fix: Version mismatch code fix

[brucebarrera]

Jira

Fixes: ARO-26767

Why

Previously, when the node pool channel group differed from the control plane channel group, the code had a critical flaw:

• If node pool channel was "stable", it would return an empty version string
• The user's explicit channel group setting was ignored
• This caused downstream validation errors and test failures

This PR fixes an issue where after a release rollout, the default node pool version (4.20.20) is higher than the control plane version (4.20.19) in STG and PROD.

Error: Node pool version '4.20.20' must not be greater than Control Plane version '4.20.19'

Failing Tests:

• Customer should update node pool labels and taints
• Customer should use workload identity via cluster OIDC
• Customer should not perform invalid operations

What

This fix ensures:

• Node pool version is always resolved from its specified channel (including stable)
• Version constraint is enforced: nodePoolVersion <= controlPlaneVersion
• If node pool version exceeds control plane, it is clamped with a clear warning
• User's channel group configuration is respected
• Graceful error handling for unparseable versions

Testing

# Ensure environment is configured
export CUSTOMER_SUBSCRIPTION=<subscriptionName>
export LOCATION=uksouth

# Run specific test cases
./test/aro-hcp-tests run-test "Customer should update node pool labels and taints"
./test/aro-hcp-tests run-test "Customer should use workload identity via cluster OIDC"
./test/aro-hcp-tests run-test "Customer should not perform invalid operations"

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: brucebarrera
Once this PR has been reviewed and has the lgtm label, please assign bennerv for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• test/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @brucebarrera. Thanks for your PR.

I'm waiting for a Azure member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.