Skip to content

OSAC-2162: Update create-caas to use --version instead of --release-image - #317

Merged
danmanor merged 3 commits into
osac-project:mainfrom
danmanor:fix/OSAC-2162-version-flag
Aug 5, 2026
Merged

danmanor merged 3 commits into
osac-project:mainfrom
danmanor:fix/OSAC-2162-version-flag

Conversation

@danmanor

@danmanor danmanor commented Aug 5, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • OSAC-2162 renamed the osac create cluster CLI flag from --release-image (OCI pullspec) to --version (ClusterVersion identifier like 4.22.0)
  • The create-caas role still used --release-image, causing the CaaS Netris E2E workflow to fail with Error: unknown flag: --release-image
  • Updates the Ansible variable from caas_release_image (full image URL) to caas_cluster_version (version string) to match

Fixes the failure in osac-project/osac#110: https://github.com/osac-project/osac/actions/runs/30980298429/job/92224031785

Test plan

  • Verify CaaS Netris E2E workflow passes with the updated flag
  • Confirm osac create cluster --version 4.22.0 works against a deployed fulfillment-service

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Configuration
    • Updated cluster version settings to align with the deployed platform version.
    • Cluster creation now uses the configured version when selecting the release.
  • Testing
    • End-to-end installation workflows can now run for pull requests from forks.
    • Added step-specific timeouts to improve workflow reliability and prevent stalled installations, diagnostics, and cleanup operations.

…mage

OSAC-2162 renamed the CLI's --release-image flag to --version, which
takes a ClusterVersion identifier (e.g. "4.22.0") instead of an OCI
image pullspec. Update the create-caas role and its variable to match.

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: Dan Manor <dmanor@redhat.com>
@openshift-ci-robot

openshift-ci-robot commented Aug 5, 2026 •

Copy link
Copy Markdown

@danmanor: This pull request references OSAC-2162 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • OSAC-2162 renamed the osac create cluster CLI flag from --release-image (OCI pullspec) to --version (ClusterVersion identifier like 4.22.0)
  • The create-caas role still used --release-image, causing the CaaS Netris E2E workflow to fail with Error: unknown flag: --release-image
  • Updates the Ansible variable from caas_release_image (full image URL) to caas_cluster_version (version string) to match

Fixes the failure in osac-project/osac#110: https://github.com/osac-project/osac/actions/runs/30980298429/job/92224031785

Test plan

  • Verify CaaS Netris E2E workflow passes with the updated flag
  • Confirm osac create cluster --version 4.22.0 works against a deployed fulfillment-service

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested a review from akshaynadkarni August 5, 2026 08:27
@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danmanor

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Aug 5, 2026 •

Copy link
Copy Markdown

Review Change Stack

Walkthrough

The CaaS configuration now derives caas_cluster_version from ocp_version and passes it to cluster creation. The Netris workflow now supports fork pull requests and applies explicit timeouts to installation, diagnostics, and cleanup steps.

Changes

CaaS and workflow updates

Layer / File(s) Summary
Version selection and cluster creation
infra/netris/inventory/group_vars/all.yml, infra/netris/roles/create-caas/tasks/main.yml
The inventory replaces caas_release_image with caas_cluster_version, derived as {{ ocp_version }}.0. Cluster creation passes the value with --version.
Workflow execution controls
.github/workflows/e2e-caas-netris-full-install-caller.yml, .github/workflows/e2e-caas-netris-full-install.yml
The reusable workflow no longer excludes fork pull requests. Installation, diagnostic, and DNS cleanup steps now have explicit timeouts.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested reviewers: rgolangh, akshaynadkarni, tzvatot


Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (1 error)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error Removing the fork gate lets PR code run after Vault secrets are passed to the job, while diagnostics are uploaded; modified scripts could print pull secrets, licenses, AWS keys, or internal data. Keep the same-repository restriction, or run fork PRs without Vault-backed secrets and uploaded diagnostics; execute only trusted base-branch scripts in the secret-bearing job.
✅ Passed checks (10 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the primary change from --release-image to --version in create-caas.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets ✅ Passed The PR adds only a cluster version and timeout values; scans found no added keys, tokens, passwords, private keys, credential URLs, or long encoded blobs. Existing credentials are unchanged.
No-Weak-Crypto ✅ Passed The PR changes only Ansible version handling and workflow timeouts/conditions; the PR patch adds no MD5, SHA1, DES, RC4, Blowfish, ECB, or custom crypto usage.
No-Injection-Vectors ✅ Passed The PR changes a fixed version variable, an Ansible command-module argument, workflow timeouts, and a job condition; no listed injection vector is introduced.
Container-Privileges ✅ Passed The complete PR diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or securityContext setting, and changes no container/Kubernetes manifest.
Ai-Attribution ✅ Passed The PR names Claude Code and all three PR commits include an Assisted-by trailer; no Co-Authored-By trailer or AI co-author text appears.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@infra/netris/inventory/group_vars/all.yml`:
- Around line 83-85: Normalize or validate ocp_version before deriving
caas_cluster_version so patch-qualified values such as 4.22.0 do not become
4.22.0.0. Update the caas_cluster_version configuration to append .0 only for a
major.minor value, while preserving the existing 4.22.0 result for the default.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cbf1889-9662-420d-8462-eefc6ffa1cbe

📥 Commits

Reviewing files that changed from the base of the PR and between 7eaf28c and 7835e03.

📒 Files selected for processing (2)
  • infra/netris/inventory/group_vars/all.yml
  • infra/netris/roles/create-caas/tasks/main.yml

Comment on lines +83 to +85
# CaaS cluster version -- must match a ClusterVersion present in the
# deployed fulfillment-service (metadata.name or spec.version).
caas_cluster_version: "{{ ocp_version }}.0"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n -C 3 '\bocp_version\b' \
  --glob '*.yml' --glob '*.yaml' --glob '*.j2' --glob '*.ini' --glob '*.sh' .

Repository: osac-project/osac-test-infra

Length of output: 4839


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Tracked files containing ocp_version/caas_cluster_version:\n'
git ls-files | xargs rg -l '\bocp_version\b|\bcaas_cluster_version\b' || true

printf '\nRelevant source snippets:\n'
for f in infra/netris/inventory/group_vars/all.yml infra/netris/playbooks/post-osac.yml infra/netris/roles/prep-osac/tasks/main.yml infra/netris/roles/discover-caas/templates/infraenv.yml.j2; do
  if [ -f "$f" ]; then
    echo "--- $f"
    rg -n -C 3 '\bocp_version\b|\bcaas_cluster_version\b' "$f" || true
  fi
done

printf '\nStatic verifier: if ocp_version already contains 3 dotted numeric components, the derived variable is 4 dotted numeric components.\n'
python3 - <<'PY'
import re
pats = ["4.22", "4.22.0"]
for v in pats:
    derived = v + ".0"
    segs = derived.split(".")
    print(f"ocp_version={v!r} -> {derived!r}, numeric_segments={sum(bool(re.fullmatch(r'\\d+', s)) for s in segs)}")
print("Current tracked default:", "4.22")
PY

Repository: osac-project/osac-test-infra

Length of output: 3660


Validate ocp_version before deriving caas_cluster_version.

The current inventory default is 4.22, so the derived 4.22.0 is valid. Any ocp_version override that already includes the patch, such as 4.22.0, produces 4.22.0.0. Add validation or normalize the value before appending .0.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@infra/netris/inventory/group_vars/all.yml` around lines 83 - 85, Normalize or
validate ocp_version before deriving caas_cluster_version so patch-qualified
values such as 4.22.0 do not become 4.22.0.0. Update the caas_cluster_version
configuration to append .0 only for a major.minor value, while preserving the
existing 4.22.0 result for the default.

Remove the if-guard that skipped the job for fork PRs. The vmaas and
bmaas callers already run for all PRs without this restriction.

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: Dan Manor <dmanor@redhat.com>
Based on observed timings from production runs, add timeout-minutes to
each step that was missing one:

  Install prerequisites:      30m (observed ~10m)
  Deploy Netris lab:          45m (observed ~17m)
  Build and load components:  30m (observed ~13m)
  Deploy OSAC:                90m (already had this)
  Deploy OCP from snapshot:   60m (already had this)
  Setup CaaS hosts/catalog:   30m (observed ~7m)
  Deploy CaaS cluster:        90m (includes up to 60m wait for ready)
  Gather diagnostics:         10m each
  Cleanup DNS:                 5m

Prevents hung steps from burning the full 6h job timeout.

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: Dan Manor <dmanor@redhat.com>
@danmanor
danmanor merged commit 173dc24 into osac-project:main Aug 5, 2026
4 of 6 checks passed

This branch was previously deployed

1 inactive deployment
e2e-test — 99afd895 Deployed Aug 5, 2026 by danmanor via e2e-bmaas-full-install / e2e #481
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants