ROSAENG-65876: Add OSDFM stage-canary gating Prow job with backplane Hive access

[anfranci14]

Summary
Adds a never-cron Prow gating job for OSDFM stage-canary, following the same pattern as INT gating (#82743 / #62722).

New job ocm-fvt-gating-osdfm-stage-canary in the ocm-fvt-osdfm-staging variant
Runs osdfm-basic-stage via rosa-e2e-ocm-fvt-longrunning with SECTOR=canary, SOAK_TIME=15
Enables backplane for Hive AAO access and AppSRE Prometheus port-forward (shared step-registry from INT migration — no new step changes)
Stage Hive override: hives02ue1 (1farlonnersks14ohfp155uoonupr9id) — matches pre-Prow Tekton kubeconfig in app-interface stage AAO secret
AppSRE Prom: app-sre-stage-01 (19mjrthsfn66bm22m574v2v1gt9a8r4q) — same cluster INT gating uses

Out of scope (follow-up):

stage-main gating job (separate PR after canary is validated)
app-interface Gangway bridge in gating-tests-qe-fvt-prow-e2e.yaml to wire SAPM deploy → Prow

Test plan

• make update (done locally)

• Prow rehearsal: periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary

• After merge: app-interface MR to add stage-canary-prow-e2e Gangway target subscribing to ocm-osdfm-deployed-stage-canary

• Retire Tekton stage-canary target from gating-tests-qe-fvt.yaml once Prow path is verified

Summary by CodeRabbit

• Adds the never-cron ocm-fvt-gating-osdfm-stage-canary Prow job to the ocm-fvt-osdfm-staging variant.
• Runs osdfm-basic-stage with canary settings through rosa-e2e-ocm-fvt-longrunning.
• Enables backplane access for Hive AAO and AppSRE Prometheus port-forwarding in the stage environment.

[openshift-ci-robot]

@anfranci14: This pull request references ROSAENG-65876 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary
Adds a never-cron Prow gating job for OSDFM stage-canary, following the same pattern as INT gating (#82743 / #62722).

New job ocm-fvt-gating-osdfm-stage-canary in the ocm-fvt-osdfm-staging variant
Runs osdfm-basic-stage via rosa-e2e-ocm-fvt-longrunning with SECTOR=canary, SOAK_TIME=15
Enables backplane for Hive AAO access and AppSRE Prometheus port-forward (shared step-registry from INT migration — no new step changes)
Stage Hive override: hives02ue1 (1farlonnersks14ohfp155uoonupr9id) — matches pre-Prow Tekton kubeconfig in app-interface stage AAO secret
AppSRE Prom: app-sre-stage-01 (19mjrthsfn66bm22m574v2v1gt9a8r4q) — same cluster INT gating uses

Out of scope (follow-up):

stage-main gating job (separate PR after canary is validated)
app-interface Gangway bridge in gating-tests-qe-fvt-prow-e2e.yaml to wire SAPM deploy → Prow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b8a49447-532b-4f48-9847-9ec196645880

📥 Commits

Reviewing files that changed from the base of the PR and between d9ebc18 and 75943f2.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main-periodics.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-staging.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The ROSA E2E configuration adds a scheduled OCM FVT staging canary job. The job enables nested Podman and intranet access, configures credentials and reporting, sets canary soak options, selects the stage environment, and applies a four-hour timeout.

Changes

OCM FVT staging canary

Layer / File(s)	Summary
Configure the staging canary job ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-osdfm-staging.yaml	Adds the ocm-fvt-gating-osdfm-stage-canary job with scheduling, canary capabilities, reporting, environment variables, long-running FVT execution, and a four-hour timeout.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

Merge Risk: ⚪ Minimal · up to 75943

This localized change adds the requested stage-canary gating configuration, and no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: redhat-chai-bot

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The new job enables an existing logging path. Its OCM_FVT_SERVICE=osdfm and OCM_FVT_USE_BACKPLANE=true settings enter the AppSRE Prometheus branch in rosa-e2e-ocm-fvt-commands.sh. That branch lo…	Before enabling this job, update the shared OCM FVT command to log only generic status, HTTP codes, and retry counts. Remove raw Prometheus response bodies, the internal Prometheus FQDN, cluster names and cluster IDs from log messages, and …

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only CI YAML and generated Prow job metadata. It adds the static job/test identifier ocm-fvt-gating-osdfm-stage-canary and fixed environment values. It does not add or…
Test Structure And Quality	✅ Passed	PASS — The pull request changes only two YAML files: the staging Prow configuration and its generated periodic-job definition. It adds no Ginkgo source, It block, assertions, Eventually/`Consisten…
Microshift Test Compatibility	✅ Passed	The check is not applicable. The pull request changes only two YAML files: the OCM FVT staging job configuration and its generated Prow job. The diff adds no Ginkgo test declarations or test source, a…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The pull request changes only Prow YAML and generated job configuration. The diff adds no Ginkgo tests or test declarations such as It(), Describe(), Context(), or When(). The reference…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only ci-operator configuration and a generated Prow periodic-job definition. The diff adds no deployment manifest, operator code, or controller code. It also adds none o…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only two YAML files: the staging job configuration and generated Prow metadata. It adds a job that uses the existing rosa-e2e-ocm-fvt-longrunning step. No Go or OTE so…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only CI YAML and generated Prow job configuration. It adds no Ginkgo test declarations or test implementation files. The referenced rosa-e2e-ocm-fvt-longrunning step i…
No-Weak-Crypto	✅ Passed	PASS. The PR changes only two YAML files: one staging job definition and its generated Prow job. Added lines contain no MD5, SHA-1, DES, 3DES, RC4, Blowfish, ECB, crypto implementation, or secret/toke…
Container-Privileges	✅ Passed	The pull request adds a Prow job and its generated ProwJob, but neither changed manifest declares privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the added OSDFM stage-canary gating Prow job and its backplane Hive access. It matches the primary change described in the pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only CI YAML and generated Prow job metadata. It adds the static job/test identifier ocm-fvt-gating-osdfm-stage-canary and fixed environment values. It does not add or modify any Ginkgo It, Describe, Context, or When title. The referenced rosa-e2e-ocm-fvt-longrunning step is pre-existing.

Full details: Test Structure And Quality

Explanation

PASS — The pull request changes only two YAML files: the staging Prow configuration and its generated periodic-job definition. It adds no Ginkgo source, It block, assertions, Eventually/Consistently calls, or fixture setup. The new job also declares a 4h timeout, and it references the existing rosa-e2e-ocm-fvt-longrunning step. Therefore, none of the stated Ginkgo test quality failure conditions applies.

Full details: Microshift Test Compatibility

Explanation

The check is not applicable. The pull request changes only two YAML files: the OCM FVT staging job configuration and its generated Prow job. The diff adds no Ginkgo test declarations or test source, and it introduces no MicroShift-incompatible API or feature reference.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS — The pull request changes only Prow YAML and generated job configuration. The diff adds no Ginkgo tests or test declarations such as It(), Describe(), Context(), or When(). The referenced rosa-e2e-ocm-fvt-longrunning step is pre-existing, so this SNO test-compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only ci-operator configuration and a generated Prow periodic-job definition. The diff adds no deployment manifest, operator code, or controller code. It also adds none of the listed topology-sensitive scheduling constraints, such as affinity, topology spread, replica, node-role, toleration, or PDB settings. The cluster: build05 field selects the Prow execution cluster and is not a workload scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only two YAML files: the staging job configuration and generated Prow metadata. It adds a job that uses the existing rosa-e2e-ocm-fvt-longrunning step. No Go or OTE source code changes, suite setup changes, or stdout/logging changes are present. The referenced runner invokes ocmtest, not an openshift-tests OTE binary.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only CI YAML and generated Prow job configuration. It adds no Ginkgo test declarations or test implementation files. The referenced rosa-e2e-ocm-fvt-longrunning step is pre-existing; its existing 127.0.0.1 and external download commands are not introduced by this pull request. Therefore, no stated IPv4 or disconnected-network failure condition is introduced by a new Ginkgo test.

Full details: No-Weak-Crypto

Explanation

PASS. The PR changes only two YAML files: one staging job definition and its generated Prow job. Added lines contain no MD5, SHA-1, DES, 3DES, RC4, Blowfish, ECB, crypto implementation, or secret/token comparison. The job references the existing rosa-e2e-ocm-fvt-longrunning step. Its definition and command script are byte-identical to the parent revision, and the script contains no listed weak-crypto API or non-constant-time secret comparison.

Full details: Container-Privileges

Explanation

The pull request adds a Prow job and its generated ProwJob, but neither changed manifest declares privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or an explicit root user. The nested_podman: true setting is CI metadata, not one of the listed prohibited security fields. The shared nested-podman SCC containing allowPrivilegeEscalation: true predates this commit, and its configured UID and image user are 1000 rather than root.

Full details: No-Sensitive-Data-In-Logs

Explanation

The new job enables an existing logging path. Its OCM_FVT_SERVICE=osdfm and OCM_FVT_USE_BACKPLANE=true settings enter the AppSRE Prometheus branch in rosa-e2e-ocm-fvt-commands.sh. That branch logs the internal hostname prometheus-app-sre.openshift-customer-monitoring.svc.cluster.local at line 370, logs app-sre-stage-01 and its cluster ID on login failure at line 300, and prints Prometheus response-body snippets at lines 353 and 361. The pull request adds the stage job that activates this path, even though the shared command file is unchanged.

Resolution

Before enabling this job, update the shared OCM FVT command to log only generic status, HTTP codes, and retry counts. Remove raw Prometheus response bodies, the internal Prometheus FQDN, cluster names and cluster IDs from log messages, and raw port-forward log output. Keep credential and kubeconfig contents out of stdout and stderr. Then regenerate the Prow job configuration.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@anfranci14: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.
The following jobs are not rehearsable without the network-access-rehearsals-ok, and approved labels present on this PR. This is due to the restrict_network_access field being set to false. The network-access-rehearsals-ok label can be added by any openshift org member other than the PR's author by commenting: /pj-rehearse network-access-allowed:

Test name
periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary

[dustman9000]

/pj-rehearse network-access-allowed

[openshift-merge-bot]

@dustman9000: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[anfranci14]

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary

[openshift-merge-bot]

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@anfranci14: job(s): periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary either don't exist or were not found to be affected, and cannot be rehearsed

[anfranci14]

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary

[openshift-merge-bot]

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@anfranci14: job(s): periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary either don't exist or were not found to be affected, and cannot be rehearsed

[dustman9000]

/approve

[anfranci14]

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary

[openshift-merge-bot]

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[anfranci14]

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-staging-ocm-fvt-gating-osdfm-stage-canary

[openshift-merge-bot]

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[anfranci14]

Rehearsals passed two times.

[anfranci14]

/pj-rehearse periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary

[openshift-merge-bot]

@anfranci14: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@anfranci14: job(s): periodic-ci-openshift-online-rosa-e2e-main-ocm-fvt-osdfm-integration-ocm-fvt-gating-osdfm-integration-canary either don't exist or were not found to be affected, and cannot be rehearsed

[dustman9000]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anfranci14, dustman9000

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift-online/rosa-e2e/OWNERS [dustman9000]
• ci-operator/jobs/openshift-online/rosa-e2e/OWNERS [dustman9000]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@anfranci14: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.