OCPBUGS-85429: hack/update-openapi-spec: prefer REGISTRY_AUTH_FILE over cluster profile pull secret

[jubittajohn]

Check REGISTRY_AUTH_FILE before CLUSTER_PROFILE_DIR/pull-secret so the CI job config can provide credentials for registries not covered by the cluster profile.

Summary by CodeRabbit

• Bug Fixes
  • Registry operations now prioritize the authentication file specified by REGISTRY_AUTH_FILE.
  • Falls back to the cluster profile pull secret when no explicit authentication file is provided.

[openshift-ci-robot]

@jubittajohn: This pull request references Jira Issue OCPBUGS-85429, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Check REGISTRY_AUTH_FILE before CLUSTER_PROFILE_DIR/pull-secret so the CI job config can provide credentials for registries not covered by the cluster profile.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fe2c735c-40b0-4cbd-b2c1-e7adb6698356

📥 Commits

Reviewing files that changed from the base of the PR and between f2c09ef and ce31fef.

📒 Files selected for processing (1)

• hack/update-openapi-spec.sh

---

Walkthrough

The OpenAPI update script now prefers an existing REGISTRY_AUTH_FILE over the cluster pull secret. It passes the selected file through --registry-config.

Changes

Registry authentication selection

Layer / File(s)	Summary
Registry authentication resolution hack/update-openapi-spec.sh	The script selects REGISTRY_AUTH_FILE when it is set and present. It otherwise uses ${CLUSTER_PROFILE_DIR}/pull-secret and preserves the existing warning fallback.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• openshift/openshift-apiserver#667: Both changes update registry authentication selection in hack/update-openapi-spec.sh.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: prioritizing REGISTRY_AUTH_FILE over the cluster profile pull secret.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only hack/update-openapi-spec.sh and adds no Ginkgo test titles or dynamic test-name values.
Test Structure And Quality	✅ Passed	The PR changes only hack/update-openapi-spec.sh, reordering shell conditionals; it adds or modifies no Ginkgo test code, so the listed test-quality checks do not apply.
Microshift Test Compatibility	✅ Passed	The pull request changes only registry authentication selection in a shell script and adds no Ginkgo e2e tests requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The patch changes only hack/update-openapi-spec.sh and adds no Ginkgo e2e tests or multi-node assumptions; SNO compatibility checks are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only registry-authentication selection in hack/update-openapi-spec.sh; it adds no manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only registry-auth selection in a shell script; it does not modify an OTE binary or process-level Go stdout behavior.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The patch changes only hack/update-openapi-spec.sh; it adds no Ginkgo e2e tests, so this compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	The patch only reorders registry credential selection; it adds no weak algorithms, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	The commit changes only registry-auth selection in a shell script; no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation setting is added.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only reorders existing registry-auth handling. Logs contain pull-secret file paths, not passwords, tokens, API keys, PII, or credential contents.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[benluddy]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benluddy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [benluddy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jubittajohn: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jubittajohn]

/verified by ci(verify job)

[openshift-ci-robot]

@jubittajohn: This PR has been marked as verified by ci(verify job).

Details

In response to this:

/verified by ci(verify job)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jubittajohn: Jira Issue OCPBUGS-85429: Some pull requests linked via external trackers have merged:

The following pull request, linked via external tracker, has not merged:

• openshift/openshift-apiserver#666 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-85429 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

Check REGISTRY_AUTH_FILE before CLUSTER_PROFILE_DIR/pull-secret so the CI job config can provide credentials for registries not covered by the cluster profile.

Summary by CodeRabbit

• Bug Fixes
• Registry operations now prioritize the authentication file specified by REGISTRY_AUTH_FILE.
• Falls back to the cluster profile pull secret when no explicit authentication file is provided.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.