DNM: Test openshift/cluster-capi-operator#527 with aws-disconnected#78315
DNM: Test openshift/cluster-capi-operator#527 with aws-disconnected#78315mdbooth wants to merge 9 commits into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds an optional TechPreview disconnected AWS CAPI E2E pipeline and presubmit, plus new pre/post disconnected step-registry chains, a disconnected E2E workflow with metadata/OWNERS files, and changes secret creation for AWS CCO manual-users to use raw Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Presubmit as "Presubmit Job"
participant CI as "ci-operator"
participant Pre as "ipi-aws-pre-disconnected"
participant Test as "openshift-e2e-test"
participant Post as "ipi-aws-post-disconnected"
participant AWS as "AWS (VPC/CFN/IAM)"
Presubmit->>CI: trigger e2e-aws-capi-disconnected-techpreview
CI->>Pre: run pre-disconnected chain (provision VPC, bastion, mirror)
Pre->>AWS: create VPC, bastion, mirror artifacts
CI->>Test: run openshift-e2e-test (TechPreview settings)
Test->>CI: deliver test results & artifacts
CI->>Post: run post-disconnected chain (gather & deprovision)
Post->>AWS: teardown bastion, CFN stacks, SGs, IAM
Post->>CI: upload post artifacts & finish
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 10 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/pj-rehearse |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml`:
- Line 126: Remove the hard-coded ephemeral CI payload by deleting the
CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE assignment that points to
registry.build10.ci.openshift.org/ci-ln-8941v02/release:latest; instead, wire
the release image via a stable dependency or parameterized env var (e.g., use
the job's release-image dependency or a configured RELEASE_IMAGE variable) so
the pipeline does not rely on a transient ci-ln-* tag before un-DNM/merge.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c281f6c6-ceb7-4daa-b5a0-f13758f11743
📒 Files selected for processing (11)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yamlci-operator/jobs/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main-presubmits.yamlci-operator/step-registry/ipi/aws/post/disconnected/OWNERSci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.metadata.jsonci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.yamlci-operator/step-registry/ipi/aws/pre/disconnected/OWNERSci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.metadata.jsonci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.yamlci-operator/step-registry/openshift/e2e/aws/disconnected/OWNERSci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.metadata.jsonci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.yaml
| steps: | ||
| cluster_profile: openshift-org-aws | ||
| env: | ||
| CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: registry.build10.ci.openshift.org/ci-ln-8941v02/release:latest |
There was a problem hiding this comment.
Avoid persisting an ephemeral ci-ln-* release override.
Line 126 hard-codes CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE to a transient ci-ln payload. Once that namespace/tag is pruned, this job becomes stale/flaky. Please remove this before un-DNM/merge, or wire the release image via a stable dependency source instead.
Suggested minimal fix
env:
- CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: registry.build10.ci.openshift.org/ci-ln-8941v02/release:latest
ENABLE_IDMS: "yes"
FEATURE_SET: TechPreviewNoUpgrade🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml`
at line 126, Remove the hard-coded ephemeral CI payload by deleting the
CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE assignment that points to
registry.build10.ci.openshift.org/ci-ln-8941v02/release:latest; instead, wire
the release image via a stable dependency or parameterized env var (e.g., use
the job's release-image dependency or a configured RELEASE_IMAGE variable) so
the pipeline does not rely on a transient ci-ln-* tag before un-DNM/merge.
mdbooth
force-pushed
the
aws-disconnected-dnm
branch
from
b05477f to
80c0f73
Compare
|
/pj-rehearse |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml (1)
126-126:⚠️ Potential issue | 🟠 MajorRemove the ephemeral
ci-ln-*release override before un-DNM/merge.
CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDEis pinned to a transientci-lnpayload. Once pruned, this job becomes stale/flaky. Keep this only for short-lived rehearsal and remove it (or source from a stable release dependency) before merging.Suggested minimal fix
env: - CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: registry.build10.ci.openshift.org/ci-ln-cc01ll2/release:latest ENABLE_IDMS: "yes" FEATURE_SET: TechPreviewNoUpgrade🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml` at line 126, CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE is currently set to a transient ci-ln-* release image; remove this ephemeral override (delete the CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE line) or replace it with a stable release reference (e.g., source from the job's release dependency or a stable release image variable) so the job does not rely on a short-lived ci-ln payload before un-DNM/merge.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In
`@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml`:
- Line 126: CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE is currently set to
a transient ci-ln-* release image; remove this ephemeral override (delete the
CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE line) or replace it with a
stable release reference (e.g., source from the job's release dependency or a
stable release image variable) so the job does not rely on a short-lived ci-ln
payload before un-DNM/merge.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 95090fbf-433c-42b9-b3c9-f2213c01ac56
📒 Files selected for processing (1)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml
|
/pj-rehearse |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml (1)
126-126:⚠️ Potential issue | 🟠 MajorRemove ephemeral
ci-ln-*release override before this is mergeable.Line 126 hard-codes a transient payload (
ci-ln-cc01ll2). Once pruned, this job will become stale/flaky. Please drop this override (or wire a stable dependency-driven image) before removing DNM/WIP.Suggested minimal change
env: - CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: registry.build10.ci.openshift.org/ci-ln-cc01ll2/release:latest ENABLE_IDMS: "yes" FEATURE_SET: TechPreviewNoUpgrade🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml` at line 126, Remove the ephemeral hard-coded release override by deleting the CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE entry that sets "registry.build10.ci.openshift.org/ci-ln-cc01ll2/release:latest" (or replace it with a stable dependency-driven image reference); update the job spec that defines CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE so it no longer references the transient "ci-ln-cc01ll2" payload, or wire it to a stable release image variable instead.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In
`@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml`:
- Line 126: Remove the ephemeral hard-coded release override by deleting the
CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE entry that sets
"registry.build10.ci.openshift.org/ci-ln-cc01ll2/release:latest" (or replace it
with a stable dependency-driven image reference); update the job spec that
defines CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE so it no longer
references the transient "ci-ln-cc01ll2" payload, or wire it to a stable release
image variable instead.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d6d96380-d408-40b5-b465-540fecbaf615
📒 Files selected for processing (1)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml
Add a new disconnected AWS workflow for component-level CI testing. The workflow creates an isolated VPC with private subnets and VPC endpoints, a bastion host providing mirror registry, egress proxy, and SSH jump host, then installs OpenShift using mirrored images and manual CCO credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mdbooth
force-pushed
the
aws-disconnected-dnm
branch
from
a6b7068 to
c158b93
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mdbooth The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@ci-operator/step-registry/aws/provision/cco-manual-users/static/aws-provision-cco-manual-users-static-commands.sh`:
- Line 67: The heredoc redirection uses an unquoted variable (cat <<EOF
>${output_file}) which can break if output_file contains spaces; update the
redirection to quote the variable (use >"${output_file}") so the heredoc writes
safely to paths with whitespace while keeping the rest of the heredoc unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4f763c34-4c4e-46c0-9ccb-18ff4cd0b5d2
📒 Files selected for processing (12)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yamlci-operator/jobs/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main-presubmits.yamlci-operator/step-registry/aws/provision/cco-manual-users/static/aws-provision-cco-manual-users-static-commands.shci-operator/step-registry/ipi/aws/post/disconnected/OWNERSci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.metadata.jsonci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.yamlci-operator/step-registry/ipi/aws/pre/disconnected/OWNERSci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.metadata.jsonci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.yamlci-operator/step-registry/openshift/e2e/aws/disconnected/OWNERSci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.metadata.jsonci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.yaml
✅ Files skipped from review due to trivial changes (6)
- ci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.metadata.json
- ci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.metadata.json
- ci-operator/step-registry/ipi/aws/pre/disconnected/OWNERS
- ci-operator/step-registry/openshift/e2e/aws/disconnected/OWNERS
- ci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.metadata.json
- ci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- ci-operator/step-registry/ipi/aws/post/disconnected/OWNERS
- ci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.yaml
- ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml
mdbooth
force-pushed
the
aws-disconnected-dnm
branch
from
c158b93 to
8f63bf5
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml (1)
126-126:⚠️ Potential issue | 🟠 MajorRemove transient
ci-ln-*release override before un-DNM.Line 126 hard-codes
CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDEto an ephemeralci-lnpayload (ci-ln-d906xw2). Once that payload is pruned, this job can become stale/flaky. Please wire the release image via a stable dependency/parameter before merge.Suggested minimal fix
env: - CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: registry.build10.ci.openshift.org/ci-ln-d906xw2/release:latest ENABLE_IDMS: "yes" FEATURE_SET: TechPreviewNoUpgrade🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml` at line 126, The job hard-codes CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE to a transient ci-ln payload (CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: registry.build10.ci.openshift.org/ci-ln-d906xw2/release:latest); remove this literal and instead source the release image via a stable parameter or dependency (e.g., a job parameter like RELEASE_IMAGE or an exported dependency in the ci-operator config/releases section) so the pipeline injects the correct, long-lived payload at runtime; update the job to reference that parameter (replace the hardcoded value with the parameter name) and ensure the pipeline that triggers this job supplies the stable release image.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In
`@ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml`:
- Line 126: The job hard-codes CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE
to a transient ci-ln payload (CUSTOM_OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE:
registry.build10.ci.openshift.org/ci-ln-d906xw2/release:latest); remove this
literal and instead source the release image via a stable parameter or
dependency (e.g., a job parameter like RELEASE_IMAGE or an exported dependency
in the ci-operator config/releases section) so the pipeline injects the correct,
long-lived payload at runtime; update the job to reference that parameter
(replace the hardcoded value with the parameter name) and ensure the pipeline
that triggers this job supplies the stable release image.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f7c1ce7d-dd38-41fc-9ad6-8dbfec37daa0
📒 Files selected for processing (1)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yaml
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
A total of 251 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@mdbooth: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
This has served its purpose (getting a successful test run). Closing as the fixes can be merged into #77922 |
1 participant
Summary by CodeRabbit
New Features
Refactor
Chores