update ci _repo for ocp 4.22 / 5.0#78029
Conversation
rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
WalkthroughTwo repository configuration files are updated to migrate from Red Hat CDN to OpenShift mirror endpoints, replace TLS client authentication with HTTP basic auth file credentials, introduce the new Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-merge-bot
bot
added
the
rehearsals-ack
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
core-services/release-controller/_repos/ocp-4.22-rhel9.repo (1)
74-84:⚠️ Potential issue | 🟠 MajorMigrate CodeReady Builder sections to mirror2 basic-auth like BaseOS/AppStream.
All four CodeReady Builder sections (
rhel-9-codeready-builder-rpms,-ppc64le,-s390x,-aarch64) still usehttps://cdn.redhat.com/content/eus/...with/tmp/key/rh-cdn.pemclient-cert auth, while the BaseOS and AppStream sections have already migrated tohttps://mirror2.openshift.com/enterprise/reposync/4.22/...withusername_fileandpassword_filebasic-auth. Update all four CRB sections to follow the same pattern:baseurl = https://mirror2.openshift.com/enterprise/reposync/4.22/rhel-98-codeready-builder-rpms username_file = /tmp/mirror-enterprise-basic-auth/username password_file = /tmp/mirror-enterprise-basic-auth/passwordRemove
sslclientkeyandsslclientcertlines and adjust architecture paths (e.g.,rhel-98-codeready-builder-rpms-ppc64lefor ppc64le) to match the BaseOS/AppStream auth model.Applies to all four CRB sections: x86_64 (lines 74–84), ppc64le (134–144), s390x (194–204), aarch64 (254–264).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@core-services/release-controller/_repos/ocp-4.22-rhel9.repo` around lines 74 - 84, Update each CodeReady Builder repo section (rhel-9-codeready-builder-rpms, rhel-9-codeready-builder-rpms-ppc64le, rhel-9-codeready-builder-rpms-s390x, rhel-9-codeready-builder-rpms-aarch64) to use the mirror2 basic-auth pattern used by BaseOS/AppStream: replace the baseurl that points to https://cdn.redhat.com/... with the mirror2 URL format https://mirror2.openshift.com/enterprise/reposync/4.22/<arch-specific-path> (e.g., rhel-98-codeready-builder-rpms or rhel-98-codeready-builder-rpms-ppc64le for ppc64le), add username_file = /tmp/mirror-enterprise-basic-auth/username and password_file = /tmp/mirror-enterprise-basic-auth/password, and remove the sslclientkey and sslclientcert lines and any client-cert usage; keep enabled/gpgcheck/sslverify/failovermethod settings consistent with the other migrated sections.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@core-services/release-controller/_repos/ocp-4.22-rhel9.repo`:
- Around line 50-60: Add architecture-specific HighAvailability repo sections
for aarch64, ppc64le, and s390x by duplicating the existing
rhel-9-highavailability block and updating the repo id/name and baseurl to the
architecture-specific variants (e.g., rhel-9-highavailability-aarch64,
rhel-9-highavailability-ppc64le, rhel-9-highavailability-s390x) following the
same format and settings (enabled, gpgkey, sslverify, gpgcheck, username_file,
password_file, failovermethod, skip_if_unavailable) as the existing
rhel-9-highavailability section and ensure baseurl mirrors the pattern used by
the architecture-specific BaseOS/AppStream entries.
In `@core-services/release-controller/_repos/ocp-5.0-rhel9.repo`:
- Around line 50-60: The new HighAvailability repo section
[rhel-9-highavailability] only targets the default architecture; add equivalent
architecture-specific repo sections for aarch64, ppc64le, and s390x (e.g.,
[rhel-9-highavailability-aarch64], [rhel-9-highavailability-ppc64le],
[rhel-9-highavailability-s390x]) mirroring the existing keys (name, baseurl,
enabled, gpgkey, sslverify, gpgcheck, username_file, password_file,
failovermethod, skip_if_unavailable) but adjusting the baseurl path to the
corresponding arch-specific repo (same pattern used by the BaseOS/AppStream arch
variants) so builds for aarch64/ppc64le/s390x include the HA repository.
---
Outside diff comments:
In `@core-services/release-controller/_repos/ocp-4.22-rhel9.repo`:
- Around line 74-84: Update each CodeReady Builder repo section
(rhel-9-codeready-builder-rpms, rhel-9-codeready-builder-rpms-ppc64le,
rhel-9-codeready-builder-rpms-s390x, rhel-9-codeready-builder-rpms-aarch64) to
use the mirror2 basic-auth pattern used by BaseOS/AppStream: replace the baseurl
that points to https://cdn.redhat.com/... with the mirror2 URL format
https://mirror2.openshift.com/enterprise/reposync/4.22/<arch-specific-path>
(e.g., rhel-98-codeready-builder-rpms or rhel-98-codeready-builder-rpms-ppc64le
for ppc64le), add username_file = /tmp/mirror-enterprise-basic-auth/username and
password_file = /tmp/mirror-enterprise-basic-auth/password, and remove the
sslclientkey and sslclientcert lines and any client-cert usage; keep
enabled/gpgcheck/sslverify/failovermethod settings consistent with the other
migrated sections.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 39c2b312-27bf-4920-a40d-0128234824bd
📒 Files selected for processing (2)
core-services/release-controller/_repos/ocp-4.22-rhel9.repocore-services/release-controller/_repos/ocp-5.0-rhel9.repo
| [rhel-9-highavailability] | ||
| name = rhel-9-highavailability | ||
| baseurl = https://mirror2.openshift.com/enterprise/reposync/4.22/rhel-98-highavailability | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| username_file = /tmp/mirror-enterprise-basic-auth/username | ||
| password_file = /tmp/mirror-enterprise-basic-auth/password | ||
| failovermethod = priority | ||
| skip_if_unavailable = true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify HighAvailability repo coverage for all architectures in the 4.22 repo file.
python3 - <<'PY'
from pathlib import Path
import re
path = Path("core-services/release-controller/_repos/ocp-4.22-rhel9.repo")
text = path.read_text()
headers = set(re.findall(r"^\[(.+?)\]", text, flags=re.M))
expected = {
"rhel-9-highavailability",
"rhel-9-highavailability-ppc64le",
"rhel-9-highavailability-s390x",
"rhel-9-highavailability-aarch64",
}
missing = sorted(expected - headers)
print("missing:", missing)
PYRepository: openshift/release
Length of output: 173
Add HighAvailability repo sections for the non-x86 architectures.
The repo file currently includes only the default rhel-9-highavailability section but is missing architecture-specific variants for aarch64, ppc64le, and s390x. The file already contains architecture-specific BaseOS/AppStream sections for these architectures, so architecture-specific HighAvailability sections are also needed for consistent coverage across all supported architectures.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@core-services/release-controller/_repos/ocp-4.22-rhel9.repo` around lines 50
- 60, Add architecture-specific HighAvailability repo sections for aarch64,
ppc64le, and s390x by duplicating the existing rhel-9-highavailability block and
updating the repo id/name and baseurl to the architecture-specific variants
(e.g., rhel-9-highavailability-aarch64, rhel-9-highavailability-ppc64le,
rhel-9-highavailability-s390x) following the same format and settings (enabled,
gpgkey, sslverify, gpgcheck, username_file, password_file, failovermethod,
skip_if_unavailable) as the existing rhel-9-highavailability section and ensure
baseurl mirrors the pattern used by the architecture-specific BaseOS/AppStream
entries.
| [rhel-9-highavailability] | ||
| name = rhel-9-highavailability | ||
| baseurl = https://mirror2.openshift.com/enterprise/reposync/5.0/rhel-98-highavailability | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| username_file = /tmp/mirror-enterprise-basic-auth/username | ||
| password_file = /tmp/mirror-enterprise-basic-auth/password | ||
| failovermethod = priority | ||
| skip_if_unavailable = true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify HighAvailability repo coverage for all architectures in the 5.0 repo file.
python3 - <<'PY'
from pathlib import Path
import re
path = Path("core-services/release-controller/_repos/ocp-5.0-rhel9.repo")
text = path.read_text()
headers = set(re.findall(r"^\[(.+?)\]", text, flags=re.M))
expected = {
"rhel-9-highavailability",
"rhel-9-highavailability-ppc64le",
"rhel-9-highavailability-s390x",
"rhel-9-highavailability-aarch64",
}
missing = sorted(expected - headers)
print("missing:", missing)
PYRepository: openshift/release
Length of output: 173
🏁 Script executed:
#!/bin/bash
# Check what sections exist in the repo file to understand the pattern
python3 - <<'PY'
from pathlib import Path
import re
path = Path("core-services/release-controller/_repos/ocp-5.0-rhel9.repo")
text = path.read_text()
headers = sorted(set(re.findall(r"^\[(.+?)\]", text, flags=re.M)))
# Group by base name
baseos_sections = [h for h in headers if "baseos" in h]
appstream_sections = [h for h in headers if "appstream" in h]
ha_sections = [h for h in headers if "highavailability" in h]
print("BaseOS sections:")
for h in baseos_sections:
print(f" {h}")
print("\nAppStream sections:")
for h in appstream_sections:
print(f" {h}")
print("\nHighAvailability sections:")
for h in ha_sections:
print(f" {h}")
PYRepository: openshift/release
Length of output: 336
Add HighAvailability repo sections for the non-x86 architectures.
The new section only covers the default rhel-9-highavailability repo, but missing architecture-specific variants for aarch64, ppc64le, and s390x. The file already carries architecture-specific BaseOS/AppStream sections for all these architectures, so ppc64le/s390x/aarch64 builds will miss the HA repo without corresponding sections.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@core-services/release-controller/_repos/ocp-5.0-rhel9.repo` around lines 50 -
60, The new HighAvailability repo section [rhel-9-highavailability] only targets
the default architecture; add equivalent architecture-specific repo sections for
aarch64, ppc64le, and s390x (e.g., [rhel-9-highavailability-aarch64],
[rhel-9-highavailability-ppc64le], [rhel-9-highavailability-s390x]) mirroring
the existing keys (name, baseurl, enabled, gpgkey, sslverify, gpgcheck,
username_file, password_file, failovermethod, skip_if_unavailable) but adjusting
the baseurl path to the corresponding arch-specific repo (same pattern used by
the BaseOS/AppStream arch variants) so builds for aarch64/ppc64le/s390x include
the HA repository.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fgallott The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@fgallott: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
superseded by #77982 |
1 participant
follows
openshift-eng/ocp-build-data#10081
openshift-eng/ocp-build-data#10082
Summary by CodeRabbit
Chores