Skip to content

ROSAENG-58795 | task: add nested podman image for on-demand to rosa-clusters-service#82109

Open
davidleerh wants to merge 3 commits into
openshift:mainfrom
davidleerh:ROSAENG-58795-PODMAN
Open

ROSAENG-58795 | task: add nested podman image for on-demand to rosa-clusters-service#82109
davidleerh wants to merge 3 commits into
openshift:mainfrom
davidleerh:ROSAENG-58795-PODMAN

Conversation

@davidleerh

@davidleerh davidleerh commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • Updates the ROSA clusters service Konflux configuration (ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml) to build and use a new nested Podman-based golang-plus image: adds base_images.nested-podman and defines images.items to create golang-plus via an inline dockerfile_literal that installs build tooling (git, go, make, jq, python3/pip, skopeo) and fetches the OpenShift CLI (oc) on top of nested-podman, copying the repo src into /opt/app-root/src/rosa-clusters-service.
  • Adjusts the ROSA clusters service PR check jobs (pr-check-rosa-hcp, pr-check-aws, pr-check-gcp, pr-check-rosa-classic, pr-check-core) to run with nested Podman enabled by setting capabilities: [nested-podman] and nested_podman: true, switching their container.from from src to the new golang-plus image while keeping the existing ./pr_check.sh --<target> command variants and mounting the rosa-clusters-service-sandbox secret at /usr/local/rosa-clusters-service-sandbox.

@openshift-ci

openshift-ci Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidleerh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 17, 2026
@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 34f118f5-4b51-45ea-b2d3-e7b84940912d

📥 Commits

Reviewing files that changed from the base of the PR and between 2fef0b4 and 21a37c1.

📒 Files selected for processing (1)
  • ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml

Walkthrough

The Konflux configuration replaces the image-stream-tag build root with a nested-Podman-based golang-plus image containing required tooling. ROSA cluster service PR checks now use that image and enable nested-Podman execution.

Changes

ROSA clusters service CI

Layer / File(s) Summary
Build the golang-plus image
ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml
Defines a nested-podman base image and builds golang-plus with required tooling and the service source.
Run PR checks with nested Podman
ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml
Updates the pr-check-* jobs to use golang-plus, enable nested-Podman support, and retain existing commands and secret mounts.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

Suggested labels: rehearsals-ack

Suggested reviewers: andreadecorte, robpblake

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the main change: adding a nested Podman image for on-demand use in rosa-clusters-service.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The only changed test/job names are static CI identifiers (pr-check-rosa-hcp, aws, gcp, rosa-classic, core); no Ginkgo titles or dynamic values appear.
Test Structure And Quality ✅ Passed Only a ci-operator YAML config file changed; no Ginkgo test code was modified, so this quality check is not applicable.
Microshift Test Compatibility ✅ Passed Only CI config changed; no new or edited Ginkgo e2e tests or MicroShift-unsafe APIs/features were introduced.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; only CI config/presubmit jobs changed, so the SNO test check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed Only a ci-operator config changed; the diff adds a build image and nested-podman test flags, with no affinity, nodeSelector, spread, or PDB scheduling constraints.
Ote Binary Stdout Contract ✅ Passed PR only updates ci-operator YAML for nested-podman/golang-plus jobs; no process-level source or suite setup was changed, so stdout contract risk is absent.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed This PR only changes CI config; it adds no new Ginkgo e2e tests or test code with IPv4/external-network assumptions.
No-Weak-Crypto ✅ Passed The PR only adjusts CI config for nested-podman and build images; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto was found.
Container-Privileges ✅ Passed PASS: the PR only changes the builder image; no privileged, hostPID/hostNetwork/hostIPC, allowPrivilegeEscalation, or SYS_ADMIN fields were added.
No-Sensitive-Data-In-Logs ✅ Passed The diff only adds nested-podman image/config and keeps pr_check commands; no new logging of secrets, tokens, or PII appears.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: job(s): pr-check-rosa-hcp either don't exist or were not found to be affected, and cannot be rehearsed

@davidleerh

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 17, 2026
@davidleerh

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml (1)

56-64: 📐 Maintainability & Code Quality | 🔵 Trivial

Run make update for this ci-operator config change. Regenerate the corresponding Prow jobs so the generated config stays in sync.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`
around lines 56 - 64, Run make update to regenerate the corresponding Prow jobs
for the modified ci-operator configuration, ensuring generated files remain
synchronized with the changes near the nested_podman and pr_check.sh settings.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`:
- Around line 16-17: Update the Dockerfile COPY instruction so the repository
contents are copied directly into /opt/app-root/src/rosa-clusters-service,
matching the WORKDIR used by subsequent commands such as ./pr_check.sh. Keep the
existing WORKDIR unchanged.

---

Nitpick comments:
In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`:
- Around line 56-64: Run make update to regenerate the corresponding Prow jobs
for the modified ci-operator configuration, ensuring generated files remain
synchronized with the changes near the nested_podman and pr_check.sh settings.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2a4c0290-2be7-41c4-9a8b-09b08441240c

📥 Commits

Reviewing files that changed from the base of the PR and between e66af52 and b908e64.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (1)
  • ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml

@openshift-merge-bot openshift-merge-bot Bot removed the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 17, 2026
@davidleerh

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@davidleerh: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-online-rosa-clusters-service-konflux-master-images openshift-online/rosa-clusters-service presubmit Presubmit changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-check-migrations openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-lint openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-aws openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-core openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-gcp openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-classic openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp openshift-online/rosa-clusters-service presubmit Ci-operator config changed
pull-ci-openshift-online-rosa-clusters-service-konflux-master-unit openshift-online/rosa-clusters-service presubmit Ci-operator config changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@davidleerh

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

@davidleerh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/openshift-online/rosa-clusters-service/konflux-master/pr-check-rosa-hcp 21a37c1 link unknown /pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@davidleerh

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant