Skip to content

OCPBUGS-85429: hack/update-openapi-spec: accept release image and auth via env vars - #667

Open
jubittajohn wants to merge 1 commit into
openshift:mainfrom
jubittajohn:update-openapi-spec-ci-env
Open

OCPBUGS-85429: hack/update-openapi-spec: accept release image and auth via env vars#667
jubittajohn wants to merge 1 commit into
openshift:mainfrom
jubittajohn:update-openapi-spec-ci-env

Conversation

@jubittajohn

@jubittajohn jubittajohn commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

The script needs a release image to extract kube-apiserver and etcd. Accept OPENSHIFT_RELEASE and REGISTRY_AUTH_FILE as env vars set by the CI job config, falling back to auto-detection from .ci-operator.yaml for local development.
Requires openshift/release#82636 to merge

Summary by CodeRabbit

  • Chores
    • Improved OpenAPI specification updates by automatically selecting the appropriate OpenShift release image.
    • Added support for using a preconfigured OpenShift release when available.
    • Added clearer guidance when the OpenShift release cannot be detected.
    • Simplified release-image handling and removed unnecessary registry authentication and configuration requirements.

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 30, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@jubittajohn: This pull request references Jira Issue OCPBUGS-85429, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

The script needs a release image to extract kube-apiserver and etcd. Accept OPENSHIFT_RELEASE and REGISTRY_AUTH_FILE as env vars set by the CI job config, falling back to auto-detection from .ci-operator.yaml for local development.
Requires openshift/release#82636 to merge

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7e17c018-8520-48ba-bd0d-d3019801eb1c

📥 Commits

Reviewing files that changed from the base of the PR and between bfecb24 and 4540ad5.

📒 Files selected for processing (1)
  • hack/update-openapi-spec.sh
🚧 Files skipped from review as they are similar to previous changes (1)
  • hack/update-openapi-spec.sh

Walkthrough

The update script now uses OPENSHIFT_RELEASE or detects the release version from .ci-operator.yaml. It constructs a registry.ci.openshift.org/ocp/release:<version> image reference and extracts kube-apiserver and etcd without registry authentication options.

Changes

Release image resolution and component extraction

Layer / File(s) Summary
Release selection and component extraction
hack/update-openapi-spec.sh
The script preserves OPENSHIFT_RELEASE when set. Otherwise, it detects the version from .ci-operator.yaml and reports an error when detection fails. It removes pull-secret discovery and registry authentication options from release queries and image extraction.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: bertinatto, kaleemsiddiqu

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: accepting the release image and registry authentication through environment variables.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only hack/update-openapi-spec.sh; the patch adds no Ginkgo tests or test-title declarations, so no unstable test names are introduced.
Test Structure And Quality ✅ Passed The pull request changes only hack/update-openapi-spec.sh and adds no Ginkgo test code, so the test-structure requirements are not applicable.
Microshift Test Compatibility ✅ Passed The pull request changes only hack/update-openapi-spec.sh and adds no Ginkgo tests or MicroShift-sensitive test references.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The pull request changes only hack/update-openapi-spec.sh; it adds no Go files or Ginkgo e2e tests, so SNO multi-node compatibility checks do not apply.
Topology-Aware Scheduling Compatibility ✅ Passed The commit modifies only hack/update-openapi-spec.sh and adds no deployment, operator, controller, or scheduling constraints; topology-aware scheduling review is not applicable.
Ote Binary Stdout Contract ✅ Passed The PR changes only a shell utility; it adds no OTE process-level code or stdout writes. Launched server output is redirected to log files.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR changes only hack/update-openapi-spec.sh and adds no Ginkgo declarations or test files, so this IPv6/disconnected test check is not applicable.
No-Weak-Crypto ✅ Passed The only changed file is hack/update-openapi-spec.sh; added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed The PR changes only hack/update-openapi-spec.sh, not a container or Kubernetes manifest; added lines contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or escalation settings.
No-Sensitive-Data-In-Logs ✅ Passed The change logs only the release image reference and temporary paths; it does not log auth-file contents, credentials, tokens, or API data.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign flavianmissi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jubittajohn
jubittajohn force-pushed the update-openapi-spec-ci-env branch from 62fe5a0 to bfecb24 Compare July 31, 2026 18:54

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@hack/update-openapi-spec.sh`:
- Around line 143-150: Make the OPENSHIFT_VERSION probe in the .ci-operator.yaml
block non-fatal under errexit and pipefail by evaluating the grep/sed assignment
within a conditional or otherwise suppressing its failure status. Preserve the
existing empty-version check so it prints the explicit error and exits when no
version is detected.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c509bb1d-9cda-472d-82ea-2253a4e40bad

📥 Commits

Reviewing files that changed from the base of the PR and between 62fe5a0 and bfecb24.

📒 Files selected for processing (1)
  • hack/update-openapi-spec.sh

Comment on lines +143 to +150
if [[ -f "${SCRIPT_ROOT}/.ci-operator.yaml" ]]; then
OPENSHIFT_VERSION=$(grep -o 'openshift-[0-9]*\.[0-9]*' "${SCRIPT_ROOT}/.ci-operator.yaml" | head -1 | sed 's/openshift-//')
fi
if [[ -z "${OPENSHIFT_VERSION}" ]]; then
echo "ERROR: Could not detect OpenShift version from .ci-operator.yaml"
echo "Please set OPENSHIFT_RELEASE environment variable manually, e.g.:"
echo " OPENSHIFT_RELEASE=registry.ci.openshift.org/ocp/release:5.0 $0"
exit 1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '1,30p' hack/update-openapi-spec.sh

tmp=$(mktemp)
trap 'rm -f "$tmp"' EXIT
printf '%s\n' 'tag: no-openshift-version' >"$tmp"

if bash -c '
  set -o errexit
  set -o pipefail
  value=$(grep -o "openshift-[0-9]*\.[0-9]*" "$1" | head -1 | sed "s/openshift-//")
  echo "reached explicit error handling"
' bash "$tmp"; then
  echo "Probe completed."
else
  echo "Probe exits before the explicit error branch."
fi

Repository: openshift/openshift-apiserver

Length of output: 1292


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '125,158p' hack/update-openapi-spec.sh

Repository: openshift/openshift-apiserver

Length of output: 1460


Make the version probe non-fatal.

If .ci-operator.yaml contains no matching version, errexit and pipefail terminate the script during the assignment. The explicit error message is not printed. Evaluate the assignment inside a conditional or make the probe non-fatal.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@hack/update-openapi-spec.sh` around lines 143 - 150, Make the
OPENSHIFT_VERSION probe in the .ci-operator.yaml block non-fatal under errexit
and pipefail by evaluating the grep/sed assignment within a conditional or
otherwise suppressing its failure status. Preserve the existing empty-version
check so it prints the explicit error and exits when no version is detected.

The script needs a release image to extract kube-apiserver and etcd. Accept OPENSHIFT_RELEASE and REGISTRY_AUTH_FILE as env vars set by the CI job config, falling back to auto-detection from .ci-operator.yaml for local development.

Signed-off-by: jubittajohn <jujohn@redhat.com>
@openshift-ci

openshift-ci Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

@jubittajohn: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify 4540ad5 link true /test verify
ci/prow/e2e-aws-ovn-serial-1of2 4540ad5 link true /test e2e-aws-ovn-serial-1of2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 4, 2026
@openshift-ci

openshift-ci Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants