Skip to content

Declare MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as medik8s-catalogsource parameter - #83097

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
ugreener:fix/declare-fbc-override-param
Aug 7, 2026
Merged

Declare MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as medik8s-catalogsource parameter#83097
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
ugreener:fix/declare-fbc-override-param

Conversation

@ugreener

@ugreener ugreener commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Problem

When the medik8s CI dashboard triggers Prow jobs via Gangway with pod_spec_options.envs containing MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA to pin a specific FBC snapshot, the override is silently dropped. ci-operator's applyEnvOverrides stores env vars in TestEnvironment with the full prefixed key name, but generateParams only injects env vars into step pods when they match a declared step parameter name. Since only FBC_COMMIT_SHA was declared, the prefixed lookup missed.

This affects all dashboard-triggered jobs: connected (weekly), disconnected, and upgrade.

Summary

Declare MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as a step parameter in both catalogsource step refs so generateParams finds the entry and injects it into the step pod.

Changes

  • medik8s-catalogsource-ref.yaml: add MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA parameter (step script already reads it)
  • medik8s-disconnected-catalogsource-ref.yaml: add MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA parameter
  • medik8s-disconnected-catalogsource-commands.sh: add bash fallback to read MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA (matching the connected step's pattern)

Summary by CodeRabbit

This change updates the Medik8s catalog source CI steps. It passes an optional FBC commit SHA from Gangway through ci-operator to the step pod.

When the override is set, the disconnected catalog source step uses it before the existing FBC commit value. The parameter defaults to an empty value, so existing behavior remains unchanged when Gangway does not provide an override.

@openshift-ci
openshift-ci Bot requested review from mshitrit and razo7 August 7, 2026 12:02
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@ugreener, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 17cfc32d-d7db-4846-93a2-f7ad769fdaf6

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1d4b and bf8558c.

📒 Files selected for processing (3)
  • ci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-ref.yaml
  • ci-operator/step-registry/medik8s/disconnected-catalogsource/medik8s-disconnected-catalogsource-commands.sh
  • ci-operator/step-registry/medik8s/disconnected-catalogsource/medik8s-disconnected-catalogsource-ref.yaml

Walkthrough

The medik8s steps now expose MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA. The disconnected-catalogsource command uses this value before the existing FBC_COMMIT_SHA value.

Changes

medik8s FBC commit override

Layer / File(s) Summary
Declare and consume the FBC override
ci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-ref.yaml, ci-operator/step-registry/medik8s/disconnected-catalogsource/medik8s-disconnected-catalogsource-ref.yaml, ci-operator/step-registry/medik8s/disconnected-catalogsource/medik8s-disconnected-catalogsource-commands.sh
The step references declare the prefixed Gangway override with an empty default. The command script selects the override first, then the existing FBC_COMMIT_SHA value.

Estimated code review effort: 2 (Simple) | ~5 minutes

Possibly related PRs

Suggested reviewers: razo7, mshitrit

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only YAML step declarations and a shell variable assignment; no Ginkgo test declarations or test titles are added or modified.
Test Structure And Quality ✅ Passed The pull request changes only two YAML step references and one shell script; it adds or modifies no Ginkgo test code, so these test-quality requirements are not applicable.
Microshift Test Compatibility ✅ Passed The patch changes only YAML step parameters and a shell fallback; it adds no Ginkgo e2e tests or new MicroShift-sensitive API usage.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The commit changes only medik8s step YAML and a shell variable; it adds no Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The commit changes only CI step parameter YAML and FBC environment handling; it adds no deployment, controller, or scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The patch changes two YAML parameter declarations and one Bash variable assignment; it adds no OTE binary entry point or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR changes only step YAML declarations and a shell variable fallback; it adds no Ginkgo e2e tests or new network/external connectivity behavior.
No-Weak-Crypto ✅ Passed The diff only adds an FBC commit SHA parameter and fallback; it introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed The commit only adds an environment parameter and changes SHA selection; its added lines contain no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed The PR adds parameter declarations and an FBC SHA assignment only; it adds no logging. Existing logs expose only the intended commit SHA and registry target, not credentials or customer data.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: declaring MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as a medik8s-catalogsource parameter.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 7, 2026
@ugreener
ugreener force-pushed the fix/declare-fbc-override-param branch from 7f51781 to 9371f14 Compare August 7, 2026 12:10
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

When Gangway triggers a job with pod_spec_options.envs containing
MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA, ci-operator's applyEnvOverrides
stores it in TestEnvironment with the full prefixed key name. However,
generateParams only injects env vars into step pods when they match a
declared step parameter name. Since only FBC_COMMIT_SHA was declared,
the override was silently dropped and the step always resolved the
latest FBC image from Quay instead of using the pinned SHA.

Declaring MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as a step parameter
makes generateParams find the entry and inject it into the step pod.

Applied to both catalogsource steps:
- medik8s-catalogsource (connected): already had the bash fallback
- medik8s-disconnected-catalogsource: added bash fallback + parameter

Co-Authored-By: Claude <noreply@anthropic.com>
@ugreener
ugreener force-pushed the fix/declare-fbc-override-param branch from 9371f14 to bf8558c Compare August 7, 2026 12:20
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@ugreener: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-medik8s-system-tests-main-4.22-upgrade-e2e-far-upgrade-presubmit-aws medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-disconnected-e2e-far-aws-disconnected medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-aws medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-mdr-aws medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-nhc-aws medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-nmo-aws medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-aws-odf medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-aws-efs medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-hypershift-aws-odf medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf medik8s/system-tests presubmit Registry content changed
pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-snr-aws medik8s/system-tests presubmit Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-disconnected-e2e-far-weekly-aws-disconnected N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-nhc-weekly-aws N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.21-disconnected-e2e-sbr-weekly-aws-disconnected-nfs N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-weekly-aws-odf N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-snr-weekly-aws N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-upgrade-e2e-far-upgrade-aws N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-weekly-aws-efs N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-weekly-aws N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-mdr-weekly-aws N/A periodic Registry content changed
periodic-ci-medik8s-system-tests-main-4.22-konflux-e2e-nmo-weekly-aws N/A periodic Registry content changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

@ugreener: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ugreener

ugreener commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse skip

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@ugreener: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Aug 7, 2026
@slintes

slintes commented Aug 7, 2026

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 7, 2026

@weshayutin weshayutin left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/LGTM

@weshayutin

Copy link
Copy Markdown
Contributor

/retest

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: slintes, ugreener, weshayutin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit 881c823 into openshift:main Aug 7, 2026
11 checks passed
TimurMP pushed a commit to TimurMP/release that referenced this pull request Aug 9, 2026
…penshift#83097)

When Gangway triggers a job with pod_spec_options.envs containing
MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA, ci-operator's applyEnvOverrides
stores it in TestEnvironment with the full prefixed key name. However,
generateParams only injects env vars into step pods when they match a
declared step parameter name. Since only FBC_COMMIT_SHA was declared,
the override was silently dropped and the step always resolved the
latest FBC image from Quay instead of using the pinned SHA.

Declaring MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as a step parameter
makes generateParams find the entry and inject it into the step pod.

Applied to both catalogsource steps:
- medik8s-catalogsource (connected): already had the bash fallback
- medik8s-disconnected-catalogsource: added bash fallback + parameter

Co-authored-by: Claude <noreply@anthropic.com>
jzding pushed a commit to jzding/release that referenced this pull request Aug 11, 2026
…penshift#83097)

When Gangway triggers a job with pod_spec_options.envs containing
MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA, ci-operator's applyEnvOverrides
stores it in TestEnvironment with the full prefixed key name. However,
generateParams only injects env vars into step pods when they match a
declared step parameter name. Since only FBC_COMMIT_SHA was declared,
the override was silently dropped and the step always resolved the
latest FBC image from Quay instead of using the pinned SHA.

Declaring MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as a step parameter
makes generateParams find the entry and inject it into the step pod.

Applied to both catalogsource steps:
- medik8s-catalogsource (connected): already had the bash fallback
- medik8s-disconnected-catalogsource: added bash fallback + parameter

Co-authored-by: Claude <noreply@anthropic.com>
davdhacs pushed a commit to davdhacs/release that referenced this pull request Aug 12, 2026
…penshift#83097)

When Gangway triggers a job with pod_spec_options.envs containing
MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA, ci-operator's applyEnvOverrides
stores it in TestEnvironment with the full prefixed key name. However,
generateParams only injects env vars into step pods when they match a
declared step parameter name. Since only FBC_COMMIT_SHA was declared,
the override was silently dropped and the step always resolved the
latest FBC image from Quay instead of using the pinned SHA.

Declaring MULTISTAGE_PARAM_OVERRIDE_FBC_COMMIT_SHA as a step parameter
makes generateParams find the entry and inject it into the step pod.

Applied to both catalogsource steps:
- medik8s-catalogsource (connected): already had the bash fallback
- medik8s-disconnected-catalogsource: added bash fallback + parameter

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants