Skip to content

CNTRLPLANE-3947: feat(oauth-apiserver): mount ci-pull-credentials and add oc to verify step - #82639

Open
jubittajohn wants to merge 1 commit into
openshift:mainfrom
jubittajohn:oauth-apiserver-verify-tools
Open

CNTRLPLANE-3947: feat(oauth-apiserver): mount ci-pull-credentials and add oc to verify step#82639
jubittajohn wants to merge 1 commit into
openshift:mainfrom
jubittajohn:oauth-apiserver-verify-tools

Conversation

@jubittajohn

@jubittajohn jubittajohn commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

Updates the OpenShift CI verification setup for oauth-apiserver to be more reliable and consistent across master and supported release streams by:

  • Mounting ci-pull-credentials into the verify jobs (and setting REGISTRY_AUTH_FILE) so the verification step can authenticate when pulling required images/artifacts.
  • Adding an oauth-apiserver-bin-with-oc helper image that bundles the oc binary into the verification environment, then switching verify to run from that image.
  • Running verification against the openshift-org-gcp cluster profile, with explicit CPU/memory resource requests.
  • Skipping verify when changes are limited to docs/metadata/ownership/license-related paths via skip_if_only_changed.
  • Standardizing the verification command usage (e.g., make verify with failure-tolerant behavior where configured, such as make verify -k, and including additional flags in the 5.0 stream).

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f6959ca4-ec97-44f3-a7f0-5de598c44e6a

📥 Commits

Reviewing files that changed from the base of the PR and between bcbee54 and 916d5cd.

⛔ Files ignored due to path filters (3)
  • ci-operator/jobs/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.23-presubmits.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.1-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (5)
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-master.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.22.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.23.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.0.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.1.yaml
🚧 Files skipped from review as they are similar to previous changes (5)
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-master.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.22.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.1.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.0.yaml
  • ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.23.yaml

Walkthrough

OpenShift OAuth apiserver CI configurations now mount pull credentials. Release 4.23, 5.0, and 5.1 pipelines also build an image containing oc and use structured verification steps with updated filtering and resources.

Changes

OAuth apiserver CI verification

Layer / File(s) Summary
Verification credential mounts
ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-{master,release-4.22}.yaml
Verification steps mount the ci-pull-credentials secret from the ci namespace and set REGISTRY_AUTH_FILE to its .dockerconfigjson path.
Verification image builds
ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-{4.23,5.0,5.1}.yaml
Release pipelines build oauth-apiserver-bin-with-oc by copying oc into /usr/bin/oc.
Release verification execution
ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-{4.23,5.0,5.1}.yaml
Verification uses structured steps, the openshift-org-gcp cluster profile, change filters, mounted credentials, updated commands, the new image, and explicit CPU and memory requests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • openshift/release#82636: Updates related OpenShift CI verification steps with the same ci-pull-credentials secret mount.

Suggested labels: jira/valid-reference

Suggested reviewers: atiratree, kaleemsiddiqu

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: mounting ci-pull-credentials and adding oc to the oauth-apiserver verify step.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Touched files are ci-operator YAML configs only; no It/Describe/Context/When titles were added or changed.
Test Structure And Quality ✅ Passed PR only changes ci-operator/job YAML; no Ginkgo *_test.go or test logic changed, so this test-structure check is not applicable.
Microshift Test Compatibility ✅ Passed Changed files are CI/job YAML only; no new Ginkgo test bodies or MicroShift-sensitive API refs/tags were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PASS: The PR only changes CI YAML/job configs; no Go/Ginkgo tests were added or modified, and no SNO-sensitive test logic appears in the touched files.
Topology-Aware Scheduling Compatibility ✅ Passed PASS: The PR only changes CI job/config YAML; no deployment manifests, controllers, or scheduling fields (affinity/nodeSelector/PDB) were added.
Ote Binary Stdout Contract ✅ Passed Only ci-operator YAML/job config changed; no process-level code (main/init/TestMain/suite setup) was modified, so stdout-contract risk is not applicable.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No Ginkgo/e2e test code was added or changed; only ci-operator and presubmit YAML were modified, so this compatibility check is not applicable.
No-Weak-Crypto ✅ Passed Changed files only add CI credentials/oc wiring; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges ✅ Passed No added privileged/host*capability/root securityContext fields were found in the touched ci-operator configs or generated presubmits.
No-Sensitive-Data-In-Logs ✅ Passed PASS: The added verify stanzas only mount ci-pull-credentials and set REGISTRY_AUTH_FILE; no commands echo secrets, tokens, or env dumps were added.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jubittajohn
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jubittajohn

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-oauth-apiserver-master-verify

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@jubittajohn

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-oauth-apiserver-release-5.0-verify

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@jubittajohn

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-oauth-apiserver-release-5.0-images

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@jubittajohn: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

… step

Signed-off-by: jubittajohn <jujohn@redhat.com>
@jubittajohn
jubittajohn force-pushed the oauth-apiserver-verify-tools branch from bcbee54 to 916d5cd Compare July 29, 2026 20:38
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 29, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@jubittajohn: This pull request references CNTRLPLANE-3947 which is a valid jira issue.

Details

In response to this:

Summary by CodeRabbit

Updates the OpenShift CI verification setup for oauth-apiserver to be more reliable and consistent across master and supported release streams by:

  • Mounting ci-pull-credentials into the verify jobs (and setting REGISTRY_AUTH_FILE) so the verification step can authenticate when pulling required images/artifacts.
  • Adding an oauth-apiserver-bin-with-oc helper image that bundles the oc binary into the verification environment, then switching verify to run from that image.
  • Running verification against the openshift-org-gcp cluster profile, with explicit CPU/memory resource requests.
  • Skipping verify when changes are limited to docs/metadata/ownership/license-related paths via skip_if_only_changed.
  • Standardizing the verification command usage (e.g., make verify with failure-tolerant behavior where configured, such as make verify -k, and including additional flags in the 5.0 stream).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@jubittajohn: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-oauth-apiserver-release-4.23-verify openshift/oauth-apiserver presubmit Presubmit changed
pull-ci-openshift-oauth-apiserver-release-5.0-verify openshift/oauth-apiserver presubmit Presubmit changed
pull-ci-openshift-oauth-apiserver-release-5.1-verify openshift/oauth-apiserver presubmit Presubmit changed
pull-ci-openshift-oauth-apiserver-release-4.22-verify openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-e2e-aws openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-e2e-aws-serial openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-e2e-aws-upgrade openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-e2e-component openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-e2e-gcp-component-serial-disruptive-ote openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-e2e-gcp-component-serial-ote openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-images openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-unit openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.0-verify-deps openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-e2e-aws openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-e2e-aws-serial openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-e2e-aws-upgrade openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-e2e-component openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-e2e-gcp-component-serial-disruptive-ote openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-e2e-gcp-component-serial-ote openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-images openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-unit openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-verify-deps openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-master-verify openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.1-e2e-aws openshift/oauth-apiserver presubmit Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.1-e2e-aws-serial openshift/oauth-apiserver presubmit Ci-operator config changed

A total of 32 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@jubittajohn: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants