Resolve FBC image from Quay; exclude upgrade tests from FAR presubmit - #82774
Resolve FBC image from Quay; exclude upgrade tests from FAR presubmit#82774ugreener wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
approved
WalkthroughMedik8s now selects active Quay SHA tags using ChangesMedik8s CI behavior
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant resolve_commit_sha
participant QuayAPI
participant verify_fbc_image
Caller->>resolve_commit_sha: provide OCP_VERSION and FBC_SHA_PINNED
alt SHA supplied
resolve_commit_sha->>Caller: mark SHA as pinned
else SHA not supplied
resolve_commit_sha->>QuayAPI: query active 40-character SHA tags
QuayAPI-->>resolve_commit_sha: return latest active SHA tag
resolve_commit_sha->>Caller: return resolved SHA
end
opt SHA is pinned
Caller->>verify_fbc_image: provide pinned SHA
verify_fbc_image->>QuayAPI: request Quay manifest
QuayAPI-->>verify_fbc_image: return HTTP status
verify_fbc_image-->>Caller: pass or fail verification
end
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/medik8s/lib/medik8s-lib-commands.sh`:
- Around line 70-84: The resolve_commit_sha() function currently evaluates only
the first 50 Quay tags, so it can miss the latest active SHA tag. Update the
Quay-fetch logic to iterate through all result pages (or otherwise retrieve all
active tags), accumulate the matching 40-character SHA tags, and then select the
newest using last_modified descending before assigning FBC_COMMIT_SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 58d7ef8d-9493-4b2b-80fd-da402fe27009
📒 Files selected for processing (1)
ci-operator/step-registry/medik8s/lib/medik8s-lib-commands.sh
ugreener
changed the title
c55c132 to
e94b86e
Compare
|
/pj-rehearse pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-aws |
|
@ugreener: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-aws |
|
@ugreener: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The dragonfly/rhwa-fbc GitLab repo is a monorepo containing FBC definitions for multiple OCP versions (4.21, 4.22, etc.). Konflux builds separate images per version. When HEAD is a 4.21-only commit, checking rhwa-fbc-422:<HEAD_SHA> on Quay returns 404, forcing a noisy fallback path. Fix by resolving the FBC commit SHA directly from Quay's active tags for the specific OCP version image. This eliminates the GitLab API call, the manifest 404, and the fallback entirely for the unpinned path. Pinned SHA verification (via FBC_COMMIT_SHA env var) is preserved unchanged. Co-Authored-By: Claude <noreply@anthropic.com>
e94b86e to
da5a7ea
Compare
ugreener
changed the title
|
/pj-rehearse pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-aws |
|
@ugreener: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ugreener The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@ugreener: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
ugreener
changed the title
ugreener
changed the title
1 participant
Problem
1. medik8s-lib Quay resolution: The
resolve_commit_sha()function inmedik8s-lib.shresolved the FBC (File-Based Catalog) commit SHA by querying the GitLab API for the HEAD commit ofdragonfly/rhwa-fbc. This approach had three problems:gitlab.cee.redhat.comregularly returns 503 errors lasting 30+ seconds.2. FAR upgrade test leak: The FAR upgrade test (
upgrade.go, added in commit 43fbac9c on Jul 29) runs inside the regulare2e-far-awspresubmit ande2e-far-weekly-awsperiodic, but it has its own dedicated presubmit (e2e-far-upgrade-presubmit-aws). Running it in the regular FAR job causes a 409 Conflict failure because the upgrade test'sBeforeAllcreates a Secret that already exists from the destructive tests.Changes
medik8s-lib-commands.sh
resolve_commit_sha(): Skip GitLab API entirely. Query Quay directly for the latest active SHA tag for the specific OCP version image. Tags are filtered to 40-character hex SHA names and sorted bystart_tsfor deterministic selection.OCP_VERSIONformat validation (^[0-9]{2,4}$) as defense-in-depth.FBC_SHA_PINNED=falseexplicitly in the Quay resolution path.verify_fbc_image(): Only verify manifest for explicitly pinned SHAs.medik8s-system-tests CI config (4.22-konflux)
ECO_TEST_LABELS: '!tier:upgrade'toe2e-far-awspresubmit ande2e-far-weekly-awsperiodic to exclude upgrade tests. Upgrade tests have their own dedicated job in the4.22-upgradevariant withECO_TEST_LABELS: tier:upgrade.Summary by CodeRabbit
OCP_VERSION.start_tswith one API call.FBC_SHA_PINNEDvalues.ECO_TEST_LABELS: '!tier:upgrade'.OCP_VERSIONandFBC_SHA_PINNED.pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-aws.