CNTRLPLANE-3434: hypershift-install: add OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE parameter by Nirshal · Pull Request #81877 · openshift/release

Nirshal · 2026-07-14T14:59:19Z

What

Adds a new OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE step parameter to the hypershift-install ref that allows callers to override both the HyperShift Operator image and the hcp CLI binary used during installation.

Why

ci-operator's OVERRIDE_IMAGE_* env var mechanism has a race condition when the same tag exists in base_images: both the override and the base_images import create concurrent InputImageTagStep nodes targeting the same pipeline ImageStream tag. Since ImageStreamTag create is an upsert and the base_images step finishes last (it calls resolveOfficialImport which makes API calls, while the override has the pullspec ready), the override is silently discarded. The --dependency-override-param CLI flag would work, but Gangway only supports env vars in the payload, not CLI arguments.

This new parameter bypasses the pipeline ImageStream entirely: the image pullspec is passed directly from the Gangway payload to the install script, avoiding the race condition.

Gangway transport workaround

ci-operator does not strip the MULTISTAGE_PARAM_OVERRIDE_ prefix when injecting env vars into step pods. The step receives the full variable name as-is. This is the same behavior used by hypershift-mce-install (see MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HO_IMAGE / MULTISTAGE_PARAM_OVERRIDE_MCE_VERSION in that step).

To support Gangway callers (e.g. the HO release controller), the ref YAML declares both:

OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE (for direct use in job configs)
MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE (Gangway transport)

The script copies the prefixed variable into the unprefixed one at startup, before any override logic runs.

What changed

hypershift-install-ref.yaml:

Added OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE parameter (default: empty)
Added MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE transport parameter (default: empty)

hypershift-install-commands.sh:

Extracted duplicated CLI extraction logic into extract_hcp_cli() function using mktemp -d (CWE-377)
Added Gangway transport: copies MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE into OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE at startup
Added OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE as the highest-priority branch in the existing if/elif chain (before HO_MULTI and INSTALL_FROM_LATEST)
When set, overrides both OPERATOR_IMAGE and extracts the hcp CLI from the same image to avoid version skew
Added WARNING log lines to all override paths for better observability
Added precedence warning when multiple override flags are set simultaneously
Fixed set -e compatibility: replaced [[ ]] && ((COUNT++)) with if/then/fi and arithmetic assignment (the ((0++)) expression returns exit code 1 under bash 4.x/5.x, killing the script)
Added --confirm to oc image extract (temp dir is non-empty after pull-secret extraction)

How to use

In a Gangway payload:

{
  "job_name": "periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aks",
  "pod_spec_options": {
    "envs": {
      "MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE": "quay.io/my-repo/hypershift-operator@sha256:abc123..."
    }
  }
}

Or in a job config:

env:
  OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE: "quay.io/my-repo/hypershift-operator@sha256:abc123..."

Impact

No behavioral change for existing jobs: the parameter defaults to empty and the if branch is skipped
HO_MULTI and INSTALL_FROM_LATEST behavior is preserved (refactored, not changed)
New WARNING log lines are informational only

Summary by CodeRabbit

Updates the hypershift-install step registry (ci-operator/step-registry/hypershift/install) to add a new OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE parameter (default empty) that lets job authors provide an Operator image pullspec directly, bypassing pipeline ImageStream dependency resolution and avoiding an OVERRIDE_IMAGE_* race with base_images.
Adds a companion transport parameter MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE; at runtime the step copies it into OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE so Gangway-style MULTISTAGE_PARAM_OVERRIDE_ wiring works as intended.
Refactors the install script to use the effective image override consistently: when OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE is set, it’s used for both the HyperShift Operator and the hcp CLI by extracting linux/amd64 hypershift from that image and setting HCP_CLI to the extracted binary path.
Introduces precedence-aware operator-image selection across OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE, HO_MULTI, and INSTALL_FROM_LATEST, including warning logs when multiple are enabled (override image > HO_MULTI > INSTALL_FROM_LATEST), while preserving the prior behavior when no override is specified.

…meter OVERRIDE_IMAGE_HYPERSHIFT_OPERATOR (ci-operator's env var mechanism) has a race condition: both the override and the base_images step write to the same pipeline ImageStream tag concurrently. Since IST Create is an upsert, the base_images step consistently wins because it finishes last (resolveOfficialImport makes API calls, the override does not). The override is silently discarded. --dependency-override-param would work, but Gangway only supports env vars in the payload, not CLI arguments. This commit adds OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE as a step parameter that bypasses the pipeline ImageStream entirely. When set, the script overrides both the operator image (--hypershift-image) and the hcp CLI binary, extracting it from the same image to avoid version skew. Also refactors the existing HO_MULTI and INSTALL_FROM_LATEST branches into a shared extract_hcp_cli() function and adds WARNING log lines to all override paths for better observability. Ref: CNTRLPLANE-3434 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot · 2026-07-14T14:59:24Z

@Nirshal: This pull request references CNTRLPLANE-3434 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What

Adds a new OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE step parameter to the hypershift-install ref that allows callers to override both the HyperShift Operator image and the hcp CLI binary used during installation.

Why

ci-operator's OVERRIDE_IMAGE_* env var mechanism has a race condition when the same tag exists in base_images: both the override and the base_images import create concurrent InputImageTagStep nodes targeting the same pipeline ImageStream tag. Since ImageStreamTag create is an upsert and the base_images step finishes last (it calls resolveOfficialImport which makes API calls, while the override has the pullspec ready), the override is silently discarded. The --dependency-override-param CLI flag would work, but Gangway only supports env vars in the payload, not CLI arguments.

This new parameter bypasses the pipeline ImageStream entirely: the image pullspec is passed directly from the Gangway payload to the install script via MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE, avoiding the race condition.

What changed

hypershift-install-ref.yaml:

Added OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE parameter (default: empty)

hypershift-install-commands.sh:

Extracted duplicated CLI extraction logic into extract_hcp_cli() function

Added OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE as the highest-priority branch in the existing if/elif chain (before HO_MULTI and INSTALL_FROM_LATEST)

When set, overrides both OPERATOR_IMAGE and extracts the hcp CLI from the same image to avoid version skew

Added WARNING log lines to all override paths (OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE, HO_MULTI, INSTALL_FROM_LATEST) for better observability in build logs

How to use

In a Gangway payload:
{
 "job_name": "periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aks",
 "pod_spec_options": {
   "envs": {
     "MULTISTAGE_PARAM_OVERRIDE_OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE": "quay.io/my-repo/hypershift-operator@sha256:abc123..."
   }
 }
}
Or in a job config:
env:
 OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE: "quay.io/my-repo/hypershift-operator@sha256:abc123..."
Impact

No behavioral change for existing jobs: the parameter defaults to empty and the if branch is skipped

HO_MULTI and INSTALL_FROM_LATEST behavior is preserved (refactored, not changed)

New WARNING log lines are informational only

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-14T14:59:55Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

HyperShift installation centralizes CLI extraction in a helper and adds precedence-aware selection for an optional operator image override. The step registry declares the override and its multistage transport variable.

Changes

HyperShift installation image selection

Layer / File(s)	Summary
Override configuration and precedence `ci-operator/step-registry/hypershift/install/hypershift-install-ref.yaml`, `ci-operator/step-registry/hypershift/install/hypershift-install-commands.sh`	Declares the operator image override, forwards its multistage value, counts active installation modes, and applies override > HO_MULTI > install-from-latest precedence.
CLI extraction and install wiring `ci-operator/step-registry/hypershift/install/hypershift-install-commands.sh`	Extracts the pull-secret and `linux/amd64` HyperShift binary from the selected image, makes it executable, and assigns its path to `HCP_CLI`.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant InstallConfig
  participant InstallScript
  participant OperatorImage
  InstallConfig->>InstallScript: provide image override or install mode
  InstallScript->>InstallScript: resolve effective operator image
  InstallScript->>OperatorImage: extract pull-secret and linux/amd64 hypershift
  OperatorImage-->>InstallScript: return hypershift binary
  InstallScript->>InstallScript: set HCP_CLI

Suggested reviewers: mgencur, enxebre

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	New WARNING logs print raw image pullspecs, including OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE, which can expose private registry hostnames or repo paths.	Avoid logging full pullspecs; use generic warnings or redact registry/repo values, and suppress shell xtrace around sensitive args if needed.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes a shell script and YAML; no Ginkgo test titles (It/Describe/Context/When) were added or modified.
Test Structure And Quality	✅ Passed	PR only touches hypershift-install shell/YAML; no Ginkgo test files were modified, so the test-quality checklist is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes a shell script and step YAML, with no MicroShift-incompatible APIs or resources introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only changes a shell step and YAML parameters, so SNO test compatibility is not implicated.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a CI step script and ref YAML changed; no manifests/controllers, no node selectors, affinity, spread, replica, or topology-dependent scheduling logic.
Ote Binary Stdout Contract	✅ Passed	Only a shell step script and YAML changed; no OTE binary main/init/TestMain code or stdout contract issue is present.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the diff only changes install script/YAML and contains no IPv4-only assertions or test connectivity logic.
No-Weak-Crypto	✅ Passed	The changed shell/YAML only add image-override logic and pull-secret handling; no weak algorithms, custom crypto, or secret/token comparisons appear.
Container-Privileges	✅ Passed	Changed files only add env/ref and shell logic; no privileged, host* or allowPrivilegeEscalation settings were introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding the OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE parameter to hypershift-install.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci-operator/step-registry/hypershift/install/hypershift-install-commands.sh`:
- Around line 18-23: Update the override warning in the hypershift install
command flow to report the effective baseline image selected by the same
HO_MULTI rules as the no-override path, rather than always labeling
HYPERSHIFT_RELEASE_LATEST as the default. Keep the override assignment and
extract_hcp_cli behavior unchanged.
- Around line 11-15: Update the installation flow around the oc extract, oc
image extract, chmod, and HCP_CLI assignments to create a private unpredictable
temporary directory with mktemp -d, use it for both pull-secret extraction and
the hypershift CLI extraction, and reference the resulting paths instead of /tmp
locations. Add cleanup of the temporary directory after installation while
preserving HCP_CLI usability.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: fe60077d-1eed-45e2-a779-4a5e9c5e97c9

📥 Commits

Reviewing files that changed from the base of the PR and between 334c674 and 1f0b907.

📒 Files selected for processing (2)

ci-operator/step-registry/hypershift/install/hypershift-install-commands.sh
ci-operator/step-registry/hypershift/install/hypershift-install-ref.yaml

…nflicting overrides Address CodeRabbit review feedback: 1. Replace hardcoded /tmp/hs-cli with mktemp -d to avoid predictable temporary paths in the extract_hcp_cli function (CWE-377). 2. Add precedence warning when multiple image override flags are set simultaneously (OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE, HO_MULTI, INSTALL_FROM_LATEST). Logs the priority order so operators can understand which override takes effect without inspecting the script. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nirshal · 2026-07-14T15:56:51Z

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-aks pull-ci-openshift-hypershift-main-e2e-aws pull-ci-openshift-hypershift-main-e2e-azure-v2-self-managed periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aks-multi-x-ax pull-ci-openshift-hypershift-main-e2e-aws-upgrade-hypershift-operator

openshift-merge-bot · 2026-07-14T15:59:04Z