more okd fixes

[Prashanth684]

Summary by CodeRabbit

This PR updates OKD-SCOS CI configuration for OpenShift components under ci-operator/config/openshift/**:

• openshift/assisted-installer-agent: switches the pipeline build_root to use from_repository: true (instead of an OpenShift image_stream_tag) and updates the SCOS base build image from origin_scos-5.0_base-stream9 to origin_scos-4.22_base-stream9.
• openshift/aws-encryption-provider: switches the pipeline build_root to from_repository: true (instead of an OpenShift release/image-stream source), while keeping the SCOS base image on origin_scos-5.0_base-stream9.
• openshift/cluster-node-tuning-operator: switches the pipeline build_root to from_repository: true for the OKD-SCOS variant (SCOS base image remains origin_scos-5.0_base-stream9).

In practical terms, these changes reduce reliance on external OpenShift image stream tags for the build_root used by OKD-SCOS builds, and align the assisted-installer-agent build to the 4.22 SCOS base stream.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a81d6aa3-928d-44eb-9c25-ae3b1a739a3a

📥 Commits

Reviewing files that changed from the base of the PR and between 7b5a482 and cfbbf04.

⛔ Files ignored due to path filters (6)

• ci-operator/jobs/openshift/assisted-installer-agent/openshift-assisted-installer-agent-master-postsubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/assisted-installer-agent/openshift-assisted-installer-agent-master-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/aws-encryption-provider/openshift-aws-encryption-provider-master-postsubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/aws-encryption-provider/openshift-aws-encryption-provider-master-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/cluster-node-tuning-operator/openshift-cluster-node-tuning-operator-main-postsubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/cluster-node-tuning-operator/openshift-cluster-node-tuning-operator-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (3)

• ci-operator/config/openshift/assisted-installer-agent/openshift-assisted-installer-agent-master__okd-scos.yaml
• ci-operator/config/openshift/aws-encryption-provider/openshift-aws-encryption-provider-master__okd-scos.yaml
• ci-operator/config/openshift/cluster-node-tuning-operator/openshift-cluster-node-tuning-operator-main__okd-scos.yaml

✅ Files skipped from review due to trivial changes (1)

• ci-operator/config/openshift/aws-encryption-provider/openshift-aws-encryption-provider-master__okd-scos.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• ci-operator/config/openshift/assisted-installer-agent/openshift-assisted-installer-agent-master__okd-scos.yaml

---

Walkthrough

Three OKD-SCOS ci-operator configurations now source build_root from the repository instead of an image stream tag. The assisted-installer-agent configuration also changes its base image from origin_scos-5.0_base-stream9 to origin_scos-4.22_base-stream9.

Changes

OKD-SCOS build configuration updates

Layer / File(s)	Summary
Build root and base image sources ci-operator/config/openshift/assisted-installer-agent/..., ci-operator/config/openshift/aws-encryption-provider/..., ci-operator/config/openshift/cluster-node-tuning-operator/...	All three build_root definitions switch to from_repository: true; the assisted-installer-agent configuration also changes its base image to origin_scos-4.22_base-stream9.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• openshift/release#81643: Also changes OKD-SCOS build_root inputs from image_stream_tag to from_repository: true.

Suggested labels: rehearsals-ack

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the OKD-related changes, but it is too vague to convey the specific CI config updates.	Use a more specific title such as "Switch OKD SCOS build roots to from_repository".

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only edits CI YAML/job generation and build-root sources; no Ginkgo It/Describe/Context/When test titles are added or changed.
Test Structure And Quality	✅ Passed	PR only changes ci-operator config/job YAMLs; no Ginkgo test code or test logic was modified, so the checklist is not applicable.
Microshift Test Compatibility	✅ Passed	PR only edits ci-operator YAML build-root/image refs; no new Ginkgo test definitions or test code were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the PR only edits CI YAML build_root/image refs, so SNO compatibility concerns are not triggered.
Topology-Aware Scheduling Compatibility	✅ Passed	Only ci-operator build-root and sparse-checkout updates; no deployment manifests, replicas, affinity, node selectors, or topology-sensitive scheduling changes were introduced.
Ote Binary Stdout Contract	✅ Passed	PR only updates ci-operator/job YAML for OKD-SCOS builds; no process-level source code or stdout writes were changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only CI operator/job YAML changed; no new Ginkgo tests, IP parsing, or external connectivity code was added.
No-Weak-Crypto	✅ Passed	Touched files are generated CI YAML only; I found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom-crypto/comparison code in the diff.
Container-Privileges	✅ Passed	Modified YAMLs only change build_root/base image refs; no privileged, hostPID/hostNetwork, allowPrivilegeEscalation, or capability settings appear in changed files.
No-Sensitive-Data-In-Logs	✅ Passed	Diffs only change build_root sources and sparse_checkout_files; no new logging, debug, or secret-emitting commands were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Prashanth684]

/pj-rehearse pull-ci-openshift-assisted-installer-agent-master-okd-scos-images

[openshift-merge-bot]

@Prashanth684: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[Prashanth684]

/pj-rehearse pull-ci-openshift-aws-encryption-provider-master-okd-scos-images

[openshift-merge-bot]

@Prashanth684: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[Prashanth684]

/pj-rehearse pull-ci-openshift-assisted-installer-agent-master-okd-scos-images

[openshift-merge-bot]

@Prashanth684: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[Prashanth684]

/pj-rehearse pull-ci-openshift-assisted-installer-agent-master-okd-scos-images

[openshift-merge-bot]

@Prashanth684: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[Prashanth684]

/pj-rehearse pull-ci-openshift-cluster-node-tuning-operator-main-okd-scos-images

[openshift-merge-bot]

@Prashanth684: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@Prashanth684: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-cluster-node-tuning-operator-main-okd-scos-e2e-aws-ovn	openshift/cluster-node-tuning-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-node-tuning-operator-main-okd-scos-images	openshift/cluster-node-tuning-operator	presubmit	Ci-operator config changed
pull-ci-openshift-assisted-installer-agent-master-okd-scos-e2e-aws-ovn	openshift/assisted-installer-agent	presubmit	Ci-operator config changed
pull-ci-openshift-assisted-installer-agent-master-okd-scos-images	openshift/assisted-installer-agent	presubmit	Ci-operator config changed
pull-ci-openshift-aws-encryption-provider-master-okd-scos-e2e-aws-ovn	openshift/aws-encryption-provider	presubmit	Ci-operator config changed
pull-ci-openshift-aws-encryption-provider-master-okd-scos-images	openshift/aws-encryption-provider	presubmit	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@Prashanth684: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Prashanth684]

/pj-rehearse ack

[openshift-merge-bot]

@Prashanth684: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: Prashanth684

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/assisted-installer-agent/OWNERS
• ci-operator/config/openshift/aws-encryption-provider/OWNERS
• ci-operator/config/openshift/cluster-node-tuning-operator/OWNERS
• ci-operator/jobs/openshift/assisted-installer-agent/OWNERS [Prashanth684]
• ci-operator/jobs/openshift/aws-encryption-provider/OWNERS [Prashanth684]
• ci-operator/jobs/openshift/cluster-node-tuning-operator/OWNERS [Prashanth684]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment