Release v20260722.00-lb-tagged-ip-dual-frontend

Phase 1: Force NSGs + configureServiceSecrets on latest master (107 commits forward)

Changes

8368479 Remove forceNSGs early-return; regenerate assets on latest master Phase 1: Force NSG deployment but keep configureServiceSecrets running so RP VMSS instances become healthy during deployment.
2c66a0b Fix template ipTags ordering bug: use targeted regex for VMSS PIPs
43a7a12 Add portal_in_tagged NSG rule and fix tagged portal container port bindings
de3feae Fix TestCleanupOrphanedTaggedPIPs: use plain error for non-404 case
76c60a2 Fix test failures: make forceNSGs a deployer struct field
0c2b9ee Add orphaned tagged PIP cleanup and NSG-only predeploy mode
6f50af1 Add IP tags to RP and Gateway VMSS public IPs
5826d09 Add portal SSH tagged LB rule and rename portal-probe-tagged
b85d905 Fix missing regexp import in deploy generator templates
cc6cc88 Add tagged public IPs to RP load balancer with dual-frontend rollback support
8764571 Merge pull request #4960 from Azure/linisusan/ARO-26771-muo-image-update
83d426b Merge pull request #4911 from Azure/linisusan/ARO-26365-aro-26372-credscan-suppress-false-positives
4f9c65b Merge pull request #4901 from Azure/linisusan/ARO-26376-removing-insecure-hostkeycallback-implementation
392df48 Merge pull request #4984 from Azure/hawkowl/npm-audit-fix-jul21
3a9edd5 npm audit fix
2c8253b Fix CredScan false positives for pullsecret and vendor swagger.
e0107e2 Fix CredScan suppression path for extract_test.go
ee4fd5c [ARO-26365, ARO-26372] Add CredScan suppressions for false positives
4e37dff Merge pull request #4955 from nikhil-thomas/ARO-26990/fix-mhc-isclusterupgrading
c404831 fix(machinehealthcheck): ARO-26990 eliminate IsClusterUpgrading false positive in MHC controller
c572354 scoping pod.conditions metrics emission (#4962)
2e696bd Merge pull request #4961 from Azure/tuxerrante/ARO-28189/ingress-visibility-fix
c3f470e Merge pull request #4935 from Azure/b-jieyuan/ARO-27840
c9e7dca Merge pull request #4964 from Azure/dependabot/go_modules/pkg/api/golang.org/x/crypto-0.52.0
54552f4 Merge pull request #4949 from Azure/admin-kubeconfig-endpoint
2ddacbc Detect worker VM quota/SKU errors from Machine ProviderStatus to enable E2E VM-size retry (#4936)
d948eed Admin API: JIT-elevated kubeconfig endpoints
bbe2a82 Merge pull request #4856 from Azure/feature/aro-27159-dynamic-memory-allocation
c98ed69 fix: improve defensive guards in compute_memory_budget
619a10c Merge pull request #4965 from Azure/dependabot/github_actions/step-security/harden-runner-2.20.0
7c8cd01 feat(deploy): add dynamic per-container memory allocation for RP VMSS
22beb9d chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0
c0ce7b3 chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /pkg/api
0c58748 fix(clusterdata): preserve stored ingress visibility on read
894d61a refactor(go): use any in put or patch helpers
ae91f7e fix(frontend): avoid persisting enrichment-only patch mutations
5292542 fix(clusterdata): stop inferring public ingress visibility
010d810 update message
d090b1c add master node protection policy for VAP
70e1c62 [ARO-26376] Replace InsecureIgnoreHostKey with persistent TOFU for portal SSH

Full Changelog: v20260714.00-test-muo-image...v20260722.00-lb-tagged-ip-dual-frontend

Release v20260709.01-lb-tagged-ip-dual-frontend

Phase 1: Force NSGs + normal configureServiceSecrets flow

Changes

b7f949c Revert forceNSGsOnly config field; keep configureServiceSecrets running

Full Changelog: v20260702.00-lb-tagged-ip-dual-frontend...v20260709.01-lb-tagged-ip-dual-frontend

Release v20260714.00-test-muo-image

Testing new MUO image v0.1.1445-g512fbce

Changes

c6b2ca3 bump MUO image tag to v0.1.1445-g512fbce
00de7ce update MUO image tag in version constants
7a90f16 bump MUO mirror image to v0.1.1445-g512fbce
30a5a73 bump MUO image to v0.1.1409-g35338f3
252cde1 Merge pull request #4963 from Azure/cadenmarchese/dont-persist-empty-ingressip-to-cosmos
c2e72c8 guard against persisting empty ingress IPs on update operations
d838183 Add explicit mimo cosmosdb throughput config (#4945)
65791d9 Merge pull request #4943 from Azure/alcasim/ARO-27326
738730d Using len() to also consider empty maps
d2765c1 creating test for aro operator rendered requests
a3842ab adding resource requests for aro-operator deployments

Full Changelog: v20260708.00...v20260714.00-test-muo-image

Release v20260714.00-test-credscan-false-postives

Security Code Bugs: Test credscan-suppress-false-positives

Changes

396442c Fix CredScan false positives for pullsecret and vendor swagger.
59e291d Fix CredScan suppression path for extract_test.go
779a7a5 [ARO-26365, ARO-26372] Add CredScan suppressions for false positives
252cde1 Merge pull request #4963 from Azure/cadenmarchese/dont-persist-empty-ingressip-to-cosmos
c2e72c8 guard against persisting empty ingress IPs on update operations
d838183 Add explicit mimo cosmosdb throughput config (#4945)
65791d9 Merge pull request #4943 from Azure/alcasim/ARO-27326
738730d Using len() to also consider empty maps
d2765c1 creating test for aro operator rendered requests
a3842ab adding resource requests for aro-operator deployments

Full Changelog: v20260708.00...v20260714.00-test-credscan-false-postives

Release v20260709.00-lb-tagged-ip-dual-frontend

Phase 1: Force NSGs + normal configureServiceSecrets flow (no skip)

Changes

b7f949c Revert forceNSGsOnly config field; keep configureServiceSecrets running

Full Changelog: v20260702.00-lb-tagged-ip-dual-frontend...v20260709.00-lb-tagged-ip-dual-frontend

Release v20260708.00

v20260708.00

Changes

d43dd20 Merge pull request #4950 from Azure/hawkowl/golangcilint-2.12
8995c24 Merge pull request #4958 from Azure/hlipsig/ARO-28163/Update-audit-log-filters
f7cd3ec Merge pull request #4946 from Azure/dependabot/go_modules/github.com/sigstore/fulcio-1.8.6
3d35143 Potential fix for pull request finding
ad76ad3 Potential fix for pull request finding
3db3e27 Potential fix for pull request finding
02a6a6f Potential fix for pull request finding
2763475 Improve Geneva OTEL audit filtering and buffering
fe8d9df import github.com/sigstore/fulcio v1.8.5
ca69ea3 chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.6
67772ad Merge pull request #4896 from Azure/dependabot/pip/cryptography-48.0.1
09f5836 ARO-28102 - fix(frontend): guard nil machine provider spec in resize control plane (#4951)
72eecef remove direct dep on x/exp/
b9b3ad7 make fmt
04644ca lint when we have goexp stuff, but exclude bindata
8a6ccd5 bump golangcilint version + github action
47ddc00 Merge pull request #4565 from Azure/hawkowl/ARO-23084-pt1
bcce99d Provision gateway private endpoint even for clusters without egress lockdown (#4932)
3e37ad0 Removed stale metrics from monitor (#4922)
c2ced12 fix python dependency resolution for cryptography 48
bbe03e2 chore(deps): bump cryptography from 46.0.7 to 48.0.1
2a9b568 remove SetDefault method from enrichers (#4947)
f3bddc3 ARO-27777 - refactor(monitor): wire arocli into shared http client pool (#4912)
3f70651 nit cleanup
d5b9bc4 clean up some lints
877492f minor fix
a7a5f11 tweaks to ipsec checking in dirtyfrag workaround
69ec1f2 fix up deprecated func
87c72cd clean up minor nit
638fe3e fix changes made since this PR started
748171a clean some nits
afaa1a2 bump deps and get rid of MCO dep
a272118 move mco to the client-go version
c31b922 reuse http client
46c96f0 apparently we don't need this
40ef98a get the last timeouts
f345ecf remove some more deprecated functions
03d92ae fmt
27f16bf machine api having breaking api changes? who would have guessed
a37a8e0 update the copyfail/dirtyfrag to use new clientfake and also use the real API for dirtyfrag
9b1371e go mod tidy
53f70be cleanup timeout
09b9ecd new things in generation, I guess
e57cd86 testing for lists, for the hive code
bae842d create an index for pkg/monitor/cluster
7a021c6 add a ginkgo comparer which doesn't look at things that don't match in local testing
1d009e5 add configv1 to have a status resource
3cf8553 move pkg/operator to use the fake client with arov1alpha1.Client registered as having a status subresource
b8833b9 add some testing helpers for k8s fake objects, add an import rule for pkg/operator so it doesn't get missed
f731289 use status subresource in pullsecret_controller
77b7bcc fix some status changes
bffa6bb ignore deprecated k8s wait APIs in linter for now
0bf4bcf clean up more wait.ErrWaitTimeout cases
a8746c1 err == wait.ErrWaitTimeout { -> wait.Interrupted()
2ecdffe fix up pkg/util/steps/condition.go to have better handling with the new k8s wait APIs
daca068 add missing functions to clienthelper
5b73bd2 fix api drift in test/e2e/cluster.go PVCs
27148c0 fix cache fallback tests
3af1231 fix api in clienthelper
6579210 remove the explicit dynamic rest mapper where not required and remove the lazy discovery
91830d8 update manager creation
fabc7e8 update for controller runtime
7b7a6d9 bump to k8s 1.29/openshift 4.16
6434490 refactor: remove unused ctx parameter from operator() entry point (#4927)
4b7cf9e Merge pull request #4941 from Azure/dependabot/github_actions/zgosalvez/github-actions-ensure-sha-pinned-actions-5.0.5
e4042e0 Merge pull request #4785 from Azure/ventifus/ARO-25356/delete-retry-409
5cf18a9 pkg/cluster: extend retryable coverage to deployments and private endpoint delete
6b600ac Merge pull request #4923 from Azure/dependabot/npm_and_yarn/portal/v2/http-proxy-middleware-2.0.10
cc73af7 chore(deps): bump http-proxy-middleware in /portal/v2
3afb5e2 Merge pull request #4939 from Azure/cadenmarchese/ensure-rt-roleassignment-id-replacement
8a073e9 Merge pull request #4940 from Azure/dependabot/github_actions/actions/setup-go-6.5.0
cb583e6 Merge pull request #4942 from Azure/dependabot/github_actions/oxsecurity/megalinter/flavors/ci_light-9.6.0
de51154 chore(deps): bump oxsecurity/megalinter/flavors/ci_light
ef7c5bf chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions
fbe8c19 chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0
6629ac7 Merge pull request #4904 from Azure/hlipsig/ARO-0000/otel-docs
92fde21 discover route tables from both subnets
2d67fc5 remove go-autorest import
815f3c8 configure role assignment over route table when required in e2e
3d03f91 Upgrade dev VPN gateway SKU from VpnGw1 to VpnGw1AZ (#4874)
7368d95 Address PR Feedback x2
c01c823 Address PR Feedback
437cd1d pkg/util/azureclient: add ARM fault injection for CI and local dev
2dcd49c pkg/cluster: wrap autorest ARM write call sites with transient retry
8c9d4f6 pkg/util/azureerrors,azuresdk/common: detect transient 409/429 ARM responses
4fbcbc2 Update OTEL Geneva docs for current behavior
691af56 Apply suggestions from code review
07498be Add OTEL developer documentation

Full Changelog: v20260625.03...v20260708.00

Release v20260702.03-lb-tagged-ip-dual-frontend

Phase 1: Force NSGs + normal configureServiceSecrets flow (no skip)

Changes

b7f949c Revert forceNSGsOnly config field; keep configureServiceSecrets running

Full Changelog: v20260702.00-lb-tagged-ip-dual-frontend...v20260702.03-lb-tagged-ip-dual-frontend

Release v20260702.02-lb-tagged-ip-dual-frontend

Phase 1: Force NSGs + normal configureServiceSecrets flow (no skip)

Changes

b7f949c Revert forceNSGsOnly config field; keep configureServiceSecrets running

Full Changelog: v20260702.00-lb-tagged-ip-dual-frontend...v20260702.02-lb-tagged-ip-dual-frontend

Release v20260702.00-lb-tagged-ip-dual-frontend

Fix ipTags template ordering bug and wire forceNSGs to config

Changes

c4ecf7a Wire forceNSGs to config field instead of hardcoding true
5c85fc7 Fix template ipTags ordering bug: use targeted regex for VMSS PIPs

Full Changelog: v20260701.00-lb-tagged-ip-dual-frontend...v20260702.00-lb-tagged-ip-dual-frontend

Release v20260701.00-lb-tagged-ip-dual-frontend

LB tagged IP dual-frontend rebased onto latest master

Changes

6a7c830 Regenerate deploy assets after rebase onto latest master
751d1e4 Regenerate deploy assets on latest master base
845e072 Add portal_in_tagged NSG rule and fix tagged portal container port bindings
664cd11 Fix TestCleanupOrphanedTaggedPIPs: use plain error for non-404 case
25c7f96 Fix test failures: make forceNSGs a deployer struct field
dee6196 Add orphaned tagged PIP cleanup and NSG-only predeploy mode
f161d4c Regenerate deploy assets after VMSS IP tagging cherry-pick
c0e701f Add INT release status to VMSS IP tagged docs
276eeb5 Update docs with correct commit ID and tag
9a56702 Fix whitespace in templates_rp.go after make generate
5dcd700 Add documentation for VMSS public IP tagging
38e1c0b Add IP tags to RP and Gateway VMSS public IPs
84966fe Regenerate deploy assets after cherry-pick onto latest master
1c76081 Fix monitor checkReady() regression: use subs.GetLastProcessed()
191fe2c Add second INT release status to LB tagged IP docs
c0da370 Add INT release pipeline link to LB tagged IP docs
54c0ac1 Add portal SSH tagged LB rule and rename portal-probe-tagged
b2c9979 Fix missing regexp import in deploy generator templates
502a4bb Add tagged public IPs to RP load balancer with dual-frontend rollback support
e4042e0 Merge pull request #4785 from Azure/ventifus/ARO-25356/delete-retry-409
5cf18a9 pkg/cluster: extend retryable coverage to deployments and private endpoint delete
6b600ac Merge pull request #4923 from Azure/dependabot/npm_and_yarn/portal/v2/http-proxy-middleware-2.0.10
cc73af7 chore(deps): bump http-proxy-middleware in /portal/v2
3afb5e2 Merge pull request #4939 from Azure/cadenmarchese/ensure-rt-roleassignment-id-replacement
8a073e9 Merge pull request #4940 from Azure/dependabot/github_actions/actions/setup-go-6.5.0
cb583e6 Merge pull request #4942 from Azure/dependabot/github_actions/oxsecurity/megalinter/flavors/ci_light-9.6.0
de51154 chore(deps): bump oxsecurity/megalinter/flavors/ci_light
fbe8c19 chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0
6629ac7 Merge pull request #4904 from Azure/hlipsig/ARO-0000/otel-docs
92fde21 discover route tables from both subnets
2d67fc5 remove go-autorest import
815f3c8 configure role assignment over route table when required in e2e
3d03f91 Upgrade dev VPN gateway SKU from VpnGw1 to VpnGw1AZ (#4874)
7368d95 Address PR Feedback x2
c01c823 Address PR Feedback
437cd1d pkg/util/azureclient: add ARM fault injection for CI and local dev
2dcd49c pkg/cluster: wrap autorest ARM write call sites with transient retry
8c9d4f6 pkg/util/azureerrors,azuresdk/common: detect transient 409/429 ARM responses
4fbcbc2 Update OTEL Geneva docs for current behavior
691af56 Apply suggestions from code review
07498be Add OTEL developer documentation

Full Changelog: v20260625.03...v20260701.00-lb-tagged-ip-dual-frontend