Skip to content

NO-ISSUE: Render OSImageStream in OKD too - #10730

Open
pablintino wants to merge 1 commit into
openshift:mainfrom
pablintino:osimagestream-cr-render-okd
Open

NO-ISSUE: Render OSImageStream in OKD too#10730
pablintino wants to merge 1 commit into
openshift:mainfrom
pablintino:osimagestream-cr-render-okd

Conversation

@pablintino

@pablintino pablintino commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

The MCO is already creating the OSImageStream for OKD as we have GAed the feature in OKD and OCP. If not passed by the installer the MCO itself creates the resource but it would be nice to generate it from the installer like we do for OCP to align the behavior with OCP.

Summary by CodeRabbit

  • Bug Fixes
    • OS image stream manifests are now generated consistently whenever the OS streams feature is enabled, including for SCOS targets.
    • Removed an additional condition that could prevent manifest generation for certain install configurations, so behavior is now determined solely by the OS streams feature gate.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 29, 2026
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@pablintino: This pull request explicitly references no jira issue.

Details

In response to this:

The MCO is already creating the OSImageStream for OKD as we have GAed the feature in OKD and OCP. If not passed by the installer the MCO itself creates the resource but it would be nice to generate it from the installer like we do for OCP to align the behavior with OCP.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 09db6237-7762-465c-af3a-a178391168f1

📥 Commits

Reviewing files that changed from the base of the PR and between af66e8e and 9dd4c23.

📒 Files selected for processing (1)
  • pkg/asset/manifests/osimagestream.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • pkg/asset/manifests/osimagestream.go

📝 Walkthrough

Walkthrough

OSImageStream.Generate now generates manifests whenever FeatureGateOSStreams is enabled, including for SCOS targets. The previous InstallConfig-based exclusion was removed.

Changes

OSImageStream gating

Layer / File(s) Summary
Feature gate generation condition
pkg/asset/manifests/osimagestream.go
Removes the ic.IsSCOS() exclusion from OSImageStream.Generate and updates the inline comment.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: rendering OSImageStream for OKD.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only pkg/asset/manifests/osimagestream.go changed; it contains manifest generation code and no Ginkgo test titles.
Test Structure And Quality ✅ Passed No Ginkgo tests were added or changed; this PR only adjusts manifest generation logic.
Microshift Test Compatibility ✅ Passed No new Ginkgo tests were added; the PR only changes OSImageStream manifest generation.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Only pkg/asset/manifests/osimagestream.go changed; no new Ginkgo e2e tests or SNO-sensitive test logic were added.
Topology-Aware Scheduling Compatibility ✅ Passed OSImageStream only emits a cluster CR gated by a feature flag; no pods, affinities, selectors, replicas, or PDBs were added.
Ote Binary Stdout Contract ✅ Passed PR only changes OSImageStream manifest generation in a package file; no main/init/suite code or stdout logging was added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Only pkg/asset/manifests/osimagestream.go changed; no new Ginkgo tests or network-dependent code were added.
No-Weak-Crypto ✅ Passed The only change is OSImageStream manifest gating/yaml generation; no weak ciphers, custom crypto, or secret comparisons were added.
Container-Privileges ✅ Passed Only OSImageStream manifest generation changed; no privileged, host*, SYS_ADMIN, root, or allowPrivilegeEscalation fields were added.
No-Sensitive-Data-In-Logs ✅ Passed The PR only changes OSImageStream generation logic; it adds no new logs and the only error message is generic, with no sensitive data exposed.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions


Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from rochacbruno and sadasu July 29, 2026 15:24
@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign vr4manta for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
pkg/asset/manifests/osimagestream.go (1)

40-48: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Add regression coverage for SCOS generation.

Because this changes the generation branch, add a unit test proving that an SCOS InstallConfig generates OSImageStream when FeatureGateOSStreams is enabled and does not generate it when disabled. This is required for Go code under pkg/.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/asset/manifests/osimagestream.go` around lines 40 - 48, Add unit-test
coverage for OSImageStream.Generate using SCOS InstallConfig fixtures: assert an
OSImageStream is generated when FeatureGateOSStreams is enabled and no resource
is generated when it is disabled. Reuse the existing test helpers and generation
assertions for pkg/asset manifests rather than changing Generate behavior.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/asset/manifests/osimagestream.go`:
- Around line 44-48: Update the comment above the feature-gate check in the
OSImageStream generation flow to describe only that generation is skipped when
FeatureGateOSStreams is disabled. Remove the stale reference to non-OCP targets;
leave the condition and return behavior unchanged.

---

Outside diff comments:
In `@pkg/asset/manifests/osimagestream.go`:
- Around line 40-48: Add unit-test coverage for OSImageStream.Generate using
SCOS InstallConfig fixtures: assert an OSImageStream is generated when
FeatureGateOSStreams is enabled and no resource is generated when it is
disabled. Reuse the existing test helpers and generation assertions for
pkg/asset manifests rather than changing Generate behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c487745d-72d0-408e-9cd2-200632b1ac25

📥 Commits

Reviewing files that changed from the base of the PR and between 22ddf07 and af66e8e.

📒 Files selected for processing (1)
  • pkg/asset/manifests/osimagestream.go

Comment thread pkg/asset/manifests/osimagestream.go
The MCO is already creating the OSImageStream for OKD as we have GAed
the feature in OKD and OCP. If not passed by the installer the MCO
itself creates the resource but it would be nice to generate it from the
installer like we do for OCP to align the behavior with OCP.

Signed-off-by: Pablo Rodriguez Nava <git@amail.pablintino.eu>
@pablintino
pablintino force-pushed the osimagestream-cr-render-okd branch from af66e8e to 9dd4c23 Compare July 29, 2026 15:36
Name: "cluster",
},
Spec: mcfgv1.OSImageStreamSpec{
DefaultStream: string(installConfig.Config.OSImageStream),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at https://github.com/openshift/installer/blob/main/pkg/types/installconfig.go#L791 it appears that the OSImageStream that should be used for SCOS should be Centos10. Current code, is adding whatever is provided in https://github.com/openshift/installer/blob/main/data/data/install.openshift.io_installconfigs.yaml#L5062 which seems to allow only 2 values rhel-9 and rhel-10.

I am also checking the OSImageStream validation code to see if that is aligned too.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/openshift/installer/blob/main/pkg/types/validation/installconfig.go#L1820 is how the OSImageStreams is validated.

If OKD is using SCOS OSImageStreamCentos10, then should the enum here https://github.com/openshift/installer/blob/main/data/data/install.openshift.io_installconfigs.yaml#L5062 be augmented?

I understand this request is probably outside the scope of this PR, but would be great to keep everything consistent with the help of this PR.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at https://github.com/openshift/installer/blob/main/pkg/types/installconfig.go#L791 it appears that the OSImageStream that should be used for SCOS should be Centos10. Current code, is adding whatever is provided in https://github.com/openshift/installer/blob/main/data/data/install.openshift.io_installconfigs.yaml#L5062 which seems to allow only 2 values rhel-9 and rhel-10.

I am also checking the OSImageStream validation code to see if that is aligned too.

@sadasu IIRC that data file is not used or consumed by our validations or defaulting, thus setting the default value is done purely manually here. Do we need to conditionally render that file? Is this the first time we face a misalignment between OCP and OKD values for that file?

The validation is done here based on what types.OSImageStreamValues() returns, that should be centos-10 only for OKD.

About the job, I'll trigger a job that I found for the MCO changes we did. The job fails some assertions but was good enough to know if the installation and the MCO were fine.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are aligned on the defaults and validation. With OKD, the user should be allowed to set osImageStreams to centos-10 in the install-config (when not specified, code currently picks the right default as you mentioned) here: https://github.com/openshift/installer/blob/main/data/data/install.openshift.io_installconfigs.yaml#L5062

enum:
            - rhel-9
            - rhel-10
            - centos-10

This install-config field was added as part of commit 1cbe68b where the enum only had values for OCD.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this the first time we face a misalignment between OCP and OKD values for that file?

Yes, it appears so.

Also, during OKD installs, if the osImageStream value is not set, we are able to pick the right defaults. But, if the customer uses this CRD as reference and explicitly sets rhel-10 as the osImageStream, our validations would reject it. Not a real problem, but an inconvenience that the user would need to rectify with updating their install-config.

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@pablintino: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@pablintino

Copy link
Copy Markdown
Contributor Author

/payload-job periodic-ci-openshift-release-main-okd-scos-5.0-e2e-aws-ovn

@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

@pablintino: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-okd-scos-5.0-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/e51282f0-8c1a-11f1-85c2-518be798ce0c-0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants