apiVersion: hypershift.openshift.io/v1beta1
kind: HostedCluster
metadata:
  annotations:
    create-external-hub-kubeconfig: "2025-11-20T21:48:24Z"
    hypershift.openshift.io/HasBeenAvailable: "true"
    hypershift.openshift.io/management-platform: AWS
  creationTimestamp: "2025-11-07T21:37:21Z"
  finalizers:
  - hypershift.openshift.io/finalizer
  generation: 5
  name: hcp-kubevirt-1
  namespace: clusters
  resourceVersion: "27972587"
  uid: 98861967-42dd-4f83-a1c2-3563d4a458e9
spec:
  autoscaling:
    scaling: ScaleUpAndScaleDown
  capabilities: {}
  channel: fast-4.20
  clusterID: 6f32121c-f131-42aa-a5b8-868084af93cb
  controllerAvailabilityPolicy: SingleReplica
  dns:
    baseDomain: apps.rj-bm.dev11.red-chesterfield.com
  etcd:
    managed:
      storage:
        persistentVolume:
          size: 8Gi
        type: PersistentVolume
    managementType: Managed
  fips: false
  imageContentSources:
  - mirrors:
    - quay.io:443/acm-d
    source: registry.redhat.io/rhacm2
  - mirrors:
    - quay.io:443/acm-d
    source: registry.redhat.io/multicluster-engine
  - mirrors:
    - registry.redhat.io/openshift4/ose-oauth-proxy
    source: registry.access.redhat.com/openshift4/ose-oauth-proxy
  - mirrors:
    - brew.registry.redhat.io
    source: registry.redhat.io
  - mirrors:
    - brew.registry.redhat.io/rhacm2
    source: registry.redhat.io/rhacm2
  - mirrors:
    - brew.registry.redhat.io
    source: registry.stage.redhat.io
  - mirrors:
    - brew.registry.redhat.io
    source: registry-proxy.engineering.redhat.com
  infraID: hcp-kubevirt-1
  infrastructureAvailabilityPolicy: SingleReplica
  issuerURL: https://kubernetes.default.svc
  networking:
    clusterNetwork:
    - cidr: 10.132.0.0/14
    networkType: OVNKubernetes
    serviceNetwork:
    - cidr: 172.31.0.0/16
  olmCatalogPlacement: management
  platform:
    kubevirt:
      baseDomainPassthrough: true
      generateID: sllxthtfvq
    type: KubeVirt
  pullSecret:
    name: pullsecret-cluster-hcp-kubevirt-1
  release:
    image: quay.io/openshift-release-dev/ocp-release:4.19.10-multi
  secretEncryption:
    aescbc:
      activeKey:
        name: hcp-kubevirt-1-etcd-encryption-key
    type: aescbc
  services:
  - service: OAuthServer
    servicePublishingStrategy:
      type: Route
  - service: OIDC
    servicePublishingStrategy:
      type: Route
  - service: Konnectivity
    servicePublishingStrategy:
      type: Route
  - service: Ignition
    servicePublishingStrategy:
      type: Route
  - service: APIServer
    servicePublishingStrategy:
      type: LoadBalancer
  sshKey:
    name: sshkey-cluster-hcp-kubevirt-1
status:
  conditions:
  - lastTransitionTime: "2025-11-17T19:22:02Z"
    message: Reconciliation completed successfully
    observedGeneration: 5
    reason: ReconciliatonSucceeded
    status: "True"
    type: ReconciliationSucceeded
  - lastTransitionTime: "2025-11-07T21:57:41Z"
    message: Condition not found in the CVO.
    observedGeneration: 5
    reason: FromClusterVersion
    status: "True"
    type: ClusterVersionUpgradeable
  - lastTransitionTime: "2025-11-07T21:55:05Z"
    message: Done applying 4.19.10
    observedGeneration: 5
    reason: FromClusterVersion
    status: "True"
    type: ClusterVersionAvailable
  - lastTransitionTime: "2025-11-07T21:55:05Z"
    message: ""
    observedGeneration: 5
    reason: FromClusterVersion
    status: "True"
    type: ClusterVersionSucceeding
  - lastTransitionTime: "2025-11-07T21:55:05Z"
    message: Cluster version is 4.19.10
    observedGeneration: 5
    reason: FromClusterVersion
    status: "False"
    type: ClusterVersionProgressing
  - lastTransitionTime: "2025-11-07T21:40:14Z"
    message: Payload loaded version="4.19.10" image="quay.io/openshift-release-dev/ocp-release@sha256:00e31a4bb3131a9994810488352c9a7419bb90bebedc5fcc4daeb53a2fe7b408"
      architecture="Multi"
    observedGeneration: 5
    reason: PayloadLoaded
    status: "True"
    type: ClusterVersionReleaseAccepted
  - lastTransitionTime: "2025-11-20T22:31:38Z"
    message: The hosted cluster is not degraded
    observedGeneration: 5
    reason: AsExpected
    status: "False"
    type: Degraded
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: All is well
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: KubeVirtNodesLiveMigratable
  - lastTransitionTime: "2025-11-07T21:38:36Z"
    message: ""
    observedGeneration: 5
    reason: QuorumAvailable
    status: "True"
    type: EtcdAvailable
  - lastTransitionTime: "2025-11-07T21:39:10Z"
    message: Kube APIServer deployment is available
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: KubeAPIServerAvailable
  - lastTransitionTime: "2025-11-07T21:37:42Z"
    message: All is well
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: InfrastructureReady
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: External DNS is not configured
    observedGeneration: 5
    reason: StatusUnknown
    status: Unknown
    type: ExternalDNSReachable
  - lastTransitionTime: "2025-11-07T21:37:40Z"
    message: Configuration passes validation
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: ValidHostedControlPlaneConfiguration
  - lastTransitionTime: "2025-11-07T21:37:54Z"
    message: All is well
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: ValidReleaseInfo
  - lastTransitionTime: "2025-11-07T21:39:21Z"
    message: Identity provider configuration is valid
    observedGeneration: 5
    reason: IDPConfigurationValid
    status: "True"
    type: ValidIDPConfiguration
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: Condition not found in the HCP
    observedGeneration: 5
    reason: StatusUnknown
    status: Unknown
    type: HostedClusterRestoredFromBackup
  - lastTransitionTime: "2025-11-07T21:48:16Z"
    message: The hosted control plane is available
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: Available
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: Configuration passes validation
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: ValidConfiguration
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: HostedCluster is supported by operator configuration
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: SupportedHostedCluster
  - lastTransitionTime: "2025-11-07T21:39:32Z"
    message: Ignition server deployment is available
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: IgnitionEndpointAvailable
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: Reconciliation active on resource
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: ReconciliationActive
  - lastTransitionTime: "2025-11-07T21:37:26Z"
    message: Release image is valid
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: ValidReleaseImage
  - lastTransitionTime: "2025-11-07T21:37:27Z"
    message: HostedCluster is at expected version
    observedGeneration: 5
    reason: AsExpected
    status: "False"
    type: Progressing
  - lastTransitionTime: "2025-11-07T21:37:27Z"
    message: Required platform credentials are found
    observedGeneration: 3
    reason: AsExpected
    status: "True"
    type: PlatformCredentialsFound
  - lastTransitionTime: "2025-11-20T12:48:26Z"
    message: ""
    observedGeneration: 5
    reason: FromClusterVersion
    status: "True"
    type: ClusterVersionRetrievedUpdates
  - lastTransitionTime: "2025-11-07T21:43:57Z"
    message: All is well
    observedGeneration: 5
    reason: AsExpected
    status: "True"
    type: ValidKubeVirtInfraNetworkMTU
  controlPlaneEndpoint:
    host: aa5d1f9fb9c3e4d1293a1598359baebd-277838587.us-west-2.elb.amazonaws.com
    port: 6443
  ignitionEndpoint: ignition-server-clusters-hcp-kubevirt-1.apps.rj-bm.dev11.red-chesterfield.com
  kubeadminPassword:
    name: hcp-kubevirt-1-kubeadmin-password
  kubeconfig:
    name: hcp-kubevirt-1-admin-kubeconfig
  oauthCallbackURLTemplate: https://oauth-clusters-hcp-kubevirt-1.apps.rj-bm.dev11.red-chesterfield.com:443/oauth2callback/[identity-provider-name]
  payloadArch: Multi
  version:
    availableUpdates:
    - channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:d909f94e2a0a72414184cf802e42fb466172ddcc0a3ab6cfcf73f238d783697e
      url: https://access.redhat.com/errata/RHBA-2025:15293
      version: 4.19.11
    conditionalUpdates:
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
            NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:eef1007b491a06505d8931e2c1d51325437e17d92f470a3ca4232e615f88a902
        url: https://access.redhat.com/errata/RHBA-2025:19301
        version: 4.19.18
      risks:
      - matchingRules:
        - promql:
            promql: |
              topk by (_id) (1,
                group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
                or on (_id)
                0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
              )
              * on (_id) group_left (name)
              (
                group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
                or on (_id)
                group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
                or on (_id)
                0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
                or on (_id)
                0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
              )
          type: PromQL
        message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
          updates, breaking Kubernetes access to those Nodes and wedging the update
          into the exposed release.
        name: NetworkManagerOVNBridgeMapping
        url: https://issues.redhat.com/browse/CORENET-6483
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
            NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:2128e8aeb605ef6360fd48d25172ccbaaf3450122e1fc0131fe6c39a0f217282
        url: https://access.redhat.com/errata/RHSA-2025:18233
        version: 4.19.17
      risks:
      - matchingRules:
        - promql:
            promql: |
              topk by (_id) (1,
                group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
                or on (_id)
                0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
              )
              * on (_id) group_left (name)
              (
                group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
                or on (_id)
                group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
                or on (_id)
                0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
                or on (_id)
                0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
              )
          type: PromQL
        message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
          updates, breaking Kubernetes access to those Nodes and wedging the update
          into the exposed release.
        name: NetworkManagerOVNBridgeMapping
        url: https://issues.redhat.com/browse/CORENET-6483
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
            NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:92bbf82553fe2b2e52bf3263364e8506d7c1c4ba8c271c99f3c0f2fd6000e8b0
        url: https://access.redhat.com/errata/RHBA-2025:17662
        version: 4.19.16
      risks:
      - matchingRules:
        - promql:
            promql: |
              topk by (_id) (1,
                group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
                or on (_id)
                0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
              )
              * on (_id) group_left (name)
              (
                group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
                or on (_id)
                group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
                or on (_id)
                0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
                or on (_id)
                0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
              )
          type: PromQL
        message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
          updates, breaking Kubernetes access to those Nodes and wedging the update
          into the exposed release.
        name: NetworkManagerOVNBridgeMapping
        url: https://issues.redhat.com/browse/CORENET-6483
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
            NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483

          Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
            OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:f2302a88ad5dfae2e3b975c771a6999d02e405a2e9dc97570f50c85ac9f0abfc
        url: https://access.redhat.com/errata/RHBA-2025:17237
        version: 4.19.15
      risks:
      - matchingRules:
        - promql:
            promql: |
              topk by (_id) (1,
                group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
                or on (_id)
                0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
              )
              * on (_id) group_left (name)
              (
                group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
                or on (_id)
                group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
                or on (_id)
                0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
                or on (_id)
                0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
              )
          type: PromQL
        message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
          updates, breaking Kubernetes access to those Nodes and wedging the update
          into the exposed release.
        name: NetworkManagerOVNBridgeMapping
        url: https://issues.redhat.com/browse/CORENET-6483
      - matchingRules:
        - promql:
            promql: |
              0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
              or
              group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
          type: PromQL
        message: Clusters with restrictive image policies may struggle with OS updates
          when the OS image is already on the local disk.
        name: OSUpdateFailureDueToImagePullPolicy
        url: https://issues.redhat.com/browse/MCO-1896
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
            NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483

          Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
            OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:8a14c89a1ac9afc9d696a7c2996a7110b75b48ce1ad49526f744538ecb0530ce
        url: https://access.redhat.com/errata/RHBA-2025:16693
        version: 4.19.14
      risks:
      - matchingRules:
        - promql:
            promql: |
              topk by (_id) (1,
                group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
                or on (_id)
                0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
              )
              * on (_id) group_left (name)
              (
                group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
                or on (_id)
                group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
                or on (_id)
                0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
                or on (_id)
                0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
              )
          type: PromQL
        message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
          updates, breaking Kubernetes access to those Nodes and wedging the update
          into the exposed release.
        name: NetworkManagerOVNBridgeMapping
        url: https://issues.redhat.com/browse/CORENET-6483
      - matchingRules:
        - promql:
            promql: |
              0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
              or
              group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
          type: PromQL
        message: Clusters with restrictive image policies may struggle with OS updates
          when the OS image is already on the local disk.
        name: OSUpdateFailureDueToImagePullPolicy
        url: https://issues.redhat.com/browse/MCO-1896
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk MachineConfigNodesV1AlphaControlPlaneLabels (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            MachineConfigNodesV1AlphaControlPlaneLabels description: Standalone clusters born in 4.11 or earlier whose control-plane nodes lack the control-plane role may need that role added to update to the target release.
            MachineConfigNodesV1AlphaControlPlaneLabels URL: https://issues.redhat.com/browse/MCO-1890

          Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
            NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483

          Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
            OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:a3f546e89872e9f363d491c665ebd68f2af1660f7df4e52507054b9a6f3d5b34
        url: https://access.redhat.com/errata/RHBA-2025:16148
        version: 4.19.13
      risks:
      - matchingRules:
        - promql:
            promql: |
              0 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="control-plane"})
              or on ()
              1 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="master"})
              or on ()
              0 * topk(1, count by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb"}))
          type: PromQL
        message: Standalone clusters born in 4.11 or earlier whose control-plane nodes
          lack the control-plane role may need that role added to update to the target
          release.
        name: MachineConfigNodesV1AlphaControlPlaneLabels
        url: https://issues.redhat.com/browse/MCO-1890
      - matchingRules:
        - promql:
            promql: |
              topk by (_id) (1,
                group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
                or on (_id)
                0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
              )
              * on (_id) group_left (name)
              (
                group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
                or on (_id)
                group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
                or on (_id)
                0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
                or on (_id)
                0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
              )
          type: PromQL
        message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
          updates, breaking Kubernetes access to those Nodes and wedging the update
          into the exposed release.
        name: NetworkManagerOVNBridgeMapping
        url: https://issues.redhat.com/browse/CORENET-6483
      - matchingRules:
        - promql:
            promql: |
              0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
              or
              group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
          type: PromQL
        message: Clusters with restrictive image policies may struggle with OS updates
          when the OS image is already on the local disk.
        name: OSUpdateFailureDueToImagePullPolicy
        url: https://issues.redhat.com/browse/MCO-1896
    - conditions:
      - lastTransitionTime: "2025-11-17T19:09:56Z"
        message: |-
          Could not evaluate exposure to update risk MachineConfigNodesV1AlphaControlPlaneLabels (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            MachineConfigNodesV1AlphaControlPlaneLabels description: Standalone clusters born in 4.11 or earlier whose control-plane nodes lack the control-plane role may need that role added to update to the target release.
            MachineConfigNodesV1AlphaControlPlaneLabels URL: https://issues.redhat.com/browse/MCO-1890

          Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
            OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
            OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
        reason: EvaluationFailed
        status: Unknown
        type: Recommended
      release:
        channels:
        - candidate-4.19
        - candidate-4.20
        - eus-4.20
        - fast-4.19
        - fast-4.20
        - stable-4.19
        - stable-4.20
        image: quay.io/openshift-release-dev/ocp-release@sha256:dbb7a2e2f7cd301ea24539fb03dfa716b905813c199e6b381ecad0a6006e9de4
        url: https://access.redhat.com/errata/RHBA-2025:15694
        version: 4.19.12
      risks:
      - matchingRules:
        - promql:
            promql: |
              0 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="control-plane"})
              or on ()
              1 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="master"})
              or on ()
              0 * topk(1, count by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb"}))
          type: PromQL
        message: Standalone clusters born in 4.11 or earlier whose control-plane nodes
          lack the control-plane role may need that role added to update to the target
          release.
        name: MachineConfigNodesV1AlphaControlPlaneLabels
        url: https://issues.redhat.com/browse/MCO-1890
      - matchingRules:
        - promql:
            promql: |
              0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
              or
              group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
          type: PromQL
        message: Clusters with restrictive image policies may struggle with OS updates
          when the OS image is already on the local disk.
        name: OSUpdateFailureDueToImagePullPolicy
        url: https://issues.redhat.com/browse/MCO-1896
    desired:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:00e31a4bb3131a9994810488352c9a7419bb90bebedc5fcc4daeb53a2fe7b408
      url: https://access.redhat.com/errata/RHBA-2025:14823
      version: 4.19.10
    history:
    - completionTime: "2025-11-07T21:55:05Z"
      image: quay.io/openshift-release-dev/ocp-release@sha256:00e31a4bb3131a9994810488352c9a7419bb90bebedc5fcc4daeb53a2fe7b408
      startedTime: "2025-11-07T21:39:36Z"
      state: Completed
      verified: false
      version: 4.19.10
    observedGeneration: 3
