Promote oadp-operator bundle directly instead of a broken index - #83282
Promote oadp-operator bundle directly instead of a broken index#83282kaovilai wants to merge 1 commit into
Conversation
ci-operator's operator.bundles builds the bundle as an image inside the building job's own namespace, then bakes a reference to it into the generated index. Promoting only the index leaves that reference unreachable once the job's namespace is torn down - confirmed via BundleUnpackFailed when a consuming job tried to install from it. skip_building_index promotes the bundle itself instead (precedent: quay/quay-operator), so a consuming job can install directly from it via `operator-sdk run bundle`, no index/catalog needed at all. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kaovilai The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughThe OADP 1.6 and development CI configurations now identify and promote the operator bundle image. They disable index-image builds and remove index-image promotion. ChangesOADP bundle promotion
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[REHEARSALNOTIFIER]
A total of 81 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml`:
- Around line 19-27: Exclude test-oadp-operator from both promotion targets by
adding excluded_images to the oadp-1.6 target in
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml:19-27
and the oadp-dev target in
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml:19-27;
retain each target’s existing additional_images mapping.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 87da2941-1b65-4a69-b977-276e9c094950
⛔ Files ignored due to path filters (4)
ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-postsubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (2)
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yamlci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml
| promotion: | ||
| to: | ||
| - excluded_images: | ||
| - test-oadp-operator | ||
| name: oadp-operator | ||
| namespace: konveyor | ||
| - additional_images: | ||
| oadp-operator-bundle: oadp-operator-bundle | ||
| oadp-operator-e2e-tests: test-oadp-operator |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
for f in \
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml \
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml
do
echo "===== $f ====="
sed -n '1,45p' "$f"
done
echo "===== related promotion configurations ====="
rg -n -C 5 'excluded_images:|additional_images:|promotion:' ci-operator/config/openshift/oadp-operatorRepository: openshift/release
Length of output: 9219
🌐 Web query:
OpenShift ci-operator promotion configuration excluded_images additional_images multiple promotion targets semantics
💡 Result:
In OpenShift ci-operator, the promotion configuration defines how container images built from a repository are promoted to external ImageStreams for use in other projects [1][2]. When multiple promotion targets are specified, the configuration allows for granular control over which images are published to each target [3][4]. Core Semantics and Configuration: 1. Multiple Promotion Targets: The promotion.to field accepts a list of targets [3][4]. Each target is defined by a block containing parameters such as namespace, name, or tag [1][2]. This allows a single repository to promote images to multiple destination ImageStreams simultaneously [5]. 2. additional_images: This field is a mapping that allows you to promote intermediary pipeline images (e.g., compiled test binaries or internal scripts) that are not part of the primary component build [1]. It maps the pipeline image tag to the desired name in the destination ImageStream [1]. Note that images specified here are exempt from the excluded_images restriction [1]. 3. excluded_images: This is an array of image names that should be blocked from promotion [1]. This exclusion applies to images built by the repository [1]. 4. Wildcard Support: The * wildcard can be used within the excluded_images list to exclude all images for a specific target [3][4]. This is particularly useful when configuring multiple targets, as it allows you to promote only specific, select images to one destination while promoting others elsewhere [3][5]. Example of Complex Promotion: The following configuration demonstrates promoting specific images to one target and everything else to a different target [3][4]: promotion: to: - namespace: "ci" name: "cli-ocm" excluded_images: - "*" additional_images: latest: cli-ocm - namespace: "origin" name: "4.15" excluded_images: - cli-ocm In this example, the first target only receives the cli-ocm image (via additional_images), while the second target receives all built images except for cli-ocm [3][4]. Promotion only occurs if all configured targets are successful and the --promote flag is used [1].
Citations:
- 1: https://github.com/openshift/ci-operator/blob/master/CONFIGURATION.md
- 2: https://docs.ci.openshift.org/how-tos/use-registries-in-build-farm/
- 3: https://docs.ci.openshift.org/architecture/ci-operator/
- 4: https://docs.ci.openshift.org/docs/architecture/ci-operator/
- 5: https://github.com/openshift/ci-docs/blob/main/content/en/architecture/ci-operator.md
🏁 Script executed:
#!/bin/bash
set -eu
echo "===== ci-operator configuration semantics ====="
curl -fsSL https://raw.githubusercontent.com/openshift/ci-operator/master/CONFIGURATION.md |
rg -n -C 8 'excluded_images|additional_images|promotion:|promot' | head -n 180
echo "===== repository-wide matching promotion patterns ====="
rg -n -U -C 6 'excluded_images:\n\s+-\s+\S+.*\n\s+name:|additional_images:' ci-operator/config |
head -n 240
echo "===== local references to the destination images ====="
rg -n -C 5 'oadp-operator-e2e-tests|test-oadp-operator' ci-operator/config/openshift/oadp-operatorRepository: openshift/release
Length of output: 50374
🏁 Script executed:
#!/bin/bash
set -eu
tree="$(curl -fsSL 'https://api.github.com/repos/openshift/ci-operator/git/trees/master?recursive=1')"
printf '%s' "$tree" |
jq -r '.tree[] | select(.path | test("promot|promotion"; "i")) | .path' |
head -n 80
echo "===== promotion implementation references ====="
for path in $(printf '%s' "$tree" |
jq -r '.tree[] | select(.path | test("\\.(go)$")) | .path' |
head -n 400)
do
body="$(curl -fsSL "https://raw.githubusercontent.com/openshift/ci-operator/master/$path")"
if printf '%s' "$body" | rg -q 'ExcludedImages|AdditionalImages|excluded_images|additional_images'; then
echo "===== $path ====="
printf '%s\n' "$body" |
rg -n -C 6 'ExcludedImages|AdditionalImages|excluded_images|additional_images' |
head -n 160
fi
doneRepository: openshift/release
Length of output: 206
🏁 Script executed:
#!/bin/bash
set -eu
curl -fsSL 'https://api.github.com/repos/openshift/ci-operator/git/trees/master?recursive=1' |
jq -r '.tree[] | select(.path | test("promot|promotion"; "i")) | .path'Repository: openshift/release
Length of output: 204
Exclude test-oadp-operator from both promotion targets.
Add excluded_images: [test-oadp-operator] to the oadp-1.6 and oadp-dev tag targets. Keep the additional_images mapping because exclusions do not affect explicitly mapped images.
📍 Affects 2 files
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml#L19-L27(this comment)ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml#L19-L27
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml`
around lines 19 - 27, Exclude test-oadp-operator from both promotion targets by
adding excluded_images to the oadp-1.6 target in
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml:19-27
and the oadp-dev target in
ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml:19-27;
retain each target’s existing additional_images mapping.
Source: MCP tools
|
/pj-rehearse pull-ci-openshift-oadp-operator-oadp-dev-ci-bundle-oadp-operator-bundle pull-ci-openshift-oadp-operator-oadp-dev-images pull-ci-openshift-oadp-operator-oadp-1.6-ci-bundle-oadp-operator-bundle pull-ci-openshift-oadp-operator-oadp-1.6-images Note Responses generated with Claude |
|
@kaovilai: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Broadening the rehearse to also cover the existing /pj-rehearse max Note Responses generated with Claude |
|
@kaovilai: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@kaovilai: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
Promotes oadp-operator's OLM bundle image directly instead of an index, for both
oadp-devandoadp-1.6. Split out of #83049 so it can merge first — #83049's kdm-controller/kdm-plugin jobs install from the bundle this promotes, and can't rehearse against a real image until it actually exists (requires this to merge + a subsequent oadp-operator postsubmit run).Why not an index
The original design (#83110, merged) promoted an
oadp-operator-indexbuilt via ci-operator'soperator.bundles(noskip_building_index). Rehearsing #83049 against the real promoted index failed withBundleUnpackFailed: Bundle image pull failed. Root cause, confirmed from oadp-operator's own promotion postsubmit log: ci-operator builds the bundle as an image inside the building job's own namespace, then bakes a reference to that bundle's pullspec into the generated index. That reference is only reachable while the building job's own namespace is alive (same-job consumption, e.g. oadp-operator's own periodic e2e, works fine) — we'd promoted only the index, never the bundle, so once oadp-operator's build namespace was torn down, the baked-in bundle reference became permanently unreachable from any other job's namespace.Fix
skip_building_index: truemeans ci-operator builds and promotes only the bundle image — no index/catalog at all, so there's no ephemeral bundle-reference problem to inherit. Precedent:quay/quay-operatoruses this exact pattern. The consuming side (#83049) installs directly from the promoted bundle viaoperator-sdk run bundle, which needs no index/catalog (precedent:openshift-file-integrity-operator, already doing this cross-repo).Does this affect oadp-operator's own e2e tests (kubevirt/cli/hcp/aws)?
No — those live entirely in separate, untouched files (
openshift-oadp-operator-oadp-dev__5.0.yaml,__4.22.yaml,__4.23.yaml,__5.1.yaml, and theoadp-1.6equivalents), which this PR does not modify. Each of those is its own independent ci-operator config with its own unnamedoperator.bundlesentry (noskip_building_index), so each still builds its ownci-indexexactly as before.Traced this mechanically to be certain, since it's easy to assume same-named things are shared:
optional-operators-subscribe(the step those e2e tests use) declaresdependencies: [{name: ci-index, env: OO_INDEX}]and its script does nothing more thanimage: "$OO_INDEX"in the CatalogSource it creates.ci-indexhappens per-config-file viatest.steps.dependencies, which can only resolve against images built within that same config file's own build graph (images.items,operator.bundles, another test's output). It cannot reach into a different config file or repo — that requiresbase_imagesinstead, which needs an explicitname/namespace/tagnaming an already-promoted, external imagestream.__5.0.yaml'sbase_imagesblock directly: it has entries forhypershift-oadp-plugin,kubevirt-datamover-controller, etc., but nothing namedci-index,oadp-operator-index, oroadp-operator-bundle.So each variant file's
dependencies: {OO_INDEX: ci-index}can only resolve to that same file's own unnamedoperator.bundlesentry — never to the base config's job (this PR's target) or anything promoted from it. These jobs build and consume their own index, in their own job, every run, completely independent of what this PR changes.The base config's own
ci-index(the one this PR touches), by contrast, was never consumed by a test in the same file — that file'stests:are onlyunit-test/unit-test-post/unit-test-periodic. Its only two roles were a presubmit build-sanity check (doesbuild/Dockerfile.bundlebuild) and postsubmit promotion for cross-repo use — the latter being the part that didn't actually work until this fix.Testing
make ci-operator-config/make jobspass cleanly. Generated job diff confirms the postsubmit's--targetlist changed fromci-indextooadp-operator-bundle, and the standalonepull-ci-openshift-oadp-operator-oadp-dev-ci-indexpresubmit is renamed to-ci-bundle-oadp-operator-bundle.Test plan
make ci-operator-config/make jobspass for both branches.oadp-operator-index(repo-wide grep), and oadp-operator's own branch-protection/required-checks config has no reference to theci-indexjob by name — nothing else depends on it surviving.oadp-operator-bundlefor real (needed before Run oadp-operator e2e against kdm-controller/kdm-plugin PRs (oadp-dev, oadp-1.6) #83049 can rehearse against it).Note
Responses generated with Claude