ROSAENG-300: Onboard aws-nuke-cf CI, decouple janitor image from rosa-regional-platform#78106
Conversation
…a-regional-platform Onboard openshift-online/aws-nuke-cf to OpenShift CI with a pre-merge image build gate and postsubmit push to quay.io/rrp-dev-ci/ci-image. Remove push-ci-image from rosa-regional-platform since the image now lives in the aws-nuke-cf repo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@typeid: This pull request references ROSAENG-300 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/pj-rehearse |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-ci
Bot
added
the
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughAdds CI and Prow configuration for repo openshift-online/aws-nuke-cf (ci-operator config, presubmit/postsubmit jobs, OWNERS, Tide and plugin configs) and removes a push-ci-image postsubmit job/config for openshift-online/rosa-regional-platform. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as "Developer PR"
participant Prow as "Prow (hook/tide)"
participant CIop as "ci-operator"
participant K8s as "Kubernetes (build01)"
participant Quay as "Quay/Registry"
Dev->>Prow: open PR / trigger presubmit
Prow->>CIop: schedule presubmit job (images/build targets)
CIop->>K8s: run build pod (mount secrets)
K8s->>Quay: push built image (images target)
Dev->>Prow: merge to main
Prow->>CIop: schedule postsubmit (push-image)
CIop->>Quay: push to `quay.io/rrp-dev-ci/aws-nuke-cf`
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
core-services/prow/02_config/openshift-online/aws-nuke-cf/_pluginconfig.yaml (1)
2-2: PopulatecommandHelpLinkinstead of leaving it empty.Line 2 currently sets an empty help link, which removes useful bot command guidance in PR workflows. Consider using the standard help URL.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@core-services/prow/02_config/openshift-online/aws-nuke-cf/_pluginconfig.yaml` at line 2, The config key commandHelpLink in _pluginconfig.yaml is currently empty; set commandHelpLink to the standard bot help URL (for example the project's or prow/help page) so PR workflows show command guidance—locate the commandHelpLink entry in _pluginconfig.yaml and replace the empty string with the appropriate help URL.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-postsubmits.yaml`:
- Line 18: Add a volume named "gcs-credentials" under spec.template.spec.volumes
to match the container's volumeMount; specifically create a secret-backed volume
with name: gcs-credentials and secret.secretName set to the secret that contains
the GCS service account (so the container arg
--gcs-upload-secret=/secrets/gcs/service-account.json can mount successfully).
Ensure the volume name exactly matches the existing volumeMount name
"gcs-credentials" and place it under spec.template.spec.volumes so the pod can
start.
In
`@ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml`:
- Line 21: The presubmit jobs reference the flag
--gcs-upload-secret=/secrets/gcs/service-account.json and mount name
gcs-credentials but the jobs' volumes blocks do not define that volume; add a
volume entry named gcs-credentials to each presubmit job's volumes list that
provides the service-account.json (e.g., a secret or projected secret) so the
mount path /secrets/gcs/service-account.json exists at runtime; update both
presubmit jobs' volumes sections to include the gcs-credentials volume (matching
the existing mount and flag).
---
Nitpick comments:
In
`@core-services/prow/02_config/openshift-online/aws-nuke-cf/_pluginconfig.yaml`:
- Line 2: The config key commandHelpLink in _pluginconfig.yaml is currently
empty; set commandHelpLink to the standard bot help URL (for example the
project's or prow/help page) so PR workflows show command guidance—locate the
commandHelpLink entry in _pluginconfig.yaml and replace the empty string with
the appropriate help URL.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 25a45560-99d2-4e74-bff5-cd7eb19f7420
📒 Files selected for processing (7)
ci-operator/config/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main.yamlci-operator/config/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main.yamlci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-postsubmits.yamlci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yamlci-operator/jobs/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main-postsubmits.yamlcore-services/prow/02_config/openshift-online/aws-nuke-cf/_pluginconfig.yamlcore-services/prow/02_config/openshift-online/aws-nuke-cf/_prowconfig.yaml
💤 Files with no reviewable changes (2)
- ci-operator/config/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main.yaml
- ci-operator/jobs/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main-postsubmits.yaml
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml (1)
21-21:⚠️ Potential issue | 🔴 CriticalMissing
gcs-credentialsvolume still breaks this presubmit job.Line 21 and Lines 34-36 reference/mount
gcs-credentials, but thevolumeslist (Lines 47-56) does not define it, so the pod cannot start.Proposed fix
volumes: + - name: gcs-credentials + secret: + secretName: gcs-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher - name: pull-secret secret: secretName: registry-pull-credentials - name: result-aggregator secret: secretName: result-aggregatorAlso applies to: 34-36, 47-56
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml` at line 21, The job references a volume named "gcs-credentials" (mounted and used by the --gcs-upload-secret flag at /secrets/gcs/service-account.json) but that volume is not defined in the pod's volumes list; add a volume entry named "gcs-credentials" under the pod spec volumes to fix the startup failure — create it as a secret volume (type: secret) with the correct secretName (the GCS service account secret) so the container mount (gcs-credentials) and the flag --gcs-upload-secret=/secrets/gcs/service-account.json match the defined volume and secret.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In
`@ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml`:
- Line 21: The job references a volume named "gcs-credentials" (mounted and used
by the --gcs-upload-secret flag at /secrets/gcs/service-account.json) but that
volume is not defined in the pod's volumes list; add a volume entry named
"gcs-credentials" under the pod spec volumes to fix the startup failure — create
it as a secret volume (type: secret) with the correct secretName (the GCS
service account secret) so the container mount (gcs-credentials) and the flag
--gcs-upload-secret=/secrets/gcs/service-account.json match the defined volume
and secret.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 00b9fb85-d233-49b2-9e2f-46937e43d4c7
📒 Files selected for processing (1)
ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml
|
/pj-rehearse |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
1 similar comment
|
/retest |
|
/pj-rehearse |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse ack |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse ack |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cdoan1, typeid The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse ack |
|
@typeid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@typeid: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@typeid: Updated the following 3 configmaps:
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…-regional-platform (openshift#78106) * ROSAENG-300: Add aws-nuke-cf CI config, remove push-ci-image from rosa-regional-platform Onboard openshift-online/aws-nuke-cf to OpenShift CI with a pre-merge image build gate and postsubmit push to quay.io/rrp-dev-ci/ci-image. Remove push-ci-image from rosa-regional-platform since the image now lives in the aws-nuke-cf repo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove redundant build-image test, rely on implicit images job Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add OWNERS files for aws-nuke-cf config and jobs directories Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove stale build-image presubmit from generated jobs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Push aws-nuke-cf image to quay.io/rrp-dev-ci/aws-nuke-cf Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…-regional-platform (openshift#78106) * ROSAENG-300: Add aws-nuke-cf CI config, remove push-ci-image from rosa-regional-platform Onboard openshift-online/aws-nuke-cf to OpenShift CI with a pre-merge image build gate and postsubmit push to quay.io/rrp-dev-ci/ci-image. Remove push-ci-image from rosa-regional-platform since the image now lives in the aws-nuke-cf repo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove redundant build-image test, rely on implicit images job Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add OWNERS files for aws-nuke-cf config and jobs directories Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove stale build-image presubmit from generated jobs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Push aws-nuke-cf image to quay.io/rrp-dev-ci/aws-nuke-cf Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
3 participants
Summary
openshift-online/aws-nuke-cfto OpenShift CI with Prow plugin/tide configbuild-imagetest that builds the Containerfile and verifiesaws-nuke --versionpush-imagejob that pushes the built image toquay.io/rrp-dev-ci/ci-imageon merge to mainpush-ci-imagepostsubmit from rosa-regional-platform (image now owned by aws-nuke-cf)Test plan
build-imagejob runs on aws-nuke-cf PRsquay.io/rrp-dev-ci/ci-imageafter merge🤖 Generated with Claude Code
Summary by CodeRabbit