Skip to content

ARO-HCP: reuse promoted images for healthchecks - #82772

Draft
roivaz wants to merge 1 commit into
openshift:mainfrom
roivaz:roivaz/periodic-healthcheck-promoted-images
Draft

ARO-HCP: reuse promoted images for healthchecks#82772
roivaz wants to merge 1 commit into
openshift:mainfrom
roivaz:roivaz/periodic-healthcheck-promoted-images

Conversation

@roivaz

@roivaz roivaz commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Summary

  • consume promoted aro-hcp-e2e-tests and aro-hcp-e2e-tools images in regional healthcheck periodics
  • provision the complete service image set published to ACR from main instead of rebuilding service images
  • support periodic execution in aro-hcp-provision-from-main and wait for every required ACR image
  • remove the generated periodic-healthcheck-images presubmit

Validation

  • make jobs WHAT=Azure/ARO-HCP
  • make ci-operator-checkconfig SKIP_PULL=true
  • targeted Prow checkconfig for ci-operator/jobs/Azure/ARO-HCP
  • bash -n ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh

Summary by CodeRabbit

  • Updates ARO-HCP regional healthcheck periodics to use promoted aro-hcp-e2e-tests and aro-hcp-e2e-tools images.
  • Provisions the complete service image set published to ACR from main instead of rebuilding service images.
  • Adds periodic support to aro-hcp-provision-from-main and waits for all required service images, including customExporter.
  • Removes the generated periodic-healthcheck-images presubmit and updates workflow documentation.
  • Preserves explicit main fetching for periodic and rehearsal jobs while using validated PULL_BASE_SHA for presubmit jobs.
  • Validation covers job generation, ci-operator checks, targeted Prow checks, and shell syntax validation.

Use promoted e2e runner images and resolve the complete main service image set from ACR instead of rebuilding images in each regional periodic healthcheck.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 1, 2026
@openshift-ci

openshift-ci Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

Changes

ARO HCP healthcheck provisioning

Layer / File(s) Summary
Healthcheck image and workflow wiring
ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__periodic-healthcheck.yaml, ci-operator/step-registry/aro-hcp/provision-healthcheck/aro-hcp-provision-healthcheck-workflow.yaml
The healthcheck uses published E2E images and invokes aro-hcp-provision-from-main.
Revision and image-set selection
ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh, ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml
Periodic and rehearsal jobs fetch main. Other jobs use validated PULL_BASE_SHA values. Image selection checks every required service image.
Custom exporter override resolution
ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh
The script resolves, logs, and applies the custom exporter image digest in the generated overrides.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant HealthcheckWorkflow
  participant ProvisionFromMain
  participant Git
  participant ACR
  participant GeneratedOverrides
  HealthcheckWorkflow->>ProvisionFromMain: start provisioning
  ProvisionFromMain->>Git: fetch main or validate PULL_BASE_SHA
  ProvisionFromMain->>ACR: verify complete service image set
  ACR-->>ProvisionFromMain: return available image manifests
  ProvisionFromMain->>ACR: resolve custom exporter digest
  ProvisionFromMain->>GeneratedOverrides: write service image overrides
Loading

Suggested reviewers: gmfrasca

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: healthchecks now reuse promoted images.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only CI YAML, generated job YAML, workflow metadata, and shell provisioning logic; no Ginkgo test declarations or test titles were added or modified.
Test Structure And Quality ✅ Passed The PR changes only YAML and shell files; no Ginkgo or test implementation code appears in the changed paths or diff.
Microshift Test Compatibility ✅ Passed The patch changes only YAML and shell CI configuration; it adds no Go or Ginkgo tests, so MicroShift compatibility review is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR changes only CI YAML and shell configuration; no Ginkgo test files or new It/Describe/Context/When declarations were added.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes only CI configs, generated Prow jobs, a workflow, and a shell script; added lines introduce no pod affinity, topology spread, node selectors, replicas, PDBs, tolerations, or taints.
Ote Binary Stdout Contract ✅ Passed The patch changes only YAML and one provisioning shell script; it adds no Go/OTE binary code, suite setup, klog, or openshift-tests references. Shell echo output is outside the OTE binary contract.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR adds no Ginkgo test declarations or test source files; the healthcheck workflow explicitly does not execute the E2E test suite.
No-Weak-Crypto ✅ Passed The PR adds no MD5, SHA1, DES, RC4, Blowfish, ECB, or custom crypto; image digests are OCI references, and no secret or token comparisons were added.
Container-Privileges ✅ Passed The PR adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or securityContext settings; it removes the periodic image's USER root build stanza.
No-Sensitive-Data-In-Logs ✅ Passed Changed logging reports job/commit and image metadata only; AZURE_CLIENT_SECRET is passed to az login but never echoed, and no password, token, API key, PII, or customer data is logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: roivaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 1, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh`:
- Around line 100-108: Add "${OC_MIRROR_REPO}" to the repository list iterated
by image_set_available in the provisioning command flow, alongside the existing
commit-tagged image repositories. Ensure oc-mirror is validated before the
commit tag is accepted and provisioning proceeds.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b4d92548-f102-48b1-adf0-4fa1be606014

📥 Commits

Reviewing files that changed from the base of the PR and between a69271a and 12dba9b.

⛔ Files ignored due to path filters (2)
  • ci-operator/jobs/Azure/ARO-HCP/Azure-ARO-HCP-main-periodics.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/Azure/ARO-HCP/Azure-ARO-HCP-main-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (4)
  • ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__periodic-healthcheck.yaml
  • ci-operator/step-registry/aro-hcp/provision-healthcheck/aro-hcp-provision-healthcheck-workflow.yaml
  • ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh
  • ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml

Comment on lines +100 to +108
for repo in \
"${BACKEND_REPO}" \
"${FRONTEND_REPO}" \
"${ADMIN_API_REPO}" \
"${SESSIONGATE_REPO}" \
"${FLEET_REPO}" \
"${MGMT_AGENT_REPO}" \
"${KUBE_APPLIER_REPO}" \
"${EXPORTER_REPO}"; do

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Validate the oc-mirror image before accepting the commit tag.

Add ${OC_MIRROR_REPO} to image_set_available. The images-push step publishes oc-mirror with the same commit-derived tag. This loop can otherwise accept a partial image set and start provisioning before oc-mirror is available.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh`
around lines 100 - 108, Add "${OC_MIRROR_REPO}" to the repository list iterated
by image_set_available in the provisioning command flow, alongside the existing
commit-tagged image repositories. Ensure oc-mirror is validated before the
commit tag is accepted and provisioning proceeds.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@roivaz: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-Azure-ARO-HCP-main-e2e-parallel-inplace-upgrade Azure/ARO-HCP presubmit Registry content changed
pull-ci-Azure-ARO-HCP-main-upgrade-e2e-parallel Azure/ARO-HCP presubmit Registry content changed
periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-westus3 N/A periodic Ci-operator config changed
periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-canadacentral N/A periodic Ci-operator config changed
periodic-ci-Azure-ARO-HCP-main-periodic-healthcheck-provision-centralus N/A periodic Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant