Fix SBR disconnected job and add 4.22 disconnected SBR jobs

[ugreener]

Problem

The SBR disconnected periodic job (periodic-ci-medik8s-system-tests-main-4.21-disconnected-e2e-sbr-weekly-aws-disconnected-nfs) has failed on all 6 runs since its creation with panic: WORKLOAD_IMAGE environment variable must be set. The e2e-test commands block was missing the WORKLOAD_IMAGE export from SHARED_DIR that the FAR disconnected job in the same config has. Additionally, the SBR job was missing ENABLE_IDMS and EXTRACT_MANIFEST_INCLUDED env vars required for disconnected image mirroring. The ticket (RHWA-1039) also calls for a presubmit job and 4.22 variant, which were never implemented.

Summary

Fix the existing 4.21 SBR disconnected periodic by adding the missing WORKLOAD_IMAGE export and disconnected env vars. Add SBR disconnected periodic and presubmit jobs to the 4.22-disconnected config, modeled on the working FAR disconnected pattern but using medik8s-sbr-nfs-bastion for NFS storage.

Changes

• 4.21-disconnected: Add WORKLOAD_IMAGE export from SHARED_DIR/workload_image, add ENABLE_IDMS/EXTRACT_MANIFEST_INCLUDED env vars, add 3h timeout
• 4.22-disconnected: Add e2e-sbr-weekly-aws-disconnected-nfs periodic (Wednesday 16:00 UTC)
• 4.22-disconnected: Add e2e-sbr-aws-disconnected-nfs presubmit (optional, on-demand via /test)
• Generated: Updated periodics and presubmits job files via make jobs

Jira: RHWA-1039

Summary by CodeRabbit

• Fixes the OpenShift CI 4.21 disconnected SBR periodic job by exporting WORKLOAD_IMAGE from SHARED_DIR, enabling ENABLE_IDMS and EXTRACT_MANIFEST_INCLUDED, and setting a three-hour timeout.
• Adds 4.22 disconnected SBR periodic and optional presubmit jobs for NFS storage. The jobs use medik8s-sbr-nfs-bastion and configure SBR packages, catalogs, storage, and test exclusions.
• Schedules the 4.22 periodic job for Wednesdays at 16:00 UTC.
• Updates the generated Prow job definitions with make jobs.

[coderabbitai]

Warning

Review limit reached

@ugreener, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5dd8576d-b06e-46cd-9124-ca417bf430d6

📥 Commits

Reviewing files that changed from the base of the PR and between f4e35c9 and ae5706e.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (2)

• ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.21-disconnected.yaml
• ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-disconnected.yaml

Walkthrough

The PR updates the 4.21 disconnected AWS NFS test configuration and adds on-demand and weekly 4.22 NFS storage-based-remediation test jobs.

Changes

Disconnected Medik8s system tests

Layer / File(s)	Summary
Test settings and remediation jobs ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.21-disconnected.yaml, ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-disconnected.yaml	The 4.21 test enables IDMS and manifest extraction, loads an optional workload image, and uses a three-hour timeout. The 4.22 configuration adds on-demand and weekly disconnected AWS NFS storage-based-remediation jobs. The weekly job runs Wednesdays at 16:00 UTC.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82777: Both PRs conditionally load the workload image from ${SHARED_DIR}/workload_image in Medik8s system-test configurations.

Suggested reviewers: mpryc, mshitrit

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The new 4.22 jobs invoke medik8s-sbr-nfs-bastion, whose container command runs sudo podman with --privileged and --net host.	Replace the privileged, host-networked NFS container with a least-privilege design, or isolate and explicitly approve the required exception.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two main changes: fixing the 4.21 disconnected job and adding 4.22 disconnected SBR jobs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only CI YAML and generated job definitions; searches found no Ginkgo It, Describe, Context, or When test titles to evaluate.
Test Structure And Quality	✅ Passed	The pull request changes four YAML files only; it adds no Ginkgo test code or It blocks to review against these requirements.
Microshift Test Compatibility	✅ Passed	The commit changes only four CI YAML files; it adds no Ginkgo tests or test declarations and no MicroShift-incompatible API or feature references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only CI YAML configuration and generated job definitions; it adds no Ginkgo It, Describe, Context, or When tests requiring SNO review.
Topology-Aware Scheduling Compatibility	✅ Passed	All four changed files are CI configuration or generated Prow job YAML; they add test settings and job metadata, not deployment manifests, operators, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only four YAML configuration/generated job files; no OTE binary source or process-level stdout/logging code changed, and no stdout constructs appear in the diff.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The patch changes only disconnected CI YAML and generated job files; it adds no Ginkgo tests or test networking code to assess.
No-Weak-Crypto	✅ Passed	The added YAML, shell commands, and generated Prow jobs contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto implementation, or secret-comparison usage.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds environment setup and image-file reads, but no echo/printf/logging of secret values or literal credentials; generated jobs only reference standard mounted secrets.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ugreener

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/medik8s/system-tests/OWNERS [ugreener]
• ci-operator/jobs/medik8s/system-tests/OWNERS [ugreener]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@ugreener: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-medik8s-system-tests-main-4.22-disconnected-e2e-sbr-aws-disconnected-nfs	medik8s/system-tests	presubmit	Presubmit changed
periodic-ci-medik8s-system-tests-main-4.22-disconnected-e2e-sbr-weekly-aws-disconnected-nfs	N/A	periodic	Periodic changed
periodic-ci-medik8s-system-tests-main-4.21-disconnected-e2e-sbr-weekly-aws-disconnected-nfs	N/A	periodic	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@ugreener: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ugreener]

/pj-rehearse pull-ci-medik8s-system-tests-main-4.22-disconnected-e2e-sbr-aws-disconnected-nfs

[openshift-merge-bot]

@ugreener: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.