Add openstack-tobiko container built from source by fyanac · Pull Request #82 · openstack-k8s-operators/s2i-openstack-containers

fyanac · 2026-08-14T16:46:50Z

Add a from-source tobiko build so Tobiko follows the same UBI
and lockfile path as tempest.
The image copies the pinned x/tobiko tree, installs tox, and uses the
TCIB run_tobiko.sh entrypoint so existing TOBIKO_TESTENV, version,
patch, and USE_EXTERNAL_FILES workflows keep working. Layout matches
tempest (scripts, sudoers, ENTRYPOINT, src gitignore). OWNERS come
from test-operator.

Assisted-By: Cursor-Grok 4.6

amoralej · 2026-08-19T09:42:25Z

+    curl -fsSL \
+      "https://mirror.openshift.com/pub/openshift-v4/${arch}/clients/ocp/stable/openshift-client-linux.tar.gz" \
+      | tar -zx -C /usr/local/bin oc kubectl


This will file in hermetic builds, is this intended to be built in this kind of environments as konflux?

I've updated the patch with:
COPY tobiko/openshift-client-linux-${TARGETARCH}.tar.gz /tmp/openshift-client-linux.tar.gz
and create the artifact file,
following the Konflux way: download a file before the image build, then use only that local copy.

amoralej · 2026-08-19T09:43:24Z

+
+# Full git checkout so run_tobiko.sh can git pull / checkout TOBIKO_VERSION
+# and tox can run tests from the source tree (TCIB layout).
+COPY --from=build /src/tobiko /usr/local/src/tobiko


Does the container requires to have all the tobiko sources in the runtime container?

Yes, because:

test_operator uses TOBIKO_VERSION and TOBIKO_PATCH_REFSPEC to set the version of tobiko or include additional patch.

It's for running tobiko tests, it uses tox from the tobiko repo.

The tobiko repo should get built into a wheel and then installed in the runtime layer IINM
Why does tobiko need tox to run? Is it to isolate the environment? Because putting it in a container should do that.

using tox would be incorrect because it wont end up using the correct dependencies as part to the hermetic build in konflux as well

i agree with emma that tobiko shoudl be packaged as a wheel and installed like the services and its requirements shoudl be installed into the final runtime contiaenr without a venv

this contianer will be run via the test-operator and the the test selection and execution should be done via its CR not via tox targets.

tox shoudl not be required or installed in the final runtime contaienr but shoudl not be used as part fo the build step either.

by the way i see that this approch si based on teh tcib images but when we are doign a hemitc build under konflux we shoudl nto depend on having netwrok access

but conversly at runtime we also cannot rely on network access because this has to also work in a disconencted envrionment.

so run_tobiko.sh need to be able to run without installign anything and without assuming it executed as root to be able to chown tobiko:tobiko -R tobiko

all of thei fiels (ssh keys config, clouds.yamls) ectra shoudl be bind mounted into the correct location by the test-operator with the approate group and permssiosn set.

the run_tobiko.sh shoudl only invoke tobiko directly (without tox) and ensure the logs are in the approate loction

it shoudl not git cloen or modify file ownership or prepare venv in its standard operating mode.

that can optionally be supproted the same way run_tempest supprot cloning git repos at runtime for ci tests
https://github.com/openstack-k8s-operators/s2i-openstack-containers/blob/main/containers/tempest/tempest/scripts/run_tempest.sh#L340
but that shoudl not be how this works by default.

that really only intended for one of tests or plugins that did not have rpms in the past, the latter of which is not really relevent for s2i and it woudl only be used for case where we do not want to ship the relevent plugin to a customer.

by the way the upstream docker files is much closer to the correct shape then this current file

https://github.com/redhat-openstack/tobiko/blob/master/Dockerfile#L19-L103

as is its run_tests.py tool

https://github.com/redhat-openstack/tobiko/blob/master/tools/run_tests.py

i think buildign form that would be a much better foundation then the current tcib images and adapting it to the convetison fo this repo

WRT usage of TOBIKO_VERSION and TOBIKO_PATCH_REFSPEC . So, this isinstalling a specific version of tobiko in the container (i.e. in this case it's tobiko-0.8.31), but then run-tobiko.sh can checkout any other version or refspec and use it to run the tests via tox with its own dependencies etc... that may be different that the ones in the container. It's a pretty strange pattern tbh.

The idea of containers is to provide repeatable execution as the code running should be pinned to specific code. When there is a new code, a new container should be created and used.

I understand there must be historical reasons to do it this way, but it sounds as an antipattern for containers. I'm not sure we can change this at this point but it may be a good timing to consider.

About hermetic builds, I'm not sure if this container is to be built via hermetic builds.

coderabbitai · 2026-08-19T09:51:32Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: a91fa82a-6a79-48ec-b2a2-e072851eee88

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

centosinfra-prod-github-app · 2026-08-19T11:44:42Z

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/s2i-openstack-containers for 82,4333470375e765e400d459be878c3e9ac217a159

elfiesmelfie · 2026-08-20T16:21:16Z

You can remove this file.
If .git* is being ignored, check for some wider-scoped exclude

I've followed the same as tempest structure -> https://github.com/openstack-k8s-operators/s2i-openstack-containers/tree/main/containers/tempest/src

elfiesmelfie · 2026-08-20T16:25:31Z

+if [[ ! -z "${USE_EXTERNAL_FILES}" ]]; then
+    if [[ -f "${TOBIKO_DIR}/external_files/clouds.yaml" ]]; then
+        mkdir -p "${TOBIKO_DIR}/.config/openstack"
+        cp "${TOBIKO_DIR}/external_files/clouds.yaml" "${TOBIKO_DIR}/.config/openstack/"


I understand that this is coming from the TCIB script, however, I am concerned about the clouds.yaml being exposed in the external_files like this.
The clouds.yaml should be mounted into the appropriate place in the container at runtime, and this script should not be concerned about the clouds.yaml at all. If it's in the right place, then openstack should just work and use the credentials

isn't that what it's doing? I'm not sure i'm missing something but iiuc, this is just copying the file from a external_files dir which as been placed into the container as a mount or copied via kolla interface and copying it under .config/openstack. The file is not exposed in this or tobiko repos, but managed in the operator?

Said that, it'd be nice if the operator would leave the files in the expected locations, but i'm not sure this have security implications.

It was set like that in tcib repo -> https://github.com/openstack-k8s-operators/tcib/blob/main/container-images/tcib/base/tobiko/run_tobiko.sh#L48
But I'll remove that part of external_files

will it work at all without it?

I'm not sure, but I think for now, I'll leave like that. I saw in tempest has the same config: https://github.com/openstack-k8s-operators/s2i-openstack-containers/blob/main/containers/tempest/tempest/scripts/run_tempest.sh#L558

elfiesmelfie · 2026-08-20T16:29:46Z

+approvers:
+  - lpiwowar
+  - adrianfusco
+  - arxcruz
+  - kstrenkova
+
+reviewers:
+  - evallesp
+  - rebtoor
+  - Valkyrie00
+  - imatza-rh
+  - posikoya


Do all these people need to be in owners? Are they all still maintaining tobiko?

I've copied it from test-operator -> https://github.com/openstack-k8s-operators/test-operator/blob/main/OWNERS_ALIASES#L8

I've update it.

elfiesmelfie · 2026-08-20T16:32:14Z

 - `openstack-manila-api`;
 - `openstack-manila-scheduler`;
 - `openstack-manila-share`;
+- `openstack-tempest`;


tempest is out of scope for this change.

Please also update containers/image-mappings.yaml

Hi, I've removed the tempest line, about pto2, tobiko is not for d/s

openshift-ci · 2026-08-21T16:53:31Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from elfiesmelfie. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add a from-source tobiko build so Tobiko follows the same UBI and lockfile path as tempest. The image copies the pinned x/tobiko tree, installs tox, and uses the TCIB run_tobiko.sh entrypoint so existing TOBIKO_TESTENV, version, patch, and USE_EXTERNAL_FILES workflows keep working. Layout matches tempest (scripts, sudoers, ENTRYPOINT, src gitignore). Assisted-By: Cursor-Grok 4.6

openshift-ci · 2026-08-21T16:59:38Z

The OWNERS file contains untrusted users, which makes it INVALID. The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the openstack-k8s-operators org. You can then trigger verification by writing /verify-owners in a comment.

eolivares
- User is not a member of the org. User is not a collaborator. Satisfy at least one of these conditions to make the user trusted.
- containers/tobiko/OWNERS

openshift-ci Bot added the do-not-merge/work-in-progress label Aug 14, 2026

fyanac marked this pull request as ready for review August 18, 2026 08:26

openshift-ci Bot removed the do-not-merge/work-in-progress label Aug 18, 2026

fyanac force-pushed the tobiko_s2i branch 2 times, most recently from ee31bef to f452228 Compare August 18, 2026 10:28

amoralej reviewed Aug 19, 2026

View reviewed changes

fyanac force-pushed the tobiko_s2i branch from f452228 to 7b8aee9 Compare August 19, 2026 09:51

fyanac force-pushed the tobiko_s2i branch from 7b8aee9 to 4333470 Compare August 19, 2026 11:44

openshift-ci Bot added the needs-rebase label Aug 19, 2026

fyanac force-pushed the tobiko_s2i branch from 4333470 to d457eee Compare August 19, 2026 13:05

openshift-ci Bot removed the needs-rebase label Aug 19, 2026

fyanac marked this pull request as draft August 19, 2026 13:13

openshift-ci Bot added the do-not-merge/work-in-progress label Aug 19, 2026

fyanac marked this pull request as ready for review August 20, 2026 09:07

openshift-ci Bot removed the do-not-merge/work-in-progress label Aug 20, 2026

elfiesmelfie requested changes Aug 20, 2026

View reviewed changes

openshift-ci Bot assigned elfiesmelfie Aug 20, 2026

fyanac force-pushed the tobiko_s2i branch from d457eee to 6e86419 Compare August 21, 2026 16:53

openshift-ci Bot added the do-not-merge/invalid-owners-file label Aug 21, 2026

fyanac force-pushed the tobiko_s2i branch from 6e86419 to a0832aa Compare August 21, 2026 16:53

fyanac force-pushed the tobiko_s2i branch from a0832aa to 26a0e65 Compare August 21, 2026 16:59

fyanac marked this pull request as draft August 21, 2026 17:24

openshift-ci Bot added the do-not-merge/work-in-progress label Aug 21, 2026

Uh oh!

Conversation

fyanac commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elfiesmelfie Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

centosinfra-prod-github-app Bot commented Aug 19, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Aug 21, 2026

Uh oh!

openshift-ci Bot commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fyanac commented Aug 14, 2026 •

edited

Loading

elfiesmelfie Aug 20, 2026 •

edited

Loading

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading