CORS-4531: Azure Gov Secret IL6 region support

[jhixson74]

Add Azure Government Secret (IL6) as a valid cloud environment and tests to verify

Summary by CodeRabbit

• New Features

  • Added support for detecting and resolving Azure US Secret Cloud environments.
  • Improved Azure environment handling for Azure Stack Hub and US Secret Cloud deployments.

• Bug Fixes

  • Added safeguards when Azure platform or ARM endpoint information is unavailable.

• Tests

  • Added coverage for US Secret Cloud detection, endpoint validation, and case-insensitive matching.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@jhixson74: This pull request references CORS-4531 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Add Azure Government Secret (IL6) as a valid cloud environment and tests to verify

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7395defa-4122-4c0a-9542-4c908b8d3820

📥 Commits

Reviewing files that changed from the base of the PR and between 4ff6c6b and 09b04b9.

⛔ Files ignored due to path filters (35)

• go.sum is excluded by !**/*.sum
• vendor/github.com/openshift/api/config/v1/types_authentication.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_ingress.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_kmsencryption.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-Hypershift.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-SelfManagedHA.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/features/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/features/legacyfeaturegates.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

• go.mod
• pkg/cloud/azure/actuators/machine_scope.go
• pkg/cloud/azure/actuators/machine_scope_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

Walkthrough

Changes

Azure cloud environment handling

Layer / File(s)	Summary
Environment detection and validation pkg/cloud/azure/actuators/machine_scope.go	MachineScope detects Azure US Secret Cloud, validates ARM endpoint data, and resolves Azure Stack Hub and US Secret Cloud from the ARM endpoint.
Environment resolution tests pkg/cloud/azure/actuators/machine_scope_test.go	Tests verify US Secret Cloud endpoint resolution and case-insensitive environment detection.

OpenShift API dependency update

Layer / File(s)	Summary
Dependency version update go.mod	The direct github.com/openshift/api dependency uses a newer pseudo-version.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 09b04

The PR adds Azure Government Secret (IL6) support and related tests without any identified merge-blocking risk at the current head.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding support for the Azure Government Secret IL6 cloud environment.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request adds standard Go tests with t.Run, not Ginkgo tests. The added subtest names are fixed string literals such as returns true for AzureUSSecCloud and `when cloud environment is USSe…
Test Structure And Quality	✅ Passed	PASS: The pull request adds standard Go tests, not Ginkgo tests. The changed file imports testing and uses Test... functions with t.Run; it has no It, BeforeEach, AfterEach, Eventually, …
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests in machine_scope_test.go using testing.T, t.Run, and a controller-runtime fake client. It does not add Ginkgo e2e tests or cluster-executed tes…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds only standard Go unit tests in pkg/cloud/azure/actuators/machine_scope_test.go, using testing.T and t.Run. It adds no Ginkgo It, Describe, Context, or When e2…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes Azure cloud-environment detection and the vendored openshift/api dependency. The first-party behavioral diff adds IsUSSecCloud, fixes ARM endpoint nil checks, and se…
Ote Binary Stdout Contract	✅ Passed	PASS: The PR adds no stdout writes in process-level code. The source diff adds only MachineScope.IsUSSecCloud, guarded ARM endpoint handling, and environment selection. The new test output uses `t.F…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests (func Test... with testing.T), not new Ginkgo e2e tests. The tests use a fake client and compare an ARM endpoint string. They do not connect to t…
No-Weak-Crypto	✅ Passed	PASS. The pull request adds Azure cloud-environment handling and tests. No changed executable code adds MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret/token comparisons. The …
Container-Privileges	✅ Passed	PASS. The pull request changes Go source, tests, dependency metadata, and vendored OpenShift API files. The diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, `allowPri…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds no production logging. The only production changes add IsUSSecCloud, correct nil checks, and select the ARM endpoint for US Secret Cloud. The new test failure message rep…

Full details: Docstring Coverage

Explanation

Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The pull request adds standard Go tests with t.Run, not Ginkgo tests. The added subtest names are fixed string literals such as returns true for AzureUSSecCloud and when cloud environment is USSecCloud return it with ARM endpoint. No added test title uses generated identifiers, timestamps, node or namespace names, IP addresses, or dynamic formatting.

Full details: Test Structure And Quality

Explanation

PASS: The pull request adds standard Go tests, not Ginkgo tests. The changed file imports testing and uses Test... functions with t.Run; it has no It, BeforeEach, AfterEach, Eventually, or Consistently calls. The tests use in-memory controller-runtime fake clients and do not create cluster resources or perform indefinite cluster waits. Failure messages include the expected and actual values.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request adds standard Go unit tests in machine_scope_test.go using testing.T, t.Run, and a controller-runtime fake client. It does not add Ginkgo e2e tests or cluster-executed tests. The changed tests therefore do not introduce MicroShift-incompatible APIs, namespaces, or unsupported assumptions under this check.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request adds only standard Go unit tests in pkg/cloud/azure/actuators/machine_scope_test.go, using testing.T and t.Run. It adds no Ginkgo It, Describe, Context, or When e2e tests. The tests use fake clients and in-memory MachineScope values, with no node, scheduling, topology, failover, drain, scaling, or load-balancing assumptions. The SNO-specific check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes Azure cloud-environment detection and the vendored openshift/api dependency. The first-party behavioral diff adds IsUSSecCloud, fixes ARM endpoint nil checks, and selects the ARM endpoint for US Secret Cloud. It adds no deployment manifests, pod specifications, replicas, affinity, topology spread constraints, node selectors, tolerations, or PDBs. The vendored changes also add no concrete scheduling constructs. Therefore, the pull request introduces no topology-related scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The PR adds no stdout writes in process-level code. The source diff adds only MachineScope.IsUSSecCloud, guarded ARM endpoint handling, and environment selection. The new test output uses t.Fatalf inside a test case, which the check excludes. No added fmt.Print*, log.Print*, klog, os.Stdout, suite setup, or initializer output appears in the Go or vendor diff.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request adds standard Go unit tests (func Test... with testing.T), not new Ginkgo e2e tests. The tests use a fake client and compare an ARM endpoint string. They do not connect to that endpoint or any external service, and they contain no IPv4-only networking assumptions.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request adds Azure cloud-environment handling and tests. No changed executable code adds MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret/token comparisons. The only related diff match is generated OpenShift API documentation that lists DES-CBC3-SHA in a TLS profile description; it does not configure or execute that cipher. The existing golang.org/x/crypto dependency is unchanged.

Full details: Container-Privileges

Explanation

PASS. The pull request changes Go source, tests, dependency metadata, and vendored OpenShift API files. The diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-user settings. No container or Kubernetes manifest changes are present. Existing Dockerfiles are unchanged, so they cannot create a pull-request-caused failure.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request adds no production logging. The only production changes add IsUSSecCloud, correct nil checks, and select the ARM endpoint for US Secret Cloud. The new test failure message reports only a boolean and cloud-environment name. The dependency and vendor changes are generated API declarations and manifests; they add no logging statements or sensitive runtime output. Existing klog calls in machine_scope.go are unchanged.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mdbooth for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jhixson74: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.