ROSAENG-58795 | config: prow hive connection - #82509
Conversation
| config: prow hive connection
WalkthroughThe Prow configuration updates five ROSA clusters service PR-check jobs to target ChangesROSA PR-check configuration
Estimated code review effort: 2 (Simple) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/label network-access-rehearsals-ok |
|
@davidleerh: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
/pj-rehearse network-access-allowed |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@davidleerh: PR author isn't allowed to allow network access rehearsals. This must be done by a different member of the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`:
- Line 58: Regenerate the derived Prow/job configuration using make update after
the openshift-online-rosa-clusters-service input change, and include all
resulting generated output changes, particularly for capabilities,
restrict_network_access, and secrets.
- Around line 68-75: Review the pr-check-aws job’s use of the
rosa-clusters-service-sandbox secret and document its PR-controlled execution
scope, or replace it with least-privilege, non-sensitive credentials. Ensure the
secret cannot expose sensitive values through the job’s unrestricted network
access, and apply the same validation to both affected PR-check jobs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 825bd4be-4c09-4ce6-843b-43b387c4a13a
📒 Files selected for processing (1)
ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml
| - always_run: false | ||
| as: pr-check-rosa-hcp | ||
| capabilities: | ||
| - intranet |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the referenced CI config and inspect relevant sections plus nearby metadata references.
target="ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml"
if [ -f "$target" ]; then
echo "== referenced file line count =="
wc -l "$target"
echo
echo "== referenced relevant sections =="
sed -n '45,145p' "$target" | nl -ba -v45
else
echo "Referenced file not found: $target"
fi
echo
echo "== generated metadata files in repo =="
git ls-files | rg '(^|/)(zz_generated_metadata|registry-metadata|ci-operator-config|jobs|\.pb\.txt|\.conf$)' || true
echo
echo "== nearby ci-operator config metadata/header =="
sed -n '1,60p' "$target" | nl -ba -v1Repository: openshift/release
Length of output: 386
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect Makefile generation targets and whether make update/job generation references Prow/job outputs.
echo "== Makefile generation targets =="
if [ -f Makefile ]; then
rg -n 'update|registry-metadata|ci-operator-config|jobs|Prow|prow|job' Makefile -C 2 || true
else
echo "Makefile not found in repository root"
fi
echo
echo "== exact generated/prow job files likely tied to this repo =="
git ls-files ci-operator/config/openshift-online/rosa-clusters-service | sortRepository: openshift/release
Length of output: 15596
Regenerate the derived Prow job configuration.
This CI operator config changes generated job inputs (capabilities, restrict_network_access, and secrets), so include the regenerated Prow/job outputs from make update before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`
at line 58, Regenerate the derived Prow/job configuration using make update
after the openshift-online-rosa-clusters-service input change, and include all
resulting generated output changes, particularly for capabilities,
restrict_network_access, and secrets.
Sources: Coding guidelines, Learnings
| restrict_network_access: false | ||
| secrets: | ||
| - mount_path: /usr/local/rosa-clusters-service-sandbox | ||
| name: rosa-clusters-service-sandbox | ||
| - always_run: false | ||
| as: pr-check-aws | ||
| capabilities: | ||
| - intranet |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant file excerpt:"
sed -n '1,170p' ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml
echo
echo "Search for rosa-clusters-service-sandbox and restrict/intranet:"
rg -n "rosa-clusters-service-sandbox|restrict_network_access|intranet|always_run|as: pr-check" ci-operator/config/openshift-online/rosa-clusters-service -S || true
echo
echo "Generated/config metadata presence:"
git ls-files | rg 'zz_generated_metadata|metadata|ci-operator/config/openshift-online/rosa-clusters-service|Makefile' || true
echo
echo "Makefile targets:"
if [ -f Makefile ]; then sed -n '1,220p' Makefile; fiRepository: openshift/release
Length of output: 50374
🌐 Web query:
ci-operator restricted network access intranet capability PR check secret mount security
💡 Result:
In the OpenShift CI (ci-operator) environment, restricted network access and intranet capability are managed through specific configuration flags and capability definitions to balance security with functional requirements [1][2]. Restricted Network Access and Intranet Capability By default, jobs in the OpenShift CI environment operate with restricted network access. To enable connectivity to the Red Hat intranet, the restrict_network_access flag must be set to false within the test section of the ci-operator configuration [1]. Additionally, jobs requiring this access must specify the intranet capability in their configuration block, which instructs the dispatcher to select a cluster that supports intranet connectivity [2]. PR Check Requirements For security, tests that set restrict_network_access: false are subject to strict PR validation. These tests require both the approved label and a network-access-rehearsals-ok label to be present on the pull request [1]. The network-access-rehearsals-ok label must be added by an authorized OpenShift organization member (not the PR author) via the /pj-rehearse network-access-allowed command [1]. If these requirements are not met, the CI platform will not trigger the test, and some build farm clusters do not support intranet access at all [1]. Secret Mount Security CI jobs access sensitive information by mounting Kubernetes secrets or by utilizing the Secrets Store CSI driver to fetch secrets from Google Secret Manager (GSM) [3][4]. - Access Model: The security model is designed to prevent users from reading secret values back [5][4]. Only the CI infrastructure can read and mount the secrets during job execution [5][4]. - Mounting: Secrets can be mounted at specific paths defined in the ci-operator credentials or secrets stanzas [3][4]. When using the CSI driver, secrets are mounted as files into the pod's filesystem, often utilizing a tmpfs to avoid writing sensitive data to durable storage [6][7]. - Principle of Least Privilege: To enhance security, it is recommended to use separate namespaces for sensitive workloads, avoid broad roles, and restrict access to the minimum set of permissions required [7]. Anyone with access to a namespace or the ability to create pods within it may theoretically be able to access mounted secrets, reinforcing the need for controlled access to the CI environment [6][7].
Citations:
- 1: https://github.com/openshift/ci-docs/blob/main/content/en/architecture/ci-operator.md
- 2: https://docs.ci.openshift.org/how-tos/capabilities/
- 3: https://docs.ci.openshift.org/how-tos/adding-a-new-secret-to-ci/
- 4: https://docs.ci.openshift.org/how-tos/adding-a-new-secret-to-ci-gsm/
- 5: https://github.com/openshift/ci-docs/blob/main/content/en/architecture/cli-secret-manager.md
- 6: https://secrets-store-csi-driver.sigs.k8s.io/concepts.html
- 7: https://kubernetes.io/docs/concepts/configuration/secret/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Target file with line numbers:"
cat -n ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml | sed -n '1,160p'
echo
echo "Local metadata/generated files for target org/repo:"
git ls-files | rg 'ci-operator/config/openshift-online/rosa-clusters-service|zz_generated_metadata|prowjobs|openshift-online' || true
echo
echo "Intranet jobs with secret mounts nearby:"
rg -n -C 8 'secrets:|mount_path:|name: rosa-clusters-service-sandbox|restrict_network_access: false|intranet|name: pr-check-aws|name: post-' ci-operator/config/openshift-online/rosa-clusters-service -S || true
echo
echo "CI docs config excerpt if present:"
if [ -f ci-docs.yaml ] || [ -d ci-docs ]; then echo found; fiRepository: openshift/release
Length of output: 47790
🌐 Web query:
Red Hat CI operator restrict_network_access false intranet approval required PR jobs
💡 Result:
In the context of OpenShift CI (Prow), setting restrict_network_access: false in a ci-operator job configuration effectively permits the job to bypass standard firewall restrictions, allowing broader network access (such as connecting to the Red Hat intranet) [1][2][3]. Because this configuration change poses security risks, the pj-rehearse tool—which manages pre-submit rehearsals—automatically disables rehearsals for any PR that modifies this setting [2][4][3]. To proceed with such a job, a specific approval process is required: 1. Manual Intervention: An openshift organization member (who is not the author of the PR) must comment on the PR with the command: /pj-rehearse network-access-allowed [3][5][6]. 2. Validation: This command adds a required label to the PR, which explicitly allows the rehearsals to run [3][5][6]. 3. Final Acknowledgment: Once the rehearsals have run and the results are verified, the PR must receive an acknowledgment (usually via the /pj-rehearse ack command) to unblock the merge process [3][5][6]. Additionally, jobs requiring access to the Red Hat intranet must be configured with the intranet capability in the capabilities block of the ci-operator configuration to ensure they are dispatched to compatible infrastructure [1][5].
Citations:
- 1: https://docs.ci.openshift.org/how-tos/capabilities/
- 2:
pj-rehearse: Disable rehearsals on tests where the 'restrict_network_access' config is toggled to 'false' ci-tools#4348 - 3: https://github.com/openshift/ci-tools/blob/074066ff5cb7/cmd/pj-rehearse/server.go
- 4:
pj-rehearse: Disable rehearsals on tests where the 'restrict_network_access' config is toggled to 'false' ci-tools#4348 - 5: Switch Tempo and OTEL 4.22 upstream jobs from GCP to baremetal-lab-ipi and updated downstream testing jobs post RHOSDT 3.10 release. #80806
- 6: CNTRLPLANE-3509: Resolve N-minor release images via release controller API #79627
Verify the PR-check secret scope.
These jobs both mount rosa-clusters-service-sandbox and disable network restrictions at lines 68-126. If the PR-check path can execute PR-controlled code, document or restrict rosa-clusters-service-sandbox to least-privilege/non-sensitive credentials so credentials cannot be exfiltrated over the unrestricted egress path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/openshift-online/rosa-clusters-service/openshift-online-rosa-clusters-service-konflux-master.yaml`
around lines 68 - 75, Review the pr-check-aws job’s use of the
rosa-clusters-service-sandbox secret and document its PR-controlled execution
scope, or replace it with least-privilege, non-sensitive credentials. Ensure the
secret cannot expose sensitive values through the job’s unrestricted network
access, and apply the same validation to both affected PR-check jobs.
| config: prow hive connection
|
@davidleerh: |
| config: prow hive connection
|
/pj-rehearse network-access-allowed |
|
@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-hcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-aws |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@davidleerh: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
2 similar comments
|
@davidleerh: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
|
@davidleerh: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-gcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-rosa-classic |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-core |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-gcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-gcp |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-core |
|
@davidleerh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-online-rosa-clusters-service-konflux-master-pr-check-core |
|
@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: davidleerh, gdbranco The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
f90da6e
into
openshift:main
![openshift-prow[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
* ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection
* ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection
* ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection * ROSAENG-58795 | config: prow hive connection
3 participants
Summary by CodeRabbit
Updated the OpenShift release CI prow presubmit job definitions for the
rosa-clusters-serviceKonflux master branch to enable Hive connectivity by grantingintranetaccess (alongsidenested-podman) to thepr-check-rosa-hcp,pr-check-aws,pr-check-gcp,pr-check-rosa-classic, andpr-check-corejobs. The jobs now target clusterbuild05and mount therosa-clusters-service-sandboxsecret withrestrict_network_access: falseso the checks can reach the required network resources. Additionally, the PR was labeled for network-access rehearsals and rehearsals for the ROSA HCPpr-checkwere re-requested as needed.