✨ Add API types for the azure registration driver

[ssijbabu]

Summary

Adds the API types for the azure registration driver proposed in enhancements#196 (ocm#1676), letting a managed cluster register with the hub using an Azure AD (Entra ID) identity instead of a client certificate.

• Klusterlet: new registrationDriver.azure (AzureAuth). credential selects one of four Azure credential types; CEL rules enforce the fields each one requires. No secret material is part of the API.
• ClusterManager: new registrationDrivers[].azure (AzureConfig) with autoApprovedIdentityPatterns and oidcIssuerURL.

All new fields are optional, so existing resources are unaffected. Integration tests cover the validation rules.

The ocm implementation using these types is in draft PR ocm#1715, which depends on this one.

Summary by CodeRabbit

• New Features
  • Added Azure authentication support for cluster registration, including managed identity, client secret, client certificate, and workload identity credentials.
  • Added Azure-specific configuration for managed cluster IDs, client and tenant IDs, federated token files, and token audiences.
  • Added Azure registration options for approved identity patterns and OIDC issuer URLs.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ssijbabu
Once this PR has been reviewed and has the lgtm label, please assign mikeshng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b43a37a5-5384-48e8-8991-03bceaa076fb

📥 Commits

Reviewing files that changed from the base of the PR and between 1f6022a and dc12890.

📒 Files selected for processing (8)

• operator/v1/0000_00_operator.open-cluster-management.io_klusterlets.crd.yaml
• operator/v1/0000_01_operator.open-cluster-management.io_clustermanagers.crd.yaml
• operator/v1/types_clustermanager.go
• operator/v1/types_klusterlet.go
• operator/v1/zz_generated.deepcopy.go
• operator/v1/zz_generated.model_name.go
• test/integration/api/clustermanager_test.go
• test/integration/api/klusterlet_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

Walkthrough

The API types and CRD schemas add Azure registration settings for Klusterlet and ClusterManager resources. Integration tests cover Azure credential validation, persistence, updates, and ClusterManager configuration.

Changes

Azure registration

Layer / File(s)	Summary
Klusterlet Azure authentication operator/v1/types_klusterlet.go, operator/v1/0000_00_operator.open-cluster-management.io_klusterlets.crd.yaml, operator/v1/zz_generated.deepcopy.go, operator/v1/zz_generated.model_name.go, test/integration/api/klusterlet_test.go	Adds Azure credential types and fields to Klusterlet registration. The schema validates required configuration and credential-specific fields. Generated deep-copy and model-name support and integration tests cover creation, persistence, updates, and raw API requests.
ClusterManager Azure configuration operator/v1/types_clustermanager.go, operator/v1/0000_01_operator.open-cluster-management.io_clustermanagers.crd.yaml, operator/v1/zz_generated.deepcopy.go, operator/v1/zz_generated.model_name.go, test/integration/api/clustermanager_test.go	Adds optional Azure identity-pattern and OIDC issuer settings to ClusterManager registration. The authType enum includes azure. Integration tests check configuration round-tripping and creation without an Azure configuration.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: suvaanshkumar

Merge Risk: ⚪ Minimal · up to dc128

The Azure API changes have no identified issue requiring a fix before merge. Normal checks remain appropriate.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to dc128

The new Azure registration settings cross an authentication and approval boundary. The API validates credential choices, but the registration implementation needed to verify identity and enforce approval is not part of this change. No exploitable behavior is established by the reviewed code.

Retained concerns

• Medium · security · inferred: The new contract supplies a managed-cluster Azure object ID for automatic approval and RBAC, but does not establish its provenance against the authenticated principal. The separate registration implementation must enforce that binding before using the ID; whether it does so is unresolved, so this is not a verified bypass.

Security review details

Security Blast Radius

• inferred — If enabled by a hub implementation, an incorrect approval decision could admit a managed cluster and affect that cluster's hub-side RBAC. The reviewed code does not establish which deployments enable the driver or how many clusters an approval pattern could cover.

Security Findings and Attack Paths

• inferred — A submitted managedClusterAzureID would be security-sensitive if approval or RBAC trusted it without comparing it to the authenticated Azure identity. No runtime consumer is established here, so this is a conditional attack path, not a verified vulnerability.

Trust Boundaries and Controls

• observed — Admission rejects a missing Azure configuration, unknown or missing credential, missing object ID, and several incompatible credential fields. It does not authenticate the object ID or verify the hub issuer setting.

Resilience and Maintainability Implications

• inferred — Driver changes, credential rotation, retries, and interrupted registration require runtime ownership and cleanup rules; the stateless API validation cannot establish their security-preserving behavior.

Hardening Proposals

• proposed — Before enabling Azure automatic approval, verify the authenticated token's issuer, audience, tenant, and principal against the configured identity and hub username; enforce the feature gate and full-pattern matching, and define safe reconciliation across driver and credential changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 6 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: adding API types for the Azure registration driver. The feature icon is appropriate and the wording is concise.
Description check	✅ Passed	The description includes a clear summary, the affected Klusterlet and ClusterManager APIs, validation behavior, compatibility details, tests, and related issue references. It does not use the exact "R…

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 6 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}