OCPBUGS-88036: Add e2e test verifying CAPI Azure VM ownership tag

[matzew]

Verify that the AzureCluster object carries the
kubernetes.io/cluster/=owned tag that openshift-install destroy cluster relies on to identify and clean up cloud resources.

CAPZ propagates AdditionalTags from the AzureCluster to all managed resources. This test confirms the tag is present without any explicit code changes.

Summary by CodeRabbit

• Tests
  • Added end-to-end validation that verifies Azure cluster ownership tagging.
  • Extended the Azure MachineSet test to assert ownership tag presence after readiness.
  • Improved test coverage and failure signaling for misconfigured or missing cluster ownership tags.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@matzew: This pull request references Jira Issue OCPBUGS-88036, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Verify that the AzureCluster object carries the
kubernetes.io/cluster/=owned tag that openshift-install destroy cluster relies on to identify and clean up cloud resources.

CAPZ propagates AdditionalTags from the AzureCluster to all managed resources. This test confirms the tag is present without any explicit code changes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bcf5b4cd-f9e1-4ac4-a6a3-070c85672c95

📥 Commits

Reviewing files that changed from the base of the PR and between c319ef3 and 3cd9e0b.

📒 Files selected for processing (2)

• e2e/azure_helpers.go
• e2e/azure_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• e2e/azure_test.go
• e2e/azure_helpers.go

---

Walkthrough

This PR adds a helper that fetches the AzureCluster and asserts its AdditionalTags contains kubernetes.io_cluster.<infraName> = "owned". The MachineSet e2e test calls this helper after cluster readiness to validate the ownership tag.

Changes

Azure Cluster Ownership Tag Verification

Layer / File(s)	Summary
Azure cluster ownership tag helper and test usage e2e/azure_helpers.go, e2e/azure_test.go	New helper verifyCAPIAzureClusterOwnershipTag fetches the AzureCluster and asserts the kubernetes.io_cluster.<infraName> ownership tag exists with value "owned". The MachineSet test invokes this helper after framework.WaitForMachineSet to validate the tag is set.

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Structure And Quality	⚠️ Warning	FAIL: Azure It block both provisions/runs the MachineSet and verifies AzureCluster ownership tag; helper also has Expect(infraName).ToNot(BeEmpty()) with no failure message.	Split tag verification into its own It block (or separate assertion block) and add meaningful messages to assertions like Expect(infraName).ToNot(BeEmpty(), "...").

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding an e2e test that verifies CAPI Azure VMs have the ownership tag, which aligns with both file summaries.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	In e2e/azure_test.go only Describe("Cluster API Azure MachineSet") and It("should be able to run a machine") are used; no dynamic data in titles. azure_helpers.go uses static By("Verifying AzureClu...
Microshift Test Compatibility	✅ Passed	PR adds verifyCAPIAzureClusterOwnershipTag and calls it after WaitForMachineSet; helper only reads sigs.k8s.io/cluster-api-provider-azure AzureCluster AdditionalTags and introduces no new OpenShift...
Single Node Openshift (Sno) Test Compatibility	✅ Passed	azure_test.go creates a MachineSet with replicas=1 and only adds a post-wait assert for AzureCluster AdditionalTags=owned; no multi-node/HA or SNO skipping checks involved.
Topology-Aware Scheduling Compatibility	✅ Passed	PR #595 only adds an e2e helper/assertion for an AzureCluster ownership tag; it does not change any operator/controller manifests or introduce pod scheduling/affinity/topology constraints.
Ote Binary Stdout Contract	✅ Passed	Changed files only add a helper function and an extra It() assertion; no fmt.Print/Printf/Println, klog stdout, os.Stdout, or other process-level stdout writes detected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	New helper/asser­tion only reads AzureCluster AdditionalTags via cl.Get and checks for kubernetes.io_cluster.=owned; no IPv4 literals/parsing or external/public connectivity.
No-Weak-Crypto	✅ Passed	Scanned e2e/azure_helpers.go and e2e/azure_test.go and did a repo-wide search for md5/sha1/DES/RC4/3DES/Blowfish/ECB + crypto imports; no weak-crypto hits found.
Container-Privileges	✅ Passed	PR #595 only adds e2e/azure_helpers.go and updates e2e/azure_test.go; diff shows no Kubernetes/container manifests or securityContext fields (privileged/hostPID/hostNetwork/hostIPC/allowPrivilegeEs...
No-Sensitive-Data-In-Logs	✅ Passed	PR adds verifyCAPIAzureClusterOwnershipTag; it logs only Ginkgo step/Expect messages with cluster name/tag key—no passwords, tokens, API keys, PII, or secrets appear in the added code.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign theobarberbany for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@matzew: This pull request references Jira Issue OCPBUGS-88036, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Verify that the AzureCluster object carries the
kubernetes.io/cluster/=owned tag that openshift-install destroy cluster relies on to identify and clean up cloud resources.

CAPZ propagates AdditionalTags from the AzureCluster to all managed resources. This test confirms the tag is present without any explicit code changes.

Summary by CodeRabbit

• Tests
• Enhanced Azure end-to-end test suite with additional cluster ownership tag verification.
• Extended test assertions to validate proper Azure cluster resource tagging configuration.
• Strengthened infrastructure validation checks to ensure cluster ownership tags are correctly configured during machine set provisioning and verification.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@e2e/azure_helpers.go`:
- Around line 40-44: The test builds expectedTagKey incorrectly using a dot;
change the construction of expectedTagKey to use an underscore so it matches
CAPZ's tag helper (NameKubernetesAzureCloudProviderPrefix /
ClusterAzureCloudProviderTagKey). Concretely, update the expectedTagKey
expression (where expectedTagKey is set from infraName) to produce
"kubernetes.io_cluster_<infraName>" and keep the assertions against
azureCluster.Spec.AzureClusterClassSpec.AdditionalTags and HaveKeyWithValue
as-is so the key lookup succeeds.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9147a505-efdd-4299-be2b-2e23269b22ff

📥 Commits

Reviewing files that changed from the base of the PR and between 05c113e and c319ef3.

📒 Files selected for processing (2)

• e2e/azure_helpers.go
• e2e/azure_test.go

[matzew]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[openshift-ci-robot]

@matzew: This pull request references Jira Issue OCPBUGS-88036, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Verify that the AzureCluster object carries the
kubernetes.io/cluster/=owned tag that openshift-install destroy cluster relies on to identify and clean up cloud resources.

CAPZ propagates AdditionalTags from the AzureCluster to all managed resources. This test confirms the tag is present without any explicit code changes.

Summary by CodeRabbit

• Tests
• Added end-to-end validation that verifies Azure cluster ownership tagging.
• Extended the Azure MachineSet test to assert ownership tag presence after readiness.
• Improved test coverage and failure signaling for misconfigured or missing cluster ownership tags.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[mdbooth]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-disconnected-techpreview
/test e2e-aws-capi-techpreview
/test e2e-aws-capi-techpreview-post-install
/test e2e-aws-ovn
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-techpreview-upgrade
/test e2e-azure-capi-techpreview
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-techpreview-upgrade
/test e2e-gcp-capi-techpreview
/test e2e-gcp-ovn-techpreview
/test e2e-metal3-capi-techpreview
/test e2e-openstack-capi-techpreview
/test e2e-openstack-ovn-techpreview
/test e2e-vsphere-capi-techpreview
/test regression-clusterinfra-aws-ipi-techpreview-capi

[openshift-ci]

@matzew: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn	3cd9e0b	link	true	/test e2e-aws-ovn
ci/prow/e2e-openstack-ovn-techpreview	3cd9e0b	link	false	/test e2e-openstack-ovn-techpreview
ci/prow/e2e-azure-capi-techpreview	3cd9e0b	link	true	/test e2e-azure-capi-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.