[ci-analyser-agent] fix: revert HyperShift operator to stable image

[rosa-regional-platform-ci]

Root cause

The nightly-ephemeral job fails because the HCP cluster created by the e2e tests (e2e-1781498628) enters HostedClusterDegraded within 3 seconds of creation.

Evidence

From the Prow build log (rosa-regional-platform-e2e/ step, build-log.txt):

2026-06-15T04:50:32Z: HostedCluster e2e-1781498628 → HostedClusterDegraded (3 sec after creation)
2026-06-15T05:25:05Z: Ginkgo timeout fires — HCP never became ready

Root cause analysis

Commit cd811ae7 (2026-06-11) replaced the HyperShift operator with a custom POC build:

# Before
image: quay.io/acm-d/rhtap-hypershift-operator@sha256:428c9ec9e24...

# After (broken)
image: quay.io/cbusse_openshift/hypershift-operator:aws-iam-auth

The POC build adds aws-iam-authenticator injection and an aws-iam-auth-config ConfigMap sync controller. E2e test clusters do not carry the hypershift.openshift.io/aws-iam-authenticator annotation or the corresponding ConfigMap, so the custom controller sets HostedClusterDegraded immediately.

Note: S3 cluster logs (HyperShift operator namespace on the ephemeral MC) would confirm the exact error message. S3 access was not available in this CI environment. The 3-second degradation window strongly points to the operator build, not a network/infrastructure race.

Fix

Revert argocd/config/management-cluster/hypershift/values.yaml to the last known-good HyperShift operator image. The aws-iam-auth POC changes in the ManifestWork (manifestwork.yaml) are left in place and can be re-enabled once the operator is validated against CI workloads.

Failing job

https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-regional-platform-main-nightly-ephemeral

Changes

• argocd/config/management-cluster/hypershift/values.yaml: revert HyperShift operator image to stable SHA

🤖 Opened automatically by the CI Analyser agent

Summary by CodeRabbit

• Chores
  • Updated the hypershift operator container image reference to use an immutable digest for improved stability and consistency.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign iamkirkbater for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a49abd0e-3f70-408f-936b-80dc27513c09

📥 Commits

Reviewing files that changed from the base of the PR and between 3bf7def and 7e48b53.

📒 Files selected for processing (1)

• argocd/config/management-cluster/hypershift/values.yaml

✅ Files skipped from review due to trivial changes (1)

• argocd/config/management-cluster/hypershift/values.yaml

---

📝 Walkthrough

Walkthrough

The hypershift operator image in argocd/config/management-cluster/hypershift/values.yaml is changed from a personal registry tag (quay.io/cbusse_openshift/hypershift-operator:aws-iam-auth) to a sha256-pinned image (quay.io/acm-d/rhtap-hypershift-operator@sha256:...) from the ACM-D registry.

Changes

Hypershift Operator Image Pin

Layer / File(s)	Summary
Operator image digest update argocd/config/management-cluster/hypershift/values.yaml	Replaces the mutable personal-registry tag with an immutable sha256-digested quay.io/acm-d/rhtap-hypershift-operator image reference.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: reverting the HyperShift operator to a stable image to fix CI failures, which is precisely what the changeset accomplishes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @rosa-regional-platform-ci. Thanks for your PR.

I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[cdoan1]

/ok-to-test

[rosa-regional-platform-ci]

Updated diagnosis based on latest failures (2026-06-16):

Nightly Ephemeral: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-regional-platform-main-nightly-ephemeral/2066732986778259456
Nightly Integration: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-regional-platform-main-nightly-integration/2066732990137896960

New diagnosis: Both jobs fail with the same root cause as yesterday. The HCP cluster enters HostedClusterDegraded state (confirmed in today's ephemeral build log):

condition {"message":"HostedCluster is degraded", "reason":"HostedClusterDegraded", "status":"False", "type":"Health"} should be True

The custom HyperShift operator image (quay.io/cbusse_openshift/hypershift-operator:aws-iam-auth) is still on main and is causing the same degradation pattern. Today the nightly-integration job also fails with the same HostedClusterDegraded / 35-minute poll timeout.

Changes: No new code changes needed — the fix in this PR (reverting the HyperShift operator image to a stable SHA) addresses both failures. This PR needs to be merged to unblock both nightly jobs.

[rosa-regional-platform-ci]

Updated based on latest failure: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-regional-platform-main-nightly-ephemeral/2067457823523999744

New diagnosis: Same root cause — the custom HyperShift operator image quay.io/cbusse_openshift/hypershift-operator:aws-iam-auth is still in main (argocd/config/management-cluster/hypershift/values.yaml) causing every HCP cluster to become HostedClusterDegraded within seconds of creation.

Today's failure evidence (2026-06-18):

• Provision: SUCCESS
• E2E: FAILURE — condition {"type":"Health", "status":"False", "reason":"HostedClusterDegraded", "lastTransitionTime":"2026-06-18T04:50:43Z"} never cleared; test timed out after 35 minutes
• Teardown: SUCCESS

Changes: No new changes needed — this PR's revert to the stable HyperShift image is still the correct fix. Needs merge to stop recurring failures.

[rosa-regional-platform-ci]

Updated fix based on latest failure: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-regional-platform-main-nightly-ephemeral/2068544912382496768

New diagnosis: Same root cause — the custom HyperShift image quay.io/cbusse_openshift/hypershift-operator:aws-iam-auth continues to cause HostedClusterDegraded immediately after HCP cluster creation. The Health condition on the cluster status is False with reason HostedClusterDegraded from the very first poll (04:50:51Z, 4 seconds after the cluster-oidc was created at 04:50:47Z), and it never recovers throughout the 35-minute Eventually timeout.

Changes: No code changes needed — this PR already contains the correct fix (revert to quay.io/acm-d/rhtap-hypershift-operator@sha256:428c9ec9e24...). PRs #615 and #616 (aws-iam-auth-config annotation and ordering fixes) are already on main but are not sufficient to prevent the degraded state. This revert is still required.

Note: PR #626 (disable FIPS endpoints) addresses the separate provision failure seen on 2026-06-20 and is unrelated to this HyperShift issue.

[rosa-regional-platform-ci]

Updated fix based on latest failure: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-regional-platform-main-nightly-ephemeral/2068907377599451136

New diagnosis: Same root cause — still failing as of 2026-06-22. The broken HyperShift POC image (quay.io/cbusse_openshift/hypershift-operator:aws-iam-auth) remains on main, causing every ephemeral e2e HCP cluster to enter HostedClusterDegraded immediately after creation. The cluster's Health condition never becomes True, causing the 35-minute timeout and test failure.

This has now failed on 2026-06-18, 2026-06-21, and 2026-06-22. The fix branch has been rebased onto latest main (commit 1ff3e259).

Changes: Branch rebased onto current main — no code changes needed, the stable image revert is still correct.

[typeid]

Closing, the clusters become ready so this is not part of the root cause.