AGENT-1573: Add release-5.1 config for ISOBuilder

[pawanpinjarkar]

Summary by CodeRabbit

• New Features
  • Added appliance configuration support for API version v1beta1.
  • Configured default image sources, registry behavior, interactive workflows, and support-tool images.
  • Added Red Hat Operator Index v4.22 packages and channels for virtualization, migration, networking, remediation, observability, storage, logging, and related capabilities.

[openshift-ci-robot]

@pawanpinjarkar: This pull request references AGENT-1573 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The PR adds a v1beta1 appliance configuration with registry, source, image, and interactive flow settings. It also configures the Red Hat Operator Index v4.22 with operator packages and channels.

Changes

Appliance configuration

Layer / File(s)	Summary
Appliance settings and operator catalog tools/iso_builder/config/5.1/appliance-config.yaml	Defines the 200 GB appliance, registry and source behavior, interactive flow options, binary image registry, support-tools image, and Red Hat Operator Index v4.22 package channels.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding the release-5.1 ISOBuilder configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch adds only a YAML ApplianceConfig file; it contains no Ginkgo test declarations or test titles, so no unstable test names are introduced.
Test Structure And Quality	✅ Passed	The commit adds only tools/iso_builder/config/5.1/appliance-config.yaml; it adds or changes no Ginkgo tests, so the test-structure requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The PR adds only one ApplianceConfig YAML file; the parent-to-HEAD diff contains no Ginkgo tests or new test declarations to assess for MicroShift compatibility.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit adds only one YAML ApplianceConfig file; it adds no Ginkgo e2e tests or test topology assumptions requiring SNO protection.
Topology-Aware Scheduling Compatibility	✅ Passed	The change adds only an ApplianceConfig YAML file. It contains registry, image, and operator selections, with no deployment, controller, or scheduling constraints such as affinity, selectors, toler...
Ote Binary Stdout Contract	✅ Passed	The commit adds only tools/iso_builder/config/5.1/appliance-config.yaml; it contains configuration data and no main, suite setup, logging, or stdout-writing code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request adds only an ApplianceConfig YAML file; it adds no Ginkgo e2e tests or test networking and therefore does not trigger this compatibility check.
No-Weak-Crypto	✅ Passed	The PR adds only an ApplianceConfig YAML file; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto API, or secret-comparison usage.
Container-Privileges	✅ Passed	The PR adds only an ApplianceConfig YAML file. Its parsed keys contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit adds only a YAML configuration. It contains no logging statements, credentials, tokens, PII, or customer data; registry references are public image and catalog names.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/iso_builder/config/5.1/appliance-config.yaml`:
- Line 12: Update the support-tools image reference in the appliance
configuration to replace the mutable latest tag with an approved immutable
digest or version-specific tag, preserving the existing registry repository.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c363d6bf-d8aa-477d-8295-f05ee387d6de

📥 Commits

Reviewing files that changed from the base of the PR and between 2823dea and cdb17e9.

📒 Files selected for processing (1)

• tools/iso_builder/config/5.1/appliance-config.yaml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- appliance-config.yaml ---'
cat -n tools/iso_builder/config/5.1/appliance-config.yaml | sed -n '1,80p'

printf '%s\n' '--- related files ---'
fd -t f . tools/iso_builder | sort

printf '%s\n' '--- references to appliance-config and support-tools ---'
rg -n -C 3 'appliance-config|support-tools|registry\.redhat\.io/rhel9' tools README.md .github 2>/dev/null || true

Repository: openshift/agent-installer-utils

Length of output: 9940

---

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- build script ---'
cat -n tools/iso_builder/hack/build-ove-image.sh | sed -n '1,130p'

printf '%s\n' '--- Dockerfile and README references ---'
cat -n tools/iso_builder/Dockerfile | sed -n '1,70p'
rg -n -C 4 'additionalImages|imageRegistry|support-tools|digest|immutable|pull|appliance' \
  tools/iso_builder/README.md tools/iso_builder/CLAUDE.md tools/iso_builder/hack \
  tools/iso_builder/config 2>/dev/null || true

printf '%s\n' '--- git metadata for target and neighboring configs ---'
git diff --stat
git status --short
git ls-files -s tools/iso_builder/config/5.1/appliance-config.yaml

Repository: openshift/agent-installer-utils

Length of output: 44555

---

Pin the support-tools image to an immutable reference.

:latest can embed different image content in different ISO builds. Use an approved digest or immutable version tag.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/iso_builder/config/5.1/appliance-config.yaml` at line 12, Update the
support-tools image reference in the appliance configuration to replace the
mutable latest tag with an approved immutable digest or version-specific tag,
preserving the existing registry repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pawanpinjarkar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pawanpinjarkar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pawanpinjarkar]

/hold till 5.1 nightly is available

[openshift-ci]

@pawanpinjarkar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.