CNTRLPLANE-3947: feat(oauth-apiserver): authenticate to build farm registry in verify step

[jubittajohn]

Summary by CodeRabbit

• Updates oauth-apiserver verification jobs for master and OpenShift releases 4.23, 5.0, and 5.1.
• Passes OPENSHIFT_RELEASE and registry credentials to make verify -k.
• Adds an oauth-apiserver-bin-with-oc image so verification can run with the required oc binary.
• Uses the openshift-org-gcp cluster profile and requests 3 CPUs and 6 GiB of memory.
• Skips verification for documentation and metadata-only changes.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The CI configurations build verification images with oc and update master and release verification tests with release-image variables, pull credentials, registry authentication, change filters, GCP steps, and resource requests.

Changes

OAuth apiserver CI verification

Layer / File(s)	Summary
Build verification images ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.23.yaml, ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.0.yaml, ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.1.yaml	Release configurations add cli base images and build oauth-apiserver-bin-with-oc images containing oc.
Configure verification workflows ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-master.yaml, ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-4.23.yaml, ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.0.yaml, ci-operator/config/openshift/oauth-apiserver/openshift-oauth-apiserver-release-5.1.yaml	Verification workflows use release-image variables, pull credentials, registry authentication, change filters, GCP steps, the new image, and explicit resource requests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• openshift/release#82636: Updates related OpenShift CI verification steps with release variables and registry credentials.

Suggested reviewers: atiratree, kaleemsiddiqu

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only seven YAML CI config/job files; the diff adds no Ginkgo It, Describe, Context, or When declarations and no dynamic test title.
Test Structure And Quality	✅ Passed	The pull request changes seven YAML CI configuration files only; the parent-to-HEAD patch contains no Ginkgo test code or It/BeforeEach/AfterEach/Eventually assertions to review.
Microshift Test Compatibility	✅ Passed	The PR changes only CI and presubmit YAML; the diff adds no Ginkgo tests, test files, or test bodies requiring MicroShift API compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The patch changes only CI configuration and job YAML files; it adds no Ginkgo e2e tests or test implementations requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only CI image/test and generated Prow job configuration; it adds no workload deployment, affinity, spread, replica, node-selector, toleration, or PDB constraint.
Ote Binary Stdout Contract	✅ Passed	The commit changes only seven YAML CI config/job files; it adds no Go or suite setup code and no stdout or logging calls, so the OTE stdout contract is unaffected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only seven YAML CI files; it adds no Ginkgo tests, IPv4 assumptions, or external-network operations.
No-Weak-Crypto	✅ Passed	The PR changes only CI YAML and generated job wiring; added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	Changed CI configs and generated jobs add no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, securityContext, capability, or root-user settings.
No-Sensitive-Data-In-Logs	✅ Passed	The changed verify steps mount credentials by path and set REGISTRY_AUTH_FILE; no secret values or logging commands such as echo, printenv, cat, or set -x were added.
Title check	✅ Passed	The title accurately identifies registry authentication in the verify step, which is a significant part of the changeset.

✨ Finishing Touches 💡 2

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch oauth-apiserver-verify-tools

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jubittajohn]

/pj-rehearse pull-ci-openshift-oauth-apiserver-master-verify

[openshift-merge-bot]

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jubittajohn]

/pj-rehearse pull-ci-openshift-oauth-apiserver-release-5.0-verify

[openshift-merge-bot]

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jubittajohn]

/pj-rehearse pull-ci-openshift-oauth-apiserver-release-5.0-images

[openshift-merge-bot]

@jubittajohn: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

[openshift-ci-robot]

@jubittajohn: This pull request references CNTRLPLANE-3947 which is a valid jira issue.

Details

In response to this:

Summary by CodeRabbit

Updates the OpenShift CI verification setup for oauth-apiserver to be more reliable and consistent across master and supported release streams by:

• Mounting ci-pull-credentials into the verify jobs (and setting REGISTRY_AUTH_FILE) so the verification step can authenticate when pulling required images/artifacts.
• Adding an oauth-apiserver-bin-with-oc helper image that bundles the oc binary into the verification environment, then switching verify to run from that image.
• Running verification against the openshift-org-gcp cluster profile, with explicit CPU/memory resource requests.
• Skipping verify when changes are limited to docs/metadata/ownership/license-related paths via skip_if_only_changed.
• Standardizing the verification command usage (e.g., make verify with failure-tolerant behavior where configured, such as make verify -k, and including additional flags in the 5.0 stream).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jubittajohn]

/pj-rehearse

[openshift-merge-bot]

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@jubittajohn, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto 7e2cec120e216df227b0b41350ac1375f4564472 due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-merge-bot]

@jubittajohn, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto d82fdb766f73dd8c6963f04e091c01e3bcb18f9a due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@jubittajohn: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/oauth-apiserver/release-5.1/e2e-aws	a2789c8	link	unknown	/pj-rehearse pull-ci-openshift-oauth-apiserver-release-5.1-e2e-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jubittajohn
Once this PR has been reviewed and has the lgtm label, please assign flavianmissi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/oauth-apiserver/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jubittajohn]

/pj-rehearse

[openshift-merge-bot]

@jubittajohn: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

[jubittajohn]

/pj-rehearse

[openshift-merge-bot]

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@jubittajohn: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-oauth-apiserver-release-5.0-verify	openshift/oauth-apiserver	presubmit	Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-4.23-verify	openshift/oauth-apiserver	presubmit	Ci-operator config changed
pull-ci-openshift-oauth-apiserver-master-verify	openshift/oauth-apiserver	presubmit	Ci-operator config changed
pull-ci-openshift-oauth-apiserver-release-5.1-verify	openshift/oauth-apiserver	presubmit	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[jubittajohn]

/pj-rehearse

[openshift-merge-bot]

@jubittajohn: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.