Skip to content

Add periodic CI cluster-updates evaluation jobs for 4.22 #82093

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fao89 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add periodic CI cluster-updates evaluation jobs for 4.22 #82093

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions ci-operator/config/fao89/ocp-evals/OWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# DO NOT EDIT; this file is auto-generated using https://github.com/openshift/ci-tools.
# Fetched from https://github.com/fao89/ocp-evals root OWNERS
# If the repo had OWNERS_ALIASES then the aliases were expanded
# Logins who are not members of 'openshift' organization were filtered out
# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md

approvers:
- fao89
options: {}
reviewers:
- fao89
197 changes: 197 additions & 0 deletions ci-operator/config/fao89/ocp-evals/fao89-ocp-evals-main__4.22.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,197 @@
base_images:
lightspeed-service-api:
name: lightspeed-service-api
namespace: ols
tag: latest
build_root:
project_image:
dockerfile_literal: |
FROM registry.ci.openshift.org/ocp/ubi-python-311:9
USER 0
RUN dnf install -y git && dnf clean all
Comment on lines +9 to +11

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='ci-operator/config/fao89/cluster-updates-evals/fao89-cluster-updates-evals-main__4.22.yaml'

echo "== File context =="
wc -l "$file"
sed -n '1,220p' "$file" | nl -ba | sed -n '1,120p'

echo
echo "== Search for related build-root Dockerfiles / USER instructions =="
rg -n --hidden --no-messages 'USER 0|USER 1001|build-root|dnf install -y git|FROM registry\.ci\.openshift\.org/ocp/ubi-python-311:9' ci-operator/config/fao89/cluster-updates-evals -S

echo
echo "== Nearby generated metadata / job config references =="
rg -n --hidden --no-messages 'zz_generated_metadata|periodic|presubmit|postsubmit|build_root|build-root' ci-operator/config/fao89/cluster-updates-evals -S

Repository: openshift/release

Length of output: 309

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='ci-operator/config/fao89/cluster-updates-evals/fao89-cluster-updates-evals-main__4.22.yaml'

echo "== Selected line ranges =="
sed -n '1,80p' "$file"
echo
sed -n '80,160p' "$file"
echo
sed -n '160,220p' "$file"

echo
echo "== Exact build-root / user references =="
rg -n '^( {2,})?(FROM|USER|RUN|build_root|build-root|dockerfile|dockerfile_literal):|USER 0|USER 1001|dnf install -y git' "$file" -n -S

echo
echo "== Other similar configs with USER restore patterns =="
rg -n 'USER 0|USER 1001|dnf install -y git' ci-operator/config -S

Repository: openshift/release

Length of output: 41037

Restore a non-root runtime user after installing Git.
ci-operator/config/fao89/cluster-updates-evals/fao89-cluster-updates-evals-main__4.22.yaml:9-11 leaves the build-root image running as root after dnf install. Switch back to the image’s standard non-root UID before it is used in CI.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/fao89/cluster-updates-evals/fao89-cluster-updates-evals-main__4.22.yaml`
around lines 9 - 11, Update the Dockerfile fragment after the Git installation
in the main image build to restore the image’s standard non-root runtime user
instead of leaving USER 0 active. Add the appropriate non-root USER directive
immediately after the dnf cleanup, preserving the existing installation steps.

Source: Coding guidelines

releases:
latest:
candidate:
product: ocp
stream: nightly
version: "4.22"
resources:
'*':
limits:
memory: 4Gi
requests:
cpu: 100m
memory: 200Mi
tests:
- as: cu-eval-openai-periodics
cluster_claim:
architecture: amd64
cloud: aws
labels:
region: us-east-1
owner: openshift-ci
product: ocp
timeout: 2h0m0s
version: "4.22"
cron: 30 14 * * *
steps:
allow_skip_on_success: true
post:
- ref: gather-must-gather
test:
- as: e2e
cli: latest
commands: |
export PROVIDER=openai
export PROVIDER_KEY_PATH=/var/run/openai/token
export OPENAI_PROVIDER_KEY_PATH=/var/run/openai/token
export OPENAI_API_KEY=$(cat /var/run/openai/token)
export EVAL_TAG=cluster-updates-critical

tests/scripts/test-cluster-updates.sh --artifact-dir "${ARTIFACT_DIR}"
credentials:
- mount_path: /var/run/openai
name: openai-apitoken
namespace: test-credentials
dependencies:
- env: OLS_IMAGE
name: lightspeed-service-api
from: src
resources:
requests:
cpu: 100m
workflow: generic-claim
- as: cu-eval-watsonx-granite-periodics
cluster_claim:
architecture: amd64
cloud: aws
labels:
region: us-east-1
owner: openshift-ci
product: ocp
timeout: 2h0m0s
version: "4.22"
cron: 30 15 * * *
steps:
allow_skip_on_success: true
post:
- ref: gather-must-gather
test:
- as: e2e
cli: latest
commands: |
export PROVIDER=watsonx
export PROVIDER_KEY_PATH=/var/run/watsonx/token
export OPENAI_PROVIDER_KEY_PATH=/var/run/openai/token
export OPENAI_API_KEY=$(cat /var/run/openai/token)
export WATSONX_PROVIDER_KEY_PATH=/var/run/watsonx/token
export EVAL_TAG=cluster-updates-critical

cp config/system_watsonx.yaml config/system.yaml
tests/scripts/test-cluster-updates.sh --artifact-dir "${ARTIFACT_DIR}"
credentials:
- mount_path: /var/run/openai
name: openai-apitoken
namespace: test-credentials
- mount_path: /var/run/watsonx
name: watsonx-apitoken
namespace: test-credentials
dependencies:
- env: OLS_IMAGE
name: lightspeed-service-api
from: src
resources:
requests:
cpu: 100m
workflow: generic-claim
- as: cu-eval-vertex-gemini-periodics
cluster_claim:
architecture: amd64
cloud: aws
labels:
region: us-east-1
owner: openshift-ci
product: ocp
timeout: 2h0m0s
version: "4.22"
cron: 30 16 * * *
steps:
allow_skip_on_success: true
post:
- ref: gather-must-gather
test:
- as: e2e
cli: latest
commands: |
export PROVIDER=google_vertex
export PROVIDER_KEY_PATH=/var/run/vertex/token
export OPENAI_PROVIDER_KEY_PATH=/var/run/openai/token
export OPENAI_API_KEY=$(cat /var/run/openai/token)
export VERTEX_PROVIDER_KEY_PATH=/var/run/vertex/token
export EVAL_TAG=cluster-updates-critical

cp config/system_google_vertex.yaml config/system.yaml
tests/scripts/test-cluster-updates.sh --artifact-dir "${ARTIFACT_DIR}"
credentials:
- mount_path: /var/run/openai
name: openai-apitoken
namespace: test-credentials
- mount_path: /var/run/vertex
name: vertex-apitoken
namespace: test-credentials
dependencies:
- env: OLS_IMAGE
name: lightspeed-service-api
from: src
resources:
requests:
cpu: 100m
workflow: generic-claim
- as: cu-eval-vertex-anthropic-periodics
cluster_claim:
architecture: amd64
cloud: aws
labels:
region: us-east-1
owner: openshift-ci
product: ocp
timeout: 2h0m0s
version: "4.22"
cron: 30 17 * * *
steps:
allow_skip_on_success: true
post:
- ref: gather-must-gather
test:
- as: e2e
cli: latest
commands: |
export PROVIDER=google_vertex_anthropic
export PROVIDER_KEY_PATH=/var/run/vertex/token
export OPENAI_PROVIDER_KEY_PATH=/var/run/openai/token
export OPENAI_API_KEY=$(cat /var/run/openai/token)
export VERTEX_PROVIDER_KEY_PATH=/var/run/vertex/token
export EVAL_TAG=cluster-updates-critical

cp config/system_google_vertex_anthropic.yaml config/system.yaml
tests/scripts/test-cluster-updates.sh --artifact-dir "${ARTIFACT_DIR}"
credentials:
- mount_path: /var/run/openai
name: openai-apitoken
namespace: test-credentials
- mount_path: /var/run/vertex
name: vertex-apitoken
namespace: test-credentials
dependencies:
- env: OLS_IMAGE
name: lightspeed-service-api
from: src
resources:
requests:
cpu: 100m
workflow: generic-claim
Comment thread
coderabbitai[bot] marked this conversation as resolved.
zz_generated_metadata:
branch: main
org: fao89
repo: ocp-evals
variant: "4.22"
Loading