Add a Zuul image content provider by rebtoor · Pull Request #85 · openstack-k8s-operators/s2i-openstack-containers

rebtoor · 2026-08-17T10:29:27Z

Summary

Rebase and rework the content provider from #66 onto the current main
branch, addressing all review feedback.

Content provider job: builds and publishes OpenStack service container
images to a Zuul buildset registry, pauses, and returns exact image
references via zuul_return for dependent jobs to consume.
build.sh enhancements: registry auth (REGISTRY_AUTH_FILE/REGISTRY_CERT_DIR),
refs/resolve CLI commands, comma-separated target union with dedup,
improved parallel build logging (live tee + sed prefix, PID-tracked
wait -n -p).
Molecule tests: provider-contract scenario exercising registry and
cleanup contracts.
Python tests: test_provider_architecture.py (contract validation) and
test_provider_shell.py (build.sh behavior).

Changes from the original #66

What	Action
"Standardize lock generation on Python 3.12" commit	Dropped (already merged via #80)
"Make source updates atomic" commit	Dropped (keep shell tests per amoralej)
Auto-base insertion in `resolve_targets()`	Removed (amoralej feedback)
`openssl-libs` in watcher	Dropped (transitive, already in UBI)
Watcher entrypoint validation in shared pipeline	Removed (SeanMooney ack'd)

Review feedback addressed

Registry container name computed once as a fact (rebtoor)
SELinux workaround comment added (rebtoor)
Socat tunnel PID recorded and killed by PID (rebtoor)
"null" string sentinel documented in content-provider-return (rebtoor)
test_provider_shell.py parallel output deadline increased to 30s (rebtoor)

Test plan

Verify tox -e molecule passes the provider-contract scenario
Verify python -m pytest tests/test_provider_architecture.py tests/test_provider_shell.py passes
Zuul github-check pipeline runs molecule + content-provider jobs
Dependent consumer job can pull images from the buildset registry

Made with Cursor

centosinfra-prod-github-app · 2026-08-17T10:33:58Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/627634093a2043bfafb106a9ea45f4cf

❌ s2i-openstack-containers-molecule FAILURE in 1m 46s
❌ s2i-openstack-container-content-provider FAILURE in 2m 48s

Enable the s2i content provider to automatically determine which images to build based on the triggering Zuul project, and to stage patched source checkouts from the Zuul workspace into container build contexts. This is a lightweight alternative to the OIB Python package from PR openstack-k8s-operators#49, implementing only the two features needed for RHOSRFE-466 (speculative testing of upstream OpenStack changes): 1. `build.sh auto-detect <project> [stream]` — scans sources.txt files to find which container images reference a given upstream project. Uses exact URL-path matching to avoid false positives (e.g., openstack/watcher does not match openstack/watcher-tempest-plugin). 2. Ansible playbooks for Zuul integration: - resolve-auto-images.yaml: resolves `s2i_ci_images: auto` by running auto-detect for each changed project in the Zuul queue. - stage-zuul-sources.yaml: copies Zuul-checked-out source repos into container src/ directories for speculative builds. Depends-On: openstack-k8s-operators#85 Related-Issue: RHOSRFE-466 Co-Authored-By: Sean Mooney <smooney@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Enable the s2i content provider to automatically determine which images to build based on the triggering Zuul project, and to stage patched source checkouts from the Zuul workspace into container build contexts. This is a lightweight alternative to the OIB Python package from PR openstack-k8s-operators#49, implementing only the two features needed for RHOSRFE-466 (speculative testing of upstream OpenStack changes): 1. `build.sh auto-detect <project> [stream]` — scans sources.txt files to find which container images reference a given upstream project. Uses exact URL-path matching to avoid false positives (e.g., openstack/watcher does not match openstack/watcher-tempest-plugin). 2. Ansible playbooks for Zuul integration: - resolve-auto-images.yaml: resolves `s2i_ci_images: auto` by running auto-detect for each changed project in the Zuul queue. - stage-zuul-sources.yaml: copies Zuul-checked-out source repos into container src/ directories for speculative builds. Depends-On: openstack-k8s-operators#85 Related-Issue: RHOSRFE-466 Co-Authored-By: Sean Mooney <work@seanmooney.info> Assisted-By: Claude (Anthropic) Co-authored-by: Cursor <cursoragent@cursor.com>

amoralej

Change in build.sh seems correct to me. See my coments about the new python tests. I'd suggest to port them to the bash based testing script, at least the ones testing build.sh.

WRT the new zuul job. I checked the new job is properly building the containers and exposing in registry and logs gathering is good. The logic seems good for the provider jobs and i think we can refine as follow-up if needed.

After merging, once we check the new job is working fine, i think we may replace the existing build job in gha by this one which is faster.

Rebase and rework the content provider from PR openstack-k8s-operators#66 onto the current main branch. The provider builds and publishes OpenStack service container images to a Zuul buildset registry so that dependent jobs can consume exact image references. Changes from the original PR openstack-k8s-operators#66: - Drop the "Make source updates atomic" commit (keep existing test_update_sources.sh per amoralej's feedback). - Drop the "Standardize lock generation on Python 3.12" commit (already merged as part of PR openstack-k8s-operators#80). - Remove auto-base insertion from resolve_targets() as requested by amoralej; the caller is now responsible for including base. - Drop openssl-libs from watcher (transitive, already in UBI). - Remove hardcoded watcher entrypoint validation from the shared run playbook (SeanMooney ack'd). Review feedback addressed: - Compute buildset registry container name as a fact once instead of repeating the expression 4 times (rebtoor). - Add SELinux workaround comment explaining the container remove/recreate sequence (rebtoor). - Record socat tunnel PID in the ownership marker and kill by PID in post-run instead of using fragile pgrep patterns (rebtoor). - Document the "null" string sentinel in content-provider-return explaining why it cannot be actual null (rebtoor). - Increase test_provider_shell.py parallel output deadline from 5s to 30s to avoid CI flakiness (rebtoor). Co-Authored-By: Sean Mooney <work@seanmooney.info> Assisted-By: Claude (Anthropic) Co-authored-by: Cursor <cursoragent@cursor.com>

amoralej · 2026-08-18T13:00:51Z

/approve

openshift-ci · 2026-08-18T13:00:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amoralej

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [amoralej]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot added the do-not-merge/work-in-progress label Aug 17, 2026

rebtoor requested a review from amoralej August 17, 2026 10:30

rebtoor force-pushed the feature/zuul-content-provider branch from fe199c2 to dcf1db1 Compare August 17, 2026 10:44

rebtoor marked this pull request as ready for review August 17, 2026 12:05

openshift-ci Bot removed the do-not-merge/work-in-progress label Aug 17, 2026

This was referenced Aug 17, 2026

Add consumer smoke job and deployment key validation #53

Merged

Add e2e job for s2i-built tempest container image openstack-k8s-operators/test-operator#492

Open

rebtoor force-pushed the feature/zuul-content-provider branch from dcf1db1 to d744294 Compare August 18, 2026 07:14

rebtoor mentioned this pull request Aug 18, 2026

Add speculative build support: auto-detect and source staging #90

Closed

rebtoor force-pushed the feature/zuul-content-provider branch 2 times, most recently from 14823b1 to d744294 Compare August 18, 2026 08:09

rebtoor mentioned this pull request Aug 18, 2026

Add speculative build support: auto-detect and source staging #91

Merged

5 tasks

amoralej reviewed Aug 18, 2026

View reviewed changes

Comment thread build.sh

Comment thread build.sh

Comment thread build.sh

Comment thread tests/test_provider_shell.py Outdated

Comment thread tests/test_provider_architecture.py Outdated

rebtoor force-pushed the feature/zuul-content-provider branch from d744294 to 7d8d9ab Compare August 18, 2026 12:05

rebtoor requested a review from amoralej August 18, 2026 12:06

rebtoor force-pushed the feature/zuul-content-provider branch from 7d8d9ab to a454ce7 Compare August 18, 2026 12:17

amoralej approved these changes Aug 18, 2026

View reviewed changes

openshift-ci Bot assigned amoralej Aug 18, 2026

openshift-ci Bot added the lgtm label Aug 18, 2026

openshift-ci Bot added the approved label Aug 18, 2026

openshift-merge-bot Bot merged commit b78ba60 into openstack-k8s-operators:main Aug 18, 2026
6 checks passed

SeanMooney mentioned this pull request Aug 19, 2026

Add a Zuul image content provider #66

Closed

Navigation Menu

Uh oh!

Add a Zuul image content provider - #85

Add a Zuul image content provider#85
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
rebtoor:feature/zuul-content-provider

rebtoor commented Aug 17, 2026 •

edited

Loading

Uh oh!

centosinfra-prod-github-app Bot commented Aug 17, 2026

Uh oh!

amoralej left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amoralej commented Aug 18, 2026

Uh oh!

openshift-ci Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rebtoor commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes from the original #66

Review feedback addressed

Test plan

Uh oh!

centosinfra-prod-github-app Bot commented Aug 17, 2026

Uh oh!

amoralej left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amoralej commented Aug 18, 2026

Uh oh!

openshift-ci Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rebtoor commented Aug 17, 2026 •

edited

Loading