Skip to content

OCPBUGS-79666: add pull secret auto populate logic to ABI local UI#3508

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift-assisted:masterfrom
ElayAharoni:pull-secret-auto-populated-in-ABI-local-UI
Mar 26, 2026
Merged

OCPBUGS-79666: add pull secret auto populate logic to ABI local UI#3508
openshift-merge-bot[bot] merged 1 commit intoopenshift-assisted:masterfrom
ElayAharoni:pull-secret-auto-populated-in-ABI-local-UI

Conversation

@ElayAharoni
Copy link
Copy Markdown
Collaborator

@ElayAharoni ElayAharoni commented Mar 26, 2026

https://redhat.atlassian.net/browse/OCPBUGS-79666

Summary by CodeRabbit

Release Notes

  • New Features
    • Introduced a dedicated service to retrieve and manage pull secrets for cluster configuration.
    • Updated pull secret interface to display a confirmation message when a secret has already been configured for a cluster.
    • Extended pull secret configuration support to single cluster feature deployments.

@openshift-ci openshift-ci bot requested review from ammont82 and rawagner March 26, 2026 11:50
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Mar 26, 2026
@openshift-ci-robot
Copy link
Copy Markdown

@ElayAharoni: This pull request references Jira Issue OCPBUGS-79666, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @bmanzari

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-79666

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 26, 2026

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: bmanzari.

Note that only openshift-assisted members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@ElayAharoni: This pull request references Jira Issue OCPBUGS-79666, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @bmanzari

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-79666

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci openshift-ci bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Mar 26, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 26, 2026

Warning

Rate limit exceeded

@ElayAharoni has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 1 minutes and 7 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3bf66522-1c20-45a3-b96f-96eb8f0f0026

📥 Commits

Reviewing files that changed from the base of the PR and between 7d92954 and 32a8776.

📒 Files selected for processing (8)
  • apps/assisted-disconnected-ui/proxy/app.go
  • apps/assisted-disconnected-ui/proxy/config/config.go
  • apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
  • libs/locales/lib/en/translation.json
  • libs/ui-lib/lib/common/components/clusters/PullSecret.tsx
  • libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
  • libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
  • libs/ui-lib/lib/ocm/hooks/usePullSecret.ts
📝 Walkthrough

Walkthrough

This PR adds a dedicated HTTP GET endpoint at /api/pull-secret in the backend that serves pull-secret manifest content from a configurable file path, while refactoring frontend components and hooks to support conditional display of whether a pull secret has already been configured.

Changes

Cohort / File(s) Summary
Backend Routing & Configuration
apps/assisted-disconnected-ui/proxy/app.go, apps/assisted-disconnected-ui/proxy/config/config.go
Added /api/pull-secret HTTP route registration and new PullSecretManifestPath config variable sourced from PULL_SECRET_MANIFEST_PATH environment variable (default: /etc/assisted/manifests/pull-secret.yaml).
Pull-Secret Handler
apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
New handler package providing Handler(manifestPath string) that serves pull-secret manifest files via GET, returning 404 for missing files, 500 for read errors, and 405 for non-GET methods.
Pull-Secret UI Component
libs/ui-lib/lib/common/components/clusters/PullSecret.tsx
Extended PullSecretProps with isPullSecretSet and isSingleClusterFeatureEnabled flags; simplified render flow to conditionally display success alert when pull secret is already set; refactored checkbox handler to always be defined for checkbox-enabled path.
Form Integration
libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
Moved pull-secret existence check from parent conditional into PullSecret component via new isPullSecretSet prop; now always renders PullSecret with feature flag passed through.
Hook & Component Logic
libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx, libs/ui-lib/lib/ocm/hooks/usePullSecret.ts
Refactored usePullSecret to accept optional isSingleClusterFeatureEnabled parameter and added fetchPullSecretFromBridge() helper for bridge-based retrieval; ClusterDetails now delegates pull-secret source selection to hook instead of inline conditional.
Localization
libs/locales/lib/en/translation.json
Added translation entry for "A pull secret has already been set for this cluster. You can edit it below." message.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant ClusterDetails as ClusterDetails Component
    participant usePullSecret as usePullSecret Hook
    participant BridgeAPI as Bridge API<br/>(/api/pull-secret)
    participant OCM as OCM API

    User->>ClusterDetails: Mount Component
    ClusterDetails->>usePullSecret: Call usePullSecret(isSingleClusterFeatureEnabled)
    
    alt isInOcm is true
        usePullSecret->>OCM: fetchPullSecret()
        OCM-->>usePullSecret: Pull secret config
        usePullSecret-->>ClusterDetails: Pull secret value
    else isInOcm is false AND isSingleClusterFeatureEnabled
        usePullSecret->>BridgeAPI: GET /api/pull-secret
        BridgeAPI-->>usePullSecret: Manifest file contents
        usePullSecret-->>ClusterDetails: Trimmed pull secret
    else isInOcm is false AND NOT isSingleClusterFeatureEnabled
        usePullSecret-->>ClusterDetails: No update (uses existing)
    end
    
    ClusterDetails->>User: Render with pull secret value
Loading
sequenceDiagram
    participant User
    participant PullSecret as PullSecret Component
    participant FormField as Form Field
    participant Backend as Backend Handler

    User->>PullSecret: Render Component<br/>(with isPullSecretSet)
    
    alt isPullSecretSet is true
        PullSecret->>PullSecret: Display success alert
    end
    
    PullSecret->>PullSecret: Show PullSecretField<br/>(checkbox or direct)
    PullSecret->>FormField: Bind to Formik field
    
    User->>PullSecret: Check/Edit pull secret
    PullSecret->>FormField: Update value
    FormField-->>User: Render updated state
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Suggested reviewers

  • ammont82
  • rawagner
  • jgyselov

Poem

🐰 A secret so pure, now polished and neat,
From bridge to frontend, the pull-secret's complete,
With flags and with handlers, the flow finds its way,
One API endpoint brings manifest play! 🎉

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 75.42% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: adding pull secret auto-population logic to ABI local UI, which aligns with the changeset's core objective across backend route/config and frontend hook/component updates.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci-robot
Copy link
Copy Markdown

@ElayAharoni: This pull request references Jira Issue OCPBUGS-79666, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @bmanzari

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-79666

Summary by CodeRabbit

  • New Features
  • Added pull secret endpoint and handler to retrieve pull secret manifests.
  • Updated UI to display pull secret configuration status with success indicator when set.
  • Enhanced pull secret retrieval to support bridge-based fetching in single-cluster environments.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 26, 2026

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: bmanzari.

Note that only openshift-assisted members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@ElayAharoni: This pull request references Jira Issue OCPBUGS-79666, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @bmanzari

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-79666

Summary by CodeRabbit

  • New Features
  • Added pull secret endpoint and handler to retrieve pull secret manifests.
  • Updated UI to display pull secret configuration status with success indicator when set.
  • Enhanced pull secret retrieval to support bridge-based fetching in single-cluster environments.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
libs/ui-lib/lib/ocm/hooks/usePullSecret.ts (1)

51-55: ⚠️ Potential issue | 🟡 Minor

Potential stale closure bug due to missing dependency.

The useEffect has an empty dependency array but calls getPullSecret, which depends on isSingleClusterFeatureEnabled. If isSingleClusterFeatureEnabled changes after initial render, getPullSecret won't be called again with the updated value.

The ESLint disable comment suggests this was intentional, but the current logic could lead to:

  1. Initial render with isSingleClusterFeatureEnabled = undefined → no bridge fetch
  2. If the value later becomes true, the effect won't re-run
Consider adding getPullSecret to the dependency array
   React.useEffect(() => {
     if (!pullSecret) {
       void getPullSecret();
     }
-  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [getPullSecret, pullSecret]);

Or, if the single-run behavior is intentional, document why:

-  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+  }, []); // eslint-disable-line react-hooks/exhaustive-deps -- intentionally run once on mount only
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@libs/ui-lib/lib/ocm/hooks/usePullSecret.ts` around lines 51 - 55, The effect
in usePullSecret calls getPullSecret but has an empty dependency array, causing
a stale closure when isSingleClusterFeatureEnabled changes; update the
React.useEffect dependencies to include getPullSecret (or
isSingleClusterFeatureEnabled and pullSecret) so the effect re-runs when feature
flag changes, or alternatively document and keep the single-run behavior if
intentional; locate the React.useEffect block that references getPullSecret,
pullSecret, and isSingleClusterFeatureEnabled and either add getPullSecret to
the dependency array or add a clear comment explaining why the effect must run
only once.
🧹 Nitpick comments (3)
apps/assisted-disconnected-ui/proxy/pullsecret/handler.go (2)

27-30: Method check is redundant given router configuration.

The router in app.go already restricts this route to GET via .Methods(http.MethodGet). The method check here is defensive but redundant.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/assisted-disconnected-ui/proxy/pullsecret/handler.go` around lines 27 -
30, Remove the redundant HTTP method check block (the if r.Method !=
http.MethodGet { w.WriteHeader(http.StatusMethodNotAllowed); return }) from the
pull secret handler so the route relies on the router's .Methods(http.MethodGet)
restriction; locate and delete this conditional inside the handler function that
receives (w, r) (e.g., the pull secret handler) and ensure no other logic
depends on that early return.

34-37: Debug-level logging may obscure deployment issues.

When the pull-secret manifest is missing, logging at Debug level means this won't appear in typical production log configurations. If the deployment is misconfigured (e.g., the file isn't mounted at the expected path), operators may not notice the issue since the endpoint silently returns 404.

Consider logging at Warn level, at least on first occurrence, or adding a startup check that validates the configured path exists.

Consider logging at a higher level for visibility
 		if os.IsNotExist(err) {
-			log.GetLog().WithField("path", manifestPath).Debug("pull secret manifest not found")
+			log.GetLog().WithField("path", manifestPath).Warn("pull secret manifest not found at configured path")
 			w.WriteHeader(http.StatusNotFound)
 			return
 		}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/assisted-disconnected-ui/proxy/pullsecret/handler.go` around lines 34 -
37, The handler currently logs a missing pull-secret manifest at Debug level
which can hide deployment issues; update the log call in the handler that checks
os.IsNotExist(err) to use Warn (e.g., replace log.GetLog().WithField("path",
manifestPath).Debug(...) with a Warn-level call) so missing file events are
visible in production, and optionally add a startup validation function (run on
init) that checks manifestPath existence and logs a clear error/warning if
absent using the same logger (log.GetLog()) to catch misconfigured mounts early.
apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/apic.go (1)

128-130: Ensure complete writes in the YAML handler wrapper.

Go's io.Writer contract guarantees that if Write returns n < len(buffer), it must also return a non-nil error. However, if defensive full-write semantics are desired for this handler, loop until the buffer is fully drained rather than returning after a single (potentially partial) write.

🛠️ Proposed fix
 func yaml_writer_write_handler(emitter *yaml_emitter_t, buffer []byte) error {
-	_, err := emitter.output_writer.Write(buffer)
-	return err
+	for len(buffer) > 0 {
+		n, err := emitter.output_writer.Write(buffer)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		buffer = buffer[n:]
+	}
+	return nil
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/apic.go` around
lines 128 - 130, The yaml_writer_write_handler currently returns after a single
Write call which may be partial; change it to repeatedly call
emitter.output_writer.Write until the entire buffer is written or an error
occurs. In other words, in yaml_writer_write_handler loop over the remaining
slice (using the returned n to advance the offset) and only return nil when
total bytes written equals len(buffer), otherwise return the encountered non-nil
error from Write.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/assisted-disconnected-ui/proxy/app.go`:
- Around line 31-33: The /pull-secret route is unprotected: wrap the existing
router.HandleFunc("/pull-secret",
pullsecret.Handler(config.PullSecretManifestPath)) registration with the same
auth/authorization middleware used for other sensitive proxy endpoints (or apply
the same handler chain used by apiHandler), so requests to "/pull-secret" must
authenticate and pass authorization checks before calling pullsecret.Handler; on
failure return the appropriate 401/403 response and log the denied attempt.
Ensure you reuse the existing auth middleware function(s) (the same middleware
applied to apiHandler or other protected routes) rather than creating a
different policy, and keep pullsecret.Handler(config.PullSecretManifestPath) as
the final handler in the chain.

In `@apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yaml.go`:
- Around line 471-483: The Node.SetString method must clear any previous style
bits before recomputing so prior styles (e.g., DoubleQuotedStyle, TaggedStyle)
don't leak into reused nodes; modify Node.SetString to reset n.Style (e.g.,
n.Style = 0 or PlainStyle) at the start (or right after setting Tag/Value) and
then reapply LiteralStyle only if strings.Contains(n.Value, "\n") so Style
reflects the new content; key symbols: Node.SetString, n.Style, LiteralStyle.

In `@libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx`:
- Line 49: Restore infraEnv.pullSecret as the highest-precedence source for
single-cluster edit flows by changing how pullSecret is computed: pick
infraEnv?.pullSecret first and only fall back to the hook value from
usePullSecret(isSingleClusterFeatureEnabled) when infraEnv.pullSecret is
undefined/null. Update the assignment in ClusterDetails (the line using
usePullSecret) so it uses infraEnv?.pullSecret ??
usePullSecret(isSingleClusterFeatureEnabled) (or equivalent) to preserve
existing infra-env pull secrets.

In `@libs/ui-lib/lib/ocm/hooks/usePullSecret.ts`:
- Around line 44-47: The alert title is a user-facing string and must be
translated: in usePullSecret.ts inside the handleApiError callback where
addAlert({ title: 'Failed to retrieve pull secret', ... }) is called, wrap the
title with t('ai:Failed to retrieve pull secret') and ensure the t translation
function is imported (or available) in the module; keep the rest of the callback
(setPullSecret and message: getApiErrorMessage(e)) unchanged.

---

Outside diff comments:
In `@libs/ui-lib/lib/ocm/hooks/usePullSecret.ts`:
- Around line 51-55: The effect in usePullSecret calls getPullSecret but has an
empty dependency array, causing a stale closure when
isSingleClusterFeatureEnabled changes; update the React.useEffect dependencies
to include getPullSecret (or isSingleClusterFeatureEnabled and pullSecret) so
the effect re-runs when feature flag changes, or alternatively document and keep
the single-run behavior if intentional; locate the React.useEffect block that
references getPullSecret, pullSecret, and isSingleClusterFeatureEnabled and
either add getPullSecret to the dependency array or add a clear comment
explaining why the effect must run only once.

---

Nitpick comments:
In `@apps/assisted-disconnected-ui/proxy/pullsecret/handler.go`:
- Around line 27-30: Remove the redundant HTTP method check block (the if
r.Method != http.MethodGet { w.WriteHeader(http.StatusMethodNotAllowed); return
}) from the pull secret handler so the route relies on the router's
.Methods(http.MethodGet) restriction; locate and delete this conditional inside
the handler function that receives (w, r) (e.g., the pull secret handler) and
ensure no other logic depends on that early return.
- Around line 34-37: The handler currently logs a missing pull-secret manifest
at Debug level which can hide deployment issues; update the log call in the
handler that checks os.IsNotExist(err) to use Warn (e.g., replace
log.GetLog().WithField("path", manifestPath).Debug(...) with a Warn-level call)
so missing file events are visible in production, and optionally add a startup
validation function (run on init) that checks manifestPath existence and logs a
clear error/warning if absent using the same logger (log.GetLog()) to catch
misconfigured mounts early.

In `@apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/apic.go`:
- Around line 128-130: The yaml_writer_write_handler currently returns after a
single Write call which may be partial; change it to repeatedly call
emitter.output_writer.Write until the entire buffer is written or an error
occurs. In other words, in yaml_writer_write_handler loop over the remaining
slice (using the returned n to advance the offset) and only return nil when
total bytes written equals len(buffer), otherwise return the encountered non-nil
error from Write.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2d90579b-8b4f-467d-b807-b071563da099

📥 Commits

Reviewing files that changed from the base of the PR and between fbecaf3 and 1d26aaf.

⛔ Files ignored due to path filters (1)
  • apps/assisted-disconnected-ui/proxy/go.sum is excluded by !**/*.sum
📒 Files selected for processing (26)
  • apps/assisted-disconnected-ui/proxy/app.go
  • apps/assisted-disconnected-ui/proxy/config/config.go
  • apps/assisted-disconnected-ui/proxy/go.mod
  • apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/LICENSE
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/NOTICE
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/README.md
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/apic.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/decode.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/emitterc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/encode.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/parserc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/readerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/resolve.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/scannerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/sorter.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/writerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yaml.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yamlh.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yamlprivateh.go
  • apps/assisted-disconnected-ui/proxy/vendor/modules.txt
  • apps/assisted-disconnected-ui/vite.config.ts
  • libs/ui-lib/lib/common/components/clusters/PullSecret.tsx
  • libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
  • libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
  • libs/ui-lib/lib/ocm/hooks/usePullSecret.ts

Comment thread apps/assisted-disconnected-ui/proxy/app.go
Comment thread apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yaml.go Outdated
Comment thread libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
Comment thread libs/ui-lib/lib/ocm/hooks/usePullSecret.ts
Comment thread apps/assisted-disconnected-ui/proxy/app.go Outdated
Comment thread apps/assisted-disconnected-ui/vite.config.ts Outdated
Comment thread libs/ui-lib/lib/common/components/clusters/PullSecret.tsx
Comment thread libs/ui-lib/lib/ocm/hooks/usePullSecret.ts Outdated
Comment thread libs/ui-lib/lib/ocm/hooks/usePullSecret.ts Outdated
Comment thread apps/assisted-disconnected-ui/proxy/pullsecret/handler.go Outdated
@ElayAharoni ElayAharoni force-pushed the pull-secret-auto-populated-in-ABI-local-UI branch 2 times, most recently from b9d5a91 to 7d92954 Compare March 26, 2026 12:30
@openshift-ci openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 26, 2026
@openshift-ci openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 26, 2026
@rawagner
Copy link
Copy Markdown
Member

/approve
/lgtm

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (1)
libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx (1)

49-49: ⚠️ Potential issue | 🟠 Major

Preserve infraEnv.pullSecret precedence in single-cluster edit flows.

The hook in libs/ui-lib/lib/ocm/hooks/usePullSecret.ts still only pulls from OCM/bridge, so an existing infraEnv.pullSecret never reaches ClusterDetailsForm. In single-cluster edit flows that can replace the saved secret with the fallback value instead of preserving the one already attached to the infra-env.

Proposed patch
-  const pullSecret = usePullSecret(isSingleClusterFeatureEnabled);
+  const fetchedPullSecret = usePullSecret(isSingleClusterFeatureEnabled);
+  const pullSecret = isSingleClusterFeatureEnabled
+    ? infraEnv?.pullSecret ?? fetchedPullSecret
+    : fetchedPullSecret;
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx` at line 49,
The current call in ClusterDetails.tsx uses
usePullSecret(isSingleClusterFeatureEnabled) which ignores an existing
infraEnv.pullSecret and causes single-cluster edit flows to lose the saved
secret; update the code so the infraEnv.pullSecret takes precedence: either
extend the hook usePullSecret to accept an optional existingPullSecret parameter
and return that when present, or change ClusterDetails.tsx to compute const
pullSecret = infraEnv?.pullSecret ??
usePullSecret(isSingleClusterFeatureEnabled) and pass that pullSecret into
ClusterDetailsForm; reference the usePullSecret hook, the ClusterDetails
component, ClusterDetailsForm, and the infraEnv.pullSecret property when making
the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/assisted-disconnected-ui/proxy/pullsecret/handler.go`:
- Around line 25-46: The Handler function currently serves the pull-secret
manifest without any authentication; fix this by enforcing the existing API auth
boundary: either register Handler through the existing apiHandler/middleware
chain (so it inherits the API auth) or add an explicit auth check at the top of
Handler (call the same authentication/authorization routine your app uses and
return http.StatusUnauthorized / http.StatusForbidden on failure) before reading
manifestPath; keep the same behavior for GET-only requests and return the
manifest only after successful auth.

---

Duplicate comments:
In `@libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx`:
- Line 49: The current call in ClusterDetails.tsx uses
usePullSecret(isSingleClusterFeatureEnabled) which ignores an existing
infraEnv.pullSecret and causes single-cluster edit flows to lose the saved
secret; update the code so the infraEnv.pullSecret takes precedence: either
extend the hook usePullSecret to accept an optional existingPullSecret parameter
and return that when present, or change ClusterDetails.tsx to compute const
pullSecret = infraEnv?.pullSecret ??
usePullSecret(isSingleClusterFeatureEnabled) and pass that pullSecret into
ClusterDetailsForm; reference the usePullSecret hook, the ClusterDetails
component, ClusterDetailsForm, and the infraEnv.pullSecret property when making
the change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 502b8c52-6e44-4aa7-93ef-b40e51f422e7

📥 Commits

Reviewing files that changed from the base of the PR and between 1d26aaf and b9d5a91.

⛔ Files ignored due to path filters (1)
  • apps/assisted-disconnected-ui/proxy/go.sum is excluded by !**/*.sum
📒 Files selected for processing (26)
  • apps/assisted-disconnected-ui/proxy/app.go
  • apps/assisted-disconnected-ui/proxy/config/config.go
  • apps/assisted-disconnected-ui/proxy/go.mod
  • apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/LICENSE
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/NOTICE
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/README.md
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/apic.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/decode.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/emitterc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/encode.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/parserc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/readerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/resolve.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/scannerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/sorter.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/writerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yaml.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yamlh.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yamlprivateh.go
  • apps/assisted-disconnected-ui/proxy/vendor/modules.txt
  • libs/locales/lib/en/translation.json
  • libs/ui-lib/lib/common/components/clusters/PullSecret.tsx
  • libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
  • libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
  • libs/ui-lib/lib/ocm/hooks/usePullSecret.ts
✅ Files skipped from review due to trivial changes (8)
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/NOTICE
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/LICENSE
  • apps/assisted-disconnected-ui/proxy/go.mod
  • libs/locales/lib/en/translation.json
  • apps/assisted-disconnected-ui/proxy/config/config.go
  • apps/assisted-disconnected-ui/proxy/vendor/modules.txt
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yamlprivateh.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/readerc.go
🚧 Files skipped from review as they are similar to previous changes (6)
  • apps/assisted-disconnected-ui/proxy/app.go
  • libs/ui-lib/lib/ocm/hooks/usePullSecret.ts
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/writerc.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/encode.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/decode.go
  • apps/assisted-disconnected-ui/proxy/vendor/gopkg.in/yaml.v3/yamlh.go

Comment thread apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
@ElayAharoni ElayAharoni force-pushed the pull-secret-auto-populated-in-ABI-local-UI branch from 7d92954 to 1d06dbc Compare March 26, 2026 12:39
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 26, 2026
Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
libs/ui-lib/lib/common/components/clusters/PullSecret.tsx (1)

11-12: ⚠️ Potential issue | 🟠 Major

Make isSingleClusterFeatureEnabled explicit (non-optional) to prevent silent behavior misses.

Line 33 now changes rendering based on isSingleClusterFeatureEnabled, but Line 12/Line 19 makes it optional with a false default. Callers that don’t pass it silently fall back to the bare-field path, which can skip the new ABI-local edit flow.
Given this component API change, require the prop and remove the default to force explicit call-site decisions.

Proposed API hardening diff
 export type PullSecretProps = {
   defaultPullSecret?: string;
   isOcm?: boolean;
   isPullSecretSet?: boolean;
-  isSingleClusterFeatureEnabled?: boolean;
+  isSingleClusterFeatureEnabled: boolean;
 };
 
 const PullSecret: React.FC<PullSecretProps> = ({
   defaultPullSecret,
   isOcm = false,
   isPullSecretSet = false,
-  isSingleClusterFeatureEnabled = false,
+  isSingleClusterFeatureEnabled,
 }) => {

Also applies to: 18-20, 33-35

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@libs/ui-lib/lib/common/components/clusters/PullSecret.tsx` around lines 11 -
12, The component PullSecret currently declares isSingleClusterFeatureEnabled as
optional with a default false which causes silent fallback; change the prop in
the component's props/interface to a required boolean
(isSingleClusterFeatureEnabled: boolean) and remove any default assignment in
the PullSecret function parameter list so callers must provide it; then update
all call sites that render <PullSecret ...> to pass an explicit boolean value
for isSingleClusterFeatureEnabled (do not rely on local fallback logic inside
PullSecret), and run typechecks to ensure no remaining optional usages.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@libs/ui-lib/lib/common/components/clusters/PullSecret.tsx`:
- Around line 11-12: The component PullSecret currently declares
isSingleClusterFeatureEnabled as optional with a default false which causes
silent fallback; change the prop in the component's props/interface to a
required boolean (isSingleClusterFeatureEnabled: boolean) and remove any default
assignment in the PullSecret function parameter list so callers must provide it;
then update all call sites that render <PullSecret ...> to pass an explicit
boolean value for isSingleClusterFeatureEnabled (do not rely on local fallback
logic inside PullSecret), and run typechecks to ensure no remaining optional
usages.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e4938d02-33ed-48c9-81bd-9039dbacd488

📥 Commits

Reviewing files that changed from the base of the PR and between b9d5a91 and 7d92954.

📒 Files selected for processing (8)
  • apps/assisted-disconnected-ui/proxy/app.go
  • apps/assisted-disconnected-ui/proxy/config/config.go
  • apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
  • libs/locales/lib/en/translation.json
  • libs/ui-lib/lib/common/components/clusters/PullSecret.tsx
  • libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
  • libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
  • libs/ui-lib/lib/ocm/hooks/usePullSecret.ts
✅ Files skipped from review due to trivial changes (1)
  • apps/assisted-disconnected-ui/proxy/app.go
🚧 Files skipped from review as they are similar to previous changes (5)
  • libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
  • libs/locales/lib/en/translation.json
  • apps/assisted-disconnected-ui/proxy/config/config.go
  • apps/assisted-disconnected-ui/proxy/pullsecret/handler.go
  • libs/ui-lib/lib/ocm/hooks/usePullSecret.ts

Signed-off-by: Elay Aharoni <elayaha@gmail.com>
@ElayAharoni ElayAharoni force-pushed the pull-secret-auto-populated-in-ABI-local-UI branch from 1d06dbc to 32a8776 Compare March 26, 2026 12:51
@ElayAharoni
Copy link
Copy Markdown
Collaborator Author

/cherrypick release-4.21

@openshift-cherrypick-robot
Copy link
Copy Markdown
Contributor

@ElayAharoni: once the present PR merges, I will cherry-pick it on top of release-4.21 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@rawagner
Copy link
Copy Markdown
Member

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 26, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 26, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ElayAharoni, rawagner

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot bot merged commit 787898c into openshift-assisted:master Mar 26, 2026
14 checks passed
@openshift-ci-robot
Copy link
Copy Markdown

@ElayAharoni: Jira Issue OCPBUGS-79666: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-79666 has been moved to the MODIFIED state.

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-79666

Summary by CodeRabbit

Release Notes

  • New Features
  • Introduced a dedicated service to retrieve and manage pull secrets for cluster configuration.
  • Updated pull secret interface to display a confirmation message when a secret has already been configured for a cluster.
  • Extended pull secret configuration support to single cluster feature deployments.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-cherrypick-robot
Copy link
Copy Markdown
Contributor

@ElayAharoni: #3508 failed to apply on top of branch "release-4.21":

Applying: add pull secret auto populate logic to ABI local UI
Using index info to reconstruct a base tree...
M	apps/assisted-disconnected-ui/proxy/config/config.go
M	libs/locales/lib/en/translation.json
M	libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
M	libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
Falling back to patching base and 3-way merge...
Auto-merging libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
CONFLICT (content): Merge conflict in libs/ui-lib/lib/ocm/components/clusterWizard/ClusterDetails.tsx
Auto-merging libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
CONFLICT (content): Merge conflict in libs/ui-lib/lib/ocm/components/clusterConfiguration/OcmClusterDetailsFormFields.tsx
Auto-merging libs/locales/lib/en/translation.json
CONFLICT (content): Merge conflict in libs/locales/lib/en/translation.json
Auto-merging apps/assisted-disconnected-ui/proxy/config/config.go
CONFLICT (content): Merge conflict in apps/assisted-disconnected-ui/proxy/config/config.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 add pull secret auto populate logic to ABI local UI

Details

In response to this:

/cherrypick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants