[ROSAENG-62740] Add image-puller service account for hp-sre-rosa-ci

[bmeng]

Adding new service account for image pull from registry.ci.openshift.org for automation purpose.
Using the existing hp-sre-rosa-ci namespace.
Also grant the permission to the existing hp-sre-rosa-ci group the permission to create the serviceaccount token

Summary by CodeRabbit

Adds an image-puller ServiceAccount in the hp-sre-rosa-ci namespace for CI automation to pull images from registry.ci.openshift.org.

Grants the ServiceAccount image-pull access across namespaces. Grants the hp-sre-rosa-ci group viewer access and permission to create tokens for the ServiceAccount.

[coderabbitai]

Walkthrough

The manifest adds an image-puller ServiceAccount and RBAC bindings for cluster-wide image pulling, namespace viewing, and ServiceAccount token creation.

Changes

Registry access RBAC

Layer / File(s)	Summary
Image-puller identity and cluster access clusters/app.ci/registry-access/hp-sre-rosa-ci/admin_manifest.yaml	Adds the image-puller ServiceAccount with token automount disabled. Binds it to the system:image-puller ClusterRole across namespaces.
Namespace viewing and token creation clusters/app.ci/registry-access/hp-sre-rosa-ci/admin_manifest.yaml	Grants the hp-sre-rosa-ci group namespace viewing and permission to create tokens for the image-puller ServiceAccount.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: jira/valid-reference

Suggested reviewers: droslean, deepsm007

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit adds only one YAML RBAC manifest. It contains no Ginkgo test declarations or test titles, so no unstable test name exists.
Test Structure And Quality	✅ Passed	The pull request adds only one Kubernetes YAML manifest; it contains no Ginkgo tests or test paths, so the listed test-quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The pull request adds only a Kubernetes RBAC manifest and no Ginkgo e2e tests, so MicroShift test compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds only a Kubernetes YAML manifest and no Ginkgo e2e tests, so the SNO test compatibility rules do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The only changed file adds a ServiceAccount, ClusterRoleBinding, RoleBinding, and Role; it adds no workloads or scheduling fields such as affinity, replicas, selectors, or tolerations.
Ote Binary Stdout Contract	✅ Passed	The PR content is a Kubernetes YAML manifest only; it contains no OTE binary, suite setup, process-level code, or stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only one Kubernetes manifest and adds no Ginkgo e2e tests, so IPv4 or external-connectivity test compatibility is not applicable.
No-Weak-Crypto	✅ Passed	The commit adds only Kubernetes RBAC YAML; added content contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The manifest contains only a ServiceAccount and RBAC resources. It has no containers or privileged fields such as hostPID, hostNetwork, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The only changed file is an RBAC manifest. It adds no logging statements and contains no literal passwords, tokens, API keys, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of the image-puller ServiceAccount for the hp-sre-rosa-ci namespace.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@clusters/app.ci/registry-access/hp-sre-rosa-ci/admin_manifest.yaml`:
- Around line 39-51: Replace the RoleBinding’s ClusterRole reference to
pull-secret-namespace-manager with a namespace-scoped Role dedicated to the
token-creation objective. Define or reuse a Role in namespace hp-sre-rosa-ci
that grants only create on serviceaccounts/token, and keep the hp-sre-rosa-ci
group subject bound to that Role; do not retain wildcard access to secrets,
serviceaccounts, configmaps, or imagestreams.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bf93d4bd-e890-4bb5-8d8f-42a26ac64e7a

📥 Commits

Reviewing files that changed from the base of the PR and between 21f2892 and cece69d.

📒 Files selected for processing (1)

• clusters/app.ci/registry-access/hp-sre-rosa-ci/admin_manifest.yaml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@clusters/app.ci/registry-access/hp-sre-rosa-ci/admin_manifest.yaml`:
- Around line 1-6: Update the image-puller ServiceAccount manifest to set
automountServiceAccountToken to false, while preserving its existing metadata
and explicit serviceaccounts/token permission behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ff1420da-ba2c-4622-b5f2-ed3e137dd9ee

📥 Commits

Reviewing files that changed from the base of the PR and between 21f2892 and b442fb8.

📒 Files selected for processing (1)

• clusters/app.ci/registry-access/hp-sre-rosa-ci/admin_manifest.yaml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bmeng: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@bmeng: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bmeng, Prucek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/OWNERS [Prucek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment