Add aws-konflux-prod cluster profile

[amisstea]

Create the rh-prod konflux group and grant the konflux-vanguard-tenant access on all clusters.

Rename the rh-staging group to rh-stg for consistency.

Summary by CodeRabbit

• Adds a new aws-konflux-prod cluster profile in OpenShift CI infrastructure, wiring Konflux ownership to the konflux-vanguard-tenant tenant and the production cluster group set (rh-prod).
• Renames the staging Konflux cluster group from rh-staging to rh-stg, and updates the aws-konflux-stg profile to reference rh-stg while keeping the amisstea-tenant tenant.
• Updates the shared Konflux cluster_groups mapping to define rh-stg (staging clusters) and rh-prod (production clusters), enabling production Konflux cluster access/assignment.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[amisstea]

Depends on #82035.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9108b4c7-1f41-4b99-8b3b-76f65cd5c152

📥 Commits

Reviewing files that changed from the base of the PR and between 18c667c and a239c3d.

📒 Files selected for processing (1)

• ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml

---

Walkthrough

Updates the aws-konflux-stg cluster group mapping and adds an aws-konflux-prod profile with tenant, secret, and production cluster group assignments.

Changes

Konflux cluster profiles

Layer / File(s)	Summary
Configure staging and production mappings ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml	Changes the staging group from rh-staging to rh-stg, adds the aws-konflux-prod profile with its tenant and secret, and defines production cluster groups.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82035: Adds related production Konflux secret and cluster group/quota configuration.

Suggested reviewers: dgoodwin, smg247

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change by adding the aws-konflux-prod cluster profile.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only changes a YAML cluster-profile config file; no Ginkgo test titles or test code were added or modified.
Test Structure And Quality	✅ Passed	Only ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml changed; no Ginkgo test files or test code were touched.
Microshift Test Compatibility	✅ Passed	Only a cluster-profile YAML changed; no new Ginkgo tests or MicroShift-sensitive code paths were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only cluster profile YAML changed; no Ginkgo e2e tests were added or modified, so SNO compatibility does not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only edits cluster profile ownership/group YAML; no deployment manifests, operators, controllers, or scheduling constraints were introduced.
Ote Binary Stdout Contract	✅ Passed	Only a YAML cluster-profile config changed; no process-level Go binary code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only cluster-profile YAML changed; no new Ginkgo tests or network-using test code were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	PR only edits cluster-profile YAML mappings; no crypto primitives, custom crypto code, or secret comparisons were added.
Container-Privileges	✅ Passed	Only a cluster-profile config changed; the diff adds no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only updates YAML cluster-profile mappings; no logging code or sensitive strings (passwords, tokens, emails, hostnames) were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@amisstea, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not determine changed registry steps: could not load step registry: resolve: profiles[30].owners[0] cluster group rh-stg not found

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[amisstea]

/assign @danilo-gemoli @bear-redhat

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml`:
- Around line 1872-1885: Merge the duplicate top-level konflux mapping into the
existing konflux block, preserving both the rh-stg cluster list and the rh-prod
cluster_groups entries under the single konflux key. Remove the second konflux
declaration and retain the existing structure for both mappings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2ba3f473-977a-49b6-a837-da88cf0e3e91

📥 Commits

Reviewing files that changed from the base of the PR and between a092939 and 18c667c.

📒 Files selected for processing (1)

• ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml

[danilo-gemoli]

/override ci/prow/check-cluster-profiles-config
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amisstea, danilo-gemoli

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/cluster-profiles/OWNERS [danilo-gemoli]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/check-cluster-profiles-config

Details

In response to this:

/override ci/prow/check-cluster-profiles-config
/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[danilo-gemoli]

/pj-rehearse ack

[openshift-merge-bot]

@danilo-gemoli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@amisstea: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.