fix: wait for MCP rollout before creating CatalogSource in quay e2e tests#79379
fix: wait for MCP rollout before creating CatalogSource in quay e2e tests#79379harishsurf wants to merge 1 commit into
Conversation
The enable-quay-catalogsource step was creating the CatalogSource before nodes had the updated pull secret. The ICSP and pull secret changes trigger an MCP rollout, and nodes can't pull from the Konflux registry until that rollout completes. Moving wait_mcp_ready before create_catalog_source ensures nodes have credentials before the catalog pod attempts to pull the FBC image. Without this fix, the catalog pod hits ImagePullBackOff with "unauthorized: access to the requested resource is not authorized" and the test times out. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR reorders function calls in the Quay catalog source setup script for unreleased FBC images. The ChangesMCP Readiness Orchestration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: harishsurf The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
[REHEARSALNOTIFIER]
A total of 48 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@harishsurf: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
wait_mcp_readyto run beforecreate_catalog_sourcein theenable-quay-catalogsourcestepImagePullBackOff: unauthorizedfor the FBC imageRoot Cause
The
enable-quay-catalogsourcestep was calling functions in this order:update_pull_secret— adds Konflux auth to global pull secretcreate_icsp— triggers MCP rollout (nodes need to restart CRI-O)create_catalog_source— OLM creates catalog pod immediatelycheck_catalog_source_status— waits 600s, times outwait_mcp_ready— nodes finally have credentials, but too lateThe catalog pod hits
ImagePullBackOffbecause the node's CRI-O still has the old pull secret without Konflux auth.Fix
Move
wait_mcp_readybeforecreate_catalog_source:update_pull_secretcreate_icspwait_mcp_ready— wait for nodes to have credentialscreate_catalog_source— now pods can pullcheck_catalog_source_statusEvidence
From must-gather pod YAML (
fbc-operator-catalog-snvkw):Affected Prow jobs:
periodic-ci-quay-quay-tests-master-quay-api-quay-e2e-tests-quay316-api-testing/2055341040251965440periodic-ci-quay-quay-tests-master-quay-api-quay-e2e-tests-quay316-api-testing/2054988676785508352Test plan
fbc-operator-catalogpod can pull the FBC image successfully🤖 Generated with Claude Code
Fix: Wait for MCP rollout before creating CatalogSource
This PR fixes the Quay CatalogSource installation process in OpenShift CI by correcting the orchestration order of operations in the
enable-quay-catalogsourceProw step.Problem
When installing the Quay operator from a custom FBC (File-Based Catalog) image, the script updates the global pull secret and creates an ImageContentSourcePolicy (ICSP) to redirect image pulls to the Konflux registry. This triggers a MachineConfigPool (MCP) rollout where worker nodes must restart CRI-O to pick up the new registry credentials. Previously, the CatalogSource pod was created before this MCP rollout completed, causing it to fail with
ImagePullBackOffdue to unauthorized access when attempting to pull the FBC image with outdated node credentials.Solution
Reorders the execution sequence in the custom catalog path so that
wait_mcp_readyexecutes after creating the ICSP but before creating the CatalogSource. The new sequence is:This ensures nodes have fully applied the new pull credentials before the CatalogSource pod attempts to pull images.
Affected CI
periodic-ci-quay-quay-tests-master-quay-api-quay-e2e-tests-quay316-api-testing)ci-operator/step-registry/quay-tests/enable-quay-catalogsource/quay-tests-enable-quay-catalogsource-commands.sh