🌱 NO-JIRA: Copy CredentialsRequest manifest from CAPIO

[mdbooth]

First step of moving the CAPA CredentialsRequest from CAPIO to this repo
to enable single-PR changes.

Adds an exact copy of
0000_30_cluster-api-provider-aws_01_credentials-request.yaml from
cluster-capi-operator to CAPA's CVO manifests. It must remain identical
to the CAPIO manifest until the manifest is removed from CAPIO.

TODO:

• OCPBUGS-104496: aws: use capa-controller-manager as service account cluster-capi-operator#644

/hold

Summary by CodeRabbit

• New Features

  • OpenShift runtime images now include the required deployment manifests.
  • Added AWS credentials configuration for Cluster API deployments, enabling required infrastructure, load-balancing, encryption, and role-management operations.

• Deployment

  • Improved OpenShift provisioning support by automatically packaging the manifests needed for AWS-based cluster management.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@mdbooth: This pull request explicitly references no jira issue.

Details

In response to this:

First step of moving the CAPA CredentialsRequest from CAPIO to this repo
to enable single-PR changes.

Adds an exact copy of
0000_30_cluster-api-provider-aws_01_credentials-request.yaml from
cluster-capi-operator to CAPA's CVO manifests. It must remain identical
to the CAPIO manifest until the manifest is removed from CAPIO.

TODO:

• OCPBUGS-104496: aws: use capa-controller-manager as service account cluster-capi-operator#644

/hold

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The change adds an AWS CredentialsRequest for the Cluster API controller and copies the OpenShift manifests into the runtime image.

Changes

OpenShift AWS credentials

Layer / File(s)	Summary
AWS credentials request openshift/manifests/0000_30_cluster-api-provider-aws_01_credentials-request.yaml	Defines AWS permissions for EC2, ELB, IAM PassRole, and KMS operations. It targets the capa-controller-manager service account and restricts grant operations to AWS resources.
Runtime manifest packaging openshift/Dockerfile.openshift	Copies openshift/manifests to /manifests in the runtime image.

Estimated code review effort: 3 (Moderate) | ~15 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch changes only a Dockerfile and a YAML CredentialsRequest; it adds no Ginkgo test declarations or test titles.
Test Structure And Quality	✅ Passed	The pull request changes only a Dockerfile and a CredentialsRequest YAML; it adds or modifies no Ginkgo test code, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	The commit changes only the OpenShift Dockerfile and adds a CredentialsRequest YAML; it adds no Ginkgo tests or test markers requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds one Dockerfile copy instruction and one CredentialsRequest YAML; it adds no Ginkgo e2e tests or multi-node test assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch only copies a CredentialsRequest into the image; the added resource has no replicas, affinity, topology spread, node selectors, tolerations, or PDB settings.
Ote Binary Stdout Contract	✅ Passed	The patch changes only a Dockerfile and YAML manifest; it adds no OTE binary, suite setup, or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The change adds only a Dockerfile copy instruction and an AWS CredentialsRequest YAML; it adds no Ginkgo tests or test network dependencies.
No-Weak-Crypto	✅ Passed	Changed files contain no MD5, SHA1, DES, RC4, Blowfish, or ECB usage; KMS permissions are AWS API actions, not weak-crypto implementations.
Container-Privileges	✅ Passed	The added CredentialsRequest has no container privilege fields, and the CAPA Deployment runs as UID 65532 with runAsNonRoot, all capabilities dropped, and privilege escalation disabled.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds one Dockerfile COPY and a CredentialsRequest manifest; added-line scans found no logging constructs or secret payloads, only a secretRef name.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: copying the CAPIO CredentialsRequest manifest into this repository.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign radekmanak for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[damdo]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-capi-techpreview
/test e2e-aws-ovn
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-hypershift

[hongkailiu]

/test verify

ignore/forgive me.
Just want to make sure the job still works.

[openshift-ci]

@mdbooth: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.