Skip to content

NO-ISSUE: Reenable RHEL 9.8 and 10.2 leftover image builds and scenarios - #7045

Draft
ggiguash wants to merge 12 commits into
openshift:mainfrom
ggiguash:rhel-98-102-leftover-fixes
Draft

NO-ISSUE: Reenable RHEL 9.8 and 10.2 leftover image builds and scenarios#7045
ggiguash wants to merge 12 commits into
openshift:mainfrom
ggiguash:rhel-98-102-leftover-fixes

Conversation

@ggiguash

@ggiguash ggiguash commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

The following issues are addressed in this PR:

Summary by CodeRabbit

  • New Features

    • Added automated coverage for FIPS-enabled environments and upgrade recovery workflows across supported releases.
    • Added validation for optional signature verification scenarios with expanded VM resources and execution timeouts.
    • Added disabled test configurations for tuned, TLS, IPv6, and storage workload combinations.
  • Bug Fixes

    • Simplified FIPS image setup by removing an unnecessary networking package.
    • Corrected VM launch behavior for release upgrade testing.

@openshift-ci-robot

Copy link
Copy Markdown

@ggiguash: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 14, 2026
@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor
ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bf85985-aceb-4162-b9b7-31799652c555

📥 Commits

Reviewing files that changed from the base of the PR and between 88ded63 and aa2219f.

📒 Files selected for processing (10)
  • test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile
  • test/image-blueprints/layer4-release/group3/rhel98-brew-lrel-tuned.toml.disabled
  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el10/releases/el102-lrel@optional-sigstore.sh
  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el9/releases/el98-lrel@optional-sigstore.sh
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios/releases/el98-lrel@ginkgo-multi-config.sh.disabled
  • test/scenarios/releases/el98-zprel@el98-lrel@rpm-upgrade.sh
🚧 Files skipped from review as they are similar to previous changes (8)

Walkthrough

Adds EL10 and EL9 bootc scenario coverage, updates release scenario VM settings, and adds disabled RHEL 9.8 tuned image and multi-configuration test assets.

Changes

Bootc scenario coverage

Layer / File(s) Summary
EL10 bootc FIPS scenario
test/image-blueprints-bootc/..., test/scenarios-bootc/el10/periodics/...
Adds an aarch64 skip guard, FIPS-enabled rhel102-bootc VM lifecycle, FIPS suite execution, and removes an unused image package.
EL10 upgrade and optional scenarios
test/scenarios-bootc/el10/presubmits/..., test/scenarios-bootc/el10/releases/...
Adds upgrade recovery hooks and sets optional sigstore timeouts and explicit VM sizing.

EL9 scenario coverage

Layer / File(s) Summary
Upgrade recovery scenarios
test/scenarios-bootc/el9/presubmits/..., test/scenarios/presubmits/...
Adds VM setup, teardown, and Robot Framework execution for EL9 upgrade recovery flows.
EL9 release scenario launch settings
test/scenarios-bootc/el9/releases/..., test/scenarios/releases/...
Adds optional sigstore timeouts and VM sizing, and removes the boot blueprint argument from the RPM upgrade launch.

Tuned release coverage

Layer / File(s) Summary
RHEL 9.8 tuned image blueprint
test/image-blueprints/layer4-release/...
Adds the disabled rhel98-brew-lrel-tuned blueprint with package, kernel, service, firewall, kubelet, and tuned configuration.
Tuned multi-configuration scenario
test/scenarios/releases/el98-lrel@ginkgo-multi-config.sh.disabled
Adds disabled IPv6 VM setup, tuned reboot checks, TLSv1.3 configuration, MicroShift orchestration, LVMS checks, and disruptive Ginkgo execution.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: pmtk, copejon, agullon, pacevedom

Sequence Diagram(s)

sequenceDiagram
  participant scenario.sh
  participant host1
  participant FIPS_Suite
  scenario.sh->>host1: Create rhel102-bootc with FIPS kickstart
  scenario.sh->>FIPS_Suite: Run suites/fips/ against host1
  scenario.sh->>host1: Remove host1
Loading

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (1 error, 1 warning)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error New scenarios pass MIRROR_REGISTRY_URL and WEB_SERVER_URL-derived URLs to run_tests, while scenario.sh logs all test arguments, exposing internal registry/web hostnames. Redact URL-valued Robot arguments in run_tests logs, or change logging to print only argument names and non-sensitive values.
Docstring Coverage ⚠️ Warning Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (13 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main changes: re-enabling leftover RHEL 9.8 and 10.2 image builds and test scenarios.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR delta adds or renames shell scenarios and image files only; it adds no Ginkgo It/Describe/Context/When titles or dynamic title interpolation, and the Ginkgo runner is disabled.
Test Structure And Quality ✅ Passed PASS: The PR changes no Ginkgo test code; its only Ginkgo-related change renames a Bash scenario to .disabled, while the shared runner already provides execution timeouts.
Microshift Test Compatibility ✅ Passed The PR adds no Ginkgo or Go tests. The only Ginkgo-named file is an existing scenario renamed to .disabled, so the MicroShift API compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR adds or renames shell and image-blueprint files only; no new Ginkgo test declarations such as It(), Describe(), Context(), or When() were found.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes only test scripts and image blueprint/containerfile content; the diff adds no deployment, operator, controller, or topology scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The PR changes only shell, Containerfile, TOML, and disabled scenario files; no OTE Go entry point or suite setup code is added or modified, and no contract violation is present.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo test declarations were added; the only Ginkgo scenario was renamed to .disabled. Changed files show no flagged IPv4-only logic or public connectivity.
No-Weak-Crypto ✅ Passed The PR adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, custom crypto, or secret comparisons; the FIPS change only enables the FIPS crypto policy.
Container-Privileges ✅ Passed PR diff adds no container/Kubernetes privilege controls; no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings occur in added lines.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from copejon and pacevedom July 14, 2026 05:15
@openshift-ci

openshift-ci Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ggiguash

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 14, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (1)
test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile (1)

12-13: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Update the stale RHEL 9.x comment.

The comment references RHEL 9.x, but this is a RHEL 10.2 containerfile. Please update it to avoid confusion, and verify if containernetworking-plugins is still needed for RHEL 10 (or if netavark is used instead).

📝 Proposed update
-# Note: CNI plugins are required for podman to operate normally on RHEL 9.x.
+# Note: CNI plugins are required for podman/cri-o to operate normally.
 # This package is no longer installed as cri-o dependency.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile`
around lines 12 - 13, Update the CNI dependency comment in the RHEL 10.2
containerfile to reference RHEL 10 accurately, and verify the current networking
implementation before stating that containernetworking-plugins is required;
document netavark instead if it has replaced that dependency.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/scenarios-bootc/el10/periodics/el102-src`@fips.sh:
- Around line 1-2: Update both
test/scenarios-bootc/el10/periodics/el102-src@fips.sh lines 1-2 and
test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
lines 1-2 to use the /usr/bin/bash shebang and add set -euo pipefail immediately
afterward.

In `@test/scenarios-bootc/el10/releases/el102-lrel`@optional-sigstore.sh:
- Line 26: Update the launch_vm invocation to pass rhel102-bootc as the first
positional argument instead of using the --boot_blueprint option, while
preserving the existing disk-size and vCPU arguments.

In `@test/scenarios-bootc/el9/presubmits/el98-src`@upgrade-fails-then-recovers.sh:
- Around line 1-2: Update the shebang and add strict error handling in all four
scripts:
test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
lines 1-2, test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
lines 1-2, test/scenarios/presubmits/el98-src@low-latency.sh lines 1-5, and
test/scenarios/releases/el98-lrel@low-latency.sh lines 1-5. Use the
/usr/bin/bash shebang and insert set -euo pipefail immediately afterward.

In `@test/scenarios/releases/el98-zprel`@el98-lrel@rpm-upgrade.sh:
- Around line 1-2: Update the script shebang to #!/usr/bin/bash and add strict
shell options with set -euo pipefail immediately afterward.

---

Nitpick comments:
In
`@test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile`:
- Around line 12-13: Update the CNI dependency comment in the RHEL 10.2
containerfile to reference RHEL 10 accurately, and verify the current networking
implementation before stating that containernetworking-plugins is required;
document netavark instead if it has replaced that dependency.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f8664e79-d4f0-4936-9e67-77abd6a551a7

📥 Commits

Reviewing files that changed from the base of the PR and between 182cc6b and 02100ae.

📒 Files selected for processing (11)
  • test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml
  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el10/releases/el102-lrel@optional-sigstore.sh
  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el9/releases/el98-lrel@optional-sigstore.sh
  • test/scenarios/presubmits/el98-src@low-latency.sh
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios/releases/el98-lrel@low-latency.sh
  • test/scenarios/releases/el98-zprel@el98-lrel@rpm-upgrade.sh

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 4

🧹 Nitpick comments (1)
test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile (1)

12-13: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Update the stale RHEL 9.x comment.

The comment references RHEL 9.x, but this is a RHEL 10.2 containerfile. Please update it to avoid confusion, and verify if containernetworking-plugins is still needed for RHEL 10 (or if netavark is used instead).

📝 Proposed update
-# Note: CNI plugins are required for podman to operate normally on RHEL 9.x.
+# Note: CNI plugins are required for podman/cri-o to operate normally.
 # This package is no longer installed as cri-o dependency.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile`
around lines 12 - 13, Update the CNI dependency comment in the RHEL 10.2
containerfile to reference RHEL 10 accurately, and verify the current networking
implementation before stating that containernetworking-plugins is required;
document netavark instead if it has replaced that dependency.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/scenarios-bootc/el10/periodics/el102-src`@fips.sh:
- Around line 1-2: Update both
test/scenarios-bootc/el10/periodics/el102-src@fips.sh lines 1-2 and
test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
lines 1-2 to use the /usr/bin/bash shebang and add set -euo pipefail immediately
afterward.

In `@test/scenarios-bootc/el10/releases/el102-lrel`@optional-sigstore.sh:
- Line 26: Update the launch_vm invocation to pass rhel102-bootc as the first
positional argument instead of using the --boot_blueprint option, while
preserving the existing disk-size and vCPU arguments.

In `@test/scenarios-bootc/el9/presubmits/el98-src`@upgrade-fails-then-recovers.sh:
- Around line 1-2: Update the shebang and add strict error handling in all four
scripts:
test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
lines 1-2, test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
lines 1-2, test/scenarios/presubmits/el98-src@low-latency.sh lines 1-5, and
test/scenarios/releases/el98-lrel@low-latency.sh lines 1-5. Use the
/usr/bin/bash shebang and insert set -euo pipefail immediately afterward.

In `@test/scenarios/releases/el98-zprel`@el98-lrel@rpm-upgrade.sh:
- Around line 1-2: Update the script shebang to #!/usr/bin/bash and add strict
shell options with set -euo pipefail immediately afterward.

---

Nitpick comments:
In
`@test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile`:
- Around line 12-13: Update the CNI dependency comment in the RHEL 10.2
containerfile to reference RHEL 10 accurately, and verify the current networking
implementation before stating that containernetworking-plugins is required;
document netavark instead if it has replaced that dependency.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f8664e79-d4f0-4936-9e67-77abd6a551a7

📥 Commits

Reviewing files that changed from the base of the PR and between 182cc6b and 02100ae.

📒 Files selected for processing (11)
  • test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml
  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el10/releases/el102-lrel@optional-sigstore.sh
  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el9/releases/el98-lrel@optional-sigstore.sh
  • test/scenarios/presubmits/el98-src@low-latency.sh
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios/releases/el98-lrel@low-latency.sh
  • test/scenarios/releases/el98-zprel@el98-lrel@rpm-upgrade.sh
🛑 Comments failed to post (4)
test/scenarios-bootc/el10/periodics/el102-src@fips.sh (1)

1-2: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use the correct shebang and enable strict error handling.

As per coding guidelines, shell scripts must use #!/usr/bin/bash and set -euo pipefail.

  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh#L1-L2: Update the shebang and add set -euo pipefail.
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh#L1-L2: Update the shebang and add set -euo pipefail.
📍 Affects 2 files
  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh#L1-L2 (this comment)
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh#L1-L2
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios-bootc/el10/periodics/el102-src`@fips.sh around lines 1 - 2,
Update both test/scenarios-bootc/el10/periodics/el102-src@fips.sh lines 1-2 and
test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
lines 1-2 to use the /usr/bin/bash shebang and add set -euo pipefail immediately
afterward.

Source: Coding guidelines

test/scenarios-bootc/el10/releases/el102-lrel@optional-sigstore.sh (1)

26-26: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Pass boot_blueprint as a positional argument.

launch_vm expects boot_blueprint as its first positional argument. Passing --boot_blueprint will cause the argument parser to fail and exit.

🐛 Proposed fix
-    launch_vm --boot_blueprint rhel102-bootc --vm_disksize 25 --vm_vcpus 4
+    launch_vm rhel102-bootc --vm_disksize 25 --vm_vcpus 4
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

    launch_vm rhel102-bootc --vm_disksize 25 --vm_vcpus 4
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios-bootc/el10/releases/el102-lrel`@optional-sigstore.sh at line
26, Update the launch_vm invocation to pass rhel102-bootc as the first
positional argument instead of using the --boot_blueprint option, while
preserving the existing disk-size and vCPU arguments.
test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh (1)

1-2: 📐 Maintainability & Code Quality | 🔴 Critical | ⚡ Quick win

Fix shebang and add strict error handling.

As per coding guidelines, shell scripts must use the #!/usr/bin/bash shebang and include set -euo pipefail.

  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh#L1-L2: Update the shebang and insert set -euo pipefail.
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh#L1-L2: Update the shebang and insert set -euo pipefail.
  • test/scenarios/presubmits/el98-src@low-latency.sh#L1-L5: Update the shebang and insert set -euo pipefail.
  • test/scenarios/releases/el98-lrel@low-latency.sh#L1-L5: Update the shebang and insert set -euo pipefail.
📍 Affects 4 files
  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh#L1-L2 (this comment)
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh#L1-L2
  • test/scenarios/presubmits/el98-src@low-latency.sh#L1-L5
  • test/scenarios/releases/el98-lrel@low-latency.sh#L1-L5
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios-bootc/el9/presubmits/el98-src`@upgrade-fails-then-recovers.sh
around lines 1 - 2, Update the shebang and add strict error handling in all four
scripts:
test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
lines 1-2, test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
lines 1-2, test/scenarios/presubmits/el98-src@low-latency.sh lines 1-5, and
test/scenarios/releases/el98-lrel@low-latency.sh lines 1-5. Use the
/usr/bin/bash shebang and insert set -euo pipefail immediately afterward.

Source: Coding guidelines

test/scenarios/releases/el98-zprel@el98-lrel@rpm-upgrade.sh (1)

1-2: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use required shebang and strict shell options.

As per coding guidelines, shell scripts must use the #!/usr/bin/bash shebang and include set -euo pipefail.

🛠️ Proposed fix
-#!/bin/bash
-
+#!/usr/bin/bash
+set -euo pipefail
+
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

#!/usr/bin/bash
set -euo pipefail

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios/releases/el98-zprel`@el98-lrel@rpm-upgrade.sh around lines 1 -
2, Update the script shebang to #!/usr/bin/bash and add strict shell options
with set -euo pipefail immediately afterward.

Source: Coding guidelines

@ggiguash
ggiguash marked this pull request as draft July 14, 2026 08:22
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 14, 2026
@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-bootc-release-el9
/test e2e-aws-tests-bootc-release-el10
/test e2e-aws-tests-release

2 similar comments
@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-bootc-release-el9
/test e2e-aws-tests-bootc-release-el10
/test e2e-aws-tests-release

@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-bootc-release-el9
/test e2e-aws-tests-bootc-release-el10
/test e2e-aws-tests-release

@ggiguash
ggiguash marked this pull request as ready for review July 31, 2026 07:59
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 31, 2026
@openshift-ci
openshift-ci Bot requested review from agullon and pmtk July 31, 2026 08:00
@ggiguash

Copy link
Copy Markdown
Contributor Author

/test ?

@ggiguash
ggiguash marked this pull request as draft July 31, 2026 08:01
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 31, 2026
@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-cache
/test e2e-aws-tests-cache-arm

@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-bootc-release-arm-el9

ggiguash and others added 2 commits July 31, 2026 14:08
…kernel-rt

RHEL 10 moved iptables compat kernel modules (nft_compat, xt_CT) from
kernel-modules-core to kernel-modules-extra. Use conditional rich
dependencies so that each variant is gated on its own kernel-core
package — installing MicroShift on a kernel-rt system does not pull
in the regular kernel (and vice-versa).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pre-commit.check-secrets: ENABLED
@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-cache

@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@ggiguash: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-tests-cache fc9d4c8 link true /test e2e-aws-tests-cache
ci/prow/e2e-aws-tests-bootc-release-arm-el9 06082cc link true /test e2e-aws-tests-bootc-release-arm-el9

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@ggiguash

ggiguash commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-cache
/test e2e-aws-tests-cache-arm

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/scenarios/releases/el98-lrel`@ginkgo-multi-config.sh.disabled:
- Around line 65-78: Update the MicroShift stop command in the TLS configuration
setup to fail the scenario when `systemctl stop microshift` fails; remove the
trailing `|| true` from the `run_command_on_vm` invocation, or explicitly verify
the service is inactive before continuing. Keep the subsequent TLS configuration
and service start steps unchanged.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bf85985-aceb-4162-b9b7-31799652c555

📥 Commits

Reviewing files that changed from the base of the PR and between 88ded63 and aa2219f.

📒 Files selected for processing (10)
  • test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile
  • test/image-blueprints/layer4-release/group3/rhel98-brew-lrel-tuned.toml.disabled
  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el10/releases/el102-lrel@optional-sigstore.sh
  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el9/releases/el98-lrel@optional-sigstore.sh
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios/releases/el98-lrel@ginkgo-multi-config.sh.disabled
  • test/scenarios/releases/el98-zprel@el98-lrel@rpm-upgrade.sh
🚧 Files skipped from review as they are similar to previous changes (8)

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/scenarios/releases/el98-lrel`@ginkgo-multi-config.sh.disabled:
- Around line 65-78: Update the MicroShift stop command in the TLS configuration
setup to fail the scenario when `systemctl stop microshift` fails; remove the
trailing `|| true` from the `run_command_on_vm` invocation, or explicitly verify
the service is inactive before continuing. Keep the subsequent TLS configuration
and service start steps unchanged.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bf85985-aceb-4162-b9b7-31799652c555

📥 Commits

Reviewing files that changed from the base of the PR and between 88ded63 and aa2219f.

📒 Files selected for processing (10)
  • test/image-blueprints-bootc/el10/layer2-presubmit/group2/rhel102-bootc-source-fips.containerfile
  • test/image-blueprints/layer4-release/group3/rhel98-brew-lrel-tuned.toml.disabled
  • test/scenarios-bootc/el10/periodics/el102-src@fips.sh
  • test/scenarios-bootc/el10/presubmits/el102-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el10/releases/el102-lrel@optional-sigstore.sh
  • test/scenarios-bootc/el9/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios-bootc/el9/releases/el98-lrel@optional-sigstore.sh
  • test/scenarios/presubmits/el98-src@upgrade-fails-then-recovers.sh
  • test/scenarios/releases/el98-lrel@ginkgo-multi-config.sh.disabled
  • test/scenarios/releases/el98-zprel@el98-lrel@rpm-upgrade.sh
🚧 Files skipped from review as they are similar to previous changes (8)
🛑 Comments failed to post (1)
test/scenarios/releases/el98-lrel@ginkgo-multi-config.sh.disabled (1)

65-78: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Locate target file:"
fd -a 'el98-lrel@ginkgo-multi-config.sh.disabled' . || true

target="$(fd 'el98-lrel@ginkgo-multi-config.sh.disabled' . | head -n 1 || true)"
if [ -n "${target:-}" ]; then
  echo "Target: $target"
  wc -l "$target"
  sed -n '1,130p' "$target" | cat -n
fi

echo
echo "Search run_command_on_vm:"
rg -n "function run_command_on_vm|run_command_on_vm\\(" . || true

Repository: openshift/microshift

Length of output: 4991


🏁 Script executed:

#!/bin/bash
set -euo pipefail
target="$(fd 'el98-lrel@ginkgo-multi-config.sh.disabled' . | head -n 1 || true)"
echo "Target: $target"
sed -n '1,40p' "$target" | cat -n
echo
sed -n '80,115p' "./test/bin/scenario.sh" | cat -n

Repository: openshift/microshift

Length of output: 3194


Fail when MicroShift cannot stop.

run_command_on_vm exits on failure, so || true at Line 66 suppresses a failed systemctl stop microshift. If MicroShift stays active, Line 78 may start it without applying /etc/microshift/config.d/10-tls.yaml; delete || true or fail the scenario after verifying the service is inactive.

Proposed fix
-    run_command_on_vm host1 "sudo systemctl stop microshift" || true
+    run_command_on_vm host1 "sudo systemctl stop microshift"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

    # Stop MicroShift before applying TLS configuration
    run_command_on_vm host1 "sudo systemctl stop microshift"

    # Apply TLSv1.3 configuration via drop-in config
    echo "INFO: Configuring TLSv1.3..."
    run_command_on_vm host1 "sudo mkdir -p /etc/microshift/config.d"
    run_command_on_vm host1 "sudo tee /etc/microshift/config.d/10-tls.yaml > /dev/null << 'EOF'
apiServer:
  tls:
    minVersion: VersionTLS13
EOF"

    # Start MicroShift to apply TLS configuration
    run_command_on_vm host1 "sudo systemctl start microshift"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios/releases/el98-lrel`@ginkgo-multi-config.sh.disabled around
lines 65 - 78, Update the MicroShift stop command in the TLS configuration setup
to fail the scenario when `systemctl stop microshift` fails; remove the trailing
`|| true` from the `run_command_on_vm` invocation, or explicitly verify the
service is inactive before continuing. Keep the subsequent TLS configuration and
service start steps unchanged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants