OCPBUGS-95594: make cloud provider fields optional during operator install

[savio87]

Summary

On Workload Identity / Federated Identity clusters (AWS STS, Azure WI, GCP WI), the Console UI incorrectly forces users to provide cloud-specific credentials (role ARN, Client ID, etc.) before installing operators that have token-auth-* CSV annotations. These annotations indicate the operator's capability to support cloud authentication, not a mandatory requirement.

This fix makes the cloud provider configuration fields optional so users can install operators first and configure cloud credentials as a Day-2 task.

Changes

• Removed required attribute and co-required CSS class from the token-auth input fields
• Removed the token-auth validation checks from formValid() that blocked the install button when fields were empty

The fields and warning banners still appear when applicable -- they just no longer block installation.

Test plan

• Install an operator with token-auth-aws annotation on an AWS STS cluster without filling in the role ARN -- should succeed
• Install an operator with token-auth-gcp annotation on a GCP WI cluster without filling in GCP fields -- should succeed
• Install an operator with token-auth-azure annotation on an Azure WI cluster without filling in Azure fields -- should succeed
• Verify the warning banners and input fields still render correctly
• Verify filling in the fields still works and values are passed to the subscription

Summary by CodeRabbit

• Bug Fixes
  • Updated the subscription form to avoid incorrectly marking certain authentication fields as required.
  • Users can now proceed without entering AWS, Azure, or GCP authentication values when they are not needed.
  • Improved form validation to prevent unnecessary blocking during operator subscription.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@savio87: This pull request references Jira Issue OCPBUGS-95594, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

On Workload Identity / Federated Identity clusters (AWS STS, Azure WI, GCP WI), the Console UI incorrectly forces users to provide cloud-specific credentials (role ARN, Client ID, etc.) before installing operators that have token-auth-* CSV annotations. These annotations indicate the operator's capability to support cloud authentication, not a mandatory requirement.

This fix makes the cloud provider configuration fields optional so users can install operators first and configure cloud credentials as a Day-2 task.

Changes

• Removed required attribute and co-required CSS class from the token-auth input fields
• Removed the token-auth validation checks from formValid() that blocked the install button when fields were empty

The fields and warning banners still appear when applicable -- they just no longer block installation.

Test plan

• Install an operator with token-auth-aws annotation on an AWS STS cluster without filling in the role ARN -- should succeed
• Install an operator with token-auth-gcp annotation on a GCP WI cluster without filling in GCP fields -- should succeed
• Install an operator with token-auth-azure annotation on an Azure WI cluster without filling in Azure fields -- should succeed
• Verify the warning banners and input fields still render correctly
• Verify filling in the fields still works and values are passed to the subscription

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 836a3cc2-8ee1-47d7-8dcc-5d4b55499c9b

📥 Commits

Reviewing files that changed from the base of the PR and between 6a276d0 and 5ba1f45.

📒 Files selected for processing (1)

• frontend/packages/operator-lifecycle-manager/src/components/operator-hub/operator-hub-subscribe.tsx

---

Walkthrough

The subscription form no longer marks authentication inputs as required or validates them as non-empty. Namespace, subscription, installation mode, resolution, and API-conflict validation remains unchanged.

Changes

Subscription form validation

Layer / File(s)	Summary
Authentication field validation frontend/packages/operator-lifecycle-manager/src/components/operator-hub/operator-hub-subscribe.tsx	The form removes the co-required label class and required validation for AWS, Azure, and GCP authentication fields. Other subscription validation remains active.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: logonoff, vojtechszocs

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Jira issue and the main change: making cloud provider fields optional during operator installation.
Description check	✅ Passed	The description explains the root cause, solution, affected providers, and test cases, but omits several template sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only one .tsx component; it adds no Ginkgo tests or test titles, so this check is not applicable.
Test Structure And Quality	✅ Passed	The commit changes only a TypeScript React component and adds or modifies no Ginkgo tests, so the Ginkgo test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The commit modifies only a frontend TSX component and adds no Ginkgo e2e tests or test constructs, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only a TypeScript React component and adds no Ginkgo e2e tests, so SNO multi-node compatibility checks are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only a React subscription form: input labels, required state, and cloud-field validation. It adds no manifests, controllers, deployments, replicas, affinity, selectors, tolerations,...
Ote Binary Stdout Contract	✅ Passed	The PR changes only one React TSX file; it adds no Go, OTE, suite-setup, or process-level stdout code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes one frontend TSX file only; it adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The PR changes only one TSX file for UI validation; the diff adds no MD5, SHA-1, DES, RC4, Blowfish, ECB, crypto API, custom crypto, or secret comparison.
Container-Privileges	✅ Passed	The commit changes only a TSX source file. It adds no Kubernetes/container manifest or privilege control such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no logging. The changed component logs only two static error messages, and cloud credential values are not passed to logging calls.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[savio87]

Hi, this fixes an issue where the Console UI forces users to provide cloud-specific credentials (AWS role ARN, Azure Client ID, GCP Project Number, etc.) during operator installation on Workload Identity clusters. The token-auth-* CSV annotations indicate capability, not a mandatory requirement, so these fields should be optional.

Two customer cases are linked to the Jira issue. The CLI does not enforce these fields, so this also aligns Console behavior with CLI.

Could a maintainer please set the target version on OCPBUGS-95594 and run /ok-to-test? Thank you!