[WIP] ci(cilium): migrate Cilium installation from OLM manifests to Cilium CLI#79164
[WIP] ci(cilium): migrate Cilium installation from OLM manifests to Cilium CLI#79164mgencur wants to merge 6 commits into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
WalkthroughReplaces OLM-manifest Cilium installs with cilium-cli installs across CI steps, bumps Cilium/CLI defaults, adds Cilium network-policy workarounds and a debug-dump step, tightens readiness waits, updates conformance skip lists, and wires new refs/workflow positions and OWNERS/metadata. ChangesCilium CI step updates (install, debug, network policies, wiring)
Sequence DiagramsequenceDiagram
participant CI as CI job
participant Workflow as Workflow YAML
participant CreateCmd as HyperShift create command
participant CloudProvider as AWS/Azure
participant Conformance as Conformance workflow
Workflow->>CreateCmd: declare `CNI_PROVIDER` env (default "")
CreateCmd->>CloudProvider: if `CNI_PROVIDER==cilium` append health-probe-mode annotation
Conformance->>Workflow: set `CNI_PROVIDER: "cilium"`, add network-policies pre-step
Conformance->>Workflow: add dump-debug post ref
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 10 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh (1)
3-7:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDrop global
set -xfrom this step script.Line 6 enables xtrace by default; this violates the step-script logging rule and increases leak risk in CI logs. Keep strict mode as
set -euo pipefail, and only enable tracing in narrow debug blocks.As per coding guidelines, "Default to
set -euo pipefailwithout-xin step-registry command scripts and only enable-xwhen actively debugging".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh` around lines 3 - 7, Remove the global xtrace enable (the "set -x" line) from the step script so the script uses strict mode only ("set -o nounset", "set -o errexit", "set -o pipefail"); if you need tracing for debugging, enable it around a narrow block with "set -x" and disable with "set +x" rather than leaving "set -x" globally. Ensure the script contains the three strict options (nounset/errexit/pipefail) and no global "set -x" so logs do not leak sensitive information.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh`:
- Line 8: The fallback default for CILIUM_CLI_VERSION currently includes a
leading "v" which causes a double "v" when the download tag is later prefixed;
fix by normalizing the variable before constructing the tag: either change the
default to omit the "v" (use "0.19.2") or strip any leading "v" from
CILIUM_CLI_VERSION when you build the download tag (e.g., use the value with
leading "v" removed and then prefix a single "v" when forming the final tag),
referencing the CILIUM_CLI_VERSION variable and the tag construction site that
currently adds the "v".
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh`:
- Line 3: The script enables xtrace via "set -xeuo pipefail" which can leak
proxy credentials when the script executes "source proxy-conf.sh"; modify the
script to temporarily disable xtrace around the sensitive operation by saving
the current xtrace state, running "set +x" before sourcing proxy-conf.sh,
sourcing it, then restoring the original xtrace state afterward so tracing is
off only while proxy-conf.sh is read (refer to the existing "set -xeuo pipefail"
and the "source proxy-conf.sh" usage to locate where to apply this change).
- Around line 41-47: The cilium install invocation is hardcoded to a dev
repository and version which overrides the CILIUM_VERSION input; update the
cilium install command (the --repository and --version flags in the cilium
install invocation) to use the CILIUM_VERSION variable instead of the literal
dev values (or make --repository conditional if you support an explicit DEV_REPO
flag), so the script honors CILIUM_VERSION; ensure you still pass --set
debug.enabled=true. Reference the existing cilium install command and the
CILIUM_VERSION variable when making the change.
- Around line 54-55: The --set argument expansions are unquoted for HOSTPREFIX
and PODCIDR (symbols: HOSTPREFIX, PODCIDR) which can cause word-splitting;
update the cilium helm/cli invocation so those values are quoted like the
preceding PODCIDR usage — e.g. change the flags to use "${HOSTPREFIX}" and
"${PODCIDR}" in the --set arguments for ipam.operator.clusterPoolIPv4MaskSize
and ipv4NativeRoutingCIDR to match the existing quoting pattern and avoid
splitting issues.
---
Outside diff comments:
In `@ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh`:
- Around line 3-7: Remove the global xtrace enable (the "set -x" line) from the
step script so the script uses strict mode only ("set -o nounset", "set -o
errexit", "set -o pipefail"); if you need tracing for debugging, enable it
around a narrow block with "set -x" and disable with "set +x" rather than
leaving "set -x" globally. Ensure the script contains the three strict options
(nounset/errexit/pipefail) and no global "set -x" so logs do not leak sensitive
information.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2d7530c4-301d-4abe-978b-13b7fe45c85b
📒 Files selected for processing (4)
ci-operator/step-registry/cilium/conf/cilium-conf-commands.shci-operator/step-registry/cilium/conf/cilium-conf-ref.yamlci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.shci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-ref.yaml
|
|
||
| cilium_olm_rev="main" | ||
| cv="$CILIUM_VERSION" | ||
| CILIUM_CLI_VERSION=${CILIUM_CLI_VERSION:-"v0.19.2"} |
There was a problem hiding this comment.
CILIUM_CLI_VERSION fallback currently builds an invalid download tag.
Line 8 defaults to v0.19.2, but Line 35 already prefixes the tag with v, producing vv0.19.2 when fallback is used.
Proposed fix
-CILIUM_CLI_VERSION=${CILIUM_CLI_VERSION:-"v0.19.2"}
+CILIUM_CLI_VERSION=${CILIUM_CLI_VERSION:-"0.19.2"}
...
-curl --fail --retry 3 -sS -L "https://github.com/cilium/cilium-cli/releases/download/v${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz" | tar -xzC /tmp/bin/
+curl --fail --retry 3 -sS -L "https://github.com/cilium/cilium-cli/releases/download/v${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz" | tar -xzC /tmp/bin/Also applies to: 35-35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh` at line 8, The
fallback default for CILIUM_CLI_VERSION currently includes a leading "v" which
causes a double "v" when the download tag is later prefixed; fix by normalizing
the variable before constructing the tag: either change the default to omit the
"v" (use "0.19.2") or strip any leading "v" from CILIUM_CLI_VERSION when you
build the download tag (e.g., use the value with leading "v" removed and then
prefix a single "v" when forming the final tag), referencing the
CILIUM_CLI_VERSION variable and the tag construction site that currently adds
the "v".
| @@ -1,7 +1,10 @@ | |||
| #!/bin/bash | |||
|
|
|||
| set -xeuo pipefail | |||
There was a problem hiding this comment.
Avoid xtrace while sourcing proxy configuration.
With Line 3 using -x, sourcing proxy-conf.sh at Line 13 can expose proxy credentials in logs. Disable tracing by default (or at least around source).
As per coding guidelines, "Disable bash tracing (set +x) when handling sensitive operations in step-registry command scripts and restore previous tracing state afterward".
Also applies to: 9-13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh`
at line 3, The script enables xtrace via "set -xeuo pipefail" which can leak
proxy credentials when the script executes "source proxy-conf.sh"; modify the
script to temporarily disable xtrace around the sensitive operation by saving
the current xtrace state, running "set +x" before sourcing proxy-conf.sh,
sourcing it, then restoring the original xtrace state afterward so tracing is
off only while proxy-conf.sh is read (refer to the existing "set -xeuo pipefail"
and the "source proxy-conf.sh" usage to locate where to apply this change).
| --set ipam.operator.clusterPoolIPv4MaskSize=${HOSTPREFIX} \ | ||
| --set ipv4NativeRoutingCIDR=${PODCIDR} \ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify unquoted --set expansions in this script.
rg -n -C2 --type=sh 'clusterPoolIPv4MaskSize=\$\{HOSTPREFIX\}|ipv4NativeRoutingCIDR=\$\{PODCIDR\}'Repository: openshift/release
Length of output: 1055
🏁 Script executed:
cat -n ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh | head -80Repository: openshift/release
Length of output: 2505
Quote variable expansions in --set args for consistency and safety.
Lines 54-55 have unquoted variable expansions while line 53 quotes the same PODCIDR variable. Quote these expansions to prevent word-splitting hazards and align with the quoting pattern used elsewhere in the command.
Proposed fix
- --set ipam.operator.clusterPoolIPv4MaskSize=${HOSTPREFIX} \
- --set ipv4NativeRoutingCIDR=${PODCIDR} \
+ --set "ipam.operator.clusterPoolIPv4MaskSize=${HOSTPREFIX}" \
+ --set "ipv4NativeRoutingCIDR=${PODCIDR}" \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| --set ipam.operator.clusterPoolIPv4MaskSize=${HOSTPREFIX} \ | |
| --set ipv4NativeRoutingCIDR=${PODCIDR} \ | |
| --set "ipam.operator.clusterPoolIPv4MaskSize=${HOSTPREFIX}" \ | |
| --set "ipv4NativeRoutingCIDR=${PODCIDR}" \ |
🧰 Tools
🪛 Shellcheck (0.11.0)
[info] 54-54: Double quote to prevent globbing and word splitting.
(SC2086)
[info] 55-55: Double quote to prevent globbing and word splitting.
(SC2086)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh`
around lines 54 - 55, The --set argument expansions are unquoted for HOSTPREFIX
and PODCIDR (symbols: HOSTPREFIX, PODCIDR) which can cause word-splitting;
update the cilium helm/cli invocation so those values are quoted like the
preceding PODCIDR usage — e.g. change the flags to use "${HOSTPREFIX}" and
"${PODCIDR}" in the --set arguments for ipam.operator.clusterPoolIPv4MaskSize
and ipv4NativeRoutingCIDR to match the existing quoting pattern and avoid
splitting issues.
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-conformance-cilium periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
mgencur
force-pushed
the
cilium_cli_install
branch
from
1713e49 to
9e45c5d
Compare
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-conformance-cilium periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mgencur The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/cucushift-hypershift-extended-cilium-network-policies-commands.sh`:
- Around line 5-7: Save the current xtrace state into a variable (e.g.
XTRACE_SAVE from "$-"), disable xtrace with set +x before sourcing the proxy
config, source "${SHARED_DIR}/proxy-conf.sh", and then restore xtrace (set -x)
only if the saved state indicated it was enabled; this ensures sensitive proxy
credentials in proxy-conf.sh are not printed while preserving the original trace
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: b03f8b40-8af8-4b50-9112-c721bfc5bdd8
📒 Files selected for processing (18)
ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yamlci-operator/step-registry/cilium/conf/cilium-conf-commands.shci-operator/step-registry/cilium/conf/cilium-conf-ref.yamlci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.shci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-ref.yamlci-operator/step-registry/cucushift/hypershift-extended/cilium/dump-debug/OWNERSci-operator/step-registry/cucushift/hypershift-extended/cilium/dump-debug/cucushift-hypershift-extended-cilium-dump-debug-commands.shci-operator/step-registry/cucushift/hypershift-extended/cilium/dump-debug/cucushift-hypershift-extended-cilium-dump-debug-ref.metadata.jsonci-operator/step-registry/cucushift/hypershift-extended/cilium/dump-debug/cucushift-hypershift-extended-cilium-dump-debug-ref.yamlci-operator/step-registry/cucushift/hypershift-extended/cilium/health-check/cucushift-hypershift-extended-cilium-health-check-commands.shci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/OWNERSci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/cucushift-hypershift-extended-cilium-network-policies-commands.shci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/cucushift-hypershift-extended-cilium-network-policies-ref.metadata.jsonci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/cucushift-hypershift-extended-cilium-network-policies-ref.yamlci-operator/step-registry/cucushift/installer/rehearse/aws/ipi/ovn/hypershift/guest/cilium/cucushift-installer-rehearse-aws-ipi-ovn-hypershift-guest-cilium-workflow.yamlci-operator/step-registry/hypershift/aws/conformance-cilium/hypershift-aws-conformance-cilium-workflow.yamlci-operator/step-registry/hypershift/kubevirt/baremetalds/conformance-cilium/hypershift-kubevirt-baremetalds-conformance-cilium-workflow.yamlci-operator/step-registry/hypershift/mce/agent/metal3/create/cilium/hypershift-mce-agent-metal3-create-cilium-chain.yaml
✅ Files skipped from review due to trivial changes (7)
- ci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/OWNERS
- ci-operator/step-registry/cucushift/hypershift-extended/cilium/dump-debug/OWNERS
- ci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/cucushift-hypershift-extended-cilium-network-policies-ref.metadata.json
- ci-operator/step-registry/hypershift/mce/agent/metal3/create/cilium/hypershift-mce-agent-metal3-create-cilium-chain.yaml
- ci-operator/step-registry/hypershift/kubevirt/baremetalds/conformance-cilium/hypershift-kubevirt-baremetalds-conformance-cilium-workflow.yaml
- ci-operator/step-registry/cucushift/hypershift-extended/cilium/dump-debug/cucushift-hypershift-extended-cilium-dump-debug-ref.metadata.json
- ci-operator/step-registry/cucushift/installer/rehearse/aws/ipi/ovn/hypershift/guest/cilium/cucushift-installer-rehearse-aws-ipi-ovn-hypershift-guest-cilium-workflow.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- ci-operator/step-registry/cilium/conf/cilium-conf-ref.yaml
- ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh
- ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh
| if [ -f "${SHARED_DIR}/proxy-conf.sh" ] ; then | ||
| source "${SHARED_DIR}/proxy-conf.sh" | ||
| fi |
There was a problem hiding this comment.
Disable xtrace while sourcing proxy configuration.
set -x is active when proxy-conf.sh is sourced, which can leak sensitive proxy credentials to job logs.
🔧 Proposed fix
if [ -f "${SHARED_DIR}/proxy-conf.sh" ] ; then
+ set +x
source "${SHARED_DIR}/proxy-conf.sh"
+ set -x
fiAs per coding guidelines, step registry command scripts must protect sensitive information from leaking into CI logs and should use set +x around sensitive operations.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/network-policies/cucushift-hypershift-extended-cilium-network-policies-commands.sh`
around lines 5 - 7, Save the current xtrace state into a variable (e.g.
XTRACE_SAVE from "$-"), disable xtrace with set +x before sourcing the proxy
config, source "${SHARED_DIR}/proxy-conf.sh", and then restore xtrace (set -x)
only if the saved state indicated it was enabled; this ensures sensitive proxy
credentials in proxy-conf.sh are not printed while preserving the original trace
behavior.
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
mgencur
force-pushed
the
cilium_cli_install
branch
from
325f3bb to
4feb9e4
Compare
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh`:
- Line 6: Normalize the CILIUM_CLI_VERSION variable before building the release
URL: detect and strip any leading "v" from CILIUM_CLI_VERSION (so both "0.19.2"
and "v0.19.2" become "0.19.2"), then explicitly prefix a single "v" when
composing the download URL; update the code that composes the URL (the place
that currently prepends "v" to CILIUM_CLI_VERSION) to use the normalized value
to avoid producing "vv..." in the URL.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: bac9563c-697e-44a4-9e08-07ca14c8fa89
📒 Files selected for processing (5)
ci-operator/step-registry/cilium/conf/cilium-conf-commands.shci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.shci-operator/step-registry/hypershift/aws/conformance-cilium/hypershift-aws-conformance-cilium-workflow.yamlci-operator/step-registry/hypershift/aws/create/hypershift-aws-create-chain.yamlci-operator/step-registry/hypershift/azure/create/hypershift-azure-create-chain.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- ci-operator/step-registry/cilium/conf/cilium-conf-commands.sh
| set -xeuo pipefail | ||
|
|
||
| CILIUM_VERSION=${CILIUM_VERSION:-"1.19.1"} | ||
| CILIUM_CLI_VERSION=${CILIUM_CLI_VERSION:-"0.19.2"} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
raw='v0.19.2'
bad="https://github.com/cilium/cilium-cli/releases/download/v${raw}/cilium-linux-amd64.tar.gz"
good="https://github.com/cilium/cilium-cli/releases/download/v${raw#v}/cilium-linux-amd64.tar.gz"
for url in "$bad" "$good"; do
code="$(curl -sS -o /dev/null -w '%{http_code}' -L "$url")"
printf '%s -> HTTP %s\n' "$url" "$code"
doneRepository: openshift/release
Length of output: 264
🏁 Script executed:
cat "ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh"Repository: openshift/release
Length of output: 2227
Normalize CILIUM_CLI_VERSION before composing the release URL.
Line 33 prepends v, but if CILIUM_CLI_VERSION is set to v0.19.2 (as intended by this PR), the download URL becomes .../vv0.19.2/... and fails with HTTP 404. The test confirms: vv0.19.2 returns 404, while v0.19.2 returns 200.
Proposed fix
-CILIUM_CLI_VERSION=${CILIUM_CLI_VERSION:-"0.19.2"}
+CILIUM_CLI_VERSION=${CILIUM_CLI_VERSION:-"v0.19.2"}
+CILIUM_CLI_TAG="${CILIUM_CLI_VERSION#v}"
@@
-curl --fail --retry 3 -sS -L "https://github.com/cilium/cilium-cli/releases/download/v${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz" | tar -xzC /tmp/bin/
+curl --fail --retry 3 -sS -L "https://github.com/cilium/cilium-cli/releases/download/v${CILIUM_CLI_TAG}/cilium-linux-amd64.tar.gz" | tar -xzC /tmp/bin/🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/cucushift/hypershift-extended/cilium/cucushift-hypershift-extended-cilium-commands.sh`
at line 6, Normalize the CILIUM_CLI_VERSION variable before building the release
URL: detect and strip any leading "v" from CILIUM_CLI_VERSION (so both "0.19.2"
and "v0.19.2" become "0.19.2"), then explicitly prefix a single "v" when
composing the download URL; update the code that composes the URL (the place
that currently prepends "v" to CILIUM_CLI_VERSION) to use the normalized value
to avoid producing "vv..." in the URL.
mgencur
force-pushed
the
cilium_cli_install
branch
2 times, most recently
from
924d9c8 to
f668780
Compare
Replace the deprecated isovalent/olm-for-cilium manifest-based installation with the official Cilium CLI in both cilium-conf and cucushift-hypershift-extended-cilium steps. Bump Cilium from 1.13.9/1.15.1 to 1.19.1 and add CILIUM_CLI_VERSION env var (v0.19.2). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mgencur
force-pushed
the
cilium_cli_install
branch
from
f668780 to
8ce2e63
Compare
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-conformance-cilium periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-conformance-cilium |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-conformance-cilium periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-conformance-cilium |
|
@mgencur: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
A total of 738 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@mgencur: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
(This will need a rebase after merging #78338)
Replace the deprecated isovalent/olm-for-cilium manifest-based installation
with the official Cilium CLI in both cilium-conf and
cucushift-hypershift-extended-cilium steps. Bump Cilium from 1.13.9/1.15.1
to 1.19.1 and add CILIUM_CLI_VERSION env var (v0.19.2).
Summary
This PR migrates OpenShift CI Cilium installs from the deprecated isovalent OLM-manifests flow to the official cilium-cli installer, bumps Cilium chart versions, and adds CI helper steps and network-policy workarounds to stabilize Cilium tests in HyperShift/OpenShift CI.
What changed in practical terms
Install method and versions
cilium install --version <CILIUM_VERSION>with explicit chart/value overrides instead of applying isovalent OLM manifests and rendered CiliumConfig YAML.Affected CI steps and scripts (practical effects)
cilium status --wait.oc waittimeouts for nodes, clusteroperators, and clusterversion.New helper steps and debugging
Workflow and test integrations
Operational impact / rationale
Review notes / calls to attention