OCPNODE-3863: UPSTREAM: <carry>: Update validation logic to allow deletion of criocredentialproviderconfigs

[QiWang19]

What type of PR is this?

/kind feature

What this PR does / why we need it:

criocredentialproviderconfigs named 'cluster' can be deleted. We do not require a singleton 'cluster' resource to be
created when there is no default crio credential provider configuration to ship; users will create the 'cluster' ( API cel validation restricts the name 'cluster' )
resource when they need it and should be able to delete it when it is no longer required.

Which issue(s) this PR is related to:

related to feature https://issues.redhat.com/browse/OCPNODE-3952
openshift/api#2557

Special notes for your reviewer:

• criocredentialproviderconfigs API work OCPNODE-3863: Add CRIOCredentialProviderConfig API api#2557 is blocked by this PR
• Verified this PR can allow reosucre deletion:

qiwan@fedora:~$ oc create -f /home/qiwan/criocp.yaml
criocredentialproviderconfig.config.openshift.io/cluster created


qiwan@fedora:~$ oc describe criocredentialproviderconfig.config.openshift.io/cluster
Name:         cluster
Namespace:    
Labels:       <none>
Annotations:  <none>
API Version:  config.openshift.io/v1alpha1
Kind:         CRIOCredentialProviderConfig
Metadata:
  Creation Timestamp:  2025-12-18T19:50:35Z
  Generation:          1
  Resource Version:    38292
  UID:                 4ef0e05d-d875-46c9-b467-804513093041
Spec:
  Match Images:
    123456789.dkr.ecr.us-east-1.amazonaws.com
    *.azurecr.io
    *.*.registry.io
    registry.io:8080/path
Events:  <none>


qiwan@fedora:~$ oc delete criocredentialproviderconfig.config.openshift.io/cluster
criocredentialproviderconfig.config.openshift.io "cluster" deleted

Does this PR introduce a user-facing change?

allow deletion of criocredentialproviderconfigs 'cluster' resource

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

• openshift enhancement: OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication enhancements#1861

[openshift-ci-robot]

@QiWang19: This pull request references OCPNODE-3863 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What type of PR is this?

/kind feature

What this PR does / why we need it:

criocredentialproviderconfigs named 'cluster' can be deleted. We do not require a singleton 'cluster' resource to be
created when there is no default crio credential provider configuration to ship; users will create the 'cluster' ( API cel validation restricts the name 'cluster' )
resource when they need it and should be able to delete it when it is no longer required.

Which issue(s) this PR is related to:

related to feature https://issues.redhat.com/browse/OCPNODE-3952
openshift/api#2557

Special notes for your reviewer:

• criocredentialproviderconfigs API work OCPNODE-3863: Add CRIOCredentialProviderConfig API api#2557 is blocked by this PR
• Verified this PR can allow reosucre deletion:

qiwan@fedora:~$ oc create -f /home/qiwan/criocp.yaml
criocredentialproviderconfig.config.openshift.io/cluster created


qiwan@fedora:~$ oc describe criocredentialproviderconfig.config.openshift.io/cluster
Name:         cluster
Namespace:    
Labels:       <none>
Annotations:  <none>
API Version:  config.openshift.io/v1alpha1
Kind:         CRIOCredentialProviderConfig
Metadata:
 Creation Timestamp:  2025-12-18T19:50:35Z
 Generation:          1
 Resource Version:    38292
 UID:                 4ef0e05d-d875-46c9-b467-804513093041
Spec:
 Match Images:
   123456789.dkr.ecr.us-east-1.amazonaws.com
   *.azurecr.io
   *.*.registry.io
   registry.io:8080/path
Events:  <none>


qiwan@fedora:~$ oc delete criocredentialproviderconfig.config.openshift.io/cluster
criocredentialproviderconfig.config.openshift.io "cluster" deleted

Does this PR introduce a user-facing change?

allow deletion of criocredentialproviderconfigs 'cluster' resource

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

• openshift enhancement: OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication enhancements#1861

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@QiWang19: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 58c5141|Update validation logic to allow deletion of criocredentialproviderconfigs: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[QiWang19]

/test all

[openshift-ci-robot]

@QiWang19: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• b09ff22|UPSTREAM: : Update validation logic to allow deletion of criocredentialproviderconfigs: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[QiWang19]

/test all

[JoelSpeed]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: JoelSpeed, QiWang19
Once this PR has been reviewed and has the lgtm label, please assign jerpeter1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[QiWang19]

/verified by @QiWang19

[openshift-ci-robot]

@QiWang19: This PR has been marked as verified by @QiWang19.

Details

In response to this:

/verified by @QiWang19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[QiWang19]

/retest-required

[QiWang19]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: JoelSpeed, QiWang19 Once this PR has been reviewed and has the lgtm label, please assign jerpeter1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.
Details
Needs approval from an approver in each of these files:

* **[DOWNSTREAM_OWNERS](https://github.com/openshift/kubernetes/blob/master/DOWNSTREAM_OWNERS)**

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

/assign @jerpeter1

[openshift-ci]

@QiWang19: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-techpreview-serial-2of2	b09ff22	link	false	/test e2e-aws-ovn-techpreview-serial-2of2
ci/prow/okd-scos-images	b09ff22	link	true	/test okd-scos-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.