Skip to content

OCPQE-18444: Add systemd-cat logging to baremetal-lab provisioning steps - #82732

Open
jadhaj wants to merge 1 commit into
openshift:mainfrom
jadhaj:OCPQE-18444-baremetal-lab-systemd-cat-logging
Open

OCPQE-18444: Add systemd-cat logging to baremetal-lab provisioning steps#82732
jadhaj wants to merge 1 commit into
openshift:mainfrom
jadhaj:OCPQE-18444-baremetal-lab-systemd-cat-logging

Conversation

@jadhaj

@jadhaj jadhaj commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Add systemd journal logging via systemd-cat to all baremetal-lab steps in the baremetal-lab-ipi-virtual-media workflow. Each step now logs a notice-level entry tagged with the cluster name to the bastion host's journal on step entry, enabling post-mortem debugging via journalctl -t <cluster-name>.

For steps that previously lacked SSH infrastructure (local config generators, cluster-level oc steps), SSHOPTS and AUX_HOST env var were added to their ref YAMLs and command scripts.

journalctl -t ci-op-lx3ym55b
baremetal-lab-pre-dhcp-conf: Configuring DHCP/PXE
Aug 01 07:20:58 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[106638]: baremetal-lab-ipi-conf-load-balancer: Generating HAProxy configuration
Aug 01 07:21:06 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[106750]: baremetal-lab-pre-load-balancer-run: Starting HAProxy load balancer
Aug 01 07:21:27 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[108041]: baremetal-lab-pre-dns: Configuring DNS records
Aug 01 07:21:36 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[108341]: baremetal-lab-ipi-conf-pxe: Disabling PXE boot
Aug 01 07:21:43 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[108436]: baremetal-lab-ipi-conf-virtual-media: Configuring Redfish virtual media
Aug 01 07:21:52 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[108579]: baremetal-lab-ipi-conf-network-vips: Configuring VIPs
Aug 01 07:22:00 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[108736]: baremetal-lab-upi-conf-network: Configuring cluster networking
Aug 01 07:22:26 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[109173]: baremetal-lab-storage: Configuring disk encryption/mirroring
Aug 01 07:22:35 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[109386]: baremetal-lab-ipi-conf-ntp: Configuring NTP servers
Aug 01 07:22:44 openshift-qe-metal-ci.arm.eng.rdu2.redhat.com ci-op-lx3ym55b[109544]: baremetal-lab-ipi-install: Starting OpenShift IPI installation

Summary by CodeRabbit

  • Added notice-level systemd-cat journal logging to baremetal-lab provisioning, configuration, installation, and cleanup steps.
  • Tagged entries with the cluster name on the bastion host for post-mortem analysis through journalctl -t <cluster-name>.
  • Added SSHOPTS and AUX_HOST support to steps that lacked SSH infrastructure.
  • The PR references Jira issue OCPQE-18444. The issue has no target version, while the target branch expects 5.0.0.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 31, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@jadhaj: This pull request references OCPQE-18444 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Add systemd journal logging via systemd-cat to all baremetal-lab steps in the baremetal-lab-ipi-virtual-media workflow. Each step now logs a notice-level entry tagged with the cluster name to the bastion host's journal on step entry, enabling post-mortem debugging via journalctl -t <cluster-name>.

For steps that previously lacked SSH infrastructure (local config generators, cluster-level oc steps), SSHOPTS and AUX_HOST env var were added to their ref YAMLs and command scripts.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from aleskandro and mhanss July 31, 2026 14:17
@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jadhaj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 31, 2026
@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

Bare-metal lab steps now accept AUX_HOST where required and send cluster-tagged lifecycle messages to the auxiliary host through SSH and systemd-cat before configuration, installation, provisioning, and cleanup operations.

Changes

Bare-metal auxiliary-host lifecycle logging

Layer / File(s) Summary
Configuration entry logging
ci-operator/step-registry/baremetal/lab/{capi,ipi,upi}/..., ci-operator/step-registry/baremetal/lab/nfs-provisioner/...
Configuration steps define AUX_HOST where required, configure SSH options, load the cluster name, and log startup events remotely.
Provisioning operation logging
ci-operator/step-registry/baremetal/lab/ipi/{conf/pxe,install}/..., ci-operator/step-registry/baremetal/lab/pre/..., ci-operator/step-registry/baremetal/lab/storage/...
Provisioning and installation steps log operation starts on the auxiliary host before existing commands run.
Deprovisioning and cleanup logging
ci-operator/step-registry/baremetal/lab/ipi/deprovision/..., ci-operator/step-registry/baremetal/lab/post/...
Cleanup steps log deprovisioning, configuration removal, rollback, node release, and wipe operations.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels: rehearsals-ack

Suggested reviewers: aleskandro, mhanss

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (14 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only shell and YAML step definitions; repository and changed-file searches found no Ginkgo It, Describe, Context, or When test titles.
Test Structure And Quality ✅ Passed Not applicable: HEAD changes only baremetal shell and YAML files; the diff has no Go/Ginkgo test files or It blocks to review.
Microshift Test Compatibility ✅ Passed The PR changes only 23 shell and 7 YAML files; it adds no Go files or Ginkgo declarations, so the MicroShift test-compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR changes only 23 shell scripts and 7 YAML step references; no Ginkgo test constructs or topology-sensitive test logic were added.
Topology-Aware Scheduling Compatibility ✅ Passed The diff adds SSH/systemd-cat logging and AUX_HOST parameters only; it adds no scheduling constraints, replicas, affinity, selectors, tolerations, PDBs, or topology spread rules.
Ote Binary Stdout Contract ✅ Passed The commit changes only 23 shell scripts and 7 YAML files under baremetal/lab; it adds no OTE binary or process-level Go code. Its output is shell/systemd-cat logging.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR changes only shell scripts and YAML step references; repository searches found no Ginkgo test files or It/Describe/Context/When declarations to assess.
No-Weak-Crypto ✅ Passed The 191 added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison logic; existing OpenSSL certificate code is unchanged.
Container-Privileges ✅ Passed Changed files add AUX_HOST and remote SSH logging only; no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or runAs settings were added.
No-Sensitive-Data-In-Logs ✅ Passed All added systemd-cat messages use static event text and the cluster name tag; cluster_name is initialized from NAMESPACE. No passwords, tokens, API keys, PII, or hostnames are logged.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the addition of systemd-cat logging to baremetal-lab provisioning steps.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-ref.yaml`:
- Around line 13-14: Ensure AUX_HOST opt-out behavior is handled before any SSH
invocation: in
ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-ref.yaml lines
13-14 and baremetal-lab-capi-commands.sh lines 17-18, and
ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-ref.yaml
lines 14-15 and baremetal-lab-ipi-conf-bmc-verify-ca-commands.sh lines 20-21,
either require AUX_HOST or skip the prologue SSH path when it is empty so no
root@ SSH target is attempted.

In
`@ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-commands.sh`:
- Around line 8-18: AUX_HOST is optional in the refs but used unconditionally by
both command scripts, causing failures when empty. In
ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-commands.sh
lines 8-18 and
ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-commands.sh
lines 11-21, guard the SSH logging calls so they run only when AUX_HOST is set;
consequently retain the empty AUX_HOST defaults in
ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-ref.yaml
lines 13-14 and
ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-ref.yaml
lines 13-15.

In
`@ci-operator/step-registry/baremetal/lab/ipi/conf/pxe/baremetal-lab-ipi-conf-pxe-commands.sh`:
- Around line 18-19: Move the “Disabling PXE boot” log in
baremetal-lab-ipi-conf-pxe-commands.sh to after the SELF_MANAGED_NETWORK guard,
or replace it with a neutral start message. Apply the same change to the
corresponding log in baremetal-lab-pre-dhcp-conf-commands.sh, ensuring skipped
operations are not logged as started.

In
`@ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-commands.sh`:
- Around line 8-18: Bound every diagnostic journal SSH call with a finite
end-to-end timeout, while keeping timeout failures non-fatal. Update the calls
in
ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-commands.sh
lines 8-18,
ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-commands.sh
lines 8-18,
ci-operator/step-registry/baremetal/lab/nfs-provisioner/baremetal-lab-nfs-provisioner-commands.sh
lines 6-16, and
ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-commands.sh
lines 8-18. Apply the same bounded, non-fatal treatment to the separate journal
calls in
ci-operator/step-registry/baremetal/lab/ipi/conf/pxe/baremetal-lab-ipi-conf-pxe-commands.sh
lines 17-19,
ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh
lines 96-97, and
ci-operator/step-registry/baremetal/lab/pre/dhcp-conf/baremetal-lab-pre-dhcp-conf-commands.sh
lines 18-20, without changing their later 10-minute operations.

In
`@ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-ref.yaml`:
- Around line 13-14: Reject an unset or empty AUX_HOST before any SSH command,
or provide the explicitly documented journal-only fallback. Apply this
consistently in
ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-ref.yaml
(13-14) and its commands.sh (15-18),
ipi/multi-arch/baremetal-lab-ipi-multi-arch-ref.yaml (13-14) and its commands.sh
(15-18), nfs-provisioner/baremetal-lab-nfs-provisioner-commands.sh (13-16), and
upi/conf/network/baremetal-lab-upi-conf-network-ref.yaml (13-14) and its
commands.sh (15-18); ensure the SSH target is never expanded as root@.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 088514a8-a47f-422a-82c8-da325fa2900a

📥 Commits

Reviewing files that changed from the base of the PR and between b476092 and 37a8267.

📒 Files selected for processing (30)
  • ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-commands.sh
  • ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/load-balancer/baremetal-lab-ipi-conf-load-balancer-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/pxe/baremetal-lab-ipi-conf-pxe-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/deprovision/baremetal-lab-ipi-deprovision-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-ref.yaml
  • ci-operator/step-registry/baremetal/lab/nfs-provisioner/baremetal-lab-nfs-provisioner-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/dhcp-pxe-conf/baremetal-lab-post-dhcp-pxe-conf-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/dns/baremetal-lab-post-dns-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/firewall/baremetal-lab-post-firewall-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/load-balancer/baremetal-lab-post-load-balancer-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/provisioning-network/baremetal-lab-post-provisioning-network-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/release-nodes/baremetal-lab-post-release-nodes-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/wipe/baremetal-lab-post-wipe-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/dhcp-conf/baremetal-lab-pre-dhcp-conf-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/dns/baremetal-lab-pre-dns-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh
  • ci-operator/step-registry/baremetal/lab/storage/baremetal-lab-storage-commands.sh
  • ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-commands.sh
  • ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-ref.yaml

@jadhaj

jadhaj commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-ipi-ovn-vmedia-disk-encryption-f7

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@jadhaj: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

Add systemd journal logging via systemd-cat to all baremetal-lab steps
in the baremetal-lab-ipi-virtual-media workflow. Each step now logs a
notice-level entry tagged with the cluster name to the bastion host's
journal on step entry, enabling post-mortem debugging via
`journalctl -t <cluster-name>`.

For steps that previously lacked SSH infrastructure (local config
generators, cluster-level oc steps), SSHOPTS and AUX_HOST env var
were added to their ref YAMLs and command scripts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@jadhaj
jadhaj force-pushed the OCPQE-18444-baremetal-lab-systemd-cat-logging branch from 37a8267 to 018a39d Compare July 31, 2026 19:08
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@jadhaj: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-lvm-operator-release-management-zstream-4.21-e2e-baremetalds-sno-dualstack-qe-integration-tests openshift/lvm-operator presubmit Registry content changed
pull-ci-openshift-lvm-operator-release-management-zstream-4.14-e2e-baremetalds-sno-dualstack-qe-integration-tests openshift/lvm-operator presubmit Registry content changed
pull-ci-openshift-lvm-operator-release-management-zstream-4.20-e2e-baremetalds-sno-dualstack-qe-integration-tests openshift/lvm-operator presubmit Registry content changed
pull-ci-openshift-lvm-operator-release-management-zstream-4.16-e2e-baremetalds-sno-dualstack-qe-integration-tests openshift/lvm-operator presubmit Registry content changed
pull-ci-openshift-lvm-operator-release-management-zstream-4.19-e2e-baremetalds-sno-dualstack-qe-integration-tests openshift/lvm-operator presubmit Registry content changed
pull-ci-openshift-lvm-operator-release-management-zstream-4.18-e2e-baremetalds-sno-dualstack-qe-integration-tests openshift/lvm-operator presubmit Registry content changed
pull-ci-openshift-eng-agent-qe-infra-extended-support-4.12-amd64-nightly-abi-bm-sno-agent-ipv4-static-connected-fips openshift-eng/agent-qe-infra presubmit Registry content changed
pull-ci-openshift-eng-agent-qe-infra-extended-support-4.14-amd64-nightly-abi-bm-sno-agent-ipv4-static-connected-fips openshift-eng/agent-qe-infra presubmit Registry content changed
pull-ci-openshift-eng-agent-qe-infra-extended-support-4.16-amd64-nightly-abi-bm-sno-agent-ipv4-static-connected-fips openshift-eng/agent-qe-infra presubmit Registry content changed
pull-ci-openshift-power-monitoring-power-monitoring-operator-v1alpha1-baremetal-power-monitoring-operator-e2e-baremetal-amd64 openshift-power-monitoring/power-monitoring-operator presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-main-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-5.1-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-5.0-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.23-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.22-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.21-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.20-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.19-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.18-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.17-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.16-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.15-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-openshift-tests-private-release-4.14-debug-disasterrecovery-metal-upi openshift/openshift-tests-private presubmit Registry content changed
pull-ci-openshift-eng-ocp-qe-perfscale-ci-main-4.22-nightly-node-density-heavy-baremetal-3nodes openshift-eng/ocp-qe-perfscale-ci presubmit Registry content changed
pull-ci-openshift-eng-ocp-qe-perfscale-ci-main-4.21-nightly-node-density-heavy-baremetal-3nodes openshift-eng/ocp-qe-perfscale-ci presubmit Registry content changed

A total of 659 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/baremetal/lab/post/firewall/baremetal-lab-post-firewall-commands.sh`:
- Around line 19-27: Update the SSH invocation in the disconnected firewall
deprovisioning path to pass CLUSTER_NAME through stdin, following the
argument/stdin pattern used by the DNS/load-balancer post steps. Remove the
direct interpolation of CLUSTER_NAME into the remote single-quoted command while
preserving the existing systemd-cat logging behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 7ba1db35-eb08-4242-b968-ca483aed49a3

📥 Commits

Reviewing files that changed from the base of the PR and between 37a8267 and 018a39d.

📒 Files selected for processing (30)
  • ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-commands.sh
  • ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/load-balancer/baremetal-lab-ipi-conf-load-balancer-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/pxe/baremetal-lab-ipi-conf-pxe-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/deprovision/baremetal-lab-ipi-deprovision-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-ref.yaml
  • ci-operator/step-registry/baremetal/lab/nfs-provisioner/baremetal-lab-nfs-provisioner-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/dhcp-pxe-conf/baremetal-lab-post-dhcp-pxe-conf-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/dns/baremetal-lab-post-dns-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/firewall/baremetal-lab-post-firewall-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/load-balancer/baremetal-lab-post-load-balancer-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/provisioning-network/baremetal-lab-post-provisioning-network-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/release-nodes/baremetal-lab-post-release-nodes-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/wipe/baremetal-lab-post-wipe-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/dhcp-conf/baremetal-lab-pre-dhcp-conf-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/dns/baremetal-lab-pre-dns-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh
  • ci-operator/step-registry/baremetal/lab/storage/baremetal-lab-storage-commands.sh
  • ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-commands.sh
  • ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-ref.yaml
🚧 Files skipped from review as they are similar to previous changes (29)
  • ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-ref.yaml
  • ci-operator/step-registry/baremetal/lab/post/load-balancer/baremetal-lab-post-load-balancer-commands.sh
  • ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/dns/baremetal-lab-pre-dns-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/dns/baremetal-lab-post-dns-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-ref.yaml
  • ci-operator/step-registry/baremetal/lab/post/dhcp-pxe-conf/baremetal-lab-post-dhcp-pxe-conf-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/deprovision/baremetal-lab-ipi-deprovision-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-ref.yaml
  • ci-operator/step-registry/baremetal/lab/upi/conf/network/baremetal-lab-upi-conf-network-ref.yaml
  • ci-operator/step-registry/baremetal/lab/nfs-provisioner/baremetal-lab-nfs-provisioner-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/dhcp-conf/baremetal-lab-pre-dhcp-conf-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/ntp/baremetal-lab-ipi-conf-ntp-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/release-nodes/baremetal-lab-post-release-nodes-commands.sh
  • ci-operator/step-registry/baremetal/lab/storage/baremetal-lab-storage-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/provisioning-network/baremetal-lab-post-provisioning-network-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/virtual-media/baremetal-lab-ipi-conf-virtual-media-commands.sh
  • ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/network/vips/baremetal-lab-ipi-conf-network-vips-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/pxe/baremetal-lab-ipi-conf-pxe-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/conf/load-balancer/baremetal-lab-ipi-conf-load-balancer-commands.sh
  • ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-ref.yaml
  • ci-operator/step-registry/baremetal/lab/ipi/conf/bmc-verify-ca/baremetal-lab-ipi-conf-bmc-verify-ca-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/multi-arch/baremetal-lab-ipi-multi-arch-commands.sh
  • ci-operator/step-registry/baremetal/lab/capi/baremetal-lab-capi-commands.sh
  • ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh
  • ci-operator/step-registry/baremetal/lab/post/wipe/baremetal-lab-post-wipe-commands.sh

Comment on lines +19 to +27
CLUSTER_NAME=$(<"${SHARED_DIR}/cluster_name")

if [ x"${DISCONNECTED}" != x"true" ]; then
echo 'Skipping firewall configuration deprovisioning as not in a disconnected environment'
exit 0
fi

timeout 10s ssh "${SSHOPTS[@]}" "root@${AUX_HOST}" \
"systemd-cat -t '${CLUSTER_NAME}' -p5 echo 'baremetal-lab-post-firewall: Deprovisioning firewall rules'" || true

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 6 'cluster_name|CLUSTER_NAME' ci-operator/step-registry/baremetal

Repository: openshift/release

Length of output: 50374


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== candidate cluster_name producers =="
rg -n -C 3 'cluster_name|metadata:|name:|CLUSTER_NAME|UNIQUE_HASH' ci-operator/step-registry/baremetal/lab -g '*.sh' | sed -n '1,240p'

echo "== target file =="
cat -n ci-operator/step-registry/baremetal/lab/post/firewall/baremetal-lab-post-firewall-commands.sh | sed -n '1,80p'

echo "== quoting exploit simulation =="
python3 - <<'PY'
quote = r"${CLUSTER_NAME}"
payloads = ["foo", "foo'\\);date\\;\\#", "foo')\\]"}
for p in payloads:
    outer = f"ssh root@aux \"systemd-cat -t '{quote}' -p5 echo 'done'\" ;"
    print(p)
    print(("[" + outer + "]").replace("$CLUSTER_NAME", p))
PY

Repository: openshift/release

Length of output: 33179


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== all cluster_name writes =="
rg -n -C 4 'cluster_name|metadata\.name\s*=|^\s*echo\s+".*cluster_name|UNIQUE_HASH|sha256sum|base_domain|JOB_NAME|PULL_NUMBER|NAMESPACE' ci-operator/step-registry/baremetal -g '*.sh' 2>/tmp/rg-error.txt | sed -n '1,300p' || true

echo "== cluster_name reads around ssh command interpolation =="
rg -n 'CLUSTER_NAME=\$\(\<"\$\{SHARED_DIR\}/cluster_name"\)|systemd-cat -t '"'"'\${CLUSTER_NAME}'"'"'\|CLUSTER_NAME="\$\(<"\$\{SHARED_DIR\}/cluster_name"\)"' ci-operator/step-registry/baremetal -g '*.sh'

Repository: openshift/release

Length of output: 42800


Pass CLUSTER_NAME through stdin before using it in the SSH command.

SHARED_DIR/cluster_name can contain a single quote in this flow, and line 27 inserts it directly into a command executed as root on AUX_HOST. That quote closes the single-quoted tag argument and lets the remaining text run as shell syntax. Use the same argument/stdin pattern as the DNS/load-balancer post steps instead.

🧰 Tools
🪛 Shellcheck (0.11.0)

[style] 21-21: Avoid x-prefix in comparisons as it no longer serves a purpose.

(SC2268)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/baremetal/lab/post/firewall/baremetal-lab-post-firewall-commands.sh`
around lines 19 - 27, Update the SSH invocation in the disconnected firewall
deprovisioning path to pass CLUSTER_NAME through stdin, following the
argument/stdin pattern used by the DNS/load-balancer post steps. Remove the
direct interpolation of CLUSTER_NAME into the remote single-quoted command while
preserving the existing systemd-cat logging behavior.

@jadhaj

jadhaj commented Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-ipi-ovn-vmedia-disk-encryption-f7

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@jadhaj: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

@jadhaj: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-ipi-ovn-vmedia-disk-encryption-f7 018a39d link unknown /pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-ipi-ovn-vmedia-disk-encryption-f7

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants