[release-4.19] OCPBUGS-56227: correct aws kms permissions

[openshift-cherrypick-robot]

This is an automated cherry-pick of #1370

/assign Phaow

[openshift-ci-robot]

@openshift-cherrypick-robot: Jira Issue OCPBUGS-56159 has been cloned as Jira Issue OCPBUGS-56227. Will retitle bug to link to clone.
/retitle [release-4.19] OCPBUGS-56227: correct aws kms permissions

Details

In response to this:

This is an automated cherry-pick of #1370

/assign Phaow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-56227, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #1370

/assign Phaow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[Phaow]

Hi @JoelSpeed , I think we could backport to 4.19 only since 4.19.0 not release yet, in z-stream better to not change permissions, right? Feel free to corret me if there's some potential risk, thank you!
/assign @JoelSpeed

[Phaow]

cc @yunjiang29 @gpei

[JoelSpeed]

/approve
/lgtm
/label backport-risk-assessed

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Phaow]

/label cherry-pick-approved

[openshift-ci]

@Phaow: Can not set label cherry-pick-approved: Must be member in one of these teams: []

Details

In response to this:

/label cherry-pick-approved

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Phaow]

@sunzhaohua2 @huali9 Could you please help add the cherry-pick-approved label since we already verify it works? Thank you!

[Phaow]

/jira refresh

[openshift-ci-robot]

@Phaow: This pull request references Jira Issue OCPBUGS-56227, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-56159 is in the state ON_QA, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
• dependent Jira Issue OCPBUGS-56159 targets the "4.20.0" version, which is one of the valid target versions: 4.20.0
• bug has dependents

Requesting review from QA contact:
/cc @gpei

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[huali9]

/label cherry-pick-approved

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 02df956 and 2 for PR HEAD a76d65e in total

[openshift-ci]

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure-ovn	a76d65e	link	false	/test e2e-azure-ovn
ci/prow/e2e-gcp-operator	a76d65e	link	false	/test e2e-gcp-operator
ci/prow/e2e-openstack	a76d65e	link	false	/test e2e-openstack

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Phaow]

security check failed caused by

[Low] Improper Certificate Validation
   ID: 2d552384-7893-4a9b-9d9f-c799aadf5f3d 
   Path: pkg/webhooks/v1beta1_suite_test.go, line 48 
   Info: TrustManager might be too permissive: The client will accept any certificate and any host name in that certificate, making it susceptible to man-in-the-middle attacks.

not caused by the fix commit, @JoelSpeed could you help override it? Thank you!

[JoelSpeed]

/test security

[openshift-ci-robot]

@openshift-cherrypick-robot: Jira Issue OCPBUGS-56227: All pull requests linked via external trackers have merged:

• openshift/machine-api-operator#1371

Jira Issue OCPBUGS-56227 has been moved to the MODIFIED state.

Details

In response to this:

This is an automated cherry-pick of #1370

/assign Phaow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-machine-api-operator
This PR has been included in build ose-machine-api-operator-container-v4.19.0-202505161145.p0.g5eb6a36.assembly.stream.el9.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.19.0-0.nightly-2025-05-17-005111

[patrickdillon]

/cherry-pick release-4.18

[openshift-cherrypick-robot]

@patrickdillon: new pull request created: #1478

Details

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.