feat: Add CI builds for ocp-secrets-management-console images and bundle#80762
feat: Add CI builds for ocp-secrets-management-console images and bundle#80762anandkuma77 wants to merge 6 commits into
Conversation
Enable automatic image builds in OpenShift CI for the secrets management
console plugin project, including plugin image, operator image, and
OLM bundle with image substitution.
## Changes
Updated: ci-operator/config/openshift/ocp-secrets-management-console/
openshift-ocp-secrets-management-console-main.yaml
### Added Image Builds
1. **Plugin Image** (ocp-secrets-management)
- Dockerfile: Dockerfile (root)
- Type: Frontend React application
- Build: Uses node22 build root
2. **Operator Image** (ocp-secrets-management-operator)
- Dockerfile: operator/images/ci/Dockerfile
- Type: Go operator binary
- Base: base-rhel9
### Added Bundle Build with Image Substitution
operator.bundles:
- as: ocp-secrets-management-operator-bundle
dockerfile_path: operator/bundle.Dockerfile
skip_building_index: true
operator.substitutions:
# Replaces operator image reference in CSV
- pullspec: openshift.io/ocp-secrets-management-operator:.*
with: pipeline:ocp-secrets-management-operator
# Replaces plugin image reference in CSV
- pullspec: openshift.io/ocp-secrets-management:.*
with: pipeline:ocp-secrets-management
**Why substitution matters:**
- Bundle CSV contains image references (operator + plugin)
- CI builds fresh images for every PR
- Substitution replaces static refs with CI-built images
- Ensures bundle uses the exact images built in this CI run
- Critical for E2E testing and production deployment
### Added Tests
1. **Unit Tests**
- Plugin: yarn test
- Operator: make test
2. **Verify Tests**
- yarn lint
3. **FIPS Image Scans** (security compliance)
- Scans plugin image
- Scans operator image
4. **E2E Tests** (deploy via OLM on real cluster)
- Claims temporary AWS cluster (4.21)
- Installs operator via operator-sdk run bundle
- Creates SecretsManagementConfig CR
- Verifies plugin deployment
- Verifies ConsolePlugin resource
### Added Configuration
- base_images: Added base-rhel9, operator-sdk
- binary_build_commands: cd operator && make build
- releases: Added latest 4.21 candidate
- resources: 4Gi memory limit (for webpack build)
## Build Flow in CI
```
PR Opened
↓
CI reads config
↓
Build images (parallel):
├─> Plugin image (Dockerfile)
└─> Operator image (operator/images/ci/Dockerfile)
↓
Build bundle:
├─> Reads operator/bundle.Dockerfile
├─> Substitutes image references in CSV:
│ - openshift.io/ocp-secrets-management:.*
│ → pipeline:ocp-secrets-management
│ - openshift.io/ocp-secrets-management-operator:.*
│ → pipeline:ocp-secrets-management-operator
└─> Creates bundle image (FROM scratch)
↓
Run tests (parallel):
├─> Unit (plugin)
├─> Unit (operator)
├─> Verify (lint)
├─> FIPS scan (plugin)
├─> FIPS scan (operator)
└─> E2E (deploy via OLM, verify)
↓
All tests pass ✓
→ PR can merge
```
## Pattern Consistency
This configuration follows the same pattern as:
- cert-manager-operator
- external-secrets-operator
- other OpenShift console plugins
Key patterns:
- Multi-stage Dockerfiles (builder → runtime)
- Image substitution in bundles
- FIPS compliance scanning
- E2E testing via OLM deployment
- operator-sdk for bundle deployment
## Testing
E2E test workflow:
1. Claims temporary cluster
2. Deploys operator via: operator-sdk run bundle
3. Bundle contains substituted images (CI-built)
4. Creates SecretsManagementConfig CR
5. Verifies plugin deploys with correct image
6. Verifies ConsolePlugin resource created
7. Releases cluster
## Impact
After merge:
- Every PR will build all images
- Every PR will run E2E tests on real cluster
- Every PR will be FIPS-scanned
- Post-merge builds can push to production registry
- Enables production deployment via OperatorHub
## Related
Plugin project PR: feat(ci): Add operator CI Dockerfile
- Creates: operator/images/ci/Dockerfile
- Required by this CI configuration
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThe CI configuration for ChangesOCP 4.21 CI Configuration and Test Pipeline Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml`:
- Around line 94-106: The `oc wait` command in the install step lacks a timeout
flag, which can cause the step to hang indefinitely if the deployment never
reaches the Available state. Add a `--timeout` flag to the `oc wait` command
that waits for the secrets-management-operator deployment to become available,
specifying an appropriate timeout duration (similar to the 10m timeout used in
the operator-sdk run bundle command) to ensure the step fails fast with a clear
error if the deployment does not become available within the specified
timeframe.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 900ca80b-cbb4-4277-bcdb-3cea6c42bb90
📒 Files selected for processing (1)
ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml
Add --timeout=10m flag to oc wait command for secrets-management-operator deployment to prevent indefinite hanging if deployment never becomes available. This matches the timeout used in the operator-sdk run bundle command and ensures fast failure with clear error message.
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
…nsole
Auto-generated Prow job configurations from CI operator config using
'make jobs'. This includes presubmit jobs for:
- Bundle build (ci-bundle-ocp-secrets-management-operator-bundle)
- E2E operator test (e2e-operator)
- FIPS image scans (fips-image-scan-plugin, fips-image-scan-operator)
- Unit tests (unit, operator-unit)
- Linting (verify)
- Image builds (images)
Generated by: prowgen
Based on: ci-operator/config/openshift/ocp-secrets-management-console/
openshift-ocp-secrets-management-console-main.yaml
Run 'make ci-operator-config' to normalize the configuration file format. The determinize-ci-operator tool removes comments to maintain consistent formatting across all CI operator configs in the repository.
Update OWNERS file to include additional approvers and reviewers: - bharath-b-rh - mytreya-rh This provides better code review coverage and aligns with the team structure for the ocp-secrets-management-console project.
Update OWNERS file in ci-operator/jobs directory to include the same approvers and reviewers as the config directory for consistency.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: anandkuma77, sarthakpurohit The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@anandkuma77: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Enable automatic image builds in OpenShift CI for the secrets management console plugin project, including plugin image, operator image, and OLM bundle with image substitution.
Changes
Updated: ci-operator/config/openshift/ocp-secrets-management-console/
openshift-ocp-secrets-management-console-main.yaml
Added Image Builds
Plugin Image (ocp-secrets-management)
Operator Image (ocp-secrets-management-operator)
Added Bundle Build with Image Substitution
operator.bundles:
operator.substitutions:
Replaces operator image reference in CSV
Replaces plugin image reference in CSV
Why substitution matters:
Added Tests
Unit Tests
Verify Tests
FIPS Image Scans (security compliance)
E2E Tests (deploy via OLM on real cluster)
Added Configuration
Build Flow in CI
Pattern Consistency
This configuration follows the same pattern as:
Key patterns:
Testing
E2E test workflow:
Impact
After merge:
Related
Plugin project PR: feat(ci): Add operator CI Dockerfile
Summary by CodeRabbit
This PR updates the OpenShift CI configuration for ocp-secrets-management-console in
ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yamlto target OpenShift 4.21, build and publish the console plugin/operator images, generate the OLM bundle with CI-specific image references, and run additional verification including linting, FIPS scans, and an operator-driven E2E deployment.Key changes
Release targeting update
releases.latest.candidate.versionand relatedbase_imagestags (including thegolangandoperator-sdkbuilders).Build configuration
base-rhel9.binary_build_commands: cd operator && make buildfor the operator binary build.OLM bundle + image substitutions
operator/bundle.Dockerfile.openshift.io/ocp-secrets-management-operator:.*→pipeline:ocp-secrets-management-operatoropenshift.io/ocp-secrets-management:.*→pipeline:ocp-secrets-managementTest pipeline enhancements
yarn install && ... yarn testcd operator && make testyarn install && ... yarn lintocp-secrets-management(plugin)ocp-secrets-management-operator(operator)New E2E operator flow on AWS (OpenShift 4.21)
generic-claim) for version 4.21.operator-sdk run bundle.SecretsManagementConfigsample (operator/config/samples/...secretsmanagementconfig.yaml).secrets-management-operatordeployment to be Availableocp-secrets-management-plugindeployment to be AvailableConsolePluginresource exists (oc get consoleplugin ocp-secrets-management).