OTA-1585: test: Include the compressed tests binary in the CVO container image #1236

DavidHurta · 2025-09-25T15:35:18Z

To make the binary discoverable to the outside world.

The following step is to register the binary in the origin repository to make the origin machine aware of the CVO tests extension.

openshift-ci-robot · 2025-09-25T15:35:23Z

@DavidHurta: This pull request references OTA-1585 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

To make the binary discoverable to the outside world.

The following step is to register the binary in the origin repository to make the origin machine aware of the CVO tests extension.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-09-25T15:35:42Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

DavidHurta · 2025-09-25T15:36:07Z

/test images

DavidHurta · 2025-09-25T15:37:10Z

Blocked by #1235.

DavidHurta · 2025-10-27T12:52:30Z

/test e2e-agnostic-ovn

DavidHurta · 2025-10-27T16:41:37Z

The e2e job failed on:

First run:
- : [sig-network][Feature:EgressFirewall] egressFirewall should have no impact outside its namespace [Suite:openshift/conformance/parallel]
Second run:
- : [sig-storage] PersistentVolumes NFS with Single PV - PVC pairs create a PV and a pre-bound PVC: test write access [Suite:openshift/conformance/parallel] [Suite:k8s]

This PR adds a new file, which is not executed anywhere, to the CVO's container image. Not likely that the flaky failures are caused by the PR.

/override ci/prow/e2e-agnostic-ovn

openshift-ci · 2025-10-27T16:45:17Z

@DavidHurta: Overrode contexts on behalf of DavidHurta: ci/prow/e2e-agnostic-ovn

In response to this:

The e2e job failed on:

First run:

: [sig-network][Feature:EgressFirewall] egressFirewall should have no impact outside its namespace [Suite:openshift/conformance/parallel]

Second run:

: [sig-storage] PersistentVolumes NFS with Single PV - PVC pairs create a PV and a pre-bound PVC: test write access [Suite:openshift/conformance/parallel] [Suite:k8s]

This PR adds a new file, which is not executed anywhere, to the CVO's container image. Not likely that the flaky failures are caused by the PR.

/override ci/prow/e2e-agnostic-ovn

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

DavidHurta · 2025-10-27T17:31:45Z

/verified by @DavidHurta

The changes affect only tests. The changes are not visible in the CI nor in a cluster as of the moment. I have tested the changes in combination with other relevant PRs using testwith command as mentioned in an associated PR. I believe this is sufficient.

This PR could cause some security scanning alerting to go off. However, such a change has already been done via other teams, so I presume nothing like that will happen.

openshift-ci-robot · 2025-10-27T17:31:56Z

@DavidHurta: This PR has been marked as verified by @DavidHurta.

In response to this:

/verified by @DavidHurta

The changes affect only tests. The changes are not visible in the CI nor in a cluster as of the moment. I have tested the changes in combination with other relevant PRs using testwith command as mentioned in an associated PR. I believe this is sufficient.

This PR could cause some security scanning alerting to go off. However, such a change has already been done via other teams, so I presume nothing like that will happen.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

DavidHurta · 2025-10-27T17:33:13Z

/cc @hongkailiu

As I am under the impression that you are interested in this area.

hongkailiu

NIT: We could simplify the commands a bit.
Otherwise, LGTM.

Dockerfile

Dockerfile.rhel

To make the binary discoverable to the outside world. The following step is to register the binary in the origin repository to make the origin machine aware of the CVO tests extension.

Co-authored-by: Hongkai Liu <hongkailiu@users.noreply.github.com>

DavidHurta · 2025-10-30T13:16:56Z

/verified bypass

The CI will either break or the compressed tests binary won't be visible, which will be discovered shortly without any impact.

openshift-ci-robot · 2025-10-30T13:17:07Z

@DavidHurta: The verified label has been added.

In response to this:

/verified bypass

The CI will either break or the compressed tests binary won't be visible, which will be discovered shortly without any impact.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

hongkailiu · 2025-10-30T13:59:46Z

This checks out the changes on Dockerfile.rhel

$ curl -s https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-version-operator/1236/pull-ci-openshift-cluster-version-operator-main-images/1983882259224072192/artifacts/build-logs/cluster-version-operator-amd64.log | grep 'COPY --from=builder'
2025-10-30T13:09:41.484955381Z [2/2] STEP 3/10: COPY --from=builder /tmp/build/cluster-version-operator /tmp/build/cluster-version-operator-tests.gz /usr/bin/

Where the Dockerfile is used? 🤔

Petr confirmed that it is not used in CI.

hongkailiu · 2025-10-30T14:15:42Z

/lgtm

openshift-ci · 2025-10-30T14:16:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: DavidHurta, hongkailiu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [DavidHurta,hongkailiu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Follow up openshift#1236 (comment) The benifit is we do not need to maintain them such as openshift#1236 * The `Dockerfile` was not used in [CI configuration](https://github.com/openshift/release/tree/master/ci-operator/config/openshift/cluster-version-operator). and not in [ocp-build](https://github.com/openshift-eng/ocp-build-data/blob/ee5e00d600bd2d15cf36d9c395c0c333106f3489/images/cluster-version-operator.yml#L3) either. Both of them use `Dockerfile.rhel`. Petr also confirms](openshift@10deb6f) this finding and suggests that tit is there is only for external contributors. However, it stops working anyway. * By replacing the private images with relatively well-known public ones, the build can be recovered. So the bar is not relatively for the externals. ```console $ diff --git a/Dockerfile.rhel b/Dockerfile.rhel index fede93e..cf549c0a 100644 --- a/Dockerfile.rhel +++ b/Dockerfile.rhel @@ -1,11 +1,10 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 AS builder -WORKDIR /go/src/github.com/openshift/cluster-version-operator +FROM docker.io/golang:1.24 AS builder COPY . . RUN hack/build-go.sh; \ mkdir -p /tmp/build; \ cp _output/linux/$(go env GOARCH)/cluster-version-operator /tmp/build/cluster-version-operator -FROM registry.ci.openshift.org/ocp/4.21:base-rhel9 +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest COPY --from=builder /tmp/build/cluster-version-operator /usr/bin/ COPY install /manifests COPY vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_* /manifests/ ``` * `Dockerfile.rhel7` was kept only for [backwards-compatibility](openshift@32204c0). It has been long enough for the consumers to adapt.

Follow up openshift#1236 (comment) The benifit is we do not need to maintain them such as openshift#1236 * The `Dockerfile` was not used in [CI configuration](https://github.com/openshift/release/tree/master/ci-operator/config/openshift/cluster-version-operator). and not in [ocp-build](https://github.com/openshift-eng/ocp-build-data/blob/ee5e00d600bd2d15cf36d9c395c0c333106f3489/images/cluster-version-operator.yml#L3) either. Both of them use `Dockerfile.rhel`. Petr also [confirms](openshift@10deb6f) this finding and suggests that tit is there is only for external contributors. However, it stops working anyway. * By replacing the private images with relatively well-known public ones, the build can be recovered. So the bar is not relatively for the externals. ```console $ diff --git a/Dockerfile.rhel b/Dockerfile.rhel index fede93e..cf549c0a 100644 --- a/Dockerfile.rhel +++ b/Dockerfile.rhel @@ -1,11 +1,10 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 AS builder -WORKDIR /go/src/github.com/openshift/cluster-version-operator +FROM docker.io/golang:1.24 AS builder COPY . . RUN hack/build-go.sh; \ mkdir -p /tmp/build; \ cp _output/linux/$(go env GOARCH)/cluster-version-operator /tmp/build/cluster-version-operator -FROM registry.ci.openshift.org/ocp/4.21:base-rhel9 +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest COPY --from=builder /tmp/build/cluster-version-operator /usr/bin/ COPY install /manifests COPY vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_* /manifests/ ``` * `Dockerfile.rhel7` was kept only for [backwards-compatibility](openshift@32204c0). It has been long enough for the consumers to adapt.

Follow up openshift#1236 (comment) The benifit is we do not need to maintain them such as openshift#1236 * The `Dockerfile` was not used in [CI configuration](https://github.com/openshift/release/tree/master/ci-operator/config/openshift/cluster-version-operator). and not in [ocp-build](https://github.com/openshift-eng/ocp-build-data/blob/ee5e00d600bd2d15cf36d9c395c0c333106f3489/images/cluster-version-operator.yml#L3) either. Both of them use `Dockerfile.rhel`. Petr also [confirms](openshift@10deb6f) this finding and suggests that it is there is only for external contributors. However, it stops working anyway. * By replacing the private images with relatively well-known public ones, the build can be recovered. So the bar is relatively low for the externals. ```console $ diff --git a/Dockerfile.rhel b/Dockerfile.rhel index fede93e..cf549c0a 100644 --- a/Dockerfile.rhel +++ b/Dockerfile.rhel @@ -1,11 +1,10 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 AS builder -WORKDIR /go/src/github.com/openshift/cluster-version-operator +FROM docker.io/golang:1.24 AS builder COPY . . RUN hack/build-go.sh; \ mkdir -p /tmp/build; \ cp _output/linux/$(go env GOARCH)/cluster-version-operator /tmp/build/cluster-version-operator -FROM registry.ci.openshift.org/ocp/4.21:base-rhel9 +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest COPY --from=builder /tmp/build/cluster-version-operator /usr/bin/ COPY install /manifests COPY vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_* /manifests/ ``` * `Dockerfile.rhel7` was kept only for [backwards-compatibility](openshift@32204c0). It has been long enough for the consumers to adapt.

openshift-ci-robot · 2025-10-30T15:57:48Z

/retest-required

Remaining retests: 0 against base HEAD 667bc63 and 2 for PR HEAD 1fd1001 in total

DavidHurta · 2025-10-30T20:22:42Z

/retest-required

openshift-ci · 2025-10-30T23:35:06Z

@DavidHurta: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`1fd1001`	link	false	`/test okd-scos-e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

DavidHurta · 2025-10-31T14:03:48Z

sig-network failures are being addressed in https://issues.redhat.com/browse/OCPBUGS-63738

DavidHurta · 2025-10-31T21:26:10Z

/retest-required

Follow up openshift#1236 (comment) The benifit is we do not need to maintain them such as openshift#1236 * The `Dockerfile` was not used in [CI configuration](https://github.com/openshift/release/tree/master/ci-operator/config/openshift/cluster-version-operator). and not in [ocp-build](https://github.com/openshift-eng/ocp-build-data/blob/ee5e00d600bd2d15cf36d9c395c0c333106f3489/images/cluster-version-operator.yml#L3) either. Both of them use `Dockerfile.rhel`. Petr also [confirms](openshift@10deb6f) this finding and suggests that it is there is only for external contributors. However, it stops working anyway. * By replacing the private images with relatively well-known public ones, the build can be recovered. So the bar is relatively low for the externals. ```console $ diff --git a/Dockerfile.rhel b/Dockerfile.rhel index fede93e..cf549c0a 100644 --- a/Dockerfile.rhel +++ b/Dockerfile.rhel @@ -1,11 +1,10 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 AS builder -WORKDIR /go/src/github.com/openshift/cluster-version-operator +FROM docker.io/golang:1.24 AS builder COPY . . RUN hack/build-go.sh; \ mkdir -p /tmp/build; \ cp _output/linux/$(go env GOARCH)/cluster-version-operator /tmp/build/cluster-version-operator -FROM registry.ci.openshift.org/ocp/4.21:base-rhel9 +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest COPY --from=builder /tmp/build/cluster-version-operator /usr/bin/ COPY install /manifests COPY vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_* /manifests/ ``` * `Dockerfile.rhel7` was kept only for [backwards-compatibility](openshift@32204c0). It has been long enough for the consumers to adapt.

Follow up openshift#1236 (comment) The benifit is we do not need to maintain them such as openshift#1236 * The `Dockerfile` was not used in [CI configuration](https://github.com/openshift/release/tree/master/ci-operator/config/openshift/cluster-version-operator). and not in [ocp-build](https://github.com/openshift-eng/ocp-build-data/blob/ee5e00d600bd2d15cf36d9c395c0c333106f3489/images/cluster-version-operator.yml#L3) either. Both of them use `Dockerfile.rhel`. Petr also [confirms](openshift@10deb6f) this finding and suggests that it is there is only for external contributors. However, it stops working anyway. * By replacing the private images in `Dockerfile.rhel` with relatively well-known public ones, the build can be recovered. So the bar is relatively low for the externals. ```console $ diff --git a/Dockerfile.rhel b/Dockerfile.rhel index fede93e..cf549c0a 100644 --- a/Dockerfile.rhel +++ b/Dockerfile.rhel @@ -1,11 +1,10 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 AS builder -WORKDIR /go/src/github.com/openshift/cluster-version-operator +FROM docker.io/golang:1.24 AS builder COPY . . RUN hack/build-go.sh; \ mkdir -p /tmp/build; \ cp _output/linux/$(go env GOARCH)/cluster-version-operator /tmp/build/cluster-version-operator -FROM registry.ci.openshift.org/ocp/4.21:base-rhel9 +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest COPY --from=builder /tmp/build/cluster-version-operator /usr/bin/ COPY install /manifests COPY vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_* /manifests/ ``` * `Dockerfile.rhel7` was kept only for [backwards-compatibility](openshift@32204c0). It has been long enough for the consumers to adapt.

Follow up openshift#1236 (comment) The benifit is we do not need to maintain them such as openshift#1236 * The `Dockerfile` was not used in [CI configuration](https://github.com/openshift/release/tree/master/ci-operator/config/openshift/cluster-version-operator). and not in [ocp-build](https://github.com/openshift-eng/ocp-build-data/blob/ee5e00d600bd2d15cf36d9c395c0c333106f3489/images/cluster-version-operator.yml#L3) either. Both of them use `Dockerfile.rhel`. Petr also [confirms](openshift@10deb6f) this finding and suggests that it is there is only for external contributors. However, it stops working anyway. * By replacing the private images in `Dockerfile.rhel` with relatively well-known public ones, the build can be recovered. So the bar is relatively low for the externals. ```console $ diff --git a/Dockerfile.rhel b/Dockerfile.rhel index fede93e..cf549c0a 100644 --- a/Dockerfile.rhel +++ b/Dockerfile.rhel @@ -1,11 +1,10 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21 AS builder -WORKDIR /go/src/github.com/openshift/cluster-version-operator +FROM docker.io/golang:1.24 AS builder COPY . . RUN hack/build-go.sh; \ mkdir -p /tmp/build; \ cp _output/linux/$(go env GOARCH)/cluster-version-operator /tmp/build/cluster-version-operator -FROM registry.ci.openshift.org/ocp/4.21:base-rhel9 +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest COPY --from=builder /tmp/build/cluster-version-operator /usr/bin/ COPY install /manifests COPY vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_* /manifests/ ``` * `Dockerfile.rhel7` was kept only for [backwards-compatibility](openshift@32204c0). It has been long enough (over 5 years already) for the consumers to adapt.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 25, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 25, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 25, 2025

DavidHurta mentioned this pull request Sep 29, 2025

OTA-1585: Register the CVO tests extension openshift/origin#30316

Merged

DavidHurta mentioned this pull request Oct 24, 2025

OTA-1585: Add conformance test suites to the CVO tests extension #1238

Merged

DavidHurta marked this pull request as ready for review October 24, 2025 21:14

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 24, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Oct 27, 2025

openshift-ci bot requested a review from hongkailiu October 27, 2025 17:33

hongkailiu reviewed Oct 27, 2025

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

Dockerfile Outdated Show resolved Hide resolved

Dockerfile.rhel Outdated Show resolved Hide resolved

Dockerfile.rhel Outdated Show resolved Hide resolved

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Oct 30, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 30, 2025

DavidHurta and others added 2 commits October 30, 2025 13:56

test: Include compressed tests binary in CVO container image

5612dcc

To make the binary discoverable to the outside world. The following step is to register the binary in the origin repository to make the origin machine aware of the CVO tests extension.

Dockerfiles: Simplify copy commands

1fd1001

Co-authored-by: Hongkai Liu <hongkailiu@users.noreply.github.com>

DavidHurta force-pushed the finalize-ote-integration-add-tests-binary-to-payload branch from d6eeb4f to 1fd1001 Compare October 30, 2025 13:01

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 30, 2025

DavidHurta requested a review from hongkailiu October 30, 2025 13:12

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Oct 30, 2025

openshift-ci bot assigned hongkailiu Oct 30, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 30, 2025

hongkailiu mentioned this pull request Oct 30, 2025

NO-JIRA: Clean up unused Dockerfile and Dockerfile.rhel7 #1254

Merged

openshift-merge-bot bot merged commit 420e6d0 into openshift:main Nov 1, 2025
14 of 15 checks passed

OTA-1585: test: Include the compressed tests binary in the CVO container image #1236

OTA-1585: test: Include the compressed tests binary in the CVO container image #1236

Uh oh!

Conversation

DavidHurta commented Sep 25, 2025

Uh oh!

openshift-ci-robot commented Sep 25, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Sep 25, 2025

Uh oh!

DavidHurta commented Sep 25, 2025

Uh oh!

DavidHurta commented Sep 25, 2025

Uh oh!

DavidHurta commented Oct 27, 2025

Uh oh!

DavidHurta commented Oct 27, 2025

Uh oh!

openshift-ci bot commented Oct 27, 2025

Uh oh!

DavidHurta commented Oct 27, 2025

Uh oh!

openshift-ci-robot commented Oct 27, 2025

Uh oh!

DavidHurta commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hongkailiu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DavidHurta commented Oct 30, 2025

Uh oh!

openshift-ci-robot commented Oct 30, 2025

Uh oh!

hongkailiu commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hongkailiu commented Oct 30, 2025

Uh oh!

openshift-ci bot commented Oct 30, 2025

Uh oh!

openshift-ci-robot commented Oct 30, 2025

Uh oh!

DavidHurta commented Oct 30, 2025

Uh oh!

openshift-ci bot commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DavidHurta commented Oct 31, 2025

Uh oh!

DavidHurta commented Oct 31, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

openshift-ci-robot commented Sep 25, 2025 •

edited by openshift-ci bot

Loading

DavidHurta commented Oct 27, 2025 •

edited

Loading

hongkailiu commented Oct 30, 2025 •

edited

Loading

openshift-ci bot commented Oct 30, 2025 •

edited

Loading