openshift · jbpratt · Jul 10, 2026
diff --git a/ci-operator/config/quay/quay/quay-quay-master__omr-3.yaml b/ci-operator/config/quay/quay/quay-quay-master__omr-3.yaml
@@ -0,0 +1,63 @@
+base_images:
+  cli:
+    name: "4.22"
+    namespace: ocp
+    tag: cli
+  upi-installer:
+    name: "4.22"
+    namespace: ocp
+    tag: upi-installer
+build_root:
+  image_stream_tag:
+    name: release
+    namespace: openshift
+    tag: rhel-9-release-golang-1.25-openshift-4.22
+images:
+  items:
+  - dockerfile_path: Dockerfile.mirror
+    optional: true
+    to: quay-mirror
+releases:
+  latest:
+    release:
+      architecture: amd64
+      channel: stable
+      version: "4.22"
+resources:
+  '*':
+    limits:
+      memory: 4Gi
+    requests:
+      cpu: 100m
+      memory: 200Mi
+tests:
+- always_run: false
+  as: omr-3-e2e
+  optional: true
+  steps:
+    allow_best_effort_post_steps: true
+    cluster_profile: aws-quay-qe
+    dependencies:
+      OMR_IMAGE: pipeline:quay-mirror
+    env:
+      ADD_INGRESS_RECORDS_MANUALLY: "yes"
+      BASE_DOMAIN: quayqe.devcluster.openshift.com
+      COMPUTE_NODE_TYPE: m5.xlarge
+      CONTROL_PLANE_INSTANCE_TYPE: m6i.xlarge
+      ENABLE_IDMS: "yes"
+      MIRROR_IN_BASTION: "yes"
+      MIRROR_RELEASE_SIGNATURES: "yes"
+      PUBLISH: Internal
+    post:
+    - ref: quay-omr-3-gather
+    - chain: ipi-aws-post-disconnected
+    pre:
+    - chain: quay-aws-ipi-disconnected-omr-3-provision
+    test:
+    - ref: quay-omr-3-validate
+  timeout: 8h0m0s
+zz_generated_metadata:
+  branch: master
+  org: quay
+  repo: quay
+  variant: omr-3
diff --git a/ci-operator/jobs/quay/quay/quay-quay-master-presubmits.yaml b/ci-operator/jobs/quay/quay/quay-quay-master-presubmits.yaml
@@ -57,6 +57,152 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    - ^master-
+    cluster: build06
+    context: ci/prow/omr-3-images
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.mirror
+    labels:
+      ci-operator.openshift.io/variant: omr-3
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-quay-quay-master-omr-3-images
+    optional: true
+    rerun_command: /test omr-3-images
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=[images]
+        - --variant=omr-3
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )omr-3-images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^master$
+    - ^master-
+    cluster: build07
+    context: ci/prow/omr-3-omr-3-e2e
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.mirror
+      timeout: 8h0m0s
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: aws-quay-qe
+      ci-operator.openshift.io/variant: omr-3
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-quay-quay-master-omr-3-omr-3-e2e
+    optional: true
+    rerun_command: /test omr-3-omr-3-e2e
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=omr-3-e2e
+        - --variant=omr-3
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )omr-3-omr-3-e2e,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:

diff --git a/ci-operator/step-registry/aws/provision/bastionhost/aws-provision-bastionhost-commands.sh b/ci-operator/step-registry/aws/provision/bastionhost/aws-provision-bastionhost-commands.sh
@@ -287,6 +287,10 @@ Resources:
         FromPort: 5000
         ToPort: 5000
         CidrIp: 0.0.0.0/0
+      - IpProtocol: tcp
+        FromPort: 8443
+        ToPort: 8443
+        CidrIp: !Ref VpcCidr
       - IpProtocol: tcp
         FromPort: 6001
         ToPort: 6002

diff --git a/ci-operator/step-registry/ipi/conf/mirror/ipi-conf-mirror-commands.sh b/ci-operator/step-registry/ipi/conf/mirror/ipi-conf-mirror-commands.sh
@@ -24,20 +24,34 @@ fi
 echo -e "image registry:\n$(cat ${install_config_mirror_patch})"
 
 # mirror registry credential
-MIRROR_REGISTRY_HOST=`head -n 1 "${SHARED_DIR}/mirror_registry_url"`
-if [ ! -f "${SHARED_DIR}/mirror_registry_url" ]; then
-    echo "File ${SHARED_DIR}/mirror_registry_url does not exist."
+if [[ ! -s "${SHARED_DIR}/mirror_registry_url" ]]; then
+    echo "File ${SHARED_DIR}/mirror_registry_url does not exist or is empty."
     exit 1
 fi
-mirror_registry_pull_secret=`mktemp`
-registry_cred=`head -n 1 "/var/run/vault/mirror-registry/registry_creds" | base64 -w 0`
-echo '{"auths":{}}' | jq --argjson a "{\"${MIRROR_REGISTRY_HOST}\": {\"auth\": \"$registry_cred\"}}" '.auths |= . + $a' > "${mirror_registry_pull_secret}"
+MIRROR_REGISTRY_HOST=$(head -n 1 "${SHARED_DIR}/mirror_registry_url")
+
+runtime_registry_creds="${SHARED_DIR}/mirror_registry_creds"
+if [[ -s "${runtime_registry_creds}" ]]; then
+    registry_creds_file="${runtime_registry_creds}"
+    echo "Using runtime mirror registry credentials from SHARED_DIR."
+else
+    registry_creds_file="/var/run/vault/mirror-registry/registry_creds"
+    echo "Using the configured mirror registry credential fallback."
+fi
+mirror_registry_pull_secret=$(mktemp)
+registry_cred=$(head -n 1 "${registry_creds_file}" | base64 -w 0)
+echo '{"auths":{}}' | jq --argjson a "{\"${MIRROR_REGISTRY_HOST}\": {\"auth\": \"$registry_cred\"}}" \
+  '.auths |= . + $a' > "${mirror_registry_pull_secret}"
 
 # Additional CA & pull secret patch
 CONFIG_PATCH="${SHARED_DIR}/pull_secret_ca.yaml.patch"
 
 additional_trust_bundle="${SHARED_DIR}/additional_trust_bundle"
-if [[ "${SELF_MANAGED_ADDITIONAL_CA}" == "true" ]]; then
+runtime_registry_ca="${SHARED_DIR}/mirror_registry_ca.crt"
+if [[ -s "${runtime_registry_ca}" ]]; then
+    echo >> "${additional_trust_bundle}"
+    cat "${runtime_registry_ca}" >> "${additional_trust_bundle}"
+elif [[ "${SELF_MANAGED_ADDITIONAL_CA}" == "true" ]]; then
     echo >> "${additional_trust_bundle}"
     cat "${CLUSTER_PROFILE_DIR}/mirror_registry_ca.crt" >> "${additional_trust_bundle}"
 else

diff --git a/ci-operator/step-registry/ipi/conf/mirror/ipi-conf-mirror-ref.yaml b/ci-operator/step-registry/ipi/conf/mirror/ipi-conf-mirror-ref.yaml
@@ -30,3 +30,4 @@ ref:
       Valid values: "", "NeverContactSource", "AllowContactingSource"
   documentation: |-
     The IPI configure step generates the custom registry specific install-config.yaml contents.
+    When SHARED_DIR/mirror_registry_creds or SHARED_DIR/mirror_registry_ca.crt exist, the step uses those runtime files instead of test-credentials vault files. Existing consumers without runtime files retain current vault and cluster-profile behavior.