osac-operator: copy Helm charts into installer overlay for presubmit CI

[omer-vishlitzky]

Summary

• Copy charts/ from osac-operator PR branches into the osac-installer-with-pr image so that CRD and Helm chart changes are tested in presubmit CI

Problem

The osac-installer-with-pr image only copies config/ from the PR branch into the installer submodule path. The umbrella Helm chart reads CRDs from charts/operator-crds/ and deployment templates from charts/operator/ — not from config/crd/bases/. This means PRs that change CRD schemas (e.g., renaming status.jobs → status.provisioningJobs) deploy the new operator binary against the old CRDs from the snapshot's submodule pin.

The result: the API server silently strips unknown status fields, the operator can't persist job tracking state, and it enters an infinite reconcile loop launching hundreds of duplicate AAP jobs. All VirtualNetwork/Subnet/PublicIP tests fail with timeout.

Evidence from osac-operator PR #299:

• Operator log: unknown field "status.provisioningJobs" repeated 478 times
• 122 duplicate provision job triggers in 29 minutes
• 380+ total AAP jobs launched (vs ~30 expected)
• 4 test failures + 14 test errors, all from VirtualNetwork stuck in Progressing

Fix

Add one line to the Dockerfile literal:

COPY charts/ /installer/base/osac-operator/charts/

This ensures helm upgrade during CI refresh picks up CRDs and deployment templates from the PR branch, not the stale submodule pin.

Test plan

• Verified the Helm umbrella chart references file://../../base/osac-operator/charts/operator-crds and file://../../base/osac-operator/charts/operator
• Verified charts/operator-crds/ is kept in sync with config/crd/bases/ by make helm-crds, enforced by CI (make check-helm-crds)
• Confirmed no other OSAC repos need this fix (fulfillment-service and osac-aap have no CRDs; bare-metal-fulfillment-operator has no independent Prow presubmit)

🤖 Generated with Claude Code

Summary by CodeRabbit

This PR modifies the OpenShift CI build configuration for the osac-operator repository to fix test failures caused by schema version mismatches during PR validation.

Context: The CI infrastructure generates an osac-installer-with-pr image that overlays PR changes into the installer base image. When testing osac-operator PRs, the build was copying only the config/ directory from the PR branch, but not the charts/ directory containing Helm chart resources. This created a critical issue: while the PR's new operator binary would be deployed, it would be run against stale CRD definitions from the base snapshot, causing the Kubernetes API server to strip unknown fields from status updates. This led to infinite reconciliation loops and cascading test failures.

The fix: A single line was added to the Dockerfile configuration in ci-operator/config/osac-project/osac-operator/osac-project-osac-operator-main.yaml to copy the charts directory into the installer overlay:

COPY charts/ /installer/base/osac-operator/charts/

Impact: This ensures that when the umbrella Helm chart runs helm upgrade operations during CI refresh, it picks up both CRD schemas and deployment templates from the PR branch, allowing the operator to be tested against the correct schema version. The charts directory is kept in sync with config/crd/bases/ through an automated make helm-crds process enforced by CI checks.

Why it matters: Without this change, PRs that modify CRD schemas (such as renaming fields) cannot be properly validated in CI, leading to silent failures where the API server silently drops unknown fields, causing the operator to lose state and retry infinitely. This is particularly problematic for infrastructure-related resources like VirtualNetwork, Subnet, and PublicIP that are critical to cluster functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 774024f2-6a97-44c7-9aa5-0e13cf98e433

📥 Commits

Reviewing files that changed from the base of the PR and between 81b7b36 and f83b1c9.

📒 Files selected for processing (1)

• ci-operator/config/osac-project/osac-operator/osac-project-osac-operator-main.yaml

---

Walkthrough

A single COPY charts/ instruction was added to the embedded dockerfile_literal in the OSAC operator CI build configuration, copying the charts/ directory into /installer/base/osac-operator/charts/ within the installer image.

Changes

OSAC Operator Installer Image Update

Layer / File(s)	Summary
Add charts/ COPY step to installer image build ci-operator/config/osac-project/osac-operator/osac-project-osac-operator-main.yaml	Adds COPY charts/ to the embedded Dockerfile so charts/ is placed under /installer/base/osac-operator/charts/ in the built installer image.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

lgtm, approved

Suggested reviewers

• adriengentil
• eranco74
• danmanor

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: adding a COPY instruction for Helm charts into the installer overlay for presubmit CI testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR contains only CI/CD configuration changes (adding Helm chart copy to YAML), no Ginkgo test definitions or modifications to test files. Check not applicable.
Test Structure And Quality	✅ Passed	PR contains only CI configuration changes (YAML file), not Ginkgo test code, so test structure review is not applicable.
Microshift Test Compatibility	✅ Passed	This PR modifies CI build configuration only, not adding any new Ginkgo e2e tests. The check for MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. The PR only modifies build configuration YAML to copy Helm charts into the installer overlay, making the SNO compatibility check not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	This PR only modifies a CI operator configuration file (ci-operator/config/) that defines how to build container images. It adds a single COPY instruction to a Dockerfile. No deployment manifests,...
Ote Binary Stdout Contract	✅ Passed	PR modifies only a CI operator YAML config file adding a Dockerfile COPY instruction; no binary, test, or process-level code changes. OTE Binary Stdout Contract check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests added; PR only modifies CI configuration YAML to copy charts directory in installer image build.
No-Weak-Crypto	✅ Passed	PR modifies only a single YAML configuration file to add a Docker COPY instruction for Helm charts. No weak cryptographic algorithms, custom crypto implementations, or non-constant-time comparisons...
Container-Privileges	✅ Passed	The PR adds only a COPY instruction to a Dockerfile, copying charts directory files. No container privileges, hostPID/Network/IPC, SYS_ADMIN capabilities, or allowPrivilegeEscalation settings are i...
No-Sensitive-Data-In-Logs	✅ Passed	No logging statements or sensitive data exposure in the PR. The change adds a simple COPY instruction to the Dockerfile with no logging, credentials, or debug output.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@omer-vishlitzky: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-osac-project-osac-operator-main-e2e-vmaas	osac-project/osac-operator	presubmit	Ci-operator config changed
pull-ci-osac-project-osac-operator-main-images	osac-project/osac-operator	presubmit	Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@omer-vishlitzky: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[rgolangh]

FYI @zszabo-rh

[rgolangh]

/lgtm
/approve

[omer-vishlitzky]

/pj-rehearse ack

[openshift-merge-bot]

@omer-vishlitzky: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: omer-vishlitzky, rgolangh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/osac-project/osac-operator/OWNERS [rgolangh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment