Add ship-status mcp server SA with ci-secret-generator token

[arnavmeduri]

Creates a mcp-server service account and configures ci-secret-generator/ci-secret-bootstrap to produce a rotating token (28-day expiry) synced to the mcp-server-token Secret on app.ci.

Changes:

• mcp-server-serviceaccount.yaml: mcp-server ServiceAccount
• ci-secret-generator/_config.yaml: mcp-server token generation on app.ci
• ci-secret-bootstrap/_config.yaml: syncs token to mcp-server-token Secret in ship-status namespace

Summary by CodeRabbit

• Added a new mcp-server ServiceAccount in the ship-status namespace on app.ci, including the protected MCP OAuth redirect callback annotation required for MCP login.
• Updated ci-secret-generator to mint a 28-day service account token (2419200s) for mcp-server in ship-status, writing it as sa.mcp-server.app.ci.token.txt under the ship-status-dash-mcp-server secret item.
• Updated ci-secret-bootstrap to sync that generated token into the ship-status namespace as the mcp-server-token Secret on app.ci.
• smg247 approved via /ok-to-test.

[openshift-ci]

Hi @arnavmeduri. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8bdcedf9-1f2f-45a4-9ed9-926f1eb872b1

📥 Commits

Reviewing files that changed from the base of the PR and between a13d957 and 7ae33a1.

📒 Files selected for processing (1)

• core-services/ci-secret-generator/_config.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• core-services/ci-secret-generator/_config.yaml

---

Walkthrough

Adds the mcp-server ServiceAccount with an OAuth callback, generates its app.ci token, and bootstraps that token into the mcp-server-token secret in the ship-status namespace.

Changes

MCP server credentials

Layer / File(s)	Summary
MCP server ServiceAccount clusters/app.ci/ship-status-dash/dashboard/mcp-server-serviceaccount.yaml	Defines the mcp-server ServiceAccount in ship-status with its OAuth callback annotation and dashboard label.
Token generation and bootstrap core-services/ci-secret-generator/_config.yaml, core-services/ci-secret-bootstrap/_config.yaml	Generates the ServiceAccount token for app.ci and maps it to mcp-server-token in ship-status.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• openshift/release#82041: Adds the authenticated MCP/OAuth-proxy setup that consumes the related ServiceAccount and token credentials.

Suggested reviewers: jmguzik, bear-redhat

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change by adding the ship-status MCP server ServiceAccount and CI secret token handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes three YAML config manifests; no Go test files or Ginkgo title declarations were added or modified.
Test Structure And Quality	✅ Passed	No Ginkgo test code is touched; the PR only changes YAML/config manifests, so the test-structure checklist is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the diff only adds/configures YAML manifests, so MicroShift test compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This commit only changes ci-secret-generator YAML and adds no Ginkgo/e2e tests, so there are no SNO compatibility concerns.
Topology-Aware Scheduling Compatibility	✅ Passed	Touched files only add a ServiceAccount and secret generation/bootstrap config; no pod specs, affinity, nodeSelector, spread, PDB, or replica logic were introduced.
Ote Binary Stdout Contract	✅ Passed	PASS: The PR only touches YAML config/manifests; no process-level code or stdout writes were added, so the OTE stdout contract isn't affected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR only adds YAML manifests; no Ginkgo e2e tests or IPv4/external-network test code is present.
No-Weak-Crypto	✅ Passed	Touched files are YAML manifests/configs only; searches in changed paths found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or token comparisons.
Container-Privileges	✅ Passed	Changed files add a ServiceAccount and token-generation configs only; no privileged, hostPID/Network/IPC, SYS_ADMIN, runAsRoot, or allowPrivilegeEscalation fields appear.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds manifest/config entries; I found no logging statements or sensitive values emitted to logs in the changed files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[smg247]

/lgtm

[smg247]

/ok-to-test

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@arnavmeduri: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[smg247]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: arnavmeduri, smg247

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/OWNERS [smg247]
• core-services/ci-secret-bootstrap/OWNERS [smg247]
• core-services/ci-secret-generator/OWNERS [smg247]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@arnavmeduri: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

@arnavmeduri: Updated the following 4 configmaps:

• ci-secret-bootstrap configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• ci-secret-bootstrap configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• ci-secret-generator configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-generator/_config.yaml
• ci-secret-generator configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-generator/_config.yaml

Details

In response to this:

Creates a mcp-server service account and configures ci-secret-generator/ci-secret-bootstrap to produce a rotating token (28-day expiry) synced to the mcp-server-token Secret on app.ci.

Changes:

• mcp-server-serviceaccount.yaml: mcp-server ServiceAccount
• ci-secret-generator/_config.yaml: mcp-server token generation on app.ci
• ci-secret-bootstrap/_config.yaml: syncs token to mcp-server-token Secret in ship-status namespace

Summary by CodeRabbit

• Added a new mcp-server ServiceAccount in the ship-status namespace on app.ci, including the protected MCP OAuth redirect callback annotation required for MCP login.
• Updated ci-secret-generator to mint a 28-day service account token (2419200s) for mcp-server in ship-status, writing it as sa.mcp-server.app.ci.token.txt under the ship-status-dash-mcp-server secret item.
• Updated ci-secret-bootstrap to sync that generated token into the ship-status namespace as the mcp-server-token Secret on app.ci.
• smg247 approved via /ok-to-test.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.