Add medik8s Konflux CatalogSource step for RHWA FBC testing#79373
Add medik8s Konflux CatalogSource step for RHWA FBC testing#79373ugreener wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ugreener The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughAdds a medik8s konflux-catalogsource step: ownership metadata and step definition, plus a new bash script that resolves a GitLab commit, verifies a Quay rhwa-fbc image, applies the matching ImageDigestMirrorSet, creates an OLM CatalogSource in openshift-marketplace, and waits with debug on failure. ChangesMedik8s Konflux CatalogSource Step Registry
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested labels
🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-merge-bot
Bot
added
the
rehearsals-ack
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.sh`:
- Around line 11-12: The declaration for OCP_VERSION uses an unguarded expansion
which triggers set -u before main() can validate it; change the declaration to
use a defaulting expansion like RHWA_FBC_COMMIT_SHA (e.g., declare
OCP_VERSION="${OCP_VERSION:-}") so the script does not exit with "unbound
variable" and allow the explicit validation in main() to produce the intended
error message; update the declaration near the top (identifier OCP_VERSION) and
leave main()'s validation intact.
- Around line 14-18: The run() helper currently uses eval which enables shell
injection; change run() to accept positional args (replace eval "$cmd" with exec
of the passed arguments using "$@") and update every caller that currently
builds a single interpolated command string to call run with separate arguments
(e.g., run oc create catalogsource "$CATALOG_SOURCE_NAME" --from-latest and
similarly for commands that include "$OCP_VERSION", "$RHWA_FBC_COMMIT_SHA", and
"$node_name") so all variables are passed as safe separate parameters rather
than interpolated into one string.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 6ad2bf92-429b-425c-b398-eb81ce3f66d4
📒 Files selected for processing (4)
ci-operator/step-registry/medik8s/konflux-catalogsource/OWNERSci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.shci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.metadata.jsonci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.yaml
ugreener
changed the title
ugreener
force-pushed
the
rhwa-konflux-catalogsource
branch
from
ab49550 to
3e31b72
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.sh (1)
61-64: 💤 Low valueFallback tag selection may not retrieve the chronologically latest image.
The
tail -1onskopeo list-tagsoutput selects the last tag in an arbitrary order (typically lexicographic), not the most recently pushed. For 40-character hex commit SHAs, this is effectively random.Since this is fallback behavior when the resolved commit lacks an image, picking any valid tag is acceptable. Consider updating the echo on line 67 from "latest" to "fallback" to avoid confusion:
- echo "Using fallback tag: $latest_tag" + echo "Using fallback tag (arbitrary valid commit): $latest_tag"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.sh` around lines 61 - 64, The fallback tag selection uses latest_tag (set by the skopeo/jq/grep/tail pipeline) but the script still echoes "latest" on failure; update the fallback wording to avoid confusion: change the echo that references "latest" to "fallback" (or similar) so it reads that a fallback tag was selected when latest_tag is used, keeping the existing latest_tag logic intact; locate references to the latest_tag variable and the echo statement near its assignment (the skopeo/jq/grep/tail pipeline and the subsequent echo) and only change the message text.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.sh`:
- Around line 61-64: The fallback tag selection uses latest_tag (set by the
skopeo/jq/grep/tail pipeline) but the script still echoes "latest" on failure;
update the fallback wording to avoid confusion: change the echo that references
"latest" to "fallback" (or similar) so it reads that a fallback tag was selected
when latest_tag is used, keeping the existing latest_tag logic intact; locate
references to the latest_tag variable and the echo statement near its assignment
(the skopeo/jq/grep/tail pipeline and the subsequent echo) and only change the
message text.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 472b2409-db5d-4fb3-908b-a4e5a41738b9
📒 Files selected for processing (4)
ci-operator/step-registry/medik8s/konflux-catalogsource/OWNERSci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.shci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.metadata.jsonci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.yaml
✅ Files skipped from review due to trivial changes (2)
- ci-operator/step-registry/medik8s/konflux-catalogsource/OWNERS
- ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.metadata.json
🚧 Files skipped from review as they are similar to previous changes (1)
- ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.yaml
ugreener
changed the title
ugreener
force-pushed
the
rhwa-konflux-catalogsource
branch
from
3e31b72 to
ac0d097
Compare
Creates a Prow step that dynamically resolves the latest medik8s/RHWA FBC catalog image and IDMS from the dragonfly/rhwa-fbc GitLab repo. Uses commit-SHA pinning to ensure IDMS and catalog image are in sync. The step: - Resolves latest dragonfly/rhwa-fbc commit SHA (or accepts override) - Fetches IDMS (images-mirror-set.yaml) from that commit - Verifies FBC catalog image exists on Quay (with fallback) - Creates CatalogSource using grpcPodConfig.extractContent (OCP 4.15+) - Waits for CatalogSource READY with full debug output on failure No credentials needed — Quay repos are public. Jira: RHWA-990
ugreener
force-pushed
the
rhwa-konflux-catalogsource
branch
from
ac0d097 to
4a8b5bd
Compare
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.sh`:
- Around line 99-117: The ensure_marketplace() function currently returns
immediately if the openshift-marketplace namespace exists, so the pod-security
label keys (security.openshift.io/scc.podSecurityLabelSync,
pod-security.kubernetes.io/enforce, pod-security.kubernetes.io/audit,
pod-security.kubernetes.io/warn) are never applied on the pre-existing path;
change ensure_marketplace to always apply those labels: keep the existing
create-via-heredoc branch for when the namespace is missing, but after creation
(or if it already exists) run an idempotent operation to set/update the labels
(for example by applying the same Namespace manifest via oc apply -f - or by
running oc patch/label with --type=merge to add the four keys), ensuring the
labels are enforced regardless of whether the namespace was newly created or
pre-existing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: d52338c3-7ff1-4397-b3bc-b2c4fe7766f0
📒 Files selected for processing (5)
ci-operator/step-registry/medik8s/OWNERSci-operator/step-registry/medik8s/konflux-catalogsource/OWNERSci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.shci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.metadata.jsonci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.yaml
✅ Files skipped from review due to trivial changes (1)
- ci-operator/step-registry/medik8s/OWNERS
🚧 Files skipped from review as they are similar to previous changes (2)
- ci-operator/step-registry/medik8s/konflux-catalogsource/OWNERS
- ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-ref.yaml
| ensure_marketplace() { | ||
| if oc get ns openshift-marketplace > /dev/null 2>&1; then | ||
| echo "openshift-marketplace namespace exists" | ||
| return 0 | ||
| fi | ||
|
|
||
| echo "Creating openshift-marketplace namespace..." | ||
| cat <<EOF | oc apply -f - | ||
| apiVersion: v1 | ||
| kind: Namespace | ||
| metadata: | ||
| labels: | ||
| security.openshift.io/scc.podSecurityLabelSync: "false" | ||
| pod-security.kubernetes.io/enforce: baseline | ||
| pod-security.kubernetes.io/audit: baseline | ||
| pod-security.kubernetes.io/warn: baseline | ||
| name: openshift-marketplace | ||
| EOF | ||
| } |
There was a problem hiding this comment.
Apply the marketplace labels even when the namespace already exists.
ensure_marketplace() returns as soon as openshift-marketplace is present, so the pod-security labels in Lines 110-114 are never enforced on the common pre-existing-namespace path. That means this step does not actually "ensure" the namespace state it depends on.
Suggested fix
ensure_marketplace() {
- if oc get ns openshift-marketplace > /dev/null 2>&1; then
- echo "openshift-marketplace namespace exists"
- return 0
- fi
-
- echo "Creating openshift-marketplace namespace..."
+ echo "Ensuring openshift-marketplace namespace and labels..."
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
labels:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/medik8s/konflux-catalogsource/medik8s-konflux-catalogsource-commands.sh`
around lines 99 - 117, The ensure_marketplace() function currently returns
immediately if the openshift-marketplace namespace exists, so the pod-security
label keys (security.openshift.io/scc.podSecurityLabelSync,
pod-security.kubernetes.io/enforce, pod-security.kubernetes.io/audit,
pod-security.kubernetes.io/warn) are never applied on the pre-existing path;
change ensure_marketplace to always apply those labels: keep the existing
create-via-heredoc branch for when the namespace is missing, but after creation
(or if it already exists) run an idempotent operation to set/update the labels
(for example by applying the same Namespace manifest via oc apply -f - or by
running oc patch/label with --type=merge to add the four keys), ensuring the
labels are enforced regardless of whether the namespace was newly created or
pre-existing.
|
@ugreener: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
medik8s-konflux-catalogsourcethat dynamically creates an OLM CatalogSource from Konflux FBC artifactsdragonfly/rhwa-fbcGitLab repo and fetches the matching IDMS and FBC catalog image from QuayRHWA_FBC_COMMIT_SHAfor reproducible test runsWhat this step does
dragonfly/rhwa-fbcmain branch via GitLab APIimages-mirror-set.yamlfrom that commit and applies it as IDMSFiles
Test plan
Jira: RHWA-990
Add medik8s-konflux-catalogsource step for Konflux FBC testing
This PR adds a new reusable Prow step to the OpenShift CI (openshift/release) step registry that enables RHWA testing against medik8s operators built with Konflux. The step dynamically creates an OLM CatalogSource that points at a Konflux File-based Catalog (FBC) image tagged with a commit SHA, and ensures the cluster can pull the catalog by applying the matching image mirror set.
What it does (practical effect)
Implementation details (files and logic)
Testing and rollout
Notes for reviewers