Machine objects in a HCP cluster with kubevirt and dual-stack deployment only shows the IPv4 as they are limited to share only one IP from the kubevirtmachine object:

https://github.com/openshift/cluster-api-provider-kubevirt/blob/6bc63fc9424fa6509063519042882828a9e141dc/pkg/kubevirt/machine.go#L229

Also it seems like te kubevirtmachine can only handle one internal IP addresses:
https://github.com/openshift/cluster-api-provider-kubevirt/blob/6bc63fc9424fa6509063519042882828a9e141dc/controllers/kubevirtmachine_controller.go#L326

This is probably the cause preventing csr auto approval on HCP cluster.

Openshift 4.20.10

Always

    1. Create a HCP cluster dual-stack 
    2.
    3.
    

"machine-approver" container is showing these errors when new machines appears:

I0115 15:11:57.723924       1 controller.go:165] Reconciling CSR: csr-j9jmt
E0115 15:11:57.742178       1 controller.go:307] failed to get kubelet CA: ConfigMap "csr-controller-ca" not found
E0115 15:11:57.742205       1 controller.go:281] failed to get kubelet CA
I0115 15:11:57.742211       1 csr_check.go:173] csr-j9jmt: CSR does not appear to be client csr
I0115 15:11:57.742216       1 csr_check.go:218] Falling back to machine-api authorization for temp--standard-fk69z
E0115 15:11:57.742224       1 csr_check.go:438] csr-j9jmt: IP address '2001:x:x:x:x:x:x:x' not in machine addresses: 10.x.x.x 10.x.x.x
I0115 15:11:57.742229       1 csr_check.go:221] Could not use Machine for serving cert authorization: IP address '2001:x:x:x:x:x:x:x' not in machine addresses: 10.x.x.x 10.x.x.x
I0115 15:11:57.743321       1 controller.go:286] csr-j9jmt: CSR not authorized
E0115 15:11:57.743352       1 controller.go:353] "Reconciler error" err="could not reconcile CSR: could not authorize CSR: exhausted all authorization methods: IP address '2001:x:x:x:x:x:x:x' not in machine addresses: 10.x.x.x 10.x.x.x" controller="certificatesigningrequest" controllerGroup="certificates.k8s.io" controllerKind="CertificateSigningRequest" CertificateSigningRequest="csr-j9jmt" namespace="" name="csr-j9jmt" reconcileID="xxxx"

machine correctly represents in the status the two ip addresses and as a consequence automatically approve the new CSR