DPTP-4833: Disable sigstore verification for 4.22 hive clusterpools#78668
Conversation
...until they are no longer using nightlies.
openshift-ci-robot
added
the
jira/valid-reference
|
@2uasimojo: This pull request references DPTP-4833 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/label priority/ci-critical |
openshift-ci
Bot
added
the
priority/ci-critical
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: 2uasimojo, deepsm007 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughAdds Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@clusters/hosted-mgmt/hive/pools/openshift-observability/obs-ocp-4-22-0-amd64-aws-us-east-2_clusterpool.yaml`:
- Around line 26-28: Add a sunset guardrail by documenting the temporary bypass
for installer image policy: annotate or comment near the installerEnv entry
referencing OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY with the
tracking ticket (e.g., JIRA/ISSUE-1234) and an explicit removal condition and/or
date (e.g., "remove when image policy verification fixed or by 2026-07-01").
Prefer adding a metadata.annotations key like temporary-bypass.ticket and
temporary-bypass.expiry (or a YAML comment immediately above the env entry) so
reviewers and automation can detect the intended removal criteria; keep the env
value until the stated condition/date is met.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 66b2b310-a25a-47de-8795-f7c2bbaacc2d
📒 Files selected for processing (5)
clusters/hosted-mgmt/hive/pools/openshift-ci/ci-ocp-4-22-0-amd64-aws-us-east-1_clusterpool.yamlclusters/hosted-mgmt/hive/pools/openshift-observability/obs-ocp-4-22-0-amd64-aws-us-east-2_clusterpool.yamlclusters/hosted-mgmt/hive/pools/openshift-observability/obs-ocp-4-22-0-fips-amd64-aws-us-east-1_clusterpool.yamlclusters/hosted-mgmt/hive/pools/rh-openshift-ecosystem/rhoe-ocp-4-22-amd64-aws-us-west-1_clusterpool.yamlclusters/hosted-mgmt/hive/pools/rh-openshift-ecosystem/rhoe-ocp-4-22-amd64-aws-us-west-2_clusterpool.yaml
| installerEnv: | ||
| - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY | ||
| value: "true" |
There was a problem hiding this comment.
Add a sunset guardrail for this temporary security bypass.
Line 26 disables installer image policy verification, and the PR states this is temporary. Please encode removal criteria (ticket + condition/date) in-file so this doesn’t silently persist.
Suggested minimal change
+ # TEMP(DPTP-4833): disable sigstore/image policy verification for 4.22 nightlies only.
+ # Remove when these pool image sets are no longer nightly-based.
installerEnv:
- name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY
value: "true"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| installerEnv: | |
| - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY | |
| value: "true" | |
| # TEMP(DPTP-4833): disable sigstore/image policy verification for 4.22 nightlies only. | |
| # Remove when these pool image sets are no longer nightly-based. | |
| installerEnv: | |
| - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY | |
| value: "true" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@clusters/hosted-mgmt/hive/pools/openshift-observability/obs-ocp-4-22-0-amd64-aws-us-east-2_clusterpool.yaml`
around lines 26 - 28, Add a sunset guardrail by documenting the temporary bypass
for installer image policy: annotate or comment near the installerEnv entry
referencing OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY with the
tracking ticket (e.g., JIRA/ISSUE-1234) and an explicit removal condition and/or
date (e.g., "remove when image policy verification fixed or by 2026-07-01").
Prefer adding a metadata.annotations key like temporary-bypass.ticket and
temporary-bypass.expiry (or a YAML comment immediately above the env entry) so
reviewers and automation can detect the intended removal criteria; keep the env
value until the stated condition/date is met.
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( |
|
@2uasimojo: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
…penshift#78668) ...until they are no longer using nightlies.
3 participants
...until they are no longer using nightlies.
Summary by CodeRabbit