[release-controller] Vanity URL updates for the new AMD64 OKD controller

[bradmwilliams]

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED

Summary by CodeRabbit

• Updates the cert-manager release controller ingress for the new AMD64 OKD controller.
• Adds the arm64.origin.releases.ci.openshift.org vanity URL.
• Routes AMD64, ARM64, and generic origin release hosts to architecture-specific OKD API services.
• Pins rh-pre-commit to version 2.4.0 with secret checking enabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8865aab9-a745-4d56-8fb4-4c576374e80f

📥 Commits

Reviewing files that changed from the base of the PR and between 8aae492 and 8af6ca6.

📒 Files selected for processing (1)

• clusters/app.ci/cert-manager/release-controller_ingress.yaml

---

Walkthrough

The release-controller ingress now covers the arm64 origin host and routes amd64, arm64, and generic origin hosts to the appropriate OKD API services.

Changes

Release controller ingress routing

Layer / File(s)	Summary
Architecture-specific ingress routing clusters/app.ci/cert-manager/release-controller_ingress.yaml	The ingress adds arm64 TLS coverage. It routes amd64 and arm64 origin hosts to their architecture-specific OKD API services. The generic origin host now uses the OKD API service.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: updating vanity URLs for the new AMD64 OKD controller.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only an ingress YAML file. The parent diff contains no Ginkgo test constructs or test titles, so it introduces no unstable test names.
Test Structure And Quality	✅ Passed	The pull request changes only one Ingress YAML file and adds no Ginkgo test code, so the listed test-quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The pull request changes only one Ingress YAML file and adds no Ginkgo e2e tests, so MicroShift test compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only one Ingress YAML file. The patch adds or updates host routing and adds no Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The change is an Ingress routing manifest only. It adds hosts and service backends and introduces no replicas, affinity, topology spread, node selection, toleration, or PDB constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only an Ingress YAML file. It adds no OTE binary, main or suite setup, logging, or stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only a Kubernetes Ingress manifest. It adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The commit changes only an Ingress manifest with host and service routing; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons are present.
Container-Privileges	✅ Passed	The only changed file is an Ingress manifest; the patch changes hosts and services only and adds no privileged, host namespace, SYS_ADMIN, escalation, or root settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes only ingress TLS hosts and backend service names. It adds no logging, credentials, tokens, PII, session IDs, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jupierce]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bradmwilliams, jupierce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/OWNERS [jupierce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bradmwilliams: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[openshift-ci]

@bradmwilliams: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.