[DEBUG][DO NOT MERGE]

[tbuskey]

/hold

Summary by CodeRabbit

• Updates the downstream Sandboxed Containers Operator Azure IPI CI job to restrict network access, use refreshed OSC and Helm chart images, upgrade Kata RPMs, enable Trustee installation, and run the C00316 scenario after an 8-hour delay.
• Refreshes Trustee operator documentation with simplified single-line podman build examples and reordered build arguments.

[coderabbitai]

Walkthrough

The Azure IPI COCO job now uses updated images and runtime settings, restricts network access, selects scenario C00316, and enables Trustee installation. Trustee chart build examples were also reformatted and reordered.

Changes

Trustee-enabled job configuration

Layer / File(s)	Summary
Update Azure IPI COCO job inputs ci-operator/config/openshift/sandboxed-containers-operator/...candidate422.yaml	The job enables restricted networking and Trustee installation, adds Trustee and Helm chart images, and updates Kata, sleep, catalog, and scenario settings.
Refresh Trustee chart build examples ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/README.md	Build variable ordering and podman build examples are updated to use inline arguments and single-line commands.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#81964: Configures Trustee installation and related chart image inputs.

Suggested labels: do-not-merge/work-in-progress

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is a debug placeholder and does not describe the actual configuration and README updates.	Replace it with a concise summary of the main change, such as updating sandboxed-containers operator CI config and Trustee Helm chart docs.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only a CI YAML and README changed; no Ginkgo It/Describe/Context/When titles were added or edited.
Test Structure And Quality	✅ Passed	No Ginkgo test code was changed; this PR only updates CI config and a README, so the test-structure checklist is not applicable.
Microshift Test Compatibility	✅ Passed	Only ci-operator config and README changed; no Ginkgo test definitions or MicroShift-unsafe APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only a CI YAML and README changed; no new Ginkgo tests or SNO-sensitive assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The PR only changes CI job env/config and README docs; no deployment manifests, controllers, affinities, spread constraints, node selectors, or replica logic were added.
Ote Binary Stdout Contract	✅ Passed	PR only edits CI config and a README; no process-level binary code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only changes CI config and README; no Ginkgo test code or IPv4/network-logic was added, so the check is not applicable.
No-Weak-Crypto	✅ Passed	Touched files only change CI config and README text; no weak crypto, custom crypto, or secret comparisons are introduced.
Container-Privileges	✅ Passed	Changed files only adjust CI env/network settings and README docs; no privileged, host*, SYS_ADMIN, root, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	Only docs and CI env/config changed; no log statements or secret/PII-like values were added, and the only hostname shown is an example placeholder.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tbuskey

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/sandboxed-containers-operator/OWNERS [tbuskey]
• ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/OWNERS [tbuskey]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/README.md`:
- Around line 72-79: Fix the variable-name mismatch in the README build examples
by making the `CHARTS_TAGS` definition and both `podman build` references use
the same variable name, preserving the intended chart tag value passed through
`--build-arg CHARTS_TAG`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: cd7c918b-5079-4b18-8d89-317a39d02199

📥 Commits

Reviewing files that changed from the base of the PR and between 7b9efe0 and 8e0a2e0.

📒 Files selected for processing (2)

• ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml
• ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/README.md

[openshift-ci]

@tbuskey: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tbuskey]

/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-coco

[tbuskey]

/pj-rehearse list

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[tbuskey]

/pj-rehearse list

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[tbuskey]

/pj-rehearse list

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[tbuskey]

/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-coco

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[tbuskey]

/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-coco

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[tbuskey]

/pj-rehearse list

[openshift-merge-bot]

@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.