Secrets example for onboarding a cluster

[hector-vido]

Summary by CodeRabbit

• Onboards the hvidosil cluster into OpenShift CI infrastructure.
• Adds cluster credentials for Prow services, CI automation, image pulling and pushing, AWS STS, Dex, Thanos, and user secrets.
• Updates credential generation and Google Secret Manager configuration for hvidosil.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 08e77f15-b9bd-4822-9b00-ca61d0df26b0

📥 Commits

Reviewing files that changed from the base of the PR and between bbd3c97 and aff227d.

📒 Files selected for processing (3)

• core-services/ci-secret-bootstrap/_config.yaml
• core-services/ci-secret-bootstrap/gsm-config.yaml
• core-services/ci-secret-generator/_config.yaml

---

Walkthrough

The change adds hvidosil to CI cluster groups, secret targets, registry credential bundles, service-account inputs, and platform integration mappings. It also enables generation of build-farm, registry, bot, scaler, component-monitor, and Thanos credentials.

Changes

hvidosil CI secret integration

Layer / File(s)	Summary
Cluster target registration core-services/ci-secret-bootstrap/_config.yaml, core-services/ci-secret-bootstrap/gsm-config.yaml, core-services/ci-secret-generator/_config.yaml	Adds hvidosil to CI cluster groups, user-secret targets, and credential-generation lists.
Registry credential bundles core-services/ci-secret-bootstrap/_config.yaml, core-services/ci-secret-bootstrap/gsm-config.yaml	Adds image-puller, registry-pull, and manifest-tool image-pusher credentials for hvidosil.
Service-account secret inputs core-services/ci-secret-bootstrap/_config.yaml, core-services/ci-secret-bootstrap/gsm-config.yaml	Adds hvidosil configuration and token inputs for CI platform services and cluster initialization.
Platform integration mappings core-services/ci-secret-bootstrap/_config.yaml, core-services/ci-secret-generator/_config.yaml	Adds Thanos TLS, Dex/OIDC, AWS STS, registry authentication, CI chat bot, pod scaler, and component-monitor mappings.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• openshift/release#83086: Adds another cluster profile to related CI secret configuration and cluster-group targets.

Suggested reviewers: prucek

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the addition of secret configurations for onboarding the hvidosil cluster.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only three YAML configuration files; added-line and changed-path scans found no Ginkgo test declarations or test titles to assess.
Test Structure And Quality	✅ Passed	The pull request changes only three YAML configuration files; it adds no Ginkgo tests or cluster operations to review.
Microshift Test Compatibility	✅ Passed	The diff changes only three YAML configuration files and adds no Ginkgo tests or MicroShift-sensitive API references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only three YAML configuration files and adds no Ginkgo tests or test code, so SNO test compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only three secret-configuration YAML files, adding cluster and credential targets; it adds no deployment manifests, controller code, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The patch changes only three YAML configuration files and adds no OTE binary, suite setup, or process-level stdout/logging code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only three YAML configuration files; no Ginkgo tests, IPv4-specific test logic, or test external-connectivity code was added.
No-Weak-Crypto	✅ Passed	The three changed YAML files add cluster and credential mappings only; scans of all 217 additions found no weak algorithms, crypto implementations, or secret/token comparisons.
Container-Privileges	✅ Passed	The PR changes only secret-management configuration files. All 217 added lines contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only YAML secret references and cluster targets. The diff contains no logging, print, stdout, or stderr statements and no literal token or key material.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@hector-vido: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[hector-vido]

/retest

[deepsm007]

/lgtm

temporary for documentation and will be decommissioned

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007, hector-vido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS [deepsm007,hector-vido]
• core-services/ci-secret-generator/OWNERS [deepsm007,hector-vido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@hector-vido: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

@hector-vido: Updated the following 20 configmaps:

• gsm-config configmap in namespace ci at cluster build10 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• ci-secret-generator configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-generator/_config.yaml
• ci-secret-bootstrap configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• gsm-config configmap in namespace ci at cluster build05 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster core-ci using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster vsphere02 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build13 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build12 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build03 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build06 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build07 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build08 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build09 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build04 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• ci-secret-generator configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-generator/_config.yaml
• ci-secret-bootstrap configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• gsm-config configmap in namespace ci at cluster build02 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster app.ci using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build01 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml
• gsm-config configmap in namespace ci at cluster build11 using the following files:
  • key gsm-config.yaml using file core-services/ci-secret-bootstrap/gsm-config.yaml

Details

In response to this:

Summary by CodeRabbit

• Onboards the hvidosil cluster into OpenShift CI infrastructure.
• Adds cluster credentials for Prow services, CI automation, image pulling and pushing, AWS STS, Dex, Thanos, and user secrets.
• Updates credential generation and Google Secret Manager configuration for hvidosil.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.