From b0a3607a2deb5752ca38ed36d20263ce9a5b30b3 Mon Sep 17 00:00:00 2001 From: Eris Hoxha Date: Mon, 10 Aug 2026 11:42:47 +0200 Subject: [PATCH] Fix OKD release-controller-api registry auth The OKD API deployment created in #83116 is missing the HOME and XDG_RUNTIME_DIR environment variables and the oc-prepare init container that the OCP API deployment has. Without these, oc cannot locate registry credentials and all release info requests fail with "unauthorized: authentication required". Add get_oc_env_vars() and get_oc_prepare_container() to the OKD API deployment template, matching the OCP API template. --- .../deploy-origin-arm64-controller.yaml | 27 +++++++++++++++++++ .../deploy-origin-controller.yaml | 27 +++++++++++++++++++ .../content/origin_resources.py | 3 +++ 3 files changed, 57 insertions(+) diff --git a/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml b/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml index 07319b0b9b514..b5e018801cb0a 100644 --- a/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml +++ b/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml @@ -242,6 +242,11 @@ spec: - --jira-password-file=/etc/jira/bot-password - --release-qualifiers-config-path=/etc/qualifiers-config/release-qualifiers.yaml - -v=4 + env: + - name: HOME + value: /tmp/home + - name: XDG_RUNTIME_DIR + value: /tmp/home/run image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller-api_latest imagePullPolicy: Always livenessProbe: @@ -277,6 +282,28 @@ spec: subPath: .git-credentials - mountPath: /tmp/pull-secret name: pull-secret + initContainers: + - command: + - /bin/bash + - -c + - "#!/bin/bash\n set -euo pipefail\n trap 'kill $(jobs -p); exit 0' TERM\n\n SECONDS=0\n\n # ensure we are logged in to our registry\n mkdir -p ${XDG_RUNTIME_DIR}/containers\n cp /tmp/pull-secret/auth.json ${XDG_RUNTIME_DIR}/containers/auth.json || true\n\n # global git config stored to $HOME/.gitconfig which is shared with the main release-controller pods\n git config --global credential.helper store\n git config --global user.name test\n git config --global user.email test@test.com\n oc registry login --to ${XDG_RUNTIME_DIR}/containers/auth.json\n\n RC_SERVICE_AVAILABLE=$(curl -s -o /dev/null -I -w '%{http_code}' https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestreams/accepted)\n if [[ \"$RC_SERVICE_AVAILABLE\" -ne 200 ]]\n then\n FROM=\"\"\n TO=\"\"\n else\n FROM=$(curl -s https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestreams/accepted | jq -r '.[\"4-stable\"][0] // empty')\n TO=$(curl -s https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestreams/accepted | jq -r '.[\"4-dev-preview\"][0] // empty')\n fi\n\n if [[ -n \"$FROM\" && -n \"$TO\" ]]\n then\n echo \"Pre-populating the git cache...\"\n oc adm release info --changelog=/tmp/git quay.io/openshift-release-dev/ocp-release:$FROM-x86_64 quay.io/openshift-release-dev/ocp-release:$TO-x86_64\n else\n echo \"Unable to Pre-populate the git cache!\"\n fi\n\n DURATION=$SECONDS\n echo \"Took: $(($DURATION / 60))m $(($DURATION % 60))s\"\n " + env: + - name: HOME + value: /tmp/home + - name: XDG_RUNTIME_DIR + value: /tmp/home/run + image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller_latest + name: oc-prepare + volumeMounts: + - mountPath: /tmp/home + name: home + - mountPath: /tmp/git + name: oc-cache + - mountPath: /tmp/home/.git-credentials + name: git-credentials + subPath: .git-credentials + - mountPath: /tmp/pull-secret + name: pull-secret serviceAccountName: release-controller-okd-arm64 volumes: - name: jira diff --git a/clusters/app.ci/release-controller/deploy-origin-controller.yaml b/clusters/app.ci/release-controller/deploy-origin-controller.yaml index d7730a028611f..79be56bb0dcb1 100644 --- a/clusters/app.ci/release-controller/deploy-origin-controller.yaml +++ b/clusters/app.ci/release-controller/deploy-origin-controller.yaml @@ -242,6 +242,11 @@ spec: - --jira-password-file=/etc/jira/bot-password - --release-qualifiers-config-path=/etc/qualifiers-config/release-qualifiers.yaml - -v=4 + env: + - name: HOME + value: /tmp/home + - name: XDG_RUNTIME_DIR + value: /tmp/home/run image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller-api_latest imagePullPolicy: Always livenessProbe: @@ -277,6 +282,28 @@ spec: subPath: .git-credentials - mountPath: /tmp/pull-secret name: pull-secret + initContainers: + - command: + - /bin/bash + - -c + - "#!/bin/bash\n set -euo pipefail\n trap 'kill $(jobs -p); exit 0' TERM\n\n SECONDS=0\n\n # ensure we are logged in to our registry\n mkdir -p ${XDG_RUNTIME_DIR}/containers\n cp /tmp/pull-secret/auth.json ${XDG_RUNTIME_DIR}/containers/auth.json || true\n\n # global git config stored to $HOME/.gitconfig which is shared with the main release-controller pods\n git config --global credential.helper store\n git config --global user.name test\n git config --global user.email test@test.com\n oc registry login --to ${XDG_RUNTIME_DIR}/containers/auth.json\n\n RC_SERVICE_AVAILABLE=$(curl -s -o /dev/null -I -w '%{http_code}' https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestreams/accepted)\n if [[ \"$RC_SERVICE_AVAILABLE\" -ne 200 ]]\n then\n FROM=\"\"\n TO=\"\"\n else\n FROM=$(curl -s https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestreams/accepted | jq -r '.[\"4-stable\"][0] // empty')\n TO=$(curl -s https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestreams/accepted | jq -r '.[\"4-dev-preview\"][0] // empty')\n fi\n\n if [[ -n \"$FROM\" && -n \"$TO\" ]]\n then\n echo \"Pre-populating the git cache...\"\n oc adm release info --changelog=/tmp/git quay.io/openshift-release-dev/ocp-release:$FROM-x86_64 quay.io/openshift-release-dev/ocp-release:$TO-x86_64\n else\n echo \"Unable to Pre-populate the git cache!\"\n fi\n\n DURATION=$SECONDS\n echo \"Took: $(($DURATION / 60))m $(($DURATION % 60))s\"\n " + env: + - name: HOME + value: /tmp/home + - name: XDG_RUNTIME_DIR + value: /tmp/home/run + image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller_latest + name: oc-prepare + volumeMounts: + - mountPath: /tmp/home + name: home + - mountPath: /tmp/git + name: oc-cache + - mountPath: /tmp/home/.git-credentials + name: git-credentials + subPath: .git-credentials + - mountPath: /tmp/pull-secret + name: pull-secret serviceAccountName: release-controller-okd volumes: - name: jira diff --git a/hack/generators/release-controllers/content/origin_resources.py b/hack/generators/release-controllers/content/origin_resources.py index 563d1bbace4c2..456db69bb0ac3 100644 --- a/hack/generators/release-controllers/content/origin_resources.py +++ b/hack/generators/release-controllers/content/origin_resources.py @@ -1,4 +1,5 @@ from content.utils import get_rc_volumes, get_rc_volume_mounts, get_rcapi_volumes, get_rcapi_volume_mounts +from content.osd_rc_deployments import get_oc_env_vars, get_oc_prepare_container def add_legacy_origin_deployments_scaled_down(gendoc): @@ -295,6 +296,7 @@ def add_okd_deployments(gendoc): } }, "spec": { + "initContainers": get_oc_prepare_container(), "containers": [ { "command": [ @@ -315,6 +317,7 @@ def add_okd_deployments(gendoc): 'imagePullPolicy': 'Always', "name": "controller", "volumeMounts": get_rcapi_volume_mounts(), + "env": get_oc_env_vars(), 'livenessProbe': { 'httpGet': { 'path': '/healthz',