Repository navigation
fix(fbc): harden OCP 5 onboarding patches and live checks - #120
Draft
dfarrell07 wants to merge 1 commit into
Draft
dfarrell07 wants to merge 1 commit into
dfarrell07 wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dfarrell07 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
dfarrell07
force-pushed
the
fix/fbc-onboard-pipelinerun
branch
from
October 15, 2026 00:33
89f2b73 to
fbe8057
Compare
dfarrell07
added a commit
to dfarrell07/submariner-release-management
that referenced
this pull request
Oct 15, 2026
Replace the dated review log with five phases and exit gates: tenant and admission MR, FBC pipelines, push build and verify-live, stage release with QE handoff, and production release with scope activation. Point to the reusable onboarding workflow instead of restating it. Record why the 0.24 content matches ACM 2.17 on OCP 5.0, that Conforma trusts catalog tasks by version rule rather than pin expiry, that the push install cannot provision before OCP 5.0 is GA, and that verify-live depends on stolostron#120. Remove the September OCP 5 handoff documents. They link only to each other and are marked historical; Git history keeps them. Claude-Session: https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
dfarrell07
force-pushed
the
fix/fbc-onboard-pipelinerun
branch
from
October 15, 2026 14:34
fbe8057 to
fae5ed6
Compare
dfarrell07
changed the title
dfarrell07
added a commit
to dfarrell07/submariner-release-management
that referenced
this pull request
Oct 16, 2026
Replace the dated review log with five phases and exit gates: tenant and admission MR, FBC pipelines, push build and verify-live, stage release with QE handoff, and production release with scope activation. Point to the reusable onboarding workflow instead of restating it. Record why the 0.24 content matches ACM 2.17 on OCP 5.0, and that Conforma trusts catalog tasks by version rule rather than pin expiry. The push install test provisions only once submariner-tenant can use the aws-konflux-prod cluster profile (openshift/release#87176) and a 5.0 release is in the OCP stable channel. verify-live and release creation both require that test to pass, so rerun it on the merged push snapshot, then pin that snapshot and commit for the stage release. verify-live also depends on stolostron#120. Remove the September OCP 5 handoff documents. They link only to each other and are marked historical; Git history keeps them. Claude-Session: https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
dfarrell07
force-pushed
the
fix/fbc-onboard-pipelinerun
branch
from
October 16, 2026 02:27
fae5ed6 to
49c70f4
Compare
dfarrell07
added a commit
to dfarrell07/submariner-release-management
that referenced
this pull request
Oct 16, 2026
Replace the dated review log with five phases and exit gates: tenant and admission MR, FBC pipelines, push build and verify-live, stage release with QE handoff, and production release with scope activation. Point to the reusable onboarding and QE handoff workflows instead of restating them. Record why the 0.24 content matches ACM 2.17 on OCP 5.0, and that Conforma trusts catalog tasks by version rule rather than pin expiry. Release management owns the automated install test. It provisions only once submariner-tenant can use the aws-konflux-prod cluster profile (openshift/release#87176) and the test requests an OCP channel with a 5.0 release: candidate until stable-5.0 has one, which needs an upstream channel parameter. verify-live and release creation both require the test to pass, so rerun it on the merged push snapshot, then pin that snapshot and commit for the stage release. verify-live also depends on stolostron#120. Remove the September OCP 5 handoff documents. They link only to each other and are marked historical; Git history keeps them. Claude-Session: https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
dfarrell07
force-pushed
the
fix/fbc-onboard-pipelinerun
branch
from
October 16, 2026 03:36
49c70f4 to
ec2b1e7
Compare
dfarrell07
added a commit
to dfarrell07/submariner-release-management
that referenced
this pull request
Oct 16, 2026
Replace the dated review log with five phases and exit gates: tenant and admission MR, FBC pipelines, push build and verify-live, stage release with QE handoff, and production release with scope activation. Point to the reusable onboarding and QE handoff workflows instead of restating them. Record why the 0.24 content matches ACM 2.17 on OCP 5.0, and that Conforma trusts catalog tasks by version rule rather than pin expiry. Release management owns the automated install test. It provisions only once submariner-tenant can use the aws-konflux-prod cluster profile (openshift/release#87176) and the test requests an OCP channel with a 5.0 release: candidate until stable-5.0 has one, which needs an upstream channel parameter. verify-live and release creation both require the test to pass, so rerun it on the merged push snapshot, then pin that snapshot and commit for the stage release. verify-live also depends on stolostron#120. Remove the September OCP 5 handoff documents. They link only to each other and are marked historical; Git history keeps them. Claude-Session: https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Generate the OCP 5+ operator ITS patch from a 4.x overlay: the 0.2 PipelineRun wrapper with resourceKind pipelinerun, the image-push secret's .dockerconfigjson key, and the optional label. One helper makes each field patch idempotent and rejects conflicting edits, and validation requires these fields for OCP 5+. Insert the new overlay after its predecessor, skipping an already listed resource so repeated preparation stays byte-for-byte stable. In verify-live, accept a retained BuildPLRInProgress marker only with the completion evidence fbc_tests_passed requires, as well as TestWarning. Stop requiring IMAGE_EXPIRES_AFTER on build-image-index, which declares no such parameter and upstream fbc-builder omits. Authenticate the merged-commit check with GITHUB_TOKEN or gh, passing the header through curl's stdin config so the token stays out of the process list. Document stream selection from ACM's ART targets and addon channel, and that the 0.3 install provisions from the OCP stable channel, which gets a new version's first release on GA day. Claude-Session: https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
dfarrell07
force-pushed
the
fix/fbc-onboard-pipelinerun
branch
from
October 16, 2026 14:07
ec2b1e7 to
7c39801
Compare
dfarrell07
added a commit
to dfarrell07/submariner-release-management
that referenced
this pull request
Oct 16, 2026
Replace the dated review log with five phases and exit gates: tenant and admission MR, FBC pipelines, push build and verify-live, stage release with QE handoff, and production release with scope activation. Point to the reusable onboarding and QE handoff workflows instead of restating them. Record why the 0.24 content matches ACM 2.17 on OCP 5.0, and that Conforma trusts catalog tasks by version rule rather than pin expiry. Release management owns the automated install test. It provisions only once submariner-tenant can use the aws-konflux-prod cluster profile (openshift/release#87176) and stable-5.0 has a release, which recent OCP versions got on GA day. verify-live and release creation both require the test to pass, so rerun it on the merged push snapshot, then pin that snapshot and commit for the stage release. verify-live also depends on stolostron#120. Remove the September OCP 5 handoff documents. They link only to each other and are marked historical; Git history keeps them. Claude-Session: https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the OCP onboarding helper (
scripts/fbc-onboard.py) so it reproduces the reviewed OCP 5.0 tenant configuration and its live checks can pass on this tenant.Operator ITS patch for OCP 5+
deploy-fbc-operatorPipelineRun wrapper withresourceKind: pipelinerun, the image-push secret's.dockerconfigjsonkey, andoptional: "true". Validation now requires these fields for OCP 5+.prepare-configproduces tenant and admission config equivalent to konflux-release-data !23786; only YAML quoting and RPA list order differ.kustomization.yaml, and skips an already listed resource so repeated preparation doesn't register the Application twice.verify-live
TestWarning, which integration-service counts as success.BuildPLRInProgressmarker only with the evidencefbc_tests_passedrequires: finished passing aggregate conditions and a completion time for every scenario. This tenant's standard scenario never reports anything else, so verify-live could not pass before.IMAGE_EXPIRES_AFTERonbuild-image-index. Task 0.4 doesn't declare it, and upstreamfbc-builderand FBC #82 omit it.Merged-commit check: authenticates with
GITHUB_TOKENorghto avoid the anonymous API rate limit, passing the header through curl's stdin config so the token stays out of the process list.Workflow doc: adds how to choose the supported stream from ACM's ART
OCP_TARGET_VERSIONSand the addon's channel, and notes that the 0.3 install provisions from the OCPstablechannel, which gets a new version's first release on GA day.Validation
scripts/tests/e2e_fbc_onboarding.py) passes against FBC Accept retest-all-comment event type and add /retest docs #86's pipelines, including repeatability and the 4.23/5.0/5.1 cases. Before this change it failed preparing 5.0.make testpasses.Tracking: ACM-48092.
https://claude.ai/code/session_01PpBn9SK2BzQUomRsrCFni7