no-jira: Fix registry authentication in ipi-conf-gcp-oidc-creds-deprovision step#78829
no-jira: Fix registry authentication in ipi-conf-gcp-oidc-creds-deprovision step#78829barbacbd wants to merge 1 commit intoopenshift:mainfrom
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@barbacbd: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughA shell step now extracts GCP credentials-requests from RELEASE_IMAGE_LATEST_FROM_BUILD_FARM inside a temporary directory: it copies the cluster pull-secret there, runs ChangesCredential Extraction Workflow
sequenceDiagram
participant Script as Script (step script)
participant FS as Filesystem
participant Registry as oc registry
participant Release as oc adm release
Script->>FS: mktemp & pushd (create temp dir)
Script->>FS: copy ${CLUSTER_PROFILE_DIR}/pull-secret -> temp/pull-secret
Script->>Registry: oc registry login --to pull-secret
Registry-->>Script: write auth into temp/pull-secret
Script->>Release: oc adm release extract --registry-config pull-secret --credentials-requests --to=/tmp/credrequests RELEASE_IMAGE_LATEST_FROM_BUILD_FARM
Release-->>FS: writes /tmp/credrequests
Script->>FS: cleanup (remove pull-secret, popd, rmdir)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: barbacbd The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/ipi/conf/gcp/oidc-creds-deprovision/ipi-conf-gcp-oidc-creds-deprovision-commands.sh`:
- Around line 30-36: The script can leave temporary files if a command fails and
should also quote CLUSTER_PROFILE_DIR; add a cleanup routine (e.g., a
trap-registered function) that removes the temporary directory and the copied
pull-secret and always runs on exit, replace unquoted ${CLUSTER_PROFILE_DIR}
with a quoted "${CLUSTER_PROFILE_DIR}" when copying pull-secret, and ensure
pushd/popd are balanced inside the trap so the temporary directory created with
dir=$(mktemp -d) is removed and no pull-secret remains on any exit path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 6abd9261-d64f-4fc2-9901-a0f7c28d375c
📒 Files selected for processing (1)
ci-operator/step-registry/ipi/conf/gcp/oidc-creds-deprovision/ipi-conf-gcp-oidc-creds-deprovision-commands.sh
|
This was originally observed here. The problem was in the This was causing the service accounts for OIDC steps to be leaked. |
|
/cc @patrickdillon |
barbacbd
force-pushed
the
fix-gcp-oidc-creds-deprovision
branch
from
2545756 to
390eedc
Compare
|
@barbacbd, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/retest-required |
The step was failing with "unauthorized: authentication required" when extracting credentials requests from the CI registry. Added the standard authentication pattern (copy pull-secret, oc registry login, use --registry-config) that all other credential provision/deprovision steps use to authenticate to the registry before extracting release images. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
barbacbd
force-pushed
the
fix-gcp-oidc-creds-deprovision
branch
from
390eedc to
3742315
Compare
|
/retest-required |
|
/pj-rehearse test |
|
@barbacbd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/test ? |
|
@barbacbd: The following commands are available to trigger required jobs: The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/pj-rehearse openshift-cloud-credential-operator-release-4.22__periodics.yaml |
|
@barbacbd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse auto-ack |
|
@tthvo: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@barbacbd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| cp "${CLUSTER_PROFILE_DIR}/pull-secret" pull-secret | ||
| oc registry login --to pull-secret |
There was a problem hiding this comment.
Looks like you need to unset the KUBECONFIG env var.
Otherwise, oc will try to auth with the build cluster 🤷 For example, the rehearsal showed:
RELEASE_IMAGE_LATEST_FROM_BUILD_FARM: registry.build04.ci.openshift.org/ci-op-j5gvr51h/release@sha256:6319e6701dc278166aaa34d733ec15715202f8ddd7460554d371d497135fafd2
Extract gcp credentials requests from the release image
error: no token is currently in use for this session
3 participants
The step was failing with "unauthorized: authentication required" when extracting credentials requests from the CI registry. Added the standard authentication pattern (copy pull-secret, oc registry login, use --registry-config) that all other credential provision/deprovision steps use to authenticate to the registry before extracting release images.
Summary by CodeRabbit