OCPBUGS-126380: Set Azure control plane OS disk caching to ReadOnly

[nikitapal-12]

IPI currently hard-codes ReadWrite and has no install-config field for OS disk caching. Default control plane OS disks to ReadOnly to match the documented etcd recommendation; an install-config override can follow.

Summary by CodeRabbit

• Bug Fixes
  • Improved Azure control plane performance by configuring OS disks to use read-only caching.
  • Worker and compute node disks continue using the platform default caching behavior.
• Tests
  • Added coverage to verify disk caching settings for control plane and worker machines.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@nikitapal-12: This pull request references Jira Issue OCPBUGS-126380, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

IPI currently hard-codes ReadWrite and has no install-config field for OS disk caching. Default control plane OS disks to ReadOnly to match the documented etcd recommendation; an install-config override can follow.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 2716de7d-10e7-45c2-ae23-164cbf91ff94

📥 Commits

Reviewing files that changed from the base of the PR and between 43ef4b6 and 4c59927.

📒 Files selected for processing (3)

• pkg/asset/machines/azure/azuremachines.go
• pkg/asset/machines/azure/machines.go
• pkg/asset/machines/azure/machines_test.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Azure OS disk caching

Layer / File(s)	Summary
Role-based caching pkg/asset/machines/azure/machines.go, pkg/asset/machines/azure/azuremachines.go	Control-plane OS disks now use ReadOnly caching. Compute disks leave caching unset.
Regression coverage pkg/asset/machines/azure/machines_test.go	Tests verify the helper, provider output, and generated control-plane machines.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4c599

Control-plane Azure OS disks use ReadOnly caching while compute disks retain the platform default. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: setting Azure control plane OS disk caching to ReadOnly. The Jira issue reference is relevant to the change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request adds three standard Go tests with static function names: TestOSDiskCachingType, TestProviderControlPlaneOSDiskCachingReadOnly, and `TestGenerateMachinesControlPlaneOSDiskCac…
Test Structure And Quality	✅ Passed	PASS — The pull request adds standard Go testing tests with testify, not Ginkgo It blocks. The tests exercise pure manifest-generation functions. They create no cluster resources, use no waits, …
Microshift Test Compatibility	✅ Passed	The pull request adds three standard Go unit tests with func Test...(t *testing.T) in pkg/asset/machines/azure/machines_test.go. The diff adds no Ginkgo e2e constructs such as It, Describe, or…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds ordinary Go unit tests with testing.T, not Ginkgo e2e tests. The tests call local Azure provider-generation functions and inspect generated objects. They do not use clust…
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes Azure machine provider OS disk caching only. The diff adds CachingType values to AzureMachineProviderSpec and CAPZ OSDisk objects, plus tests. It does not add or modify …
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request changes only Azure machine specification generation and unit tests. The added code assigns CachingType, adds osDiskCachingType, and adds assertions. The authoritative diff a…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds standard Go testing unit tests, not Ginkgo It/Describe/Context/When e2e tests. The added tests only construct local Azure objects and inspect fields. They contain…
No-Weak-Crypto	✅ Passed	PASS. The pull request changes Azure OS disk caching from ReadWrite to ReadOnly and adds role-based caching tests. The exact added-line scan found no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom c…
Container-Privileges	✅ Passed	PASS: The pull request changes only three Go files and no container or Kubernetes manifest. The added behavior sets Azure OS disk caching to ReadOnly; it does not add privileged, hostPID, `hostN…
No-Sensitive-Data-In-Logs	✅ Passed	No logging was added or changed. The production diff only changes Azure OS disk caching and adds osDiskCachingType; it contains no logger, print, event, or record call. The new tests use synthetic v…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rna-afk for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• pkg/asset/machines/azure/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @nikitapal-12. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[patrickdillon]

/hold

see https://issues.redhat.com//browse/OCPBUGS-33470

Looks like docs need to be updated.