OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22

[djoshy]

Much of this PR is based on #5027 which landed directly in the release-4.19 branch. This PR adds a new admin-ack gate with the key ack-4.21-boot-image-opt-out-in-4.22 when a Azure/vSphere cluster does not have a boot image configuration in 4.21.

These gates are only relevant for upgrades to 4.22, so they will only need to exist in the MCO's release-4.21 branch.

- How to verify it

Before testing, ensure that any non MCO keys in the admin-gates CM have been acknowledged. See the description of #5027 for an example of this. Then, follow the steps below:

• Launch this PR against a 4.21 cluster on the Azure or vSphere platform without a boot image configuration defined. The CVO should trip Upgradeable=False (check via oc get clusterversion -o yaml). Now, add a boot image configuration - the CVO should no longer be setting Upgradeable to false.
• This gate should not show up on any other platforms.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-77689, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
• expected Jira Issue OCPBUGS-77689 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/jira refresh

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-77689, which is invalid:

• expected Jira Issue OCPBUGS-77689 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/jira refresh

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-77689, which is invalid:

• expected dependent Jira Issue OCPBUGS-77690 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is Closed (Obsolete) instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/jira refresh

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-77689, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.z) matches configured target version for branch (4.21.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-77690 is in the state Closed (Done), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-77690 targets the "4.22.0" version, which is one of the valid target versions: 4.22.0
• bug has dependents

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/retest

[isabella-janssen]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: djoshy, isabella-janssen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [djoshy,isabella-janssen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[djoshy]

/label backport-risk-assessed

[ptalgulk01]

Pre-merge tested:

Environment Setup
OCP version: 4.21.0-0-2026-03-06-020606-test-ci-ln-p2q64yb-latest
Platform: IPI based Azure and Vsphere

Steps

• Check the cv upgradeable status

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
{"lastTransitionTime":"2026-03-06T02:30:24Z","message":"This cluster is Azure or vSphere but lacks a boot image configuration. OCP will automatically opt this cluster into boot image management in 4.22. Please add a configuration to disable boot image updates if this is not desired. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/machine_configuration/mco-update-boot-images#mco-update-boot-images-disable_machine-configs-configure for more details.","reason":"AdminAckRequired","status":"False","type":"Upgradeable"}

• Add the below label in config map admin-ack

$ oc edit cm  admin-acks -n openshift-config -o yaml
apiVersion: v1
data:
  ack-4.21-boot-image-opt-out-in-4.22: "true"
kind: ConfigMap
metadata:
  annotations:
    include.release.openshift.io/hypershift: "true"
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
    kubernetes.io/description: Record administrator acknowledgments of update gates
      defined in the admin-gates ConfigMap in the openshift-config-managed namespace.
    release.openshift.io/create-only: "true"
  creationTimestamp: "2026-03-06T02:30:55Z"
  name: admin-acks
  namespace: openshift-config
  resourceVersion: "49973"
  uid: fbad92d1-73a0-4184-8153-cc83eb726224

• Check the upgradeable status is not visible

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
empty

• To revert the changes edit the label with false value to get back upgradeable status

data:
  ack-4.21-boot-image-opt-out-in-4.22: "false"

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
{"lastTransitionTime":"2026-03-06T04:15:02Z","message":"This cluster is Azure or vSphere but lacks a boot image configuration. OCP will automatically opt this cluster into boot image management in 4.22. Please add a configuration to disable boot image updates if this is not desired. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/machine_configuration/mco-update-boot-images#mco-update-boot-images-disable_machine-configs-configure for more details.","reason":"AdminAckRequired","status":"False","type":"Upgradeable"}

• Edit the machineconfiguration and add the boot-image value

    managedBootImages:
      machineManagers:
      - apiGroup: machine.openshift.io
        resource: machinesets
        selection:
          mode: All

• Check the upgradeable status is not visible

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
empty

• Revert the changes to get back upgradeable status

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
{"lastTransitionTime":"2026-03-06T04:15:02Z","message":"This cluster is Azure or vSphere but lacks a boot image configuration. OCP will automatically opt this cluster into boot image management in 4.22. Please add a configuration to disable boot image updates if this is not desired. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/machine_configuration/mco-update-boot-images#mco-update-boot-images-disable_machine-configs-configure for more details.","reason":"AdminAckRequired","status":"False","type":"Upgradeable"}

/label qe-approved
/verified by @ptalgulk01

[openshift-ci-robot]

@djoshy: This pull request references Jira Issue OCPBUGS-77689, which is valid.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.z) matches configured target version for branch (4.21.z)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-77690 is in the state Closed (Done), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-77690 targets the "4.22.0" version, which is one of the valid target versions: 4.22.0
• bug has dependents

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Much of this PR is based on #5027 which landed directly in the release-4.19 branch. This PR adds a new admin-ack gate with the key ack-4.21-boot-image-opt-out-in-4.22 when a Azure/vSphere cluster does not have a boot image configuration in 4.21.

These gates are only relevant for upgrades to 4.22, so they will only need to exist in the MCO's release-4.21 branch.

- How to verify it

Before testing, ensure that any non MCO keys in the admin-gates CM have been acknowledged. See the description of #5027 for an example of this. Then, follow the steps below:

• Launch this PR against a 4.21 cluster on the Azure or vSphere platform without a boot image configuration defined. The CVO should trip Upgradeable=False (check via oc get clusterversion -o yaml). Now, add a boot image configuration - the CVO should no longer be setting Upgradeable to false.
• This gate should not show up on any other platforms.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@ptalgulk01: This PR has been marked as verified by @ptalgulk01.

Details

In response to this:

Pre-merge tested:

Environment Setup
OCP version: 4.21.0-0-2026-03-06-020606-test-ci-ln-p2q64yb-latest
Platform: IPI based Azure and Vsphere

Steps

• Check the cv upgradeable status

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
{"lastTransitionTime":"2026-03-06T02:30:24Z","message":"This cluster is Azure or vSphere but lacks a boot image configuration. OCP will automatically opt this cluster into boot image management in 4.22. Please add a configuration to disable boot image updates if this is not desired. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/machine_configuration/mco-update-boot-images#mco-update-boot-images-disable_machine-configs-configure for more details.","reason":"AdminAckRequired","status":"False","type":"Upgradeable"}

• Add the below label in config map admin-ack

$ oc edit cm  admin-acks -n openshift-config -o yaml
apiVersion: v1
data:
 ack-4.21-boot-image-opt-out-in-4.22: "true"
kind: ConfigMap
metadata:
 annotations:
   include.release.openshift.io/hypershift: "true"
   include.release.openshift.io/ibm-cloud-managed: "true"
   include.release.openshift.io/self-managed-high-availability: "true"
   kubernetes.io/description: Record administrator acknowledgments of update gates
     defined in the admin-gates ConfigMap in the openshift-config-managed namespace.
   release.openshift.io/create-only: "true"
 creationTimestamp: "2026-03-06T02:30:55Z"
 name: admin-acks
 namespace: openshift-config
 resourceVersion: "49973"
 uid: fbad92d1-73a0-4184-8153-cc83eb726224

• Check the upgradeable status is not visible

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
empty

• To revert the changes edit the label with false value to get back upgradeable status

data:
 ack-4.21-boot-image-opt-out-in-4.22: "false"

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
{"lastTransitionTime":"2026-03-06T04:15:02Z","message":"This cluster is Azure or vSphere but lacks a boot image configuration. OCP will automatically opt this cluster into boot image management in 4.22. Please add a configuration to disable boot image updates if this is not desired. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/machine_configuration/mco-update-boot-images#mco-update-boot-images-disable_machine-configs-configure for more details.","reason":"AdminAckRequired","status":"False","type":"Upgradeable"}

• Edit the machineconfiguration and add the boot-image value

   managedBootImages:
     machineManagers:
     - apiGroup: machine.openshift.io
       resource: machinesets
       selection:
         mode: All

• Check the upgradeable status is not visible

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
empty

• Revert the changes to get back upgradeable status

$ oc get clusterversion version -o jsonpath='{.status.conditions[?(@.type=="Upgradeable")]}'
{"lastTransitionTime":"2026-03-06T04:15:02Z","message":"This cluster is Azure or vSphere but lacks a boot image configuration. OCP will automatically opt this cluster into boot image management in 4.22. Please add a configuration to disable boot image updates if this is not desired. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/machine_configuration/mco-update-boot-images#mco-update-boot-images-disable_machine-configs-configure for more details.","reason":"AdminAckRequired","status":"False","type":"Upgradeable"}

/label qe-approved
/verified by @ptalgulk01

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@djoshy: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@djoshy: Jira Issue OCPBUGS-77689: Some pull requests linked via external trackers have merged:

• openshift/machine-config-operator#5735

The following pull request, linked via external tracker, has not merged:

• openshift/cincinnati-graph-data#8913 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-77689 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

Much of this PR is based on #5027 which landed directly in the release-4.19 branch. This PR adds a new admin-ack gate with the key ack-4.21-boot-image-opt-out-in-4.22 when a Azure/vSphere cluster does not have a boot image configuration in 4.21.

These gates are only relevant for upgrades to 4.22, so they will only need to exist in the MCO's release-4.21 branch.

- How to verify it

Before testing, ensure that any non MCO keys in the admin-gates CM have been acknowledged. See the description of #5027 for an example of this. Then, follow the steps below:

• Launch this PR against a 4.21 cluster on the Azure or vSphere platform without a boot image configuration defined. The CVO should trip Upgradeable=False (check via oc get clusterversion -o yaml). Now, add a boot image configuration - the CVO should no longer be setting Upgradeable to false.
• This gate should not show up on any other platforms.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/jira refresh

[openshift-ci-robot]

@djoshy: Jira Issue OCPBUGS-77689: Some pull requests linked via external trackers have merged:

• openshift/machine-config-operator#5735

The following pull request, linked via external tracker, has not merged:

• openshift/cincinnati-graph-data#8913 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-77689 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[djoshy]

/jira refresh

[openshift-ci-robot]

@djoshy: Jira Issue Verification Checks: Jira Issue OCPBUGS-77689
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-77689 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.