CNTRLPLANE-3336: Add Azure AKS upgrade-from-zero job for 4.22

[bryan-cox]

Summary

• Adds e2e-aks-upgrade-from-zero periodic job for 4.22 on Azure AKS, now that 4.22 is GA
• Switches 4.22 HCM Azure releases from candidate/CI stream to fast channel (GA)
• Tests control plane upgrade from 4.22.0 → latest 4.22.z

Changes

• Added initial-zero release pinned to 4.22.0 from the fast channel
• Added e2e-aks-upgrade-from-zero test (cron: 0 8 * * *, offset from the existing minor upgrade job)
• Updated initial and latest releases from candidate stream to fast channel

Test plan

• Use /pj-rehearse to run rehearsal of the new periodic job
• Verify rehearsal job completes successfully
• Monitor job after merge to ensure it runs on schedule

References

• Follow-up from #73748 which deferred this job until 4.22 GA
• JIRA: CNTRLPLANE-3336

🤖 Generated with Claude Code

Summary by CodeRabbit

This PR extends HyperShift's Azure AKS control plane upgrade testing for OpenShift 4.22 by adding a new periodic CI job.

Infrastructure Changes:
The PR modifies the HyperShift periodic test configuration for 4.22 on Azure AKS (ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics-hcm-azure.yaml) to:

1. Add a new release pinning: Introduces initial-zero release configuration pinned explicitly to version 4.22.0 from the fast channel, allowing testing with the exact initial GA release

2. Add upgrade-from-zero test job: Creates a new periodic test e2e-aks-upgrade-from-zero scheduled to run daily at 8 AM UTC (cron: 0 8 * * *). This job tests control plane upgrades from the pinned 4.22.0 release to the latest 4.22.z build, complementing the existing e2e-aks-upgrade-minor job (which runs at 7 AM UTC and tests upgrades from the previous minor version).

Pattern & Consistency:
This change follows the established pattern used across HyperShift for earlier OpenShift versions (4.16-4.21), which all include initial-zero release pinning and corresponding upgrade-from-zero test jobs for comprehensive upgrade coverage.

Practical Impact:
The 4.22 HyperShift Azure AKS CI infrastructure now has enhanced upgrade testing that validates the upgrade path from the initial release, ensuring control plane stability and compatibility throughout the 4.22.z release lifecycle.

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3336 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds e2e-aks-upgrade-from-zero periodic job for 4.22 on Azure AKS, now that 4.22 is GA
• Switches 4.22 HCM Azure releases from candidate/CI stream to fast channel (GA)
• Tests control plane upgrade from 4.22.0 → latest 4.22.z

Changes

• Added initial-zero release pinned to 4.22.0 from the fast channel
• Added e2e-aks-upgrade-from-zero test (cron: 0 8 * * *, offset from the existing minor upgrade job)
• Updated initial and latest releases from candidate stream to fast channel

Test plan

• Use /pj-rehearse to run rehearsal of the new periodic job
• Verify rehearsal job completes successfully
• Monitor job after merge to ensure it runs on schedule

References

• Follow-up from #73748 which deferred this job until 4.22 GA
• JIRA: CNTRLPLANE-3336

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 0d2e120d-ebfa-4062-baa3-82e9d4b78ea9

📥 Commits

Reviewing files that changed from the base of the PR and between 980a85f and 44eb24b.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.22-periodics.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics-hcm-azure.yaml

---

Walkthrough

The CI config for HyperShift 4.22 Azure periodics is updated: release image selections are refactored from candidate-based to direct channel/version/relative fields, a new initial-zero release pinned to 4.22.0 is added, and a new e2e-aks-upgrade-from-zero periodic test is introduced that upgrades from that zero release.

Changes

HyperShift 4.22 Azure Periodics — Release Config and New Upgrade-from-Zero Test

Layer / File(s)	Summary
Release image selection refactor and initial-zero addition ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics-hcm-azure.yaml	initial, initial-minor, and latest releases are updated from candidate-based structures to direct release fields with channel: fast. A new initial-zero entry is added, pinned to version: 4.22.0.
New e2e-aks-upgrade-from-zero periodic test ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics-hcm-azure.yaml	Adds a daily periodic (0 8 * * *) that runs hypershift-azure-aks-e2e with OCP_IMAGE_PREVIOUS: release:initial-zero, AUTH_THROUGH_CERTS: "true", HYPERSHIFT_AZURE_LOCATION: centralus, and test selector ^TestUpgradeControlPlane$.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

lgtm, approved, rehearsals-ack

Suggested reviewers

• hector-vido
• bear-redhat

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and specifically describes the main change: adding a new Azure AKS upgrade-from-zero periodic test job for OpenShift 4.22.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only YAML configuration files defining test job scheduling, not Ginkgo test code. No Ginkgo test names (It(), Describe(), etc.) are added or modified.
Test Structure And Quality	✅ Passed	The custom check reviews Ginkgo test code quality, but this PR only modifies a YAML CI operator configuration file with no Go test code present.
Microshift Test Compatibility	✅ Passed	PR only modifies CI configuration YAML; no Ginkgo test code (It/Describe/etc.) was added, so the MicroShift Test Compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR modifies CI configuration (YAML) to add a periodic job reference, not new Ginkgo e2e test code. The custom check applies only when new Ginkgo tests are added; this PR adds no test implement...
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies CI test configuration only (ci-operator/config), not deployment manifests, operator code, or controllers, so topology-aware scheduling check does not apply.
Ote Binary Stdout Contract	✅ Passed	This PR only modifies YAML configuration files and documentation. No OTE binary source code (Go, Python, etc.) was modified, so the stdout contract check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR does not add any new Ginkgo e2e tests. It only modifies CI configuration (YAML) files to add a periodic job entry and update release versions. The check is not applicable.
No-Weak-Crypto	✅ Passed	PR modifies only a YAML CI/CD configuration file with no cryptographic code, weak crypto patterns, or secret comparison logic present.
Container-Privileges	✅ Passed	File is a CI/CD configuration (not a K8s manifest) with no container/pod privilege-related declarations; no privileged settings, hostPID/Network/IPC, SYS_ADMIN, or securityContext fields present.
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data exposure found. The YAML configuration file contains only non-sensitive CI/CD parameters: release versions, Azure location, test regex patterns, and boolean flags. No logging of p...

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/hypershift/OWNERS [bryan-cox]
• ci-operator/jobs/openshift/hypershift/OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bryan-cox: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-openshift-hypershift-release-4.22-periodics-hcm-azure-e2e-aks-upgrade-minor	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-hypershift-release-4.22-periodics-hcm-azure-e2e-aks-upgrade-from-zero	N/A	periodic	Periodic changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[bryan-cox]

/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-hcm-azure-e2e-aks-upgrade-minor

[bryan-cox]

/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-hcm-azure-e2e-aks-upgrade-from-zero

[openshift-merge-bot]

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bryan-cox]

/pj-rehearse ack

[openshift-merge-bot]

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[bryan-cox]

/cc @clebs