prowgen: always add GSM config volumes to multi-stage test jobs

[psalajova]

Summary

• Remove the EnableSecretsStoreCSIDriver gate in jobbase.go — prowgen now unconditionally adds GSM config volumes (gsm-config ConfigMap, gsm-sa-key CSI) and --enable-secrets-store-csi-driver=true to all multi-stage test job specs.
• Post-migration, all credentials use GSM. This PR ensures new repo onboarding works without manually setting prowgen: enable_secrets_store_csi_driver: true in the ci-operator config.

Context

This is part of the Vault-to-GSM migration plan. After migration day:

1. We have already added enable_secrets_store_csi_driver: true to all existing configs
2. This PR makes the flag unnecessary for new onboarding

DO NOT MERGE until the Vault-to-GSM migration is complete.
After merge + image build: make update in release repo to regenerate all jobs

Summary

prowgen now configures every multi-stage test ProwJob for Google Secret Manager. It enables the Secrets Store CSI driver, passes GSM configuration paths to ci-operator, and mounts the gsm-config ConfigMap and gsm-sa-key CSI volume.

The EnableSecretsStoreCSIDriver gate no longer controls multi-stage jobs. New repositories do not need prowgen: enable_secrets_store_csi_driver: true.

Unit and integration fixtures now match the generated ProwJob specifications.

Production note

Complete the Vault-to-GSM migration before merging. After building the image, run make update in the release repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: psalajova

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [psalajova]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

The ProwJob generator now always adds GSMConfig() for literal and structured multistage configurations. Expected fixtures now include Secrets Store CSI arguments, GSM mounts, a ConfigMap volume, and a CSI credential volume.

Changes

GSM and Secrets Store CSI integration

Layer / File(s)	Summary
Always add GSM configuration pkg/prowgen/jobbase.go	Literal and structured multistage jobs now always add GSMConfig().
Update generated and controller fixtures pkg/prowgen/testdata/..., cmd/ci-operator-prowgen/testdata/..., pkg/controller/...	Fixtures now include GSM arguments, read-only mounts, a gsm-config ConfigMap volume, and a CSI credential volume.
Refresh integration expectations test/integration/...	Integration outputs now include the same Secrets Store CSI and GSM pod configuration across affected jobs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/ci-tools#5352: Changes related Secrets Store CSI defaults and GSM initialization.

Suggested reviewers: smg247, danilo-gemoli, prucek

🚥 Pre-merge checks | ✅ 17

✅ Passed checks (17 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: always adding GSM configuration volumes to multi-stage test jobs.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	The only added Go statements call Add, which returns a builder rather than an error; existing resolver errors are checked and wrapped with %w, and the patch adds no ignored errors or panic.
Test Coverage For New Features	✅ Passed	The PR modifies an existing function and includes comprehensive snapshot-based test coverage: TestNewProwJobBaseBuilderForTest exercises both affected code paths (literal and standard multi-stage),...
Stable And Deterministic Test Names	✅ Passed	The diff changes only jobbase.go and YAML fixtures; it adds no Ginkgo declarations or dynamic test titles. Existing table-driven test names are static strings.
Test Structure And Quality	✅ Passed	This PR modifies only fixture files (YAML test data) and one production file. It does not include Ginkgo test code with It/Describe/BeforeEach/AfterEach blocks. The check is not applicable to this PR.
Microshift Test Compatibility	✅ Passed	PR does not add new Ginkgo e2e tests; it only modifies production code and test fixture files. MicroShift compatibility check applies only to new test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds no Ginkgo e2e tests or test constructs; it changes one prowgen implementation file and YAML fixtures only, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	PR adds GSM configuration volumes and CSI driver arguments to Prow job specs. No pod affinity, topology spread constraints, node selectors, or replica-count logic targeting control-plane nodes are...
Ote Binary Stdout Contract	✅ Passed	The PR changes only prowgen logic and YAML fixtures; no OTE entrypoint, suite setup, stdout write, or logging configuration was added or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR does not add new Ginkgo e2e tests. It modifies business logic and test fixture files. The check applies only when new Ginkgo e2e tests are added.
No-Weak-Crypto	✅ Passed	No weak cryptographic algorithms, custom crypto implementations, or non-constant-time secret comparisons were found in the modified code.
Container-Privileges	✅ Passed	The PR adds Google Secret Manager (GSM) configuration volumes and arguments to multi-stage test jobs. The changes include only read-only volume mounts for GSM config and credentials, ConfigMap and...
No-Sensitive-Data-In-Logs	✅ Passed	The only executable change adds GSMConfig(); no logging or print calls were added. YAML changes contain secret volume names and file paths, not secret values or logged data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[psalajova]

/hold

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/integration/pj-rehearse/expected.yaml`:
- Around line 538-543: Update the GSMConfig() mutator to add container-level
securityContext settings for GSM credential containers: runAsNonRoot true,
allowPrivilegeEscalation false, readOnlyRootFilesystem true, and
capabilities.drop containing ALL. Regenerate
test/integration/pj-rehearse/expected.yaml, applying the fixture update at
538-543, 1174-1179, 1321-1326, 1470-1475, 1617-1622, 1881-1886, 2027-2032, and
2173-2178; verify Prow’s base configuration does not already provide these
controls.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 76ed0a13-c769-4756-8b75-5ffe8061d806

📥 Commits

Reviewing files that changed from the base of the PR and between 497f6c8 and be757ce.

📒 Files selected for processing (23)

• cmd/ci-operator-prowgen/testdata/zz_fixture_presubmit_TestFromCIOperatorConfigToProwYaml_Custom_test_timeout.yaml
• pkg/controller/ephemeralcluster/testdata/zz_fixture_pj_TestReconcileCreateProwJob_An_EphemeralCluster_request_creates_a_ProwJob.yaml
• pkg/controller/ephemeralcluster/testdata/zz_fixture_pj_TestReconcileCreateProwJob_Hive_cluster_request_creates_a_ProwJob.yaml
• pkg/controller/ephemeralcluster/testdata/zz_fixture_pj_TestReconcileCreateProwJob_Privileged_tenant.yaml
• pkg/controller/prpqr_reconciler/testdata/zz_fixture_prowjobs_TestReconcile_basic_aggregated_case.yaml
• pkg/controller/prpqr_reconciler/testdata/zz_fixture_prowjobs_TestReconcile_private_repo_aggregated_sets_aggregator_hidden.yaml
• pkg/prowgen/jobbase.go
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_literal_multi_stage_test.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_claim.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_cluster_profile.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_releases.yaml
• test/integration/ci-operator-prowgen/output/jobs/sharded/repo/sharded-repo-main-presubmits.yaml
• test/integration/ci-operator-prowgen/output/jobs/super/duper/super-duper-master-presubmits.yaml
• test/integration/pj-rehearse/candidate/ci-operator/jobs/super/trooper/super-trooper-master-periodics.yaml
• test/integration/pj-rehearse/candidate/ci-operator/jobs/super/trooper/super-trooper-master-presubmits.yaml
• test/integration/pj-rehearse/candidate/ci-operator/jobs/uses/observer/uses-observer-master-presubmits.yaml
• test/integration/pj-rehearse/expected.yaml
• test/integration/pj-rehearse/master/ci-operator/jobs/super/trooper/super-trooper-master-periodics.yaml
• test/integration/pj-rehearse/master/ci-operator/jobs/super/trooper/super-trooper-master-presubmits.yaml
• test/integration/pj-rehearse/master/ci-operator/jobs/uses/observer/uses-observer-master-presubmits.yaml
• test/integration/repo-init/expected/ci-operator/jobs/org/repo/org-repo-main-presubmits.yaml
• test/integration/repo-init/expected/ci-operator/jobs/org/third/org-third-nonstandard-presubmits.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift/release (manual)
• openshift/ci-docs (manual)
• openshift/release-controller (manual)
• openshift/ci-chat-bot (manual)

🚧 Files skipped from review as they are similar to previous changes (22)

• pkg/controller/ephemeralcluster/testdata/zz_fixture_pj_TestReconcileCreateProwJob_Hive_cluster_request_creates_a_ProwJob.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_claim.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test.yaml
• test/integration/pj-rehearse/candidate/ci-operator/jobs/super/trooper/super-trooper-master-periodics.yaml
• pkg/controller/ephemeralcluster/testdata/zz_fixture_pj_TestReconcileCreateProwJob_An_EphemeralCluster_request_creates_a_ProwJob.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_literal_multi_stage_test.yaml
• test/integration/pj-rehearse/master/ci-operator/jobs/super/trooper/super-trooper-master-periodics.yaml
• pkg/prowgen/jobbase.go
• test/integration/ci-operator-prowgen/output/jobs/super/duper/super-duper-master-presubmits.yaml
• pkg/controller/prpqr_reconciler/testdata/zz_fixture_prowjobs_TestReconcile_private_repo_aggregated_sets_aggregator_hidden.yaml
• test/integration/repo-init/expected/ci-operator/jobs/org/third/org-third-nonstandard-presubmits.yaml
• cmd/ci-operator-prowgen/testdata/zz_fixture_presubmit_TestFromCIOperatorConfigToProwYaml_Custom_test_timeout.yaml
• pkg/controller/ephemeralcluster/testdata/zz_fixture_pj_TestReconcileCreateProwJob_Privileged_tenant.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_cluster_profile.yaml
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_releases.yaml
• test/integration/pj-rehearse/master/ci-operator/jobs/super/trooper/super-trooper-master-presubmits.yaml
• test/integration/ci-operator-prowgen/output/jobs/sharded/repo/sharded-repo-main-presubmits.yaml
• test/integration/pj-rehearse/candidate/ci-operator/jobs/uses/observer/uses-observer-master-presubmits.yaml
• pkg/controller/prpqr_reconciler/testdata/zz_fixture_prowjobs_TestReconcile_basic_aggregated_case.yaml
• test/integration/pj-rehearse/master/ci-operator/jobs/uses/observer/uses-observer-master-presubmits.yaml
• test/integration/pj-rehearse/candidate/ci-operator/jobs/super/trooper/super-trooper-master-presubmits.yaml
• test/integration/repo-init/expected/ci-operator/jobs/org/repo/org-repo-main-presubmits.yaml

[openshift-ci]

@psalajova: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	be757ce	link	true	/test images
ci/prow/breaking-changes	be757ce	link	false	/test breaking-changes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.