NO-ISSUE: add kustomize to osac-installer container image by omer-vishlitzky · Pull Request #80431 · openshift/release

omer-vishlitzky · 2026-06-11T16:59:08Z

Summary

Add the kustomize binary to the osac-installer container image, alongside the existing helm install.

Why

The refresh script (scripts/refresh-after-snapshot.sh) needs kustomize edit set replicas to deploy fulfillment pods at zero replicas during the kustomize apply. This prevents a race condition where database migrations are interrupted by a StatefulSet pod recreation, leaving the database in a dirty state (osac-installer#260).

Test plan

Verify the osac-installer image builds successfully with kustomize included

🤖 Generated with Claude Code

Summary by CodeRabbit

This PR updates the OpenShift CI configuration for the osac-installer image to add kustomize to the installer container alongside the existing Helm installation. The change is in the ci-operator Dockerfile snippet used for the osac-installer build: after installing Helm and moving the helm binary, the Dockerfile now preserves shell line-continuation so the subsequent kustomize download/extract (curl | tar) runs as part of the same multi-command RUN step.

Practically, this ensures kustomize is available inside the osac-installer image so the repository's refresh script (scripts/refresh-after-snapshot.sh) can use kustomize edit set replicas to bring fulfillment pods to zero during kustomize apply. That behavior prevents a race where StatefulSet pod recreation could interrupt database migrations and leave the database in a dirty/inconsistent state. The test plan is to verify the osac-installer image builds successfully with kustomize included.

The refresh script needs `kustomize edit set replicas` to deploy fulfillment pods at zero replicas during the kustomize apply, preventing a race condition where database migrations are interrupted by a StatefulSet pod recreation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci-robot · 2026-06-11T16:59:12Z

@omer-vishlitzky: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Add the kustomize binary to the osac-installer container image, alongside the existing helm install.

Why

The refresh script (scripts/refresh-after-snapshot.sh) needs kustomize edit set replicas to deploy fulfillment pods at zero replicas during the kustomize apply. This prevents a race condition where database migrations are interrupted by a StatefulSet pod recreation, leaving the database in a dirty state (osac-installer#260).

Test plan

Verify the osac-installer image builds successfully with kustomize included

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-06-11T17:22:00Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: fb1a5f3f-2056-4425-b59e-075ef2d647e3

📥 Commits

Reviewing files that changed from the base of the PR and between ff4ee1d and e6f047d.

📒 Files selected for processing (1)

ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml

Walkthrough

The PR adds an explicit shell line-continuation in the Dockerfile RUN that installs Helm so the subsequent kustomize curl|tar extract remains part of the same chained command.

Changes

Container Image Build Configuration

Layer / File(s)	Summary
Helm and Kustomize installation formatting `ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml`	Inserted a shell line-continuation after moving the Helm binary into `/usr/local/bin/helm` so the following kustomize `curl ...

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels:
ok-to-test

Suggested reviewers:

shubham-pampattiwar
jmguzik
kaovilai

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding kustomize to the osac-installer container image, which is the primary purpose of this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR `#80431` changes only ci-operator/config/.../osac-project-osac-installer-main.yaml (adds kustomize to Dockerfile); no Ginkgo test titles (It/Describe/Context) are modified.
Test Structure And Quality	✅ Passed	PR changes only ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml; no Ginkgo test (*_test.go) code is modified, so the test-structure/quality check is not applica...
Microshift Test Compatibility	✅ Passed	PR does not add any Ginkgo e2e tests; it modifies only container image build configuration. MicroShift Test Compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR change is to osac-installer image YAML installing kustomize; no Go Ginkgo e2e tests were added/modified (no *_test.go or ginkgo in changed Go files).
Topology-Aware Scheduling Compatibility	✅ Passed	PR `#80431` only changes osac-installer Dockerfile RUN to download/extract kustomize (shell chaining); no scheduling constraints, affinities, topology keys, or node selectors are added.
Ote Binary Stdout Contract	✅ Passed	PR edits osac-installer YAML dockerfile_literal to install helm/kustomize; repository contains no OTE binaries (only generic tooling Go files), so stdout JSON contract is unaffected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR `#80431` only changes ci-operator/osac-installer YAML (no Ginkgo e2e tests added/modified), so the IPv6/disconnected network test-compatibility checks are not applicable.
No-Weak-Crypto	✅ Passed	Scanned osac-project-osac-installer-main.yaml for MD5/SHA1/DES/RC4/3DES/Blowfish/ECB and crypto/comparison keywords; no matches found.
Container-Privileges	✅ Passed	Inspected ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml; kustomize was added to the image Dockerfile, and no privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/...
No-Sensitive-Data-In-Logs	✅ Passed	PR `#80431` only updates osac-installer-main.yaml RUN command to chain kustomize curl\|tar after helm mv; no logging/echo of tokens/passwords/PII or Authorization headers found.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…ac-installer-main.yaml Co-authored-by: Trey West <treywest45th@gmail.com>

omer-vishlitzky · 2026-06-11T18:14:40Z

/pj-rehearse ack

openshift-merge-bot · 2026-06-11T18:14:43Z

@omer-vishlitzky: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

omer-vishlitzky · 2026-06-11T18:28:31Z

/retest

eliorerz

LGTM.

omer-vishlitzky · 2026-06-11T18:37:38Z

/unhold

openshift-merge-bot · 2026-06-11T18:42:38Z

[REHEARSALNOTIFIER]
@omer-vishlitzky: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-osac-project-osac-installer-main-e2e-vmaas	osac-project/osac-installer	presubmit	Ci-operator config changed
pull-ci-osac-project-osac-installer-main-images	osac-project/osac-installer	presubmit	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

omer-vishlitzky · 2026-06-11T18:43:07Z

/retest

omer-vishlitzky · 2026-06-11T18:43:47Z

/pj-rehearse ack

openshift-merge-bot · 2026-06-11T18:43:50Z

@omer-vishlitzky: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

larsks · 2026-06-11T18:59:18Z

/lgtm

openshift-ci · 2026-06-11T19:03:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz, jhernand, larsks, omer-vishlitzky, trewest

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/osac-project/osac-installer/OWNERS~~ [eliorerz,jhernand,omer-vishlitzky,trewest]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-06-11T19:26:14Z

@omer-vishlitzky: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci · 2026-06-11T19:27:33Z

@larsks: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

…80431) * NO-ISSUE: add kustomize to osac-installer container image The refresh script needs `kustomize edit set replicas` to deploy fulfillment pods at zero replicas during the kustomize apply, preventing a race condition where database migrations are interrupted by a StatefulSet pod recreation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml Co-authored-by: Trey West <treywest45th@gmail.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Trey West <treywest45th@gmail.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 11, 2026

openshift-ci Bot requested review from akshaynadkarni and eliorerz June 11, 2026 16:59

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 11, 2026

trewest reviewed Jun 11, 2026

View reviewed changes

Comment thread ci-operator/config/osac-project/osac-installer/osac-project-osac-installer-main.yaml Outdated

Update ci-operator/config/osac-project/osac-installer/osac-project-os…

e6f047d

…ac-installer-main.yaml Co-authored-by: Trey West <treywest45th@gmail.com>

trewest approved these changes Jun 11, 2026

View reviewed changes

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jun 11, 2026

omer-vishlitzky closed this Jun 11, 2026

omer-vishlitzky reopened this Jun 11, 2026

omer-vishlitzky marked this pull request as draft June 11, 2026 18:24

omer-vishlitzky marked this pull request as ready for review June 11, 2026 18:24

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 11, 2026

openshift-ci Bot requested review from adriengentil and eranco74 June 11, 2026 18:26

eliorerz approved these changes Jun 11, 2026

View reviewed changes

openshift-ci Bot assigned eliorerz Jun 11, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 11, 2026

openshift-ci Bot assigned trewest Jun 11, 2026

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jun 11, 2026

omer-vishlitzky marked this pull request as draft June 11, 2026 18:42

openshift-merge-bot Bot removed the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jun 11, 2026

omer-vishlitzky marked this pull request as ready for review June 11, 2026 18:42

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 11, 2026

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jun 11, 2026

openshift-ci Bot requested a review from trewest June 11, 2026 18:44

jhernand approved these changes Jun 11, 2026

View reviewed changes

openshift-ci Bot assigned jhernand Jun 11, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 11, 2026

openshift-merge-bot Bot merged commit 62880b1 into openshift:main Jun 11, 2026
14 checks passed

Uh oh!

Conversation

omer-vishlitzky commented Jun 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jun 11, 2026

Summary

Why

Test plan

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

Uh oh!

omer-vishlitzky commented Jun 11, 2026

Uh oh!

openshift-merge-bot Bot commented Jun 11, 2026

Uh oh!

omer-vishlitzky commented Jun 11, 2026

Uh oh!

eliorerz left a comment

Choose a reason for hiding this comment

Uh oh!

omer-vishlitzky commented Jun 11, 2026

Uh oh!

openshift-merge-bot Bot commented Jun 11, 2026

Uh oh!

omer-vishlitzky commented Jun 11, 2026

Uh oh!

omer-vishlitzky commented Jun 11, 2026

Uh oh!

openshift-merge-bot Bot commented Jun 11, 2026

Uh oh!

larsks commented Jun 11, 2026

Uh oh!

openshift-ci Bot commented Jun 11, 2026

Uh oh!

openshift-ci Bot commented Jun 11, 2026

Uh oh!

openshift-ci Bot commented Jun 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

omer-vishlitzky commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading