Setup boskos leases and secrets for aws-konflux-prod cluster profile

[amisstea]

Summary by CodeRabbit

• Adds secret bootstrap configuration for cluster-secrets-aws-konflux-prod in the ci namespace for non-application CI clusters.
• Provisions BOSKOS quota slices for the konflux-aws-prod profile across four AWS regions, with 100 free slices per region.
• Updates the BOSKOS generator so the production quota-slice configuration is reproducibly included.

[coderabbitai]

Walkthrough

Adds aws-konflux-prod-quota-slice capacity to the Boskos generator and manifest, and adds a cluster-secrets-aws-konflux-prod secret target for non-app CI clusters in the ci namespace.

Changes

Konflux production provisioning

Layer / File(s)	Summary
Production quota slice definition and resources core-services/prow/02_config/generate-boskos.py, core-services/prow/02_config/_boskos.yaml	Adds 100 free quota slices per region for four AWS regions and lists the generated slice identifiers in the Boskos resources configuration.
Production cluster secret target core-services/ci-secret-bootstrap/_config.yaml	Adds the cluster-secrets-aws-konflux-prod target for the non_app_ci cluster group in the ci namespace.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: danilo-gemoli, bear-redhat, deepsm007

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only edits config/bootstrap files; no Ginkgo test files or It/Describe/Context/When titles were added or changed.
Test Structure And Quality	✅ Passed	PASS: This PR only changes config YAML/Python; no Ginkgo or *_test.go files were modified, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	The commit only changes boskos/secret config files; no Ginkgo tests or MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds Boskos/secret config; no Ginkgo e2e tests or SNO-sensitive test code changed, so the check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only Boskos quota/secret config changed; no manifests, controllers, replicas, affinity, selectors, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	Touched files are config/YAML plus a Python generator that only writes _boskos.yaml; no main/init/TestMain stdout writes or klog/stdout usage were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: PR only updates secret/Boskos config files; no new Ginkgo It/Describe/Context tests or network/IP-handling code were added, so the check is not applicable.
No-Weak-Crypto	✅ Passed	Changed files only add Boskos quota/secret config; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto/comparison logic appears in the touched paths.
Container-Privileges	✅ Passed	The PR only changes secret/Boskos configs; no container/K8s manifests or privileged flags appear in the touched files.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds Boskos/secret config entries; no logging statements or emitted sensitive data appear in the touched files.
Title check	✅ Passed	The title clearly matches the PR’s main change: adding Boskos leases and secrets for the aws-konflux-prod cluster profile.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@amisstea, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't checkout base SHA a09293919c6c3b63e32a64a38a3d7ad6fc274617: error checking out "a09293919c6c3b63e32a64a38a3d7ad6fc274617": exit status 128 fatal: unable to read tree (a09293919c6c3b63e32a64a38a3d7ad6fc274617)

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[amisstea]

/assign @danilo-gemoli @bear-redhat

[danilo-gemoli]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amisstea, danilo-gemoli

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS [danilo-gemoli]
• core-services/prow/02_config/OWNERS [danilo-gemoli]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[danilo-gemoli]

/pj-rehearse ack

[openshift-merge-bot]

@danilo-gemoli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@amisstea: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

@amisstea: Updated the following 3 configmaps:

• ci-secret-bootstrap configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• ci-secret-bootstrap configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• resources configmap in namespace ci at cluster app.ci using the following files:
  • key boskos.yaml using file core-services/prow/02_config/_boskos.yaml

Details

In response to this:

Summary by CodeRabbit

• Adds secret bootstrap configuration for cluster-secrets-aws-konflux-prod in the ci namespace for non-application CI clusters.
• Provisions BOSKOS quota slices for the konflux-aws-prod profile across four AWS regions, with 100 free slices per region.
• Updates the BOSKOS generator so the production quota-slice configuration is reproducibly included.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.