Skip to content

ROSAENG-62716: add never-cron OSDFM int-canary gating job with backplane Hive access - #82743

Open
anfranci14 wants to merge 4 commits into
openshift:mainfrom
anfranci14:ROSAENG-62716-add-osdfm-int-canary-gating
Open

ROSAENG-62716: add never-cron OSDFM int-canary gating job with backplane Hive access#82743
anfranci14 wants to merge 4 commits into
openshift:mainfrom
anfranci14:ROSAENG-62716-add-osdfm-int-canary-gating

Conversation

@anfranci14

@anfranci14 anfranci14 commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add never-cron Prow periodic 'ocm-fvt-gating-osdfm-integration-canary' for OSDFM gating FVT ('osdfm-basic-integration', sector canary) so Gangway can trigger it after int-canary deploy.
  • Pin to 'build05' with 'intranet' + 'nested-podman'; Slack '#rosa-prow-info' on success/failure/error.
  • Extend 'rosa-e2e-ocm-fvt' step with opt-in Hive access via ocm-backplane when 'OCM_FVT_USE_BACKPLANE=true' (default false — no impact on Jenkins/Tekton or other Prow jobs).
    Job name (Gangway 'JOB_NAME'):
    'periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary'

Notes

  • Does not wire app-interface SaaS/promotion (cutover is a follow-up).
  • Rehearsals do not publish OSDFM promotion channels.

Summary by CodeRabbit

  • Adds a never-cron OSDFM integration-canary gating job for the rosa-e2e-ocm-fvt CI workflow.
  • Configures Gangway-triggered execution after int-canary deployment on build05 with intranet and nested-podman.
  • Reports success, failure, and error states to #rosa-prow-info and enforces a four-hour timeout.
  • Adds optional Hive access through ocm-backplane when OCM_FVT_USE_BACKPLANE=true.
  • Installs and authenticates ocm, ocm-backplane, and oc to generate a backplane kubeconfig.
  • Uses the backplane kubeconfig in preference to the Vault-provided kubeconfig and removes it during cleanup.
  • Keeps backplane access disabled by default.
  • Does not add app-interface SaaS, promotion wiring, or OSDFM promotion channel publication.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 31, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@anfranci14: This pull request references ROSAENG-62716 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Add never-cron Prow periodic 'ocm-fvt-gating-osdfm-integration-canary' for OSDFM gating FVT ('osdfm-basic-integration', sector canary) so Gangway can trigger it after int-canary deploy.
  • Pin to 'build05' with 'intranet' + 'nested-podman'; Slack '#rosa-prow-info' on success/failure/error.
  • Extend 'rosa-e2e-ocm-fvt' step with opt-in Hive access via ocm-backplane when 'OCM_FVT_USE_BACKPLANE=true' (default false — no impact on Jenkins/Tekton or other Prow jobs).
    Job name (Gangway 'JOB_NAME'):
    'periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary'

Notes

  • Does not wire app-interface SaaS/promotion (cutover is a follow-up).
  • Rehearsals do not publish OSDFM promotion channels.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 05aeb224-6d4d-4d14-ab2f-c23d44957a2c

📥 Commits

Reviewing files that changed from the base of the PR and between ed79a35 and e79131b.

📒 Files selected for processing (1)
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
🚧 Files skipped from review as they are similar to previous changes (1)
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh

Walkthrough

The change adds a canary OCM FVT Prow job and optional ocm-backplane integration. The integration authenticates to Hive, generates a kubeconfig, passes it to the test container, and preserves the OCM FVT result code.

Changes

ROSA OCM FVT integration

Layer / File(s) Summary
Backplane configuration contract
ci-operator/step-registry/rosa/e2e/ocm-fvt/...
Adds optional settings for backplane enablement, cluster credentials, OCM endpoints, proxy configuration, elevation audit reasons, and the service credentials mount.
Backplane kubeconfig execution flow
ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
Authenticates with ocm-backplane, generates and mounts a Hive kubeconfig, applies backplane environment settings, gives the generated kubeconfig precedence, cleans up temporary files, and returns the captured test status.
Canary job wiring
ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-integration.yaml
Adds the canary job with canary environment settings, Rosa Prow reporting, required capabilities, the long-running OCM FVT reference, and a four-hour timeout.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: rehearsals-ack

Suggested reviewers: bmeng, jfrazierredhat

Sequence Diagram(s)

sequenceDiagram
  participant ProwCanaryJob
  participant OcmFvtCommands
  participant OcmBackplane
  participant OcmFvtContainer
  ProwCanaryJob->>OcmFvtCommands: Provide backplane settings
  OcmFvtCommands->>OcmBackplane: Authenticate and elevate cluster access
  OcmBackplane-->>OcmFvtCommands: Generate Hive kubeconfig
  OcmFvtCommands->>OcmFvtContainer: Mount kubeconfig and CLI environment
  OcmFvtContainer-->>OcmFvtCommands: Return OCM FVT result
  OcmFvtCommands-->>ProwCanaryJob: Exit with captured result code
Loading

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error With inherited xtrace, added backplane assignments and printf log squid.corp.redhat.com; the related script explicitly disables xtrace to prevent internal hostnames in logs. Disable xtrace around all backplane URL/credential setup, including proxy config, then restore the prior tracing state only after those commands complete.
Ipv6 And Disconnected Network Test Compatibility ⚠️ Warning The new canary FVT job enables backplane access and downloads CLIs from GitHub and mirror.openshift.com; it also contacts api.openshift.com, requiring external connectivity. Run periodic-ci-openshift-release-master-nightly-4.22-e2e-metal-ipi-ovn-ipv6; if access cannot be adapted for disconnected clusters, add [Skipped:Disconnected].
✅ Passed checks (13 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the new OSDFM integration-canary gating job and its backplane Hive access.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes CI YAML and a shell wrapper only; they add no Ginkgo It, Describe, Context, or When titles, dynamic or otherwise.
Test Structure And Quality ✅ Passed Not applicable: the PR changes only CI YAML and a shell step; no Ginkgo test files, It blocks, assertions, or Eventually/Consistently calls were added or changed.
Microshift Test Compatibility ✅ Passed The PR changes only CI configuration and shell/ref files; the base-to-HEAD diff adds no Go or Ginkgo e2e tests, so MicroShift compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR changes only CI YAML and shell files; the complete diff adds no Ginkgo e2e tests or multi-node test logic, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes only CI job/step YAML and a shell script; the full diff adds no deployment, operator, controller, or topology scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The PR changes only YAML and a shell wrapper; no Go or OTE binary source changed. The shell invokes external ocmtest, so no process-level OTE stdout violation is introduced.
No-Weak-Crypto ✅ Passed The complete PR patch contains no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto implementation, or secret-content comparison; credential checks only test for empty values.
Container-Privileges ✅ Passed PR-added manifests contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root-user, or allowPrivilegeEscalation settings; nested-podman uses the existing UID 1000 CI setup.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from bmeng and jfrazierRedHat July 31, 2026 16:27

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh (1)

104-109: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Combine repeated redirects per shellcheck SC2129.

Shellcheck flags the sequence of individual >> redirects into podman_env_file. Group them into a single redirected block for clarity.

♻️ Proposed refactor
-  echo "PATH=/usr/local/backplane-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" >> "${podman_env_file}"
-  echo "HOME=/home/ci-user" >> "${podman_env_file}"
-  echo "HTTPS_PROXY=${backplane_proxy_url}" >> "${podman_env_file}"
-  echo "HTTP_PROXY=${backplane_proxy_url}" >> "${podman_env_file}"
-  echo "https_proxy=${backplane_proxy_url}" >> "${podman_env_file}"
-  echo "http_proxy=${backplane_proxy_url}" >> "${podman_env_file}"
+  {
+    echo "PATH=/usr/local/backplane-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    echo "HOME=/home/ci-user"
+    echo "HTTPS_PROXY=${backplane_proxy_url}"
+    echo "HTTP_PROXY=${backplane_proxy_url}"
+    echo "https_proxy=${backplane_proxy_url}"
+    echo "http_proxy=${backplane_proxy_url}"
+  } >> "${podman_env_file}"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`
around lines 104 - 109, Group the environment-variable echo commands in the
podman environment setup into a single block redirected once to podman_env_file,
preserving the existing PATH, HOME, proxy variable names, and values while
eliminating the repeated >> redirects flagged by ShellCheck SC2129.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`:
- Around line 27-32: Wrap the credential file reads assigning
backplane_client_id and backplane_client_secret, the ocm login invocation, and
the kubeconfig content assignment in minimal tracing-disabled scopes matching
the existing patterns in this script. Add clear comments at each
disabled-tracing block, ensure tracing is restored immediately afterward, and
use ${SHARED_DIR} for step data rather than printing secret material.
- Around line 39-43: Declare OCM_FVT_BACKPLANE_OCM_URL,
OCM_FVT_BACKPLANE_PROXY_URL, and OCM_FVT_BACKPLANE_ELEVATE_REASON as env
parameters in
ci-operator/step-registry/rosa/e2e/ocm-fvt/longrunning/rosa-e2e-ocm-fvt-longrunning-ref.yaml
lines 53-69 and
ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-ref.yaml lines
50-66, using the matching defaults and documentation consistent with the
existing backplane parameters; the command script’s corresponding assignments
require no direct change.
- Around line 69-82: Update the kubeconfig setup around ocm-backplane elevate
and the generated hive_kubeconfig so exec-plugin calls can recover after the
20-minute elevation cache expires. Add a non-interactive re-elevation path,
particularly for the 12-hour step, that supplies the configured
backplane_elevate_reason when no valid reason remains; preserve the existing
login, kubeconfig rewriting, and read-only ~/.config compatibility.

---

Nitpick comments:
In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`:
- Around line 104-109: Group the environment-variable echo commands in the
podman environment setup into a single block redirected once to podman_env_file,
preserving the existing PATH, HOME, proxy variable names, and values while
eliminating the repeated >> redirects flagged by ShellCheck SC2129.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d70a3769-6a4b-4b7f-bacd-36903c2b140f

📥 Commits

Reviewing files that changed from the base of the PR and between 4313230 and 39b4429.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main-periodics.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (4)
  • ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-integration.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/longrunning/rosa-e2e-ocm-fvt-longrunning-ref.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-ref.yaml

Comment thread ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh Outdated
@anfranci14
anfranci14 force-pushed the ROSAENG-62716-add-osdfm-int-canary-gating branch from 39b4429 to adbf211 Compare July 31, 2026 17:39

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`:
- Around line 52-64: Update both CLI download curl calls in the installation
flow for ocm and ocm-backplane to use HTTP failure handling and bounded
connection and total timeouts. Add --fail, --connect-timeout, and --max-time
with appropriate values before the downloaded artifacts are processed,
preserving the existing output paths and extraction flow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: e4e36fc5-4a26-4c9e-b187-e12c4715d731

📥 Commits

Reviewing files that changed from the base of the PR and between 39b4429 and adbf211.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main-periodics.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (4)
  • ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-integration.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/longrunning/rosa-e2e-ocm-fvt-longrunning-ref.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-ref.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-ref.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/longrunning/rosa-e2e-ocm-fvt-longrunning-ref.yaml
  • ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-integration.yaml

Comment on lines +52 to +64
echo "Installing ocm CLI into ${backplane_bin_dir}"
curl -sSL -o "${backplane_bin_dir}/ocm" \
"https://github.com/openshift-online/ocm-cli/releases/download/v1.0.15/ocm-linux-amd64"
chmod 0755 "${backplane_bin_dir}/ocm"

echo "Installing ocm-backplane CLI into ${backplane_bin_dir}"
bp_ver="0.11.0"
bp_tar="$(mktemp /tmp/ocm-backplane.XXXXXX.tar.gz)"
curl -sSL -o "${bp_tar}" \
"https://github.com/openshift/backplane-cli/releases/download/v${bp_ver}/ocm-backplane_${bp_ver}_Linux_x86_64.tar.gz"
tar -xzf "${bp_tar}" -C "${backplane_bin_dir}" ocm-backplane
chmod 0755 "${backplane_bin_dir}/ocm-backplane"
rm -f "${bp_tar}"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the relevant command script and the repo-wide curl patterns without executing repository code.
if [ -f ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh ]; then
  echo "== relevant files =="
  wc -l ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
  echo
  echo "== lines 1-90 =="
  sed -n '1,90p' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh | nl -ba
  echo
  echo "== shellcheck option parse behavior =="
  if command -v bash >/dev/null; then
    bash --noedit --version | head -1
  fi
  sed -n '145,155p' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh | nl -ba
else
  echo "target file not found"
fi

echo
echo "== other ci-operator step registry curl examples =="
rg -n "curl -[a-zA-Z]*(?:-f|--fail|[^a-zA-Z][^a-zA-Z]*(?:-f|--fail))?|github\.com/.*/releases/download" ci-operator/step-registry -g '*.sh' | head -120

Repository: openshift/release

Length of output: 311


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Programmatic probe of bash errexit behavior around curl commands without network or execution.
# This reads the command strings only and models curl's documented non-zero-exit absence for HTTP errors.
python3 - <<'PY'
from pathlib import Path
p = Path('ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh')
if not p.exists():
    print('file missing')
    raise SystemExit(0)
s = p.read_text()
for label in ['ocm CLI', 'ocm-backplane CLI']:
    start = s.index(label)
    for i, line in enumerate(s[start:start+700].splitlines(), 1):
        if ('backplane_bin_dir' in line and 'curl' in line) or (label == 'ocm-backplane CLI' and 'bp_tar' in line and 'curl' in line):
            # print only original source line around curl
            src = s.splitlines()[start+s[:len(s)-len(s[start:])*0].count('\n')]

Repository: openshift/release

Length of output: 352


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Programmatic probe of bash errexit behavior around curl commands without network or execution.
python3 - <<'PY'
import re
from pathlib import Path

p = Path('ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh')
if not p.exists():
    print('file missing')
    raise SystemExit(0)

lines = list(p.read_text().splitlines())
for i, line in enumerate(lines, 1):
    if re.search(r'\bcurl\b', line):
        print(f"{i}: {line}")
        # Print nearby errexit options for state context.
        for j in range(max(1, i-10), min(len(lines), i+15)+1):
            if re.search(r'\b(set\s+.*?)\b|trap|chmod 0755', lines[j-1]):
                print(f"  -> {j}: {lines[j-1]}")
PY

Repository: openshift/release

Length of output: 470


🏁 Script executed:

#!/bin/sh
set -euo pipefail

echo "== shell tool availability =="
command -v sed || true
command -v grep || true
command -v python3 || true
command -v awk || true

echo
echo "== relevant file imports/options and curl download commands =="
sed -n '1,90p' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh

echo
echo "== all curl commands in target =="
grep -n 'curl' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh || true

echo
echo "== grep for curl fail/timeout/ssh in step registry =="
grep -EIn '\bcurl\b|gh|ssh|ocm login|backplane' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh || true

Repository: openshift/release

Length of output: 7952


🌐 Web query:

curl --fail option HTTP response non-2xx exit code documentation

💡 Result:

The --fail (or -f) command-line option for curl instructs it to fail silently when an HTTP server returns an error response code (400 or greater), rather than proceeding to output the response body as it does by default [1][2][3]. When this option is used and an HTTP server returns an error code of 400 or higher, curl will exit with the specific error code 22 [1][3][4]. Key details regarding this behavior include: 1. No Body Output: In the event of such a failure, curl will prevent the output of the server's error document, which often contains HTML text describing the error [2][3][5]. 2. Limitations: This mechanism is not fail-safe. Certain authentication-related responses, such as 401 (Unauthorized) and 407 (Proxy Authentication Required), may still pass through without triggering the error exit code, depending on how the server responds and how curl processes the authentication flow [1][2][6]. 3. Alternative Options: - --fail-with-body: Introduced as an alternative to --fail, this option also triggers an exit code of 22 for HTTP errors (400+) but allows the response body (the server's error message) to be output and saved [1][3][5]. - --fail-early: This is a distinct option that causes curl to exit immediately upon the first transfer error encountered, regardless of whether that error is related to an HTTP status code [1][2][7]. For scripts, --fail is a primary method for ensuring that HTTP errors are correctly surfaced as process exit codes, allowing for standard error handling [1][2][4].

Citations:


🌐 Web query:

curl connect-timeout max-time documentation

💡 Result:

In curl, --connect-timeout and --max-time serve distinct purposes for managing operation duration [1][2][3]. --connect-timeout This option sets the maximum time, in seconds, that curl is allowed to spend during the connection phase [4][5][6]. The connection phase is considered complete once DNS lookups and any required TCP, TLS, or QUIC handshakes are finished [2][4][6]. If the connection is not established within this time, curl will exit with a timeout error (exit code 28) [2][3][6]. --max-time (-m) This option sets the maximum total time, in seconds, that the entire curl operation is allowed to take [2][3][7]. When this limit is reached, curl will terminate the operation immediately, regardless of what is happening (e.g., even if it is in the middle of transferring data) [2][3]. Like the connection timeout, exceeding this limit results in a timeout exit code of 28 [2][3]. Key similarities: Both options accept decimal values for sub-second precision (e.g., 0.5 for 500 milliseconds) [1][2][7][4]. When specifying decimals, you must always use a dot (.) as the separator, regardless of your system's locale settings [7][4][6]. If these flags are provided multiple times in a command, the last provided value is used [4][5][6]. While --connect-timeout only restricts the initial setup, --max-time provides a hard limit on the lifetime of the request [1][2][3]. If you use both, the --connect-timeout will effectively act as a subset of the --max-time constraint [2][3].

Citations:


Add HTTP failure handling and a timeout to the CLI download curl calls.

Add --fail to both downloads so HTTP 4xx/5xx responses exit with a clear failure before the artifacts become usable. Add --connect-timeout and --max-time so unresponsive GitHub downloads cannot hang the job.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`
around lines 52 - 64, Update both CLI download curl calls in the installation
flow for ocm and ocm-backplane to use HTTP failure handling and bounded
connection and total timeouts. Add --fail, --connect-timeout, and --max-time
with appropriate values before the downloaded artifacts are processed,
preserving the existing output paths and extraction flow.

@deepsm007

Copy link
Copy Markdown
Contributor

/pj-rehearse network-access-allowed

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@deepsm007: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@anfranci14

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@anfranci14: job(s): periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary either don't exist or were not found to be affected, and cannot be rehearsed

@dustman9000

Copy link
Copy Markdown
Member

/approve

@anfranci14

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anfranci14, dustman9000

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 31, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@anfranci14: job(s): periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary either don't exist or were not found to be affected, and cannot be rehearsed

@anfranci14

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@anfranci14
anfranci14 force-pushed the ROSAENG-62716-add-osdfm-int-canary-gating branch from adbf211 to ed79a35 Compare July 31, 2026 21:12

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh (1)

119-124: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Combine the consecutive >> redirects into one block.

Shellcheck flags this pattern (SC2129). Combine the six appends into a single { ...; } >> "${podman_env_file}" block for a single redirect instead of six.

♻️ Proposed refactor
-  echo "PATH=/usr/local/backplane-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" >> "${podman_env_file}"
-  echo "HOME=/home/ci-user" >> "${podman_env_file}"
-  echo "HTTPS_PROXY=${backplane_proxy_url}" >> "${podman_env_file}"
-  echo "HTTP_PROXY=${backplane_proxy_url}" >> "${podman_env_file}"
-  echo "https_proxy=${backplane_proxy_url}" >> "${podman_env_file}"
-  echo "http_proxy=${backplane_proxy_url}" >> "${podman_env_file}"
+  {
+    echo "PATH=/usr/local/backplane-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    echo "HOME=/home/ci-user"
+    echo "HTTPS_PROXY=${backplane_proxy_url}"
+    echo "HTTP_PROXY=${backplane_proxy_url}"
+    echo "https_proxy=${backplane_proxy_url}"
+    echo "http_proxy=${backplane_proxy_url}"
+  } >> "${podman_env_file}"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`
around lines 119 - 124, Update the environment-variable writes near the podman
environment setup to group all six echo commands in a single shell block
redirected once to podman_env_file, preserving their order and values while
eliminating the consecutive append redirects flagged by ShellCheck SC2129.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh`:
- Around line 119-124: Update the environment-variable writes near the podman
environment setup to group all six echo commands in a single shell block
redirected once to podman_env_file, preserving their order and values while
eliminating the consecutive append redirects flagged by ShellCheck SC2129.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: e3bdd645-4df0-4cc1-b210-2871cdcb63ea

📥 Commits

Reviewing files that changed from the base of the PR and between adbf211 and ed79a35.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main-periodics.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (4)
  • ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-integration.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/longrunning/rosa-e2e-ocm-fvt-longrunning-ref.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-ref.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
  • ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-integration.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-ref.yaml
  • ci-operator/step-registry/rosa/e2e/ocm-fvt/longrunning/rosa-e2e-ocm-fvt-longrunning-ref.yaml

@deepsm007

Copy link
Copy Markdown
Contributor

/pj-rehearse network-access-allowed

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@deepsm007: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dustman9000

Copy link
Copy Markdown
Member

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dustman9000: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@anfranci14: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-classic-staging-ocm-fvt-periodic-cs-rosa-sts-shared-vpc-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-periodic-osdfm-sc-autoscaling-integration N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-shared-vpc-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-upgrade-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osd-aws-integration-ocm-fvt-periodic-cs-osd-ccs-aws-ad-integration-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-hcp-e2e-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-classic-staging-ocm-fvt-periodic-cs-rosa-sts-upgrade-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-sanity-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-classic-staging-ocm-fvt-periodic-cs-rosa-ad-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-access-request-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-y-upgrade-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osd-gcp-staging-ocm-fvt-periodic-cs-osd-ccs-gcp-marketplace-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-amd64-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-periodic-osdfm-basic-periodic-stage N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-pl-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-autonode-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-zero-egress-upgrade-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-classic-integration-ocm-fvt-periodic-cs-rosa-sts-ad-integration-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-classic-staging-ocm-fvt-periodic-cs-rosa-sts-ad-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osd-gcp-staging-ocm-fvt-periodic-cs-osd-ccs-gcp-ad-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-amd64-upgrade-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-integration-ocm-fvt-periodic-cs-rosa-hcp-ad-integration-regional-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-rosa-hcp-staging-ocm-fvt-periodic-cs-rosa-hcp-arm-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osd-gcp-staging-ocm-fvt-periodic-cs-osd-gcp-root-disk-staging-main N/A periodic Registry content changed
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-periodic-osdfm-basic-periodic-integration N/A periodic Registry content changed

A total of 39 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here
The following jobs are not rehearsable without the network-access-rehearsals-ok, and approved labels present on this PR. This is due to the restrict_network_access field being set to false. The network-access-rehearsals-ok label can be added by any openshift org member other than the PR's author by commenting: /pj-rehearse network-access-allowed:

Test name
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-ci

openshift-ci Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

@anfranci14: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary ed79a35 link unknown /pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants