Skip to content

[DNM] Sync Serverless CI config/serverless-operator.yaml #80071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
maschmid wants to merge 1 commit into from
Closed

[DNM] Sync Serverless CI config/serverless-operator.yaml #80071

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
321 changes: 321 additions & 0 deletions ...-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,321 @@
base_images:
ocp_4.16_cli-artifacts:
name: "4.16"
namespace: ocp
tag: cli-artifacts
ocp_ubi-minimal_9:
name: ubi-minimal
namespace: ocp
tag: "9"
openshift_eventing-istio-src_knative-v1.17:
name: eventing-istio-src
namespace: openshift
tag: knative-v1.17
openshift_eventing-kafka-broker-src_knative-v1.17:
name: eventing-kafka-broker-src
namespace: openshift
tag: knative-v1.17
openshift_knative-eventing-src_knative-v1.17:
name: knative-eventing-src
namespace: openshift
tag: knative-v1.17
openshift_knative-serving-src_knative-v1.17:
name: knative-serving-src
namespace: openshift
tag: knative-v1.17
openshift_release_rhel-9-release-golang-1.25-openshift-4.21:
name: release
namespace: openshift
tag: rhel-9-release-golang-1.25-openshift-4.21
origin_scos-4.22_cli-artifacts:
name: scos-4.22
namespace: origin
tag: cli-artifacts
origin_scos-4.22_operator-registry:
name: scos-4.22
namespace: origin
tag: operator-registry
build_root:
project_image:
dockerfile_path: openshift/ci-operator/build-image/Dockerfile
images:
items:
- dockerfile_path: knative-operator/Dockerfile
inputs:
ocp_ubi-minimal_9:
as:
- $GO_RUNTIME
openshift_release_rhel-9-release-golang-1.25-openshift-4.21:
as:
- $GO_BUILDER
to: serverless-knative-operator
- dockerfile_path: must-gather/Dockerfile
inputs:
ocp_4.16_cli-artifacts:
as:
- $CLI_ARTIFACTS
ocp_ubi-minimal_9:
as:
- $RUNTIME
to: serverless-must-gather
- dockerfile_path: olm-catalog/serverless-operator-index/Dockerfile
inputs:
ocp_ubi-minimal_9:
as:
- registry.access.redhat.com/ubi9/ubi-minimal
origin_scos-4.22_operator-registry:
as:
- registry.ci.openshift.org/origin/scos-4.22:operator-registry
to: serverless-index
- dockerfile_path: olm-catalog/serverless-operator/Dockerfile
inputs:
ocp_ubi-minimal_9:
as:
- $GO_RUNTIME
to: serverless-bundle
- dockerfile_path: openshift-knative-operator/Dockerfile
inputs:
ocp_ubi-minimal_9:
as:
- $GO_RUNTIME
openshift_release_rhel-9-release-golang-1.25-openshift-4.21:
as:
- $GO_BUILDER
to: serverless-openshift-knative-operator
- dockerfile_path: openshift/ci-operator/source-image/Dockerfile
from: src
inputs:
openshift_eventing-istio-src_knative-v1.17:
as:
- registry.ci.openshift.org/openshift/eventing-istio-src:knative-v1.17
openshift_eventing-kafka-broker-src_knative-v1.17:
as:
- registry.ci.openshift.org/openshift/eventing-kafka-broker-src:knative-v1.17
openshift_knative-eventing-src_knative-v1.17:
as:
- registry.ci.openshift.org/openshift/knative-eventing-src:knative-v1.17
openshift_knative-serving-src_knative-v1.17:
as:
- registry.ci.openshift.org/openshift/knative-serving-src:knative-v1.17
origin_scos-4.22_cli-artifacts:
as:
- registry.ci.openshift.org/origin/scos-4.22:cli-artifacts
to: serverless-source-image
- dockerfile_path: serving/ingress/Dockerfile
inputs:
ocp_ubi-minimal_9:
as:
- $GO_RUNTIME
openshift_release_rhel-9-release-golang-1.25-openshift-4.21:
as:
- $GO_BUILDER
to: serverless-ingress
- dockerfile_path: serving/metadata-webhook/Dockerfile
inputs:
ocp_ubi-minimal_9:
as:
- $GO_RUNTIME
openshift_release_rhel-9-release-golang-1.25-openshift-4.21:
as:
- $GO_BUILDER
to: serverless-metadata-webhook
skip_if_only_changed: ^.tekton/.*|^.konflux.*|^.github/.*|^rpms.lock.yaml$|^hack/(lib$|[^l].*|l[^i].*|li[^b].*|lib[^/].*)|^OWNERS.*|.*\.md
releases:
latest:
release:
channel: fast
version: "4.20"
resources:
'*':
limits:
memory: 6Gi
requests:
cpu: 100m
memory: 200Mi
tests:
- as: kitchensink-upgrade
optional: true
skip_if_only_changed: ^.tekton/.*|^.konflux.*|^.github/.*|^rpms.lock.yaml$|^hack/(lib$|[^l].*|l[^i].*|li[^b].*|lib[^/].*)|^OWNERS.*|.*\.md
steps:
allow_best_effort_post_steps: true
allow_skip_on_success: true
cluster_profile: aws-serverless
env:
BASE_DOMAIN: serverless.devcluster.openshift.com
SPOT_INSTANCES: "true"
ZONES_COUNT: "1"
post:
- as: testlog-gather
best_effort: true
cli: latest
commands: cp -v ${SHARED_DIR}/debuglog-*.log ${SHARED_DIR}/stdout-*.log ${SHARED_DIR}/stderr-*.log
"${ARTIFACT_DIR}/" || true
from: serverless-source-image
optional_on_success: true
resources:
requests:
cpu: 100m
timeout: 1m0s
- as: knative-must-gather
best_effort: true
cli: latest
commands: oc adm must-gather --image=quay.io/openshift-knative/must-gather --dest-dir
"${ARTIFACT_DIR}/gather-knative"
from: serverless-source-image
optional_on_success: true
resources:
requests:
cpu: 100m
timeout: 20m0s
- as: openshift-must-gather
best_effort: true
cli: latest
commands: oc adm must-gather --dest-dir "${ARTIFACT_DIR}/gather-openshift"
from: serverless-source-image
optional_on_success: true
resources:
requests:
cpu: 100m
timeout: 20m0s
- as: openshift-gather-extra
best_effort: true
cli: latest
commands: curl -skSL https://raw.githubusercontent.com/openshift/release/main/ci-operator/step-registry/gather/extra/gather-extra-commands.sh
| /bin/bash -s
Comment on lines +183 to +184

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify current remote-script execution usage and discover in-repo gather-extra step alternatives.

# 1) Locate all mutable remote curl|bash usages in ci-operator configs
rg -n -C2 'curl -skSL https://raw.githubusercontent.com/openshift/release/main/ci-operator/step-registry/gather/extra/gather-extra-commands\.sh\s*\|\s*/bin/bash -s' ci-operator/config

# 2) Find gather-extra step-registry definitions that can replace remote execution
fd -i 'gather-extra*.yaml' ci-operator/step-registry

# 3) Show references to gather-extra command assets in step-registry
rg -n -C2 'gather-extra-commands\.sh|as:\s*gather-extra' ci-operator/step-registry

Repository: openshift/release

Length of output: 3849

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml"

echo "== curl usage in $FILE =="
rg -n 'curl -skSL|raw\.githubusercontent\.com|/bin/bash -s' "$FILE" || true

echo
echo "== Context around lines 170-210 =="
nl -ba "$FILE" | sed -n '170,210p'

echo
echo "== Context around lines 250-310 =="
nl -ba "$FILE" | sed -n '250,310p'

echo
echo "== Existing in-repo gather-extra step-registry refs (if present) =="
ls -la ci-operator/step-registry/gather/extra/ 2>/dev/null || true
test -f ci-operator/step-registry/gather/extra/gather-extra-ref.yaml && nl -ba ci-operator/step-registry/gather/extra/gather-extra-ref.yaml | head -n 80 || true
test -f ci-operator/step-registry/gather/extra/gather-extra-commands.sh && nl -ba ci-operator/step-registry/gather/extra/gather-extra-commands.sh | head -n 40 || true

Repository: openshift/release

Length of output: 655

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml"

echo "== curl usage in $FILE =="
rg -n 'curl -skSL|raw\.githubusercontent\.com|/bin/bash -s' "$FILE" || true

echo
echo "== Context around lines 175-190 =="
awk 'NR>=175 && NR<=190 {printf "%d:%s\n", NR, $0}' "$FILE"

echo
echo "== Context around lines 268-290 =="
awk 'NR>=268 && NR<=290 {printf "%d:%s\n", NR, $0}' "$FILE"

echo
echo "== In-repo gather-extra step-registry files =="
ls -la ci-operator/step-registry/gather/extra 2>/dev/null || true
test -f ci-operator/step-registry/gather/extra/gather-extra-ref.yaml && echo "FOUND gather-extra-ref.yaml" || echo "MISSING gather-extra-ref.yaml"
test -f ci-operator/step-registry/gather/extra/gather-extra-commands.sh && echo "FOUND gather-extra-commands.sh" || echo "MISSING gather-extra-commands.sh"

echo
echo "== Top of gather-extra-ref.yaml (if present) =="
if test -f ci-operator/step-registry/gather/extra/gather-extra-ref.yaml; then
  head -n 60 ci-operator/step-registry/gather/extra/gather-extra-ref.yaml
fi

echo
echo "== First lines of gather-extra-commands.sh (if present) =="
if test -f ci-operator/step-registry/gather/extra/gather-extra-commands.sh; then
  head -n 60 ci-operator/step-registry/gather/extra/gather-extra-commands.sh
fi

Repository: openshift/release

Length of output: 6357

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml"

echo "== How gather-extra is referenced elsewhere (repo-wide) =="
rg -n --glob 'ci-operator/config/**/*.yaml' 'as:\s*openshift-gather-extra|gather-extra-ref\.yaml|commands:\s*gather-extra-commands\.sh|ref:\s*gather-extra\b' ci-operator/config | head -n 80

echo
echo "== Gather-extra references in this specific file =="
rg -n 'gather-extra|openshift-gather-extra' "$FILE" || true

echo
echo "== Show the full openshift-gather-extra blocks =="
awk 'NR>=160 && NR<=200 {print} NR==200{exit}' "$FILE"
awk 'NR>=260 && NR<=300 {print}' "$FILE"

Repository: openshift/release

Length of output: 15076

🏁 Script executed:

#!/bin/bash
set -euo pipefail

TARGET="ci-operator/config/redhat-openshift-ecosystem/msp/redhat-openshift-ecosystem-msp-osd-4.10.yaml"

echo "== Inspect $TARGET around gather-extra ref =="
rg -n "ref:\s*gather-extra|as:\s*openshift-gather-extra" "$TARGET"
awk 'NR>=35 && NR<=80 {print}' "$TARGET"

Repository: openshift/release

Length of output: 1473

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Gather-extra ref yaml =="
FILE="ci-operator/step-registry/gather/extra/gather-extra-ref.yaml"
nl -ba "$FILE" | head -n 120

echo
echo "== Search for in-repo gather-extra usage patterns (ref: gather-extra) =="
rg -n --glob 'ci-operator/config/**/*.yaml' 'ref:\s*gather-extra\b' ci-operator/config | head -n 50

echo
echo "== Show a couple surrounding blocks of ref: gather-extra =="
rg -n --glob 'ci-operator/config/**/*.yaml' -C4 'ref:\s*gather-extra\b' ci-operator/config | head -n 120

echo
echo "== Search for configs using curl|bash gather-extra-commands.sh =="
rg -n --glob 'ci-operator/config/**/*.yaml' 'curl -skSL .*gather/extra/gather-extra-commands\.sh\s*\|\s*/bin/bash -s' ci-operator/config | head -n 50

Repository: openshift/release

Length of output: 150

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Gather-extra ref yaml first 120 lines =="
FILE="ci-operator/step-registry/gather/extra/gather-extra-ref.yaml"
if test -f "$FILE"; then
  head -n 120 "$FILE"
else
  echo "MISSING $FILE"
fi

echo
echo "== Gather-extra ref occurrences (show up to 5 matches) =="
rg -n --glob 'ci-operator/config/**/*.yaml' 'ref:\s*gather-extra\b' ci-operator/config | head -n 5

echo
echo "== Configs using in-repo gather-extra commands via ref: gather-extra (show -C2 around first match) =="
FIRST="$(rg -n --glob 'ci-operator/config/**/*.yaml' 'ref:\s*gather-extra\b' ci-operator/config | head -n 1 | cut -d: -f1)"
if test -n "$FIRST" && test -f "$FIRST"; then
  rg -n -C2 'ref:\s*gather-extra\b' "$FIRST"
fi

echo
echo "== Any configs using curl|bash gather-extra-commands.sh (show up to 10 matches) =="
rg -n --glob 'ci-operator/config/**/*.yaml' 'curl -skSL .*gather/extra/gather-extra-commands\.sh.*\|\s*/bin/bash -s' ci-operator/config | head -n 10

Repository: openshift/release

Length of output: 1187

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml"

echo "== Top-level image definitions (first ~220 lines) =="
head -n 220 "$FILE"

echo
echo "== Where serverless-source-image is defined (search) =="
rg -n 'serverless-source-image|from:\s*serverless-source-image|as:\s*serverless-source-image' "$FILE"

echo
echo "== Post-step block for openshift-gather-extra (first occurrence, ~170-210) =="
awk 'NR>=160 && NR<=210 {print}' "$FILE"

echo
echo "== Post-step block for openshift-gather-extra (second occurrence, ~250-300) =="
awk 'NR>=250 && NR<=300 {print}' "$FILE"

Repository: openshift/release

Length of output: 11019

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Pick a known file that uses "as: openshift-gather-extra" (no network access change needed)
FILE="ci-operator/config/openshift-knative/serving/openshift-knative-serving-release-next__420.yaml"

echo "== Looking for openshift-gather-extra blocks in $FILE =="
rg -n "as:\s*openshift-gather-extra|ref:\s*gather-extra|gather-extra-commands\.sh|curl -skSL .*gather/extra" "$FILE"

echo
echo "== Show first openshift-gather-extra block (around first match) =="
FIRST_LINE="$(rg -n "as:\s*openshift-gather-extra" "$FILE" | head -n1 | cut -d: -f1)"
if test -n "${FIRST_LINE}"; then
  START=$((FIRST_LINE-20))
  END=$((FIRST_LINE+60))
  awk -v s="$START" -v e="$END" 'NR>=s && NR<=e {print}' "$FILE"
fi

Repository: openshift/release

Length of output: 3740

Replace remote curl -skSL ... | /bin/bash -s gather-extra execution with in-repo ref: gather-extra.

In ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml, the openshift-gather-extra post steps (lines 183-184 and 278-279) download ci-operator/step-registry/gather/extra/gather-extra-commands.sh from the mutable .../main/... path and execute it with TLS verification disabled (-k). Switch to the in-tree step-registry ci-operator/step-registry/gather/extra/gather-extra-ref.yaml (- ref: gather-extra, matching the current from: serverless-source-image), or pin to an immutable commit URL and remove -k.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__420.yaml`
around lines 183 - 184, The post-step that runs openshift-gather-extra currently
downloads and executes the remote script via "curl -skSL ... | /bin/bash -s";
update the post step(s) named openshift-gather-extra to use the in-repo
step-registry reference instead (replace the curl+pipe command with a step entry
"ref: gather-extra" and ensure "from: serverless-source-image" matches), or
alternatively change the curl invocation to a pinned immutable commit URL and
remove the "-k" flag; locate the command strings in the YAML (the commands block
under openshift-gather-extra) and replace accordingly.

from: serverless-source-image
grace_period: 1m0s
optional_on_success: true
resources:
requests:
cpu: 300m
memory: 300Mi
timeout: 20m0s
- ref: ipi-deprovision-deprovision
test:
- as: test
cli: latest
commands: GOPATH=/tmp/go PATH=$PATH:/tmp/go/bin SKIP_MESH_AUTH_POLICY_GENERATION=true
make kitchensink-upgrade
dependencies:
- env: SERVERLESS_KNATIVE_OPERATOR
name: serverless-knative-operator
- env: SERVERLESS_MUST_GATHER
name: serverless-must-gather
- env: SERVERLESS_INDEX
name: serverless-index
- env: SERVERLESS_BUNDLE
name: serverless-bundle
- env: SERVERLESS_OPENSHIFT_KNATIVE_OPERATOR
name: serverless-openshift-knative-operator
- env: SERVERLESS_SOURCE_IMAGE
name: serverless-source-image
- env: SERVERLESS_INGRESS
name: serverless-ingress
- env: SERVERLESS_METADATA_WEBHOOK
name: serverless-metadata-webhook
from: serverless-source-image
resources:
requests:
cpu: 100m
timeout: 4h0m0s
workflow: ipi-aws
- as: kitchensink-upgrade-c
cron: 53 1 * * 1,5
reporter_config:
channel: '#serverless-ci'
job_states_to_report:
- success
- failure
- error
report_template: '{{if eq .Status.State "success"}} :rainbow: Job *{{.Spec.Job}}*
ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> :rainbow: {{else}}
:volcano: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
logs> :volcano: {{end}}'
steps:
allow_best_effort_post_steps: true
allow_skip_on_success: true
cluster_profile: aws-serverless
env:
BASE_DOMAIN: serverless.devcluster.openshift.com
SPOT_INSTANCES: "true"
ZONES_COUNT: "1"
post:
- as: testlog-gather
best_effort: true
cli: latest
commands: cp -v ${SHARED_DIR}/debuglog-*.log ${SHARED_DIR}/stdout-*.log ${SHARED_DIR}/stderr-*.log
"${ARTIFACT_DIR}/" || true
from: serverless-source-image
optional_on_success: false
resources:
requests:
cpu: 100m
timeout: 1m0s
- as: knative-must-gather
best_effort: true
cli: latest
commands: oc adm must-gather --image=quay.io/openshift-knative/must-gather --dest-dir
"${ARTIFACT_DIR}/gather-knative"
from: serverless-source-image
optional_on_success: false
resources:
requests:
cpu: 100m
timeout: 20m0s
- as: openshift-must-gather
best_effort: true
cli: latest
commands: oc adm must-gather --dest-dir "${ARTIFACT_DIR}/gather-openshift"
from: serverless-source-image
optional_on_success: false
resources:
requests:
cpu: 100m
timeout: 20m0s
- as: openshift-gather-extra
best_effort: true
cli: latest
commands: curl -skSL https://raw.githubusercontent.com/openshift/release/main/ci-operator/step-registry/gather/extra/gather-extra-commands.sh
| /bin/bash -s
from: serverless-source-image
grace_period: 1m0s
optional_on_success: false
resources:
requests:
cpu: 300m
memory: 300Mi
timeout: 20m0s
- ref: ipi-deprovision-deprovision
test:
- as: test
cli: latest
commands: GOPATH=/tmp/go PATH=$PATH:/tmp/go/bin SKIP_MESH_AUTH_POLICY_GENERATION=true
make kitchensink-upgrade
dependencies:
- env: SERVERLESS_KNATIVE_OPERATOR
name: serverless-knative-operator
- env: SERVERLESS_MUST_GATHER
name: serverless-must-gather
- env: SERVERLESS_INDEX
name: serverless-index
- env: SERVERLESS_BUNDLE
name: serverless-bundle
- env: SERVERLESS_OPENSHIFT_KNATIVE_OPERATOR
name: serverless-openshift-knative-operator
- env: SERVERLESS_SOURCE_IMAGE
name: serverless-source-image
- env: SERVERLESS_INGRESS
name: serverless-ingress
- env: SERVERLESS_METADATA_WEBHOOK
name: serverless-metadata-webhook
from: serverless-source-image
resources:
requests:
cpu: 100m
timeout: 4h0m0s
workflow: ipi-aws
zz_generated_metadata:
branch: release-1.37
org: openshift-knative
repo: serverless-operator
variant: "420"
Loading