OCPBUGS-59888: Add support to disable CAPZ components through a manager flag

[bryan-cox]

This is from kubernetes-sigs#5552.

Adds the ability to disable CAPZ components through a manager flag. Flags added for disabling ASO Secret Controller and disabling Azure JSON Machine Controller.

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-263 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.z" version, but no target version was set.

In response to this:

This is from kubernetes-sigs#5552.

Adds the ability to disable CAPZ components through a manager flag. Flags added for disabling ASO Secret Controller and disabling Azure JSON Machine Controller.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[damdo]

/approve

cc. @nrb

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: damdo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [damdo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[damdo]

/assign @nrb

[nrb]

/lgtm

/retest-required

[bryan-cox]

/test security

[nrb]

Security verification was failing on this:

 ✗ [Medium] Path Traversal
   ID: a7448f64-c142-4f4e-8d3d-793913d4b04e 
   Path: hack/boilerplate/boilerplate.py, line 57 
   Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: ed01acc1-027a-4af3-8b13-8e85880dd57b 
   Path: hack/boilerplate/boilerplate.py, line 173 
   Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

At the moment, I'm not quite sure how to log in to Snyk to mark this as ignored permanently, but we do not ship anything within the hack directory; these are build-time tools used primarily by the upstream developers.

/override ci/prow/security

[openshift-ci]

@nrb: Overrode contexts on behalf of nrb: ci/prow/security

In response to this:

Security verification was failing on this:

✗ [Medium] Path Traversal
  ID: a7448f64-c142-4f4e-8d3d-793913d4b04e 
  Path: hack/boilerplate/boilerplate.py, line 57 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: ed01acc1-027a-4af3-8b13-8e85880dd57b 
  Path: hack/boilerplate/boilerplate.py, line 173 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

At the moment, I'm not quite sure how to log in to Snyk to mark this as ignored permanently, but we do not ship anything within the hack directory; these are build-time tools used primarily by the upstream developers.

/override ci/prow/security

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[nrb]

/label backport-risk-assessed

[openshift-ci-robot]

@bryan-cox: This pull request references Jira Issue OCPBUGS-59888, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This is from kubernetes-sigs#5552.

Adds the ability to disable CAPZ components through a manager flag. Flags added for disabling ASO Secret Controller and disabling Azure JSON Machine Controller.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bryan-cox]

/jira refresh

[openshift-ci-robot]

@bryan-cox: This pull request references Jira Issue OCPBUGS-59888, which is valid.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.z) matches configured target version for branch (4.19.z)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-59887 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-59887 targets the "4.20.0" version, which is one of the valid target versions: 4.20.0
• bug has dependents

Requesting review from QA contact:
/cc @sunzhaohua2

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[damdo]

/override ci/prow/security

[openshift-ci]

@damdo: Overrode contexts on behalf of damdo: ci/prow/security

In response to this:

/override ci/prow/security

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@bryan-cox: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	d51dd10	link	true	/test security
ci/prow/okd-scos-e2e-aws-ovn	d51dd10	link	false	/test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[sunzhaohua2]

/label cherry-pick-approved

[sunzhaohua2]

/label qe-approved

Setup a cluster and disabled cvo and cluster-capi-operator, update deployment capz-controller-manager to try the new flag - --disable-controllers-or-webhooks=DisableAzureJSONMachineController, the deployment works well.

$ oc get po                
NAME                                       READY   STATUS    RESTARTS   AGE
capi-controller-manager-65f5c44f8b-mqh6n   1/1     Running   0          24m
capz-controller-manager-b64c4885-r66hx     1/1     Running   0          21s
$ oc get po capz-controller-manager-b64c4885-r66hx -o yaml | grep disable                     
    - --disable-controllers-or-webhooks=DisableAzureJSONMachineController

[openshift-ci-robot]

@bryan-cox: Jira Issue OCPBUGS-59888: All pull requests linked via external trackers have merged:

• openshift/cluster-api-provider-azure#347

Jira Issue OCPBUGS-59888 has been moved to the MODIFIED state.

In response to this:

This is from kubernetes-sigs#5552.

Adds the ability to disable CAPZ components through a manager flag. Flags added for disabling ASO Secret Controller and disabling Azure JSON Machine Controller.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-azure-cluster-api-controllers
This PR has been included in build ose-azure-cluster-api-controllers-container-v4.19.0-202507291138.p0.g2e2909c.assembly.stream.el9.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.19.0-0.nightly-2025-07-30-023414