OCPBUGS-85429: feat(openshift-apiserver): authenticate to build farm registry in verify step by jubittajohn · Pull Request #82636 · openshift/release

jubittajohn · 2026-07-29T17:38:17Z

To have openshift/openshift-apiserver#666 pass the update verify ci job.

The verify-openapi-spec check pulls binaries from the CI release image on build farm registries, which aren't covered by the cluster profile pull secret. Add oc registry login before make verify so the job can pull from CI-internal registries.

Summary by CodeRabbit

Updates OpenShift API server verification jobs for releases 4.23, 5.0, and 5.1, plus the main branch.
Passes OPENSHIFT_RELEASE to make verify, using RELEASE_IMAGE_LATEST as the fallback.
Mounts ci-pull-credentials and sets REGISTRY_AUTH_FILE so verification jobs can pull binaries from build farm registries.

openshift-ci-robot · 2026-07-29T17:38:24Z

@jubittajohn: This pull request references Jira Issue OCPBUGS-85429, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

To have openshift/openshift-apiserver#666 pass the update verify ci job.

The verify-openapi-spec check pulls binaries from the CI release image on the build farm registry. The cluster profile pull secret only covers external registries (quay.io, registry.redhat.io), not CI-internal registries like registry.build02.ci.openshift.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-29T17:38:49Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

The four OpenShift API Server verification workflows now set OPENSHIFT_RELEASE, mount ci-pull-credentials, and configure REGISTRY_AUTH_FILE before running make verify.

Changes

OpenShift API Server verification

Layer / File(s)	Summary
Configure verification environment `ci-operator/config/openshift/openshift-apiserver/openshift-openshift-apiserver-*.yaml`	The `verify` steps set `OPENSHIFT_RELEASE` with release-image fallbacks, mount `ci-pull-credentials`, and set `REGISTRY_AUTH_FILE` to the mounted Docker configuration file.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: everettraven, p0lyn0mial

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only four CI YAML files; it adds shell environment and credential settings, with no Ginkgo test titles or dynamic test names.
Test Structure And Quality	✅ Passed	The PR changes only four CI YAML files; it adds no Ginkgo It blocks or test source, so the requested Ginkgo quality review is not applicable.
Microshift Test Compatibility	✅ Passed	The parent-to-current diff changes only four CI YAML files; it adds no Ginkgo tests or MicroShift-sensitive API/resource references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only four CI YAML workflow files; they contain no Ginkgo test declarations or new e2e test logic, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff only changes CI verify commands, environment variables, and a registry credential mount; it does not modify deployment manifests, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only four CI YAML workflows; added release/auth environment settings contain no OTE binary or process-level stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only four YAML CI workflow files; it adds no Ginkgo tests or test networking code, so this compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	The four changed YAML files only add release-image environment handling and a registry credential mount; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, or crypto implementation was added.
Container-Privileges	✅ Passed	All four changed verify steps add only environment variables and a credential mount; the diff contains no privileged, host namespace, SYS_ADMIN, privilege-escalation, or root-setting fields.
No-Sensitive-Data-In-Logs	✅ Passed	The four added steps mount credentials and set REGISTRY_AUTH_FILE by path; they add no echo, tracing, secret value, token, or hostname logging.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding build farm registry authentication to the OpenShift API server verify step.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-29T17:42:01Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jubittajohn
Once this PR has been reviewed and has the lgtm label, please assign atiratree for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

ci-operator/config/openshift/openshift-apiserver/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jubittajohn · 2026-07-29T17:45:32Z

/pj-rehearse pull-ci-openshift-openshift-apiserver-main-verify

openshift-merge-bot · 2026-07-29T17:47:12Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-29T18:03:00Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-29T18:03:55Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-29T18:06:02Z

@jubittajohn: job(s): pull-ci-openshift-openshift-apiserver-5.0-verify either don't exist or were not found to be affected, and cannot be rehearsed

openshift-merge-bot · 2026-07-29T18:06:06Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-29T18:06:55Z

@jubittajohn: job(s): pull-ci-openshift-openshift-apiserver-4.23-verify either don't exist or were not found to be affected, and cannot be rehearsed

openshift-merge-bot · 2026-07-29T18:09:00Z

@jubittajohn: job(s): pull-ci-openshift-openshift-apiserver-4.22-verify either don't exist or were not found to be affected, and cannot be rehearsed

jubittajohn · 2026-07-29T19:04:52Z

/pj-rehearse pull-ci-openshift-openshift-apiserver-release-5.0-verify

openshift-merge-bot · 2026-07-29T19:04:54Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-07-29T19:05:01Z

/pj-rehearse pull-ci-openshift-openshift-apiserver-release-4.22-verify

jubittajohn · 2026-07-29T19:05:07Z

/pj-rehearse pull-ci-openshift-openshift-apiserver-release-4.23-verify

openshift-merge-bot · 2026-07-29T19:06:39Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-29T19:06:44Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-07-29T20:33:00Z

/pj-rehearse pull-ci-openshift-openshift-apiserver-main-verify

openshift-merge-bot · 2026-07-29T20:33:04Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-07-29T20:40:28Z

/retest

jubittajohn · 2026-07-30T14:57:10Z

/pj-rehearse pull-ci-openshift-openshift-apiserver-release-5.0-verify

openshift-merge-bot · 2026-07-30T15:00:03Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-08-03T19:54:21Z

/pj-rehearse

openshift-merge-bot · 2026-08-03T19:55:22Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-08-04T16:31:42Z

/pj-rehearse

openshift-merge-bot · 2026-08-04T16:36:08Z

@jubittajohn: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

openshift-merge-bot · 2026-08-04T16:36:45Z

@jubittajohn: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

jubittajohn · 2026-08-04T17:31:58Z

/pj-rehearse

openshift-merge-bot · 2026-08-04T17:32:00Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-08-04T20:53:33Z

/pj-rehearse

openshift-merge-bot · 2026-08-04T20:53:35Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-08-05T13:39:38Z

/pj-rehearse

openshift-merge-bot · 2026-08-05T13:39:41Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

benluddy · 2026-08-05T17:03:31Z

      commands: |
+        export XDG_RUNTIME_DIR=/tmp/run
+        mkdir -p "${XDG_RUNTIME_DIR}/containers"
+        oc registry login
        make verify -k --warn-undefined-variables


What if oc or something in the make recipe relies on XDG_RUNTIME_DIR for something else, today or in the future? There could be unintended side effects of pointing it to a mostly-empty directory.

oc registry login prefers REGISTRY_AUTH_FILE https://github.com/openshift/oc/blob/9c7ccc4232cffdbe39ae3396e9163b985d070cc5/pkg/cli/registry/login/login.go#L238 for its write destination, too. Does that allow us to do something like this:

Suggested change

commands: |

export XDG_RUNTIME_DIR=/tmp/run

mkdir -p "${XDG_RUNTIME_DIR}/containers"

oc registry login

make verify -k --warn-undefined-variables

env:

- name: REGISTRY_AUTH_FILE

default: /tmp/registry-auth.json

commands: |

oc registry login

make verify -k --warn-undefined-variables

@benluddy
Yes that would work. Verified that using this same change in #82639 which is fixing this against the oauth-apiserver. The reason it fails in openshift-apiserver is due to the openshift/openshift-apiserver#669 merged PR where we prefered REGISTRY_AUTH_FILE over cluster profile pull secret.
openshift/openshift-apiserver#670 - revert PR open. Could you approve them after that the rehearsals on this PR should pass

jubittajohn · 2026-08-05T18:17:57Z

/pj-rehearse

openshift-merge-bot · 2026-08-05T18:18:00Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

jubittajohn · 2026-08-05T20:47:16Z

/pj-rehearse

openshift-merge-bot · 2026-08-05T20:47:20Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

…unt ci-pull-credentials in verify step Signed-off-by: jubittajohn <jujohn@redhat.com>

openshift-merge-bot · 2026-08-06T18:59:24Z

[REHEARSALNOTIFIER]
@jubittajohn: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-openshift-apiserver-release-5.1-verify	openshift/openshift-apiserver	presubmit	Ci-operator config changed
pull-ci-openshift-openshift-apiserver-release-4.23-verify	openshift/openshift-apiserver	presubmit	Ci-operator config changed
pull-ci-openshift-openshift-apiserver-release-5.0-verify	openshift/openshift-apiserver	presubmit	Ci-operator config changed
pull-ci-openshift-openshift-apiserver-main-verify	openshift/openshift-apiserver	presubmit	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

jubittajohn · 2026-08-06T19:00:57Z

/pj-rehearse

openshift-merge-bot · 2026-08-06T19:00:59Z

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-ci · 2026-08-06T19:36:34Z

@jubittajohn: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/openshift-apiserver/release-5.1/verify	`6da11e5`	link	unknown	`/pj-rehearse pull-ci-openshift-openshift-apiserver-release-5.1-verify`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 29, 2026

openshift-ci Bot requested review from everettraven and p0lyn0mial July 29, 2026 17:41

coderabbitai Bot mentioned this pull request Jul 29, 2026

CNTRLPLANE-3947: feat(oauth-apiserver): authenticate to build farm registry in verify step #82639

Open

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 90114de to 7c320c4 Compare July 29, 2026 20:27

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 7c320c4 to 67d0867 Compare July 30, 2026 14:35

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 67d0867 to ab7e87c Compare July 30, 2026 19:14

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from b4aa087 to 123a9c3 Compare August 3, 2026 19:54

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 123a9c3 to 56cad29 Compare August 4, 2026 16:31

jubittajohn force-pushed the openshift-apiserver-verify-tools branch 2 times, most recently from e687e46 to 182ffe3 Compare August 4, 2026 20:48

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 182ffe3 to 8ede041 Compare August 5, 2026 13:15

jubittajohn changed the title ~~OCPBUGS-85429: feat(openshift-apiserver): pass release image and auth to verify step~~ OCPBUGS-85429: feat(openshift-apiserver): authenticate to build farm registry in verify step Aug 5, 2026

benluddy reviewed Aug 5, 2026

View reviewed changes

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 8ede041 to a514752 Compare August 5, 2026 18:14

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from a514752 to 3bec432 Compare August 5, 2026 20:46

feat(openshift-apiserver): authenticate to build farm registry and mo…

6da11e5

…unt ci-pull-credentials in verify step Signed-off-by: jubittajohn <jujohn@redhat.com>

jubittajohn force-pushed the openshift-apiserver-verify-tools branch from 3bec432 to 6da11e5 Compare August 6, 2026 18:56

Uh oh!

Conversation

jubittajohn commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 29, 2026

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 29, 2026

Uh oh!

jubittajohn commented Jul 30, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 30, 2026

Uh oh!

jubittajohn commented Aug 3, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 3, 2026

Uh oh!

jubittajohn commented Aug 4, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 4, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 4, 2026

Uh oh!

jubittajohn commented Aug 4, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 4, 2026

Uh oh!

jubittajohn commented Aug 4, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 4, 2026

Uh oh!

jubittajohn commented Aug 5, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 5, 2026

Uh oh!

benluddy Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

jubittajohn Aug 5, 2026

jubittajohn commented Jul 29, 2026 •

edited

Loading

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading