.default service errors caused by DNS lookup i/o timeout against the cluster DNS service, followed by mass failures across unrelated SIGs.
Completed supporting jobs: 23 checks passed, including build, unit, verify, integration, ci/prow/e2e-aws-ovn-hypershift, ci/prow/e2e-aws-ovn-techpreview, ci/prow/e2e-gcp, ci/prow/e2e-upgrade, and ci/prow/e2e-upgrade-out-of-change. Pending: ci/prow/e2e-aws-serial-2of2, ci/prow/e2e-aws-serial-techpreview-2of2, ci/prow/e2e-azure, and tide. The other failed check is ci/prow/e2e-aws-ovn-hypershift-conformance.
Fleet-wide failure rate: Across 21 recent runs of this job outside this PR, 10 passed and 11 failed (47.6% pass rate), affecting multiple PRs. Representative failing tests also pass at approximately 98.6% outside this run: [sig-api-machinery] API priority and fairness should ensure that requests can be classified by adding FlowSchema and PriorityLevelConfiguration (98.63%) and [sig-api-machinery] CustomResourcePublishOpenAPI [Privileged:ClusterAdmin] works for CRD with validation schema [Conformance] (98.57%).
Overlap assessment: The PR only removes AzureWorkloadIdentity from features.md, features/features.go, and eight feature-gate manifests. It does not modify AWS, OVN, DNS, networking, storage, or test implementation code. The failure is a cluster-wide API/DNS connectivity breakdown with failures scattered across unrelated SIGs, not a failure focused on the removed feature gate.
Missing-coverage risk: Low for this override: the cluster was provisioned and the full e2e suite ran for over two hours, with 2,205 passing tests; the failed result is attributable to infrastructure connectivity rather than a semantic assertion in the changed surface. A fresh run remains appropriate if additional confidence is required.
Rationale: The repeated cluster DNS lookup timeouts and broad mass-failure pattern are unrelated to this feature-gate removal, and the job is demonstrably unhealthy across other PRs.

If you disagree with this assessment, rerun the current job with /test e2e-aws-ovn.

---

AI-generated. Review for accuracy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[JoelSpeed]

/retest

[openshift-ci]

@damdo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure	80a61bd	link	true	/test e2e-azure

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.