ROSAENG-61450: wire rosa-clients for openshift/rosa CI by amandahla · Pull Request #81830 · openshift/release

amandahla · 2026-07-13T18:52:31Z

Summary

Wire openshift/rosa Prow to a repo-owned rosa-clients image (Dockerfile.clients) instead of from: src / hardcoded ocp/builder.

Blocked on / waits for: openshift/rosa#3366 (adds Dockerfile.clients and .ci-operator.yaml). Do not merge this until that PR is in openshift/rosa master.

Changes

openshift-rosa-master.yaml: build_root: from_repository: true, build Dockerfile.clients → rosa-clients, point lint/build/test/commits/coverage/govulncheck at from: rosa-clients
e2e / images variants: build_root: from_repository: true (fixes e2e rhel-8 builder drift)
Regenerated / sanitized prow jobs (including /test images)

Test plan

Wait for ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 rosa#3366 to merge
Rehearse or verify /test images, /test build, /test lint, /test test on a rosa PR after merge

Made with Cursor

Summary by CodeRabbit

Updates openshift/rosa CI configurations to build from the repository source.
Adds the repository-owned rosa-clients image from Dockerfile.clients and uses it across build, test, lint, coverage, commit, and vulnerability checks.
Applies the repository build root to master, e2e, and image workflows, removing hardcoded builder image references.
Regenerates and sanitizes the associated Prow jobs, including /test images.
Verification remains dependent on openshift/rosa#3366, which provides Dockerfile.clients and .ci-operator.yaml.

openshift-ci-robot · 2026-07-13T18:52:35Z

@amandahla: This pull request references ROSAENG-61450 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Wire openshift/rosa Prow to a repo-owned rosa-clients image (Dockerfile.clients) instead of from: src / hardcoded ocp/builder.

Blocked on / waits for: openshift/rosa#3366 (adds Dockerfile.clients and .ci-operator.yaml). Do not merge this until that PR is in openshift/rosa master.

Changes

openshift-rosa-master.yaml: build_root: from_repository: true, build Dockerfile.clients → rosa-clients, point lint/build/test/commits/coverage/govulncheck at from: rosa-clients

e2e / images variants: build_root: from_repository: true (fixes e2e rhel-8 builder drift)

Regenerated / sanitized prow jobs (including /test images)

Related

Jira: ROSAENG-61450

Depends on: ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 rosa#3366

Test plan

Wait for ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 rosa#3366 to merge

Rehearse or verify /test images, /test build, /test lint, /test test on a rosa PR after merge

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-13T18:53:30Z

Walkthrough

ROSA CI configurations now use repository-derived build roots. The main configuration defines a rosa-clients image from Dockerfile.clients and updates build, test, coverage, publishing, and vulnerability-check steps to use it.

Changes

ROSA CI image configuration

Layer / File(s)	Summary
Repository-derived build roots `ci-operator/config/openshift/rosa/*`	Build root selection uses repository sourcing, and the main configuration adds the `rosa-clients` image built from `Dockerfile.clients`.
rosa-clients job wiring `ci-operator/config/openshift/rosa/openshift-rosa-master.yaml`	Build, test, commits, coverage, publish-coverage, and govulncheck steps change their container source from `src` to `rosa-clients`.
Estimated code review effort: 2 (Simple)	~10 minutes

Possibly related PRs

openshift/release#81561: Updates the ROSA govulncheck step to use the rosa-clients container.

Suggested labels: lgtm

Suggested reviewers: olucasfreitas, danilo-gemoli, prucek

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only ci-operator/job YAML changed; no Go/Ginkgo test titles were added or modified, and searches found no It/Describe/Context/When strings in the diff.
Test Structure And Quality	✅ Passed	PR only changes ci-operator/job YAMLs; no Ginkgo test code was added or modified, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes ci-operator/prow YAML; no Ginkgo e2e test code or new It/Describe specs were added, so no MicroShift compatibility issue.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only changes CI/job YAML and image wiring; no Go/Ginkgo test files were added or modified, so SNO compatibility review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates ci-operator/prow YAMLs for ROSA; no deployment manifests, controllers, or topology-sensitive scheduling fields were added.
Ote Binary Stdout Contract	✅ Passed	Diff only changes ci-operator/job YAML; no process-level source code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only changes ci-operator/job YAML; no new Go/Ginkgo e2e tests or hardcoded IP/external-network code was added.
No-Weak-Crypto	✅ Passed	Only CI YAML/job config changed; scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	Changed YAMLs add no privileged/host* / allowPrivilegeEscalation / SYS_ADMIN / securityContext settings; diff only updates build roots and image sources.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds secret refs/token paths but no echo, set -x, printenv, or plaintext secret logging in the changed configs.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately names the main change: wiring the repository-owned rosa-clients image into openshift/rosa CI.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

amandahla · 2026-07-13T19:02:38Z

/hold

amandahla · 2026-07-17T12:31:49Z

/pj-rehearse ack

openshift-merge-bot · 2026-07-17T12:31:52Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-17T12:32:51Z

/pj-rehearse pull-ci-openshift-rosa-master-build
/pj-rehearse pull-ci-openshift-rosa-master-lint
/pj-rehearse pull-ci-openshift-rosa-master-test

openshift-merge-bot · 2026-07-17T12:32:53Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jerichokeyne · 2026-07-21T15:00:44Z

/pj-rehearse pull-ci-openshift-rosa-master-build
/pj-rehearse pull-ci-openshift-rosa-master-lint
/pj-rehearse pull-ci-openshift-rosa-master-test
/pj-rehearse periodic-ci-openshift-rosa-master-e2e-rosa-day1-negative-f7

openshift-merge-bot · 2026-07-21T15:00:46Z

@jerichokeyne: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-21T15:04:09Z

@jerichokeyne: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

openshift-merge-bot · 2026-07-21T15:04:10Z

@jerichokeyne: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

openshift-merge-bot · 2026-07-21T15:04:11Z

@jerichokeyne: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

jerichokeyne · 2026-07-21T15:04:35Z

/pj-rehearse pull-ci-openshift-rosa-master-build pull-ci-openshift-rosa-master-lint pull-ci-openshift-rosa-master-test periodic-ci-openshift-rosa-master-e2e-rosa-day1-negative-f7

openshift-merge-bot · 2026-07-21T15:04:38Z

@jerichokeyne: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-22T20:50:05Z

/pj-rehearse pull-ci-openshift-rosa-master-test

openshift-merge-bot · 2026-07-22T20:50:12Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-23T12:41:49Z

Running again, latest error not related to the PR
* could not initialize namespace: could not set up namespace for test: etcdserver: mvcc: database space exceeded

/pj-rehearse pull-ci-openshift-rosa-master-test

openshift-merge-bot · 2026-07-23T12:41:51Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-24T18:21:47Z

/unhold

openshift-merge-bot · 2026-07-27T18:57:23Z

@amandahla: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

openshift-merge-bot · 2026-07-27T18:57:24Z

@amandahla: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

openshift-merge-bot · 2026-07-27T18:57:25Z

@amandahla: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

openshift-merge-bot · 2026-07-27T18:57:26Z

@amandahla: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

openshift-merge-bot · 2026-07-27T18:57:27Z

@amandahla: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

amandahla · 2026-07-27T19:22:52Z

/pj-rehearse pull-ci-openshift-rosa-master-build pull-ci-openshift-rosa-master-images pull-ci-openshift-rosa-master-lint pull-ci-openshift-rosa-master-test pull-ci-openshift-rosa-master-commits pull-ci-openshift-rosa-master-images-release-images pull-ci-openshift-rosa-master-e2e-presubmits-images pull-ci-openshift-rosa-master-images-images

openshift-merge-bot · 2026-07-27T19:22:54Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-27T20:03:30Z

The commits failed due unrelated changes.
Ready to be reviewed again.

amandahla · 2026-07-27T20:03:45Z

/pj-rehearse ack

amandahla · 2026-07-27T20:05:59Z

/pj-rehearse ack

openshift-merge-bot · 2026-07-27T20:06:03Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-27T20:07:44Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-27T20:08:56Z

/pj-rehearse skip pull-ci-openshift-rosa-master-commits

openshift-merge-bot · 2026-07-27T20:08:59Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

amandahla · 2026-07-27T20:09:12Z

/override ci/rehearse/openshift/rosa/master/commits

openshift-ci · 2026-07-27T20:09:34Z

@amandahla: amandahla unauthorized: /override is restricted to Repo administrators, approvers in top level OWNERS file, and the following github teams:openshift: openshift-release-oversight openshift-staff-engineers openshift-sustaining-engineers.

Details

In response to this:

/override ci/rehearse/openshift/rosa/master/commits

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-merge-bot · 2026-07-27T20:12:08Z

@amandahla: job(s): skip either don't exist or were not found to be affected, and cannot be rehearsed

amandahla · 2026-07-27T20:13:01Z

/pj-rehearse skip

openshift-merge-bot · 2026-07-27T20:13:03Z

@amandahla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

olucasfreitas · 2026-07-28T17:48:42Z

/lgtm
/approve

openshift-ci · 2026-07-28T17:49:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amandahla, olucasfreitas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/rosa/OWNERS~~ [amandahla,olucasfreitas]
~~ci-operator/jobs/openshift/rosa/OWNERS~~ [amandahla,olucasfreitas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-07-28T18:03:13Z

@amandahla: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-openshift-rosa-master-e2e-rosa-day1-negative-f7	`9914b4c`	link	unknown	`/pj-rehearse periodic-ci-openshift-rosa-master-e2e-rosa-day1-negative-f7`
ci/rehearse/openshift/rosa/master/commits	`857b1a3`	link	unknown	`/pj-rehearse pull-ci-openshift-rosa-master-commits`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Depends on openshift/rosa#3366 (Dockerfile.clients + .ci-operator.yaml). Switch rosa ci-operator configs to build_root from_repository, run presubmits from rosa-clients, and regenerate prow jobs. Stop skipping jobs when only .ci-operator.yaml changes now that build_root uses from_repository: true. Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Follow-up to openshift#3366: align go.mod, bingo tool modules, and renovate Go constraint with ubi9/go-toolset 1.26.5 already used by Dockerfiles. Drop deferred stdlib Snyk and govulncheck ignores fixed in Go >= 1.26.4. Depends on openshift/release#81830 (from: rosa-clients) so Prow presubmits compile with go-toolset 1.26.5 instead of ocp/builder 1.26.3. Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com>

Depends on openshift/rosa#3366 (Dockerfile.clients + .ci-operator.yaml). Switch rosa ci-operator configs to build_root from_repository, run presubmits from rosa-clients, and regenerate prow jobs. Stop skipping jobs when only .ci-operator.yaml changes now that build_root uses from_repository: true. Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 13, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 13, 2026

openshift-ci Bot requested review from davidleerh and jerichokeyne July 13, 2026 18:53

amandahla mentioned this pull request Jul 13, 2026

ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 openshift/rosa#3366

Merged

23 tasks

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 13, 2026

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 17, 2026

amandahla mentioned this pull request Jul 17, 2026

ROSAENG-61450 | chore: bump go.mod to 1.26.5 openshift/rosa#3388

Open

23 tasks

amandahla force-pushed the ROSAENG-61450-rosa-ci-clients branch from fd6e952 to 9914b4c Compare July 17, 2026 18:03

openshift-merge-bot Bot removed the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 17, 2026

amandahla mentioned this pull request Jul 22, 2026

ROSAENG-61450 | ci: restore Dockerfile.clients after OpenShift build rewrite openshift/rosa#3408

Merged

23 tasks

amandahla requested a review from olucasfreitas July 27, 2026 20:03

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 27, 2026

openshift-ci Bot assigned olucasfreitas Jul 28, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 28, 2026

openshift-merge-bot Bot merged commit c9e2c31 into openshift:main Jul 28, 2026
23 of 24 checks passed

Uh oh!

Conversation

amandahla commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Related

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 13, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Related

Test plan

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

amandahla commented Jul 13, 2026

Uh oh!

amandahla commented Jul 17, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 17, 2026

Uh oh!

amandahla commented Jul 17, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 17, 2026

Uh oh!

jerichokeyne commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

jerichokeyne commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

amandahla commented Jul 22, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 22, 2026

Uh oh!

amandahla commented Jul 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

amandahla commented Jul 24, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

amandahla commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

amandahla commented Jul 27, 2026

Uh oh!

amandahla commented Jul 27, 2026

Uh oh!

amandahla commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

amandahla commented Jul 13, 2026 •

edited

Loading

openshift-ci-robot commented Jul 13, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading