NO-ISSUE: Debugging capi tests by CrystalChun · Pull Request #82023 · openshift/release

CrystalChun · 2026-07-16T16:30:08Z

Summary by CodeRabbit

Updates the OpenShift Assisted Service release (OCM 2.16) CI configuration to pin the HyperShift Operator image to 4.21 instead of latest.
Enhances the Assisted Baremetal CAPI job script to copy the pull secret to the target host before building the deployment payload, load helper scripts from the correct relative paths, and run oc image info for the HyperShift and Assisted OpenShift release images (using the remote pull secret) to aid debugging before deploying the CAPI cluster.

openshift-ci-robot · 2026-07-16T16:30:11Z

@CrystalChun: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-16T16:30:22Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

CrystalChun · 2026-07-16T16:30:42Z

/pj-rehearse ?

openshift-merge-bot · 2026-07-16T16:30:46Z

@CrystalChun: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai · 2026-07-16T16:30:52Z

Walkthrough

The release configuration pins the Hypershift operator image to 4.21. The CAPI deployment commands copy a pull-secret, update helper script paths, and add authenticated image metadata checks before deployment.

Changes

Assisted service CAPI deployment

Layer / File(s)	Summary
Hypershift operator image pin `ci-operator/config/openshift/assisted-service/openshift-assisted-service-release-ocm-2.16.yaml`	The `hypershift-operator` image reference changes from `latest` to `4.21`.
CAPI deployment image diagnostics `ci-operator/step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh`	The script copies the pull-secret to `/root/pull-secret`, sources helper scripts from parent paths, and runs authenticated `oc image info` checks before deployment.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: rehearsals-ack

Suggested reviewers: redhat-chai-bot

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change, which is debugging CAPI tests and related CI configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only changes CI YAML and a shell script; no Go test files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	PR only changes CI config and a step-registry shell script; no Ginkgo test code was added or modified, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR only changes CI YAML and a shell step; no new Ginkgo test declarations or MicroShift-relevant APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo specs were added; the diff only changes CI config and a deployment script, so the SNO test check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The changes only adjust CI image tags and remote debug commands; they add no replicas, affinity, node selectors, PDBs, or topology-dependent scheduling logic.
Ote Binary Stdout Contract	✅ Passed	PR only changes CI config and a shell step; no Go OTE entrypoints or suite setup code were modified, so no stdout contract violation is introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only updates CI config and a step script, with no IPv4-specific test logic or external-network test code.
No-Weak-Crypto	✅ Passed	Touched files only change an image tag and add image-info logging; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret comparisons found.
Container-Privileges	✅ Passed	The PR only changes an image tag and a shell script; no manifest adds privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The new log lines only print image metadata; the pull secret is referenced by path and xtrace output is already redacted for auths, with no passwords/tokens/PII added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-16T16:32:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: CrystalChun
Once this PR has been reviewed and has the lgtm label, please assign rccrdpccl for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/assisted-service/OWNERS~~ [CrystalChun]
ci-operator/step-registry/assisted/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-07-16T16:33:51Z

@CrystalChun: job(s): ? either don't exist or were not found to be affected, and cannot be rehearsed

CrystalChun · 2026-07-16T16:33:57Z

/pj-rehearse pull-ci-openshift-assisted-service-release-ocm-2.16-e2e-ai-operator-ztp-capi

openshift-merge-bot · 2026-07-16T16:33:59Z

@CrystalChun: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh`:
- Around line 71-72: Update the remote execution flow around the oc image info
commands to make the pull secret available on the remote host before invoking
them. Copy PULL_SECRET_FILE to a remote temporary location or define a valid
remote path, then pass that remote path to both oc image info invocations while
preserving the existing image arguments.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a2bb1ade-1794-4423-b581-fb9822d15d0a

📥 Commits

Reviewing files that changed from the base of the PR and between 9c87d06 and 26563a0.

📒 Files selected for processing (2)

ci-operator/config/openshift/assisted-service/openshift-assisted-service-release-ocm-2.16.yaml
ci-operator/step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh

CrystalChun · 2026-07-16T19:42:15Z

/pj-rehearse pull-ci-openshift-assisted-service-release-ocm-2.16-e2e-ai-operator-ztp-capi

openshift-merge-bot · 2026-07-16T19:42:19Z

@CrystalChun: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh`:
- Around line 29-30: Update the pull-secret transfer command to ensure the
remote /root/pull-secret is mode 600 while present and is removed failure-safely
after use, including when deployment or the SSH session fails; use a remote trap
or equivalent cleanup tied to the operation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 4df4df0f-2611-4c21-a3ab-5d3d01739c31

📥 Commits

Reviewing files that changed from the base of the PR and between 26563a0 and 1299dee.

📒 Files selected for processing (2)

ci-operator/config/openshift/assisted-service/openshift-assisted-service-release-ocm-2.16.yaml
ci-operator/step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh

🚧 Files skipped from review as they are similar to previous changes (1)

ci-operator/config/openshift/assisted-service/openshift-assisted-service-release-ocm-2.16.yaml

coderabbitai · 2026-07-16T19:48:13Z

+scp "${SSHOPTS[@]}" "${CLUSTER_PROFILE_DIR}/pull-secret" "root@${IP}:/root/pull-secret"
+


🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove the remote pull-secret after use.

This newly copied credential remains at /root/pull-secret after the SSH session, including when deployment fails. Add failure-safe cleanup (for example, a remote trap), and restrict the file to mode 600 while it exists.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh` around lines 29 - 30, Update the pull-secret transfer command to ensure the remote /root/pull-secret is mode 600 while present and is removed failure-safely after use, including when deployment or the SSH session fails; use a remote trap or equivalent cleanup tied to the operation.

openshift-ci · 2026-07-16T22:10:18Z

@CrystalChun: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/assisted-service/release-ocm-2.16/e2e-ai-operator-ztp-capi	`1299dee`	link	unknown	`/pj-rehearse pull-ci-openshift-assisted-service-release-ocm-2.16-e2e-ai-operator-ztp-capi`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

CrystalChun · 2026-07-16T22:25:00Z

/pj-rehearse pull-ci-openshift-assisted-service-release-ocm-2.16-e2e-ai-operator-ztp-capi

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 16, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 16, 2026

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread .../step-registry/assisted/baremetal/operator/capi/assisted-baremetal-operator-capi-commands.sh Outdated

CrystalChun force-pushed the debug-capi-ci branch from 26563a0 to 1299dee Compare July 16, 2026 19:41

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

Debugging capi tests

540d72d

CrystalChun force-pushed the debug-capi-ci branch from 1299dee to 540d72d Compare July 16, 2026 22:24

		scp "${SSHOPTS[@]}" "${CLUSTER_PROFILE_DIR}/pull-secret" "root@${IP}:/root/pull-secret"

Uh oh!

Conversation

CrystalChun commented Jul 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 16, 2026

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

CrystalChun commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

CrystalChun commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

CrystalChun commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

CrystalChun commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

CrystalChun commented Jul 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading