CNTRLPLANE-3789: images: Add squid image used in CAO e2e tests by tchap · Pull Request #31434 · openshift/origin

tchap · 2026-07-27T15:15:19Z

The tests themselves are gonna be OTE tests hosted in the CAO repository, so this is the only change needed in origin.

This is needed to be able to run the tests in a disconnected environment.

Summary by CodeRabbit

Tests
- Added an approved authentication proxy container image for end-to-end test validation.
- Expanded the set of container images recognized during image lookup and pull-spec checks.

openshift-merge-bot · 2026-07-27T15:15:21Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-07-27T15:15:23Z

@tchap: This pull request references CNTRLPLANE-3789 which is a valid jira issue.

Details

In response to this:

The tests themselves are gonna be OTE tests hosted in the CAO repository, so this is the only change needed in origin.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-27T15:15:45Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a709fc89-ac3d-402f-87a0-7a43975f93e7

📥 Commits

Reviewing files that changed from the base of the PR and between ed1655f and 18b163e.

⛔ Files ignored due to path filters (1)

test/extended/util/image/zz_generated.txt is excluded by !**/zz_generated*

📒 Files selected for processing (1)

test/extended/util/image/image.go

Walkthrough

The image utility allowlist adds registry.redhat.io/rhel10/squid:10.2-1784702318 as a pre-approved image for cluster-authentication-operator end-to-end tests.

Changes

Image allowlist

Layer / File(s)	Summary
Allow authentication-proxy image `test/extended/util/image/image.go`	Adds the Authentication proxy image pull spec to `allowedImages` with index `-1`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: jubittajohn

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a Squid image mapping for CAO e2e tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles were added or changed; this PR only adds a static image mapping in util code, so the check is not applicable.
Test Structure And Quality	✅ Passed	No Ginkgo tests were changed; only an image allowlist and generated mapping entry were added, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only an image allowlist entry changed; no new Ginkgo tests or MicroShift-sensitive APIs/features were added in the diff.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The PR only adds an allowed image mapping in a utility file; it introduces no new Ginkgo e2e tests or SNO-relevant node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The change only adds a test image allowlist entry in image utility code; it introduces no manifests, controllers, replicas, node selectors, or other scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR only adds a new allowed image mapping in a util map; no main/init/TestMain/suite stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo test code was added; this PR only extends an image-mapping utility, so IPv4/external-connectivity test checks don’t apply.
No-Weak-Crypto	✅ Passed	PR only adds a pre-approved image mapping string in allowedImages; no weak crypto, custom crypto, or secret comparisons are introduced.
Container-Privileges	✅ Passed	PR only adds a squid image mapping in Go/generated text; no container manifests or privilege settings changed.
No-Sensitive-Data-In-Logs	✅ Passed	The patch only adds a pre-approved image mapping; no new log statements or sensitive data exposure were introduced in the changed files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

everettraven · 2026-07-27T15:29:56Z

/lgtm

jubittajohn · 2026-07-27T17:16:54Z

/test verify-image-manifest-lists

jubittajohn · 2026-07-27T17:17:43Z

/lgtm

openshift-merge-bot · 2026-07-27T17:40:37Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

jubittajohn · 2026-07-27T18:50:02Z

/retest

jubittajohn · 2026-07-27T19:36:57Z

/lgtm cancel

openshift-trt · 2026-07-27T21:30:51Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: ed1655f

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (block volmode)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (default fs)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-gcp-csi	High - "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-gcp-csi	High - "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-gcp-csi	High - "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: ed1655f

"External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (block volmode)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
"External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (default fs)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
"External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
"External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
"External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
"External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" [Total: 2, Pass: 2, Fail: 0, Flake: 0]
"External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" [Total: 2, Pass: 2, Fail: 0, Flake: 0]
"External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" [Total: 2, Pass: 2, Fail: 0, Flake: 0]

The tests themselves are gonna be OTE tests hosted in the CAO repository, so this is the only change needed in origin.

bertinatto · 2026-07-28T12:38:33Z

 		"quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z": -1,
+
+		// used by cluster-authentication-operator e2e tests (Authentication proxy)
+		"registry.redhat.io/rhel10/squid:10.2-1784702318": -1,


looks god to me! Thanks!

jubittajohn · 2026-07-28T13:55:23Z

Mirrored the new image

oc image mirror \
    registry.redhat.io/rhel10/squid:10.2-1784702318 \
    quay.io/openshift/community-e2e-images:e2e-registry-redhat-io-rhel10-squid-10-2-1784702318-xaA8NbKhmNRam1k2 \
    '--filter-by-os=.*'
quay.io/
  openshift/community-e2e-images
    blobs:
      registry.redhat.io/rhel10/squid sha256:884d27f82fb5de4e7d6aa09c7c998ca37c47d5e57153bcd767c43348cf0ed9e1 11.48KiB
      registry.redhat.io/rhel10/squid sha256:f7791a5c381957cce1dada09f139c842ecc5fbb5c12fcfdbc3fb769ce3897358 11.49KiB
      registry.redhat.io/rhel10/squid sha256:dd367f945f1b607b38cc5ec4d472763e486879bcfecb88dd8ee6c86ff18f8df2 11.49KiB
      registry.redhat.io/rhel10/squid sha256:78553609c4beb06ef88dcb8ec6f18435fd742e7e42045f1c8b5c07ec95a3205d 11.5KiB
      registry.redhat.io/rhel10/squid sha256:49b7c805f19ad8b269975cb3b173f6623e3d8fd454ffd2980f1c9ae5542396bd 20.71MiB
      registry.redhat.io/rhel10/squid sha256:05d7e13c73bd130fdfbf832ec677e35460b7c8164b57a06f44a1e65d1bb8688a 21.07MiB
      registry.redhat.io/rhel10/squid sha256:05f0ddb0156f0c29f173279ee61599efaf5e8db99cf0c7860e327f2bfb28f29e 21.42MiB
      registry.redhat.io/rhel10/squid sha256:69385e433464ce26aae8a9ec1541afd416fc0cd7afe81e0b1399872ad72d51c7 22.54MiB
      registry.redhat.io/rhel10/squid sha256:1084bdc22b82b92e8a2c9205ab088853ae19a507c8be01b4358717e6c5063e92 74.77MiB
      registry.redhat.io/rhel10/squid sha256:1769348262c7d7d6b205e92bc8bbcab005911d00b8b69d0ca03cde6f4260bede 77.22MiB
      registry.redhat.io/rhel10/squid sha256:b6d24771f0ca3514163e6cfd32d1a208000953be59bf1a79240b9b6bcf4b943e 77.31MiB
      registry.redhat.io/rhel10/squid sha256:5649d67571450d585c2d84122f7a140394cc31125b495a41e92a79ac963dd109 82.4MiB
    manifests:
      sha256:1b426efcd9bc1d52377926fb0a7ce29920cb4187cb0b84445ae22e89ef985b8c
      sha256:4c1290e819c4fd203f88edb535184bb7c7acf3cf2400b83e04759aa2986758bd
      sha256:5061796ded5fac6cddfe47d12d697163ef422e3c110ff3881482cbfe9670d57b
      sha256:88832e9cc1f263bef9527eab5ff20a544414e09347a02b2aab62c2bce792aa04
      sha256:15adf3a8d283b0653ec05c35f47eca2108d007339dca130d4884158aefdaf29d -> e2e-registry-redhat-io-rhel10-squid-10-2-1784702318-xaA8NbKhmNRam1k2
  stats: shared=0 unique=12 size=397.5MiB ratio=1.00

phase 0:
  quay.io openshift/community-e2e-images blobs=12 mounts=0 manifests=5 shared=0

info: Planning completed in 2.08s
uploading: quay.io/openshift/community-e2e-images sha256:1769348262c7d7d6b205e92bc8bbcab005911d00b8b69d0ca03cde6f4260bede 77.22MiB
uploading: quay.io/openshift/community-e2e-images sha256:1084bdc22b82b92e8a2c9205ab088853ae19a507c8be01b4358717e6c5063e92 74.77MiB
uploading: quay.io/openshift/community-e2e-images sha256:b6d24771f0ca3514163e6cfd32d1a208000953be59bf1a79240b9b6bcf4b943e 77.31MiB
uploading: quay.io/openshift/community-e2e-images sha256:49b7c805f19ad8b269975cb3b173f6623e3d8fd454ffd2980f1c9ae5542396bd 20.71MiB
uploading: quay.io/openshift/community-e2e-images sha256:05d7e13c73bd130fdfbf832ec677e35460b7c8164b57a06f44a1e65d1bb8688a 21.07MiB
uploading: quay.io/openshift/community-e2e-images sha256:69385e433464ce26aae8a9ec1541afd416fc0cd7afe81e0b1399872ad72d51c7 22.54MiB
uploading: quay.io/openshift/community-e2e-images sha256:5649d67571450d585c2d84122f7a140394cc31125b495a41e92a79ac963dd109 82.4MiB
uploading: quay.io/openshift/community-e2e-images sha256:05f0ddb0156f0c29f173279ee61599efaf5e8db99cf0c7860e327f2bfb28f29e 21.42MiB
sha256:4c1290e819c4fd203f88edb535184bb7c7acf3cf2400b83e04759aa2986758bd quay.io/openshift/community-e2e-images
sha256:88832e9cc1f263bef9527eab5ff20a544414e09347a02b2aab62c2bce792aa04 quay.io/openshift/community-e2e-images
sha256:1b426efcd9bc1d52377926fb0a7ce29920cb4187cb0b84445ae22e89ef985b8c quay.io/openshift/community-e2e-images
sha256:5061796ded5fac6cddfe47d12d697163ef422e3c110ff3881482cbfe9670d57b quay.io/openshift/community-e2e-images
sha256:15adf3a8d283b0653ec05c35f47eca2108d007339dca130d4884158aefdaf29d quay.io/openshift/community-e2e-images:e2e-registry-redhat-io-rhel10-squid-10-2-1784702318-xaA8NbKhmNRam1k2
info: Mirroring completed in 27.9s (14.94MB/s)

jubittajohn · 2026-07-28T13:55:57Z

/test verify-image-manifest-lists

jubittajohn · 2026-07-28T13:56:05Z

/pipeline required

openshift-merge-bot · 2026-07-28T13:56:08Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

jubittajohn · 2026-07-28T13:57:06Z

/lgtm

openshift-ci · 2026-07-28T13:59:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: everettraven, jubittajohn, tchap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~test/extended/util/image/OWNERS~~ [jubittajohn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jubittajohn · 2026-07-28T15:08:18Z

/test verify-image-manifest-lists

openshift-ci · 2026-07-28T18:04:46Z

@tchap: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jubittajohn · 2026-07-28T18:09:29Z

/verified by https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/31434/pull-ci-openshift-origin-main-e2e-metal-ipi-ovn-ipv6/2082103437197053952/artifacts/e2e-metal-ipi-ovn-ipv6/baremetalds-e2e-test/build-log.txt
The new image is included in the list of images to be mirrored

sha256:15adf3a8d283b0653ec05c35f47eca2108d007339dca130d4884158aefdaf29d -> e2e-registry-redhat-io-rhel10-squid-10-2-1784702318-xaA8NbKhmNRam1k2

openshift-ci-robot · 2026-07-28T18:09:42Z

@jubittajohn: This PR has been marked as verified by https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/31434/pull-ci-openshift-origin-main-e2e-metal-ipi-ovn-ipv6/2082103437197053952/artifacts/e2e-metal-ipi-ovn-ipv6/baremetalds-e2e-test/build-log.txt.

Details

In response to this:

/verified by https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/31434/pull-ci-openshift-origin-main-e2e-metal-ipi-ovn-ipv6/2082103437197053952/artifacts/e2e-metal-ipi-ovn-ipv6/baremetalds-e2e-test/build-log.txt
The new image is included in the list of images to be mirrored
sha256:15adf3a8d283b0653ec05c35f47eca2108d007339dca130d4884158aefdaf29d -> e2e-registry-redhat-io-rhel10-squid-10-2-1784702318-xaA8NbKhmNRam1k2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 27, 2026

openshift-ci Bot added the e2e-images-update Related to images used by e2e tests label Jul 27, 2026

openshift-ci Bot requested review from bertinatto and jubittajohn July 27, 2026 15:16

coderabbitai Bot approved these changes Jul 27, 2026

View reviewed changes

openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Jul 27, 2026

openshift-ci Bot assigned everettraven Jul 27, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 27, 2026

openshift-ci Bot assigned jubittajohn Jul 27, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 27, 2026

openshift-ci Bot removed lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jul 27, 2026

bertinatto reviewed Jul 27, 2026

View reviewed changes

Comment thread test/extended/util/image/image.go Outdated

images: Add squid image used in CAO e2e tests

18b163e

The tests themselves are gonna be OTE tests hosted in the CAO repository, so this is the only change needed in origin.

tchap force-pushed the squid-image-mapping branch from ed1655f to 18b163e Compare July 28, 2026 11:10

bertinatto reviewed Jul 28, 2026

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 28, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 28, 2026

openshift-merge-bot Bot merged commit 0207755 into openshift:main Jul 28, 2026
23 checks passed

Uh oh!

Conversation

tchap commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-ci-robot commented Jul 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

everettraven commented Jul 27, 2026

Uh oh!

jubittajohn commented Jul 27, 2026

Uh oh!

jubittajohn commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

jubittajohn commented Jul 27, 2026

Uh oh!

jubittajohn commented Jul 27, 2026

Uh oh!

Uh oh!

openshift-trt Bot commented Jul 27, 2026

Uh oh!

bertinatto Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

jubittajohn commented Jul 28, 2026

Uh oh!

jubittajohn commented Jul 28, 2026

Uh oh!

jubittajohn commented Jul 28, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 28, 2026

Uh oh!

jubittajohn commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 28, 2026

Uh oh!

jubittajohn commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 28, 2026

Uh oh!

jubittajohn commented Jul 28, 2026

Uh oh!

openshift-ci-robot commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tchap commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Jul 27, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading