Update libs to OpenShift 4.21/controller-runtime v0.22

[Amber Brown (hawkowl)]

Which issue this PR addresses:

Fixes ARO-28473

What this PR does / why we need it:

Updates dependencies to a version that lets us use SSA in testing.

Test plan for issue:

Unit tests, E2E.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

Please rebase pull request.

[Copilot]

Pull request overview

Updates the repository’s Kubernetes/OpenShift/controller-runtime-related dependencies (targeting OpenShift 4.21 and controller-runtime v0.22) and adjusts production/test code to compile and behave correctly with the newer APIs, enabling Server-Side Apply (SSA) usage in testing workflows.

Changes:

• Added controller-runtime Client.Apply(...) support in the test HookingClient to enable SSA-related test scenarios.
• Introduced a Kubernetes-scheme-backed YAML serializer and switched Hive/container-install manifest serialization to use it.
• Performed broad mechanical updates across controllers, tests, and generated CRDs to match updated upstream API types/fields.

Reviewed changes

Copilot reviewed 34 out of 35 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/util/clienthelper/hookclient.go	Extends HookingClient to support SSA via Apply(...) and adds apply hook plumbing.
test/util/clienthelper/helpers.go	Updates test tally helpers to derive Kind via scheme-based kind resolution and fixes diff orientation.
pkg/util/subnet/cluster_subnets_test.go	Updates expected error strings due to upstream serialization behavior changes.
pkg/util/scheme/scheme.go	Registers additional OpenShift API types (samples/v1) into the shared scheme.
pkg/util/kubeserializer/kubeserializer.go	Adds a Kubernetes codec-based YAML serializer utility for runtime objects.
pkg/util/clienthelper/clienthelper_test.go	Updates test fixtures to match upstream type changes (e.g., Conditions slice types, TypeMeta handling).
pkg/portal/kubeconfig/kubeconfig_test.go	Updates kubeconfig output expectations and comparison strategy after dependency changes.
pkg/operator/deploy/staticresources/preview.aro.openshift.io_previewfeatures.yaml	Regenerates CRD (controller-gen version bump + schema details).
pkg/operator/deploy/staticresources/aro.openshift.io_clusters.yaml	Regenerates CRD (controller-gen version bump + schema details).
pkg/operator/controllers/workaround/dirtyfragworkaround.go	Removes now-unnecessary TypeMeta population in generated resources.
pkg/operator/controllers/workaround/copyfailworkaround.go	Removes now-unnecessary TypeMeta population in generated resources.
pkg/operator/controllers/muo/muo_controller_test.go	Updates test objects to no longer rely on explicit TypeMeta.
pkg/operator/controllers/guardrails/guardrails_controller_test.go	Updates test objects to no longer rely on explicit TypeMeta.
pkg/operator/controllers/genevalogging/genevalogging.go	Adapts to upstream monitoring API type changes (relabel configs and alert For pointer).
pkg/operator/controllers/genevalogging/genevalogging_test.go	Updates tests for alert For pointer semantics.
pkg/operator/controllers/clusteroperatoraro/clusteroperatoraro_controller.go	Updates status condition setting to pass a clock per updated OpenShift helper signatures.
pkg/operator/controllers/checkers/internetchecker/unsupportedconditionchecker.go	Updates status condition setting to pass a clock per updated OpenShift helper signatures.
pkg/hive/resources.go	Switches manifest serialization from sigs.k8s.io/yaml to the new codec-based serializer.
pkg/hive/resources_test.go	Updates expected YAML output and adds error handling in the test.
pkg/frontend/fixetcd_test.go	Updates fakes/test setup for updated OpenShift operator client APIs.
pkg/frontend/admin_openshiftcluster_etcdrecovery_test.go	Updates fakes/test setup for updated OpenShift operator client APIs.
pkg/frontend/admin_openshiftcluster_etcdcertificaterenew_test.go	Adjusts test fixtures to reflect upstream struct field changes.
pkg/containerinstall/install.go	Switches manifest serialization from sigs.k8s.io/yaml to the new codec-based serializer.
pkg/cluster/workloadidentityresources.go	Removes explicit TypeMeta population from generated resources.
pkg/cluster/workloadidentityresources_test.go	Updates expected objects to no longer rely on explicit TypeMeta.
pkg/cluster/clusterserviceprincipal_test.go	Tightens test assertions around secret retrieval errors.
hack/hive/hive-config/hive-additional-install-log-regexes.yaml	Removes a now-omitted creationTimestamp field from YAML output.
go.sum	Updates dependency checksums for the OpenShift/Kubernetes/controller-runtime upgrades.
go.mod	Bumps OpenShift/Kubernetes/controller-runtime deps and pins replacements to upgraded versions.
.bingo/Variables.mk	Updates tool versions (client-gen/controller-gen) to match upgraded Kubernetes/controller-tools.
.bingo/variables.env	Updates tool version env vars (client-gen/controller-gen).
.bingo/controller-gen.sum	Updates bingo-managed controller-gen dependency checksums.
.bingo/controller-gen.mod	Updates bingo-managed controller-gen module version.
.bingo/client-gen.sum	Updates bingo-managed client-gen dependency checksums.
.bingo/client-gen.mod	Updates bingo-managed client-gen module version.

Suppressed comments (1)

test/util/clienthelper/helpers.go:52

• TallyCountsAndKey ignores scheme.Scheme.ObjectKinds errors by returning nil. This can hide missing scheme registrations and can produce false-positive tallies in tests (especially when comparing against an empty expected tally). It should return the error (and guard against an empty kinds slice).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 35 out of 36 changed files in this pull request and generated no new comments.

Suppressed comments (3)

go.mod:70

• The required OpenShift module versions here don’t match the pinned versions in the replace block below (openshift/api and openshift/library-go). Having mismatched require vs replace makes dependency intent harder to understand and can cause surprising downgrades if the replace is modified/removed later. Consider aligning the require versions to the same commits as the replace pins.

	github.com/openshift/api v0.0.0-20260304172252-b0658d22beea
	github.com/openshift/client-go v0.0.0-20251205093018-96a6cbc1420c
	github.com/openshift/cloud-credential-operator v0.0.0-20240910012137-a0245d57d1e6
	github.com/openshift/hive/apis v0.0.0-20260127213836-e33d70397d57
	github.com/openshift/library-go v0.0.0-20240424194921-cb8aac942b79

go.mod:118

• The go.mod require version for controller-runtime (v0.22.3) doesn’t match the pinned version in the replace block (v0.22.5). To reduce confusion and make the intended dependency version explicit, align the require to the same version as the replace pin.

	mvdan.cc/sh/v3 v3.13.0
	sigs.k8s.io/controller-runtime v0.22.3
	sigs.k8s.io/yaml v1.6.0

test/util/clienthelper/helpers_test.go:57

• The test assertion is currently tied to a very specific error string (including the concrete type name formatting). Since require.ErrorContains only needs a substring, using a shorter/stabler fragment will make this test less brittle across Kubernetes/controller-runtime version bumps.

[cloudygreybeard]

Approve. Dependency uplift (k8s.io 0.33→0.34, controller-runtime 0.21→0.22, openshift/api, prometheus-operator API) with all the breaking-change adaptations bundled in — TypeMeta stripped from hand-built objects in favour of a new kubeserializer scheme lookup, RelabelConfigs/SourceLabels/Rule.For updated for the new prometheus-operator types, SetStatusCondition clock param added, fake etcd client updated to the new generated shape.

Checked out the branch and built/tested the touched packages directly — no compile errors and all targeted tests pass (a couple of pre-existing, unrelated build failures on this host for vendored containers/storage/gpgme reproduce identically on master, so not this PR's doing).

One nice catch bundled in: clusterserviceprincipal_test.go fixes a secret != nil check that should've been an error check — the old fake client apparently returned non-nil on not-found. Worth a shout-out in review but not a blocker.

test/util/clienthelper also gets new coverage (TallyCountsAndKey happy path + unregistered-kind error path) rather than losing it, and dead code (TallyCounts) is removed.

[cloudygreybeard]

/azp run ci

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[github-actions]

Please rebase pull request.