Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-60125

[release-4.19 backport][ARO HCP] HostedCluster deletion fails due to Image Registry managementState validation

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Proposed
    • None
    • Done
    • Release Note Not Required
    • N/A
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-59194. The following is the description of the original issue:

      Description:When deleting a HostedCluster on ARO HCP (Azure Red Hat OpenShift Hosted Control Plane), the CLI operation sometimes fails due to a validation error related to the Image Registry operator configuration.Error Message:

      lastTransitionTime: "2025-07-10T11:09:01Z"message: 'Error: failed to update image registry management state: configs.imageregistry.operator.openshift.io "cluster" is forbidden: ValidatingAdmissionPolicy 'deny-removed-managementstate' with binding 'deny-removed-managementstate-binding' denied request: Setting managementState to 'Removed' is not allowed in Image Registry config.'observedGeneration: 3reason: ErrorOccurredstatus: "False"type: CloudResourcesDestroyed

      Expected Behavior:

      • The HostedCluster deletion should complete successfully
      • The Image Registry operator configuration should be properly cleaned up during deletion

      Actual Behavior:

      • The deletion fails due to a ValidatingAdmissionPolicy preventing the Image Registry managementState from being set to 'Removed'
      • The CloudResourcesDestroyed condition reports failure

      Impact:

      • Users cannot cleanly delete their HostedClusters
      • May lead to orphaned resources
      • Affects cluster lifecycle management

      Steps to Reproduce:

      1. Create a HostedCluster on ARO HCP
      1. Attempt to delete the HostedCluster using the CLI
      1. Observe the deletion failure with the above error

      Additional Notes:

      • The ValidatingAdmissionPolicy 'deny-removed-managementstate' is blocking a legitimate operation during cluster deletion
      • This should be handled gracefully during the deletion process
      • The validation policy may need to be adjusted to allow this state during cluster deletion

              rh-ee-brcox Bryan Cox
              rh-ee-brcox Bryan Cox
              None
              None
              He Liu He Liu
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: