step-registry: migrate proxy image from registry.ci to quay.io in AWS proxy scripts - #83144
Conversation
Migrate PROXY_IMAGE from registry.ci.openshift.org/origin/4.5:egress-http-proxy to quay.io/openshifttest/squid-proxy:multiarch. The proxy VM is a bare CoreOS EC2 instance without CI pull credentials, so it cannot authenticate to registry.ci.openshift.org. The replacement image is publicly pullable and already used by baremetalds-devscripts-proxy for the same purpose.
Same registry.ci.openshift.org migration issue as the IPI script. The proxy VM has no CI pull credentials, so switch to the publicly pullable quay.io/openshifttest/squid-proxy:multiarch image.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughThe AWS IPI and UPI proxy configurations now use ChangesAWS proxy image configuration
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[REHEARSALNOTIFIER]
A total of 279 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-openshift-installer-release-5.0-e2e-aws-upi-proxy pull-ci-openshift-installer-release-4.22-e2e-aws-upi-proxy AI-generated. Review for accuracy. |
|
@redhat-chai-bot: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-installer-release-5.0-e2e-aws-ovn-proxy pull-ci-openshift-installer-release-4.22-e2e-aws-ovn-proxy pull-ci-openshift-installer-main-e2e-aws-ovn-proxy AI-generated. Review for accuracy. |
|
@redhat-chai-bot: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse rehearse-83144-pull-ci-openshift-installer-release-4.22-e2e-aws-upi-proxy rehearse-83144-pull-ci-openshift-installer-release-4.22-e2e-aws-ovn-proxy |
|
@neisw: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@neisw: job(s): rehearse-83144-pull-ci-openshift-installer-release-4.22-e2e-aws-upi-proxy, rehearse-83144-pull-ci-openshift-installer-release-4.22-e2e-aws-ovn-proxy either don't exist or were not found to be affected, and cannot be rehearsed |
|
/pj-rehearse pull-ci-openshift-installer-release-4.22-e2e-aws-ovn-proxy pull-ci-openshift-installer-release-4.22-e2e-aws-upi-proxy |
|
@neisw: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-proxy periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-proxy |
|
@neisw: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/lgtm |
|
@neisw: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: neisw, redhat-chai-bot The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@redhat-chai-bot: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
7fd0295
into
openshift:main
2 participants
Summary
Migrate the Squid proxy image (
PROXY_IMAGE) from the auth-gatedregistry.ci.openshift.orgto the publicly-pullablequay.io/openshifttest/squid-proxy:multiarchin both IPI and UPI AWSproxy CI step scripts.
Problem
After the QCI migration (ci-tools#4866, May 2026), images are no longer
mirrored to
registry.ci.openshift.org. The proxy VM is a bare CoreOS EC2instance launched via ignition — it has no CI pull secret, so
podman runagainst
registry.cifails with an authentication error. This causes allovn-proxy install runs to fail, rejecting 5.0 nightly payloads
(e.g.
5.0.0-0.nightly-2026-08-07-234136).Related: CNTRLPLANE-3986 tracks the same
registry.ci→ QCI migrationgap for other images.
Changes
ipi-conf-aws-proxy-commands.sh(line 242): ChangePROXY_IMAGEfromregistry.ci.openshift.org/origin/4.5:egress-http-proxytoquay.io/openshifttest/squid-proxy:multiarchupi-conf-aws-proxy-commands.sh(line 309): ChangePROXY_IMAGEfromregistry.ci.openshift.org/origin/4.18:egress-http-proxytoquay.io/openshifttest/squid-proxy:multiarchWhy
quay.io/openshifttest/squid-proxy:multiarchSame image already used by
baremetalds-devscripts-proxy-commands.shforthe identical purpose (running Squid in CI). Publicly pullable, multiarch,
actively maintained.
AI-generated. Review for accuracy.
@petr-muller requested in Slack thread
Summary by CodeRabbit
The AWS IPI and UPI proxy CI scripts now use the publicly pullable
quay.io/openshifttest/squid-proxy:multiarchimage. This prevents proxy VM failures caused by missing CI registry credentials after the QCI migration and provides multi-architecture support.