Skip to content

ROSAENG-58795 | config: prow hive connection #82509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 5 commits into from
Jul 30, 2026
Merged

ROSAENG-58795 | config: prow hive connection #82509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3a807ee
ROSAENG-58795
davidleerh Jul 27, 2026
d8ca44f
ROSAENG-58795
davidleerh Jul 27, 2026
1df05fb
ROSAENG-58795
davidleerh Jul 27, 2026
935a8b5
ROSAENG-58795 | config: prow hive connection
davidleerh Jul 30, 2026
8e25952
ROSAENG-58795 | config: prow hive connection
davidleerh Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions ...t-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,9 @@ tests:
- always_run: false
as: pr-check-rosa-hcp
capabilities:
- intranet

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate the referenced CI config and inspect relevant sections plus nearby metadata references.
target="ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml"
if [ -f "$target" ]; then
  echo "== referenced file line count =="
  wc -l "$target"
  echo
  echo "== referenced relevant sections =="
  sed -n '45,145p' "$target" | nl -ba -v45
else
  echo "Referenced file not found: $target"
fi

echo
echo "== generated metadata files in repo =="
git ls-files | rg '(^|/)(zz_generated_metadata|registry-metadata|ci-operator-config|jobs|\.pb\.txt|\.conf$)' || true

echo
echo "== nearby ci-operator config metadata/header =="
sed -n '1,60p' "$target" | nl -ba -v1

Repository: openshift/release

Length of output: 386

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect Makefile generation targets and whether make update/job generation references Prow/job outputs.
echo "== Makefile generation targets =="
if [ -f Makefile ]; then
  rg -n 'update|registry-metadata|ci-operator-config|jobs|Prow|prow|job' Makefile -C 2 || true
else
  echo "Makefile not found in repository root"
fi

echo
echo "== exact generated/prow job files likely tied to this repo =="
git ls-files ci-operator/config/openshift-online/rosa-clusters-service | sort

Repository: openshift/release

Length of output: 15596

Regenerate the derived Prow job configuration.

This CI operator config changes generated job inputs (capabilities, restrict_network_access, and secrets), so include the regenerated Prow/job outputs from make update before merging.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`
at line 58, Regenerate the derived Prow/job configuration using make update
after the openshift-online-rosa-clusters-service input change, and include all
resulting generated output changes, particularly for capabilities,
restrict_network_access, and secrets.

Sources: Coding guidelines, Learnings

- nested-podman
cluster: build05
commands: |
source prow/load_prow_secrets.sh
set -x
Expand All @@ -64,13 +66,16 @@ tests:
from: golang-plus
nested_podman: true
optional: true
restrict_network_access: false
secrets:
- mount_path: /usr/local/rosa-clusters-service-sandbox
name: rosa-clusters-service-sandbox
- always_run: false
as: pr-check-aws
capabilities:
- intranet
Comment on lines +69 to +76

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Relevant file excerpt:"
sed -n '1,170p' ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml

echo
echo "Search for rosa-clusters-service-sandbox and restrict/intranet:"
rg -n "rosa-clusters-service-sandbox|restrict_network_access|intranet|always_run|as: pr-check" ci-operator/config/openshift-online/rosa-clusters-service -S || true

echo
echo "Generated/config metadata presence:"
git ls-files | rg 'zz_generated_metadata|metadata|ci-operator/config/openshift-online/rosa-clusters-service|Makefile' || true

echo
echo "Makefile targets:"
if [ -f Makefile ]; then sed -n '1,220p' Makefile; fi

Repository: openshift/release

Length of output: 50374

🌐 Web query:

ci-operator restricted network access intranet capability PR check secret mount security

💡 Result:

In the OpenShift CI (ci-operator) environment, restricted network access and intranet capability are managed through specific configuration flags and capability definitions to balance security with functional requirements [1][2]. Restricted Network Access and Intranet Capability By default, jobs in the OpenShift CI environment operate with restricted network access. To enable connectivity to the Red Hat intranet, the restrict_network_access flag must be set to false within the test section of the ci-operator configuration [1]. Additionally, jobs requiring this access must specify the intranet capability in their configuration block, which instructs the dispatcher to select a cluster that supports intranet connectivity [2]. PR Check Requirements For security, tests that set restrict_network_access: false are subject to strict PR validation. These tests require both the approved label and a network-access-rehearsals-ok label to be present on the pull request [1]. The network-access-rehearsals-ok label must be added by an authorized OpenShift organization member (not the PR author) via the /pj-rehearse network-access-allowed command [1]. If these requirements are not met, the CI platform will not trigger the test, and some build farm clusters do not support intranet access at all [1]. Secret Mount Security CI jobs access sensitive information by mounting Kubernetes secrets or by utilizing the Secrets Store CSI driver to fetch secrets from Google Secret Manager (GSM) [3][4]. - Access Model: The security model is designed to prevent users from reading secret values back [5][4]. Only the CI infrastructure can read and mount the secrets during job execution [5][4]. - Mounting: Secrets can be mounted at specific paths defined in the ci-operator credentials or secrets stanzas [3][4]. When using the CSI driver, secrets are mounted as files into the pod's filesystem, often utilizing a tmpfs to avoid writing sensitive data to durable storage [6][7]. - Principle of Least Privilege: To enhance security, it is recommended to use separate namespaces for sensitive workloads, avoid broad roles, and restrict access to the minimum set of permissions required [7]. Anyone with access to a namespace or the ability to create pods within it may theoretically be able to access mounted secrets, reinforcing the need for controlled access to the CI environment [6][7].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Target file with line numbers:"
cat -n ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml | sed -n '1,160p'

echo
echo "Local metadata/generated files for target org/repo:"
git ls-files | rg 'ci-operator/config/openshift-online/rosa-clusters-service|zz_generated_metadata|prowjobs|openshift-online' || true

echo
echo "Intranet jobs with secret mounts nearby:"
rg -n -C 8 'secrets:|mount_path:|name: rosa-clusters-service-sandbox|restrict_network_access: false|intranet|name: pr-check-aws|name: post-' ci-operator/config/openshift-online/rosa-clusters-service -S || true

echo
echo "CI docs config excerpt if present:"
if [ -f ci-docs.yaml ] || [ -d ci-docs ]; then echo found; fi

Repository: openshift/release

Length of output: 47790

🌐 Web query:

Red Hat CI operator restrict_network_access false intranet approval required PR jobs

💡 Result:

In the context of OpenShift CI (Prow), setting restrict_network_access: false in a ci-operator job configuration effectively permits the job to bypass standard firewall restrictions, allowing broader network access (such as connecting to the Red Hat intranet) [1][2][3]. Because this configuration change poses security risks, the pj-rehearse tool—which manages pre-submit rehearsals—automatically disables rehearsals for any PR that modifies this setting [2][4][3]. To proceed with such a job, a specific approval process is required: 1. Manual Intervention: An openshift organization member (who is not the author of the PR) must comment on the PR with the command: /pj-rehearse network-access-allowed [3][5][6]. 2. Validation: This command adds a required label to the PR, which explicitly allows the rehearsals to run [3][5][6]. 3. Final Acknowledgment: Once the rehearsals have run and the results are verified, the PR must receive an acknowledgment (usually via the /pj-rehearse ack command) to unblock the merge process [3][5][6]. Additionally, jobs requiring access to the Red Hat intranet must be configured with the intranet capability in the capabilities block of the ci-operator configuration to ensure they are dispatched to compatible infrastructure [1][5].

Citations:

Verify the PR-check secret scope.

These jobs both mount rosa-clusters-service-sandbox and disable network restrictions at lines 68-126. If the PR-check path can execute PR-controlled code, document or restrict rosa-clusters-service-sandbox to least-privilege/non-sensitive credentials so credentials cannot be exfiltrated over the unrestricted egress path.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`
around lines 68 - 75, Review the pr-check-aws job’s use of the
rosa-clusters-service-sandbox secret and document its PR-controlled execution
scope, or replace it with least-privilege, non-sensitive credentials. Ensure the
secret cannot expose sensitive values through the job’s unrestricted network
access, and apply the same validation to both affected PR-check jobs.

- nested-podman
cluster: build05
commands: |
source prow/load_prow_secrets.sh
set -x
Expand All @@ -79,13 +84,16 @@ tests:
from: golang-plus
nested_podman: true
optional: true
restrict_network_access: false
secrets:
- mount_path: /usr/local/rosa-clusters-service-sandbox
name: rosa-clusters-service-sandbox
- always_run: false
as: pr-check-gcp
capabilities:
- intranet
- nested-podman
cluster: build05
commands: |
source prow/load_prow_secrets.sh
set -x
Expand All @@ -94,13 +102,16 @@ tests:
from: golang-plus
nested_podman: true
optional: true
restrict_network_access: false
secrets:
- mount_path: /usr/local/rosa-clusters-service-sandbox
name: rosa-clusters-service-sandbox
- always_run: false
as: pr-check-rosa-classic
capabilities:
- intranet
- nested-podman
cluster: build05
commands: |
source prow/load_prow_secrets.sh
set -x
Expand All @@ -109,13 +120,16 @@ tests:
from: golang-plus
nested_podman: true
optional: true
restrict_network_access: false
secrets:
- mount_path: /usr/local/rosa-clusters-service-sandbox
name: rosa-clusters-service-sandbox
- always_run: false
as: pr-check-core
capabilities:
- intranet
- nested-podman
cluster: build05
commands: |
source prow/load_prow_secrets.sh
set -x
Expand All @@ -124,6 +138,7 @@ tests:
from: golang-plus
nested_podman: true
optional: true
restrict_network_access: false
secrets:
- mount_path: /usr/local/rosa-clusters-service-sandbox
name: rosa-clusters-service-sandbox
Expand Down
10 changes: 10 additions & 0 deletions ...sa-clusters-service/openshift-online-rosa-clusters-service-konflux-master-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,9 @@ presubmits:
decoration_config:
skip_cloning: true
labels:
capability/intranet: intranet
capability/nested-podman: nested-podman
ci-operator.openshift.io/cluster: build05
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-aws
Expand Down Expand Up @@ -292,7 +294,9 @@ presubmits:
decoration_config:
skip_cloning: true
labels:
capability/intranet: intranet
capability/nested-podman: nested-podman
ci-operator.openshift.io/cluster: build05
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-core
Expand Down Expand Up @@ -371,7 +375,9 @@ presubmits:
decoration_config:
skip_cloning: true
labels:
capability/intranet: intranet
capability/nested-podman: nested-podman
ci-operator.openshift.io/cluster: build05
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-gcp
Expand Down Expand Up @@ -450,7 +456,9 @@ presubmits:
decoration_config:
skip_cloning: true
labels:
capability/intranet: intranet
capability/nested-podman: nested-podman
ci-operator.openshift.io/cluster: build05
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-classic
Expand Down Expand Up @@ -529,7 +537,9 @@ presubmits:
decoration_config:
skip_cloning: true
labels:
capability/intranet: intranet
capability/nested-podman: nested-podman
ci-operator.openshift.io/cluster: build05
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp
Expand Down