ARO-25108: Add v1api20251223preview API support for HcpOpenShift resources

[marek-veber]

Summary

• Update ASO CRDs to use v1api20251223previewstorage as the storage version for HcpOpenShiftClusters, HcpOpenShiftClustersNodePools, and HcpOpenShiftClustersExternalAuth
• This enables ASO to use the 2025-12-23-preview ARM API version when communicating with Azure
• Add CHANGELOG for v1.22.1-mce-217 release

Key Changes

• CRD storage version migration: v1api20240610previewstorage → v1api20251223previewstorage for all HcpOpenShift resources
• KMS structure change: In the new API, vaultName moved from kms.activeKey.vaultName to kms.vaultName, and a new required visibility field was added at the kms level
• Makefile: Updated ASO CRD generation to target the new API version

Test plan

• Deploy updated CRDs and verify ASO conversion webhook handles version conversion
• Verify HcpOpenShiftCluster creation with v1api20251223preview API version
• Verify existing clusters using v1api20240610preview continue to work via conversion webhook
• Verify ETCD encryption key management with the new KMS structure

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b2d689dd-7934-494e-8b07-19290a044dd5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[RadekCap]

/lgtm

Two findings from the review:

1. Missing CVE dependency updates in CHANGELOG — PR ARO-25528: Update Go dependencies to fix critical and high CVEs #136 (ARO-25528: Update Go dependencies to fix critical and high CVEs) was merged between releases but is not documented in the CHANGELOG. This includes:

   • google.golang.org/grpc → v1.79.3 (Critical CVE GHSA-p77j-4mvh-x3m3)
   • go.opentelemetry.io/otel/sdk → v1.40.0 (High CVE GHSA-9h8m-3fm2-qjrq)

2. v1.22.1-mce-217 tag points to the wrong commit — The existing GitHub release tag v1.22.1-mce-217 points to e14357b2, which is the same commit as v1.22.0-mce-217. The tag does NOT include any of the documented bug fixes or features. It should point to a commit on backplane-2.17 that includes all the changes.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: marek-veber, RadekCap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [RadekCap,marek-veber]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment