Skip to content

OCPBUGS-85429: feat(openshift-apiserver): authenticate to build farm registry in verify step #82636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jubittajohn wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OCPBUGS-85429: feat(openshift-apiserver): authenticate to build farm registry in verify step #82636

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions ci-operator/config/openshift/openshift-apiserver/openshift-openshift-apiserver-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,17 @@ tests:
test:
- as: verify
commands: |
cp /var/run/secrets/ci-pull-credentials/.dockerconfigjson "${REGISTRY_AUTH_FILE}"
oc registry login --to="${REGISTRY_AUTH_FILE}"
export OPENSHIFT_RELEASE="${RELEASE_IMAGE_LATEST}"
make verify -k --warn-undefined-variables
Comment on lines 50 to 54

@benluddy benluddy Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if oc or something in the make recipe relies on XDG_RUNTIME_DIR for something else, today or in the future? There could be unintended side effects of pointing it to a mostly-empty directory.

oc registry login prefers REGISTRY_AUTH_FILE https://github.com/openshift/oc/blob/9c7ccc4232cffdbe39ae3396e9163b985d070cc5/pkg/cli/registry/login/login.go#L238 for its write destination, too. Does that allow us to do something like this:

Suggested change
commands: |
export XDG_RUNTIME_DIR=/tmp/run
mkdir -p "${XDG_RUNTIME_DIR}/containers"
oc registry login
make verify -k --warn-undefined-variables
env:
- name: REGISTRY_AUTH_FILE
default: /tmp/registry-auth.json
commands: |
oc registry login
make verify -k --warn-undefined-variables

@jubittajohn jubittajohn Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@benluddy
Yes that would work. Verified that using this same change in #82639 which is fixing this against the oauth-apiserver. The reason it fails in openshift-apiserver is due to the openshift/openshift-apiserver#669 merged PR where we prefered REGISTRY_AUTH_FILE over cluster profile pull secret.
openshift/openshift-apiserver#670 - revert PR open. Could you approve them after that the rehearsals on this PR should pass

credentials:
- mount_path: /var/run/secrets/ci-pull-credentials
name: ci-pull-credentials
namespace: ci
env:
- default: /tmp/registry-auth.json
name: REGISTRY_AUTH_FILE
from: bin-with-oc
resources:
requests:
Expand Down
10 changes: 10 additions & 0 deletions ...ator/config/openshift/openshift-apiserver/openshift-openshift-apiserver-release-4.23.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,17 @@ tests:
test:
- as: verify
commands: |
cp /var/run/secrets/ci-pull-credentials/.dockerconfigjson "${REGISTRY_AUTH_FILE}"
oc registry login --to="${REGISTRY_AUTH_FILE}"
export OPENSHIFT_RELEASE="${RELEASE_IMAGE_LATEST}"
make verify -k --warn-undefined-variables
credentials:
- mount_path: /var/run/secrets/ci-pull-credentials
name: ci-pull-credentials
namespace: ci
env:
- default: /tmp/registry-auth.json
name: REGISTRY_AUTH_FILE
from: bin-with-oc
resources:
requests:
Expand Down
10 changes: 10 additions & 0 deletions ...rator/config/openshift/openshift-apiserver/openshift-openshift-apiserver-release-5.0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,17 @@ tests:
test:
- as: verify
commands: |
cp /var/run/secrets/ci-pull-credentials/.dockerconfigjson "${REGISTRY_AUTH_FILE}"
oc registry login --to="${REGISTRY_AUTH_FILE}"
export OPENSHIFT_RELEASE="${RELEASE_IMAGE_LATEST}"
make verify -k --warn-undefined-variables
credentials:
- mount_path: /var/run/secrets/ci-pull-credentials
name: ci-pull-credentials
namespace: ci
env:
- default: /tmp/registry-auth.json
name: REGISTRY_AUTH_FILE
from: bin-with-oc
resources:
requests:
Expand Down
10 changes: 10 additions & 0 deletions ...rator/config/openshift/openshift-apiserver/openshift-openshift-apiserver-release-5.1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,17 @@ tests:
test:
- as: verify
commands: |
cp /var/run/secrets/ci-pull-credentials/.dockerconfigjson "${REGISTRY_AUTH_FILE}"
oc registry login --to="${REGISTRY_AUTH_FILE}"
export OPENSHIFT_RELEASE="${RELEASE_IMAGE_LATEST}"
make verify -k --warn-undefined-variables
credentials:
- mount_path: /var/run/secrets/ci-pull-credentials
name: ci-pull-credentials
namespace: ci
env:
- default: /tmp/registry-auth.json
name: REGISTRY_AUTH_FILE
from: bin-with-oc
resources:
requests:
Expand Down