ci-staging: back job-configs-nfs on app.ci with AWS EFS

[Prucek]

Summary

• Installs the AWS EFS CSI driver operator on app.ci (Subscription + ClusterCSIDriver + CredentialsRequest for auto-provisioned credentials via CCO Mint mode, same mechanism as the existing EBS driver)
• Binds the job-configs-nfs PVC (already referenced by ci-staging's hook/horologium/tide/prow-controller-manager/statusreconciler manifests but never defined in git) to a static PV backed by a newly created EFS filesystem

Depends on #83268 (whitelists PersistentVolume and CredentialsRequest in the app-ci ArgoCD AppProject) — cluster-manifest-verifier validates new resource kinds against the AppProject already live on the Argo CD server, so that PR must merge first.

[coderabbitai]

Walkthrough

The change installs the AWS EFS CSI driver, provisions its AWS credentials, documents the credential secret, and adds a retained 10Gi EFS-backed PersistentVolume with an explicitly bound staging claim.

Changes

AWS EFS storage integration

Layer / File(s)	Summary
EFS CSI driver setup clusters/app.ci/aws-efs-csi-driver/credentialsrequest.yaml, clusters/app.ci/aws-efs-csi-driver/operator.yaml	Adds AWS permissions, credential references, service accounts, the operator subscription, and a managed ClusterCSIDriver.
Staging EFS volume binding clusters/app.ci/prow/staging/job-configs-efs.yaml	Adds a retained 10Gi PersistentVolume and an explicitly bound ReadWriteMany PersistentVolumeClaim for ci-staging.
Credential inventory documentation clusters/app.ci/prow/staging/admin_secrets_inventory.yaml	Documents the EFS cloud-credentials secret, its provisioning, consumer, AWS resources, and filesystem reference.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CredentialsRequest
  participant CloudCredentialOperator
  participant EFSCSI
  participant PersistentVolumeClaim
  participant PersistentVolume
  participant AWS EFS
  CredentialsRequest->>CloudCredentialOperator: Request EFS and EC2 permissions
  CloudCredentialOperator->>EFSCSI: Provision aws-efs-cloud-credentials
  EFSCSI->>PersistentVolume: Use efs.csi.aws.com
  PersistentVolumeClaim->>PersistentVolume: Bind job-configs-nfs to job-configs-efs
  PersistentVolume->>AWS EFS: Reference the fixed filesystem handle

Loading

Possibly related PRs

• openshift/release#83268: Enables the EFS PersistentVolume, CredentialsRequest, and job-configs-nfs storage resources.

Suggested reviewers: deepsm007, danilo-gemoli

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The complete four-file diff adds only YAML manifests and comments; it contains no Ginkgo It, Describe, Context, or When test titles.
Test Structure And Quality	✅ Passed	The PR changes only Kubernetes YAML manifests; it adds or modifies no Ginkgo test code, so the listed test-quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The PR adds only YAML manifests and documentation; the parent-to-HEAD diff contains no Ginkgo tests or It/Describe/Context/When constructs to assess.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds only YAML manifests and documentation; no new Ginkgo e2e tests or It/Describe/Context/When blocks require SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The four PR-added manifests contain no node selectors, affinities, topology spreads, tolerations, replica counts, PDBs, or rollout constraints.
Ote Binary Stdout Contract	✅ Passed	The PR diff adds only four YAML manifests; no OTE binary source, entrypoint, suite setup, or process-level stdout write is introduced or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit adds only two YAML manifests and no Go or Ginkgo e2e tests, so IPv4 or external-connectivity test checks do not apply.
No-Weak-Crypto	✅ Passed	The PR adds only inventory comments and PersistentVolume/PersistentVolumeClaim YAML; added content contains no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or token comparisons.
Container-Privileges	✅ Passed	The four added YAML manifests contain no privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root user, or allowPrivilegeEscalation:true settings.
No-Sensitive-Data-In-Logs	✅ Passed	The four added YAML manifests contain resource definitions and secret references only; searches found no logging configuration, log output, or credential, token, API key, or PII values.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: backing the app.ci job-configs-nfs PVC with AWS EFS.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@Prucek: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-merge-bot]

@Prucek: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

[Prucek]

/retest-required

[Prucek]

/retest-required

[Prucek]

/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007, Prucek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/OWNERS [Prucek,deepsm007]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Prucek]

/pj-rehearse ack

[openshift-merge-bot]

@Prucek: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@Prucek: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.