Add speculative build support: auto-detect and source staging by rebtoor · Pull Request #91 · openstack-k8s-operators/s2i-openstack-containers

rebtoor · 2026-08-18T08:09:41Z

Summary

Overhaul the s2i content provider: plain Docker registry, speculative
build automation, quay push infrastructure, and OpenStackVersion-based
deployment validation.

1. Plain Docker registry (replaces Zuul buildset registry)

Replace the complex buildset registry setup — which required TLS
certificates, SSH tunnel management, SELinux :Z volume workarounds,
and ownership tracking — with a plain registry:2 container on host
network. This matches the plain-registry pattern used by the standard
OpenStack content provider.

2. Speculative build support (auto-detect + source staging)

Enable CI pipelines to automatically rebuild only the images affected
by an upstream OpenStack patch:

build.sh auto-detect <project> [stream] — scans sources.txt
files to determine which images reference a given project. Exact
URL-path matching prevents false positives.
build.sh list-sources <image> [stream] — lists source
dependencies as pipe-delimited records for Ansible consumption.
Zuul playbooks — resolve-auto-images.yaml resolves
s2i_ci_images: auto by inspecting the Zuul change queue;
stage-zuul-sources.yaml copies patched sources into container
build contexts.
Auto-detect reads the queue via zuul['items'] (bracket access;
Jinja zuul.items is dict.items and is not iterable).

3. Consumer job foundation

s2i-speculative-deploy-test-base — abstract Zuul job for
operator repos to wire deploy+validate pipelines. s2i-built images
from the content provider are passed as cifmw_set_containers_images
and applied to OpenStackVersion during edpm_prepare (ci-framework
set_containers, PR 4131).
CRC trusts the s2i registry via content_provider_registry_ip.
containers/image-mappings.yaml maps s2i targets to
OpenStackVersion customContainerImages fields, including nova,
neutron, cinder, swift, ovn, and infra. Backend maps
(cinderVolumeImages, manilaShareImages) and services s2i does
not build (nova-compute, placement) stay on operator defaults.

4. Deployment validation

s2i-openstack-deploy-validation — concrete job that deploys
OpenStack with mapped s2i-built images applied during edpm_prepare
and runs a Tempest smoke suite. Wired as non-voting in github-check
to validate update-sources bumps on real deployments.

5. Quay push infrastructure

Extract build/push logic into includable tasks files
(push-to-quay-build-tasks.yaml, push-to-quay-push-tasks.yaml,
prepare-host-tasks.yaml) so the config repo can delegate via
include_tasks without exposing quay credentials to untrusted code.
REGISTRY_AUTH_FILE is passed through to build.sh.
Keep GitHub Actions push-on-merge until the Zuul github-post
publish job in the config repo is live. workflow_dispatch remains
available for manual runs.

6. Bug fixes and improvements

Fix auto-detect over-matching: when an image-level sources.txt
matches, only that specific image is returned (not all siblings).
Fix list-sources to include image-level sources when called at the
project level, and deduplicate entries across multiple sources files.
Port auto-detect and list-sources tests from Python to bash,
matching the existing test_build.sh/test_update_sources.sh patterns.
Add command documentation to build.sh usage output for resolve,
refs, and install-deps.

Other changes

Exclude zuul.d/ from ansible-lint.

Test plan

tox -e linters passes
tox -e test passes (includes auto-detect and list-sources tests)
Zuul content provider job builds and pushes images successfully
s2i-openstack-deploy-validation deploys and runs tempest smoke
Post-merge s2i-openstack-container-build-push pushes to quay.io
(gated on the config-repo publish job landing)

Depends-On: openstack-k8s-operators/ci-framework#4131

centosinfra-prod-github-app · 2026-08-18T08:22:10Z

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/s2i-openstack-containers for 91,fd37ed76d30fcc1e8a352e0ed4efbfb8cdb1b41e

rebtoor · 2026-08-18T08:30:39Z

recheck

coderabbitai · 2026-08-19T09:27:56Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 156909bc-82fa-4980-84e3-15fc0b108453

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

centosinfra-prod-github-app · 2026-08-19T09:52:12Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/e2bdaaea786d43158600aace9c71c70e

✔️ s2i-openstack-containers-molecule SUCCESS in 1m 56s
❌ s2i-openstack-container-content-provider FAILURE in 23m 30s

centosinfra-prod-github-app · 2026-08-19T10:38:35Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/f4aaefcb32554797ac3131a7cc765b7a

✔️ s2i-openstack-containers-molecule SUCCESS in 2m 07s
❌ s2i-openstack-container-content-provider FAILURE in 26m 44s

Add a consumer smoke Zuul job that validates the content provider contract on a fresh consumer node: registry access, image pull, image inspection, and deployment key resolution. Add a unit test validating deployment keys in image-mappings.yaml against OpenStackVersion.spec.customContainerImages fields (covers both ContainerTemplate and ContainerDefaults structs). Depends-On: openstack-k8s-operators#91 Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Roberto Alfieri <ralfieri@redhat.com>

Add a consumer smoke Zuul job that validates the content provider contract on a fresh consumer node: registry access, image pull, image inspection, and deployment key resolution. Add a unit test validating deployment keys in image-mappings.yaml against OpenStackVersion.spec.customContainerImages fields (covers both ContainerTemplate and ContainerDefaults structs). Depends-On: openstack-k8s-operators#91 Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Roberto Alfieri <ralfieri@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

rebtoor · 2026-08-21T10:49:10Z

recheck

Move the speculative watcher consumer off the late pre_tests OpenStackVersion patch and onto cifmw_set_containers_images so images are injected before the control plane deploys. Add opendev-watcher-s2i-pipeline for Gerrit openstack/watcher only; the shared edpm template also covers watcherclient and tempest-plugin. Depends-On: openstack-k8s-operators/s2i-openstack-containers#91 Depends-On: openstack-k8s-operators/ci-framework#4131 Co-authored-by: Cursor <cursoragent@cursor.com>

Move the speculative watcher consumer off the late pre_tests OpenStackVersion patch and onto cifmw_set_containers_images so images are injected before the control plane deploys. Fold the s2i provider and deploy jobs into opendev-watcher-edpm-pipeline so RDO config does not need a second template. Limit those jobs to watcher/ source paths so python-watcherclient and watcher-tempest-plugin keep EDPM-only. Depends-On: openstack-k8s-operators/s2i-openstack-containers#91 Depends-On: openstack-k8s-operators/ci-framework#4131 Co-authored-by: Cursor <cursoragent@cursor.com>

rebtoor · 2026-08-21T14:43:32Z

recheck

Add a consumer smoke Zuul job that validates the content provider contract on a fresh consumer node: registry access, image pull, image inspection, and deployment key resolution. Add a unit test validating deployment keys in image-mappings.yaml against OpenStackVersion.spec.customContainerImages fields (covers both ContainerTemplate and ContainerDefaults structs). Depends-On: openstack-k8s-operators#91 Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Roberto Alfieri <ralfieri@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

rebtoor · 2026-08-24T14:21:43Z

recheck

Inject s2i-built watcher images through cifmw_set_containers_images during edpm_prepare so they land in OpenStackVersion before the control plane deploys. github-check uses the non-meta operator content provider for operator images and appends the s2i registry as an extra insecure registry so CRC can pull both the operator catalog and watcher service images. Fold the s2i provider and deploy jobs into opendev-watcher-edpm-pipeline and limit them to watcher/ source paths so python-watcherclient and watcher-tempest-plugin keep EDPM-only. Depends-On: openstack-k8s-operators/s2i-openstack-containers#91 Depends-On: openstack-k8s-operators/ci-framework#4131 Co-authored-by: Cursor <cursoragent@cursor.com>

Inject s2i-built cinder images through cifmw_set_containers_images during edpm_prepare so they land in OpenStackVersion before the control plane deploys. github-check keeps the operator content provider for the catalog and appends the s2i registry so CRC can pull both. cinder-volume is applied as cinderVolumeImages.volume1 because OpenStackVersion stores volume backends as a map. Depends-On: openstack-k8s-operators/s2i-openstack-containers#91 Depends-On: openstack-k8s-operators/ci-framework#4131 Co-authored-by: Cursor <cursoragent@cursor.com>

Replace the Zuul buildset registry with a plain Docker registry:2 container running on host network. This eliminates SSH tunnels, TLS negotiation, SELinux workarounds, and ownership tracking, matching the plain-registry pattern used by the standard OpenStack content provider. Add speculative build support so CI pipelines can automatically rebuild only the images affected by an upstream OpenStack patch: - `build.sh auto-detect <project> [stream]` scans sources.txt files to find which container images reference a given project. Uses exact URL-path matching to avoid false positives. - `build.sh list-sources <image> [stream]` lists source dependencies as pipe-delimited records for Ansible consumption. - Zuul playbooks resolve `s2i_ci_images: auto` by querying the change queue, then stage patched source checkouts into container build contexts before the build runs. Access the change queue with `zuul['items']` (bracket notation). Jinja `zuul.items` is dict.items() and is not iterable, which crashes Ansible during auto-detect. Zuul canonical names (`opendev.org/openstack/tempest`) do not match `sources.txt` paths (`openstack/tempest`). Pass `project.name` into auto-detect, also accept host/org/repo canonical names as a fallback, and map those short paths onto `zuul.projects` keys when staging speculative sources. Queue items with no image mapping (e.g. ci-framework Depends-On) stay non-fatal; auto-detect still fails if no project maps to an image. Add an abstract Zuul job (s2i-speculative-deploy-test-base) for operator repos to wire deploy+validate pipelines with minimal boilerplate. Consumer jobs rely on ci-framework edpm_prepare to apply s2i_content_provider_os_custom_container_images via set_containers before the control plane is deployed. CRC trusts the s2i registry through content_provider_registry_ip, which merge-patches insecureRegistries and creates the list when it is missing. Add s2i-openstack-deploy-validation, a concrete job that deploys OpenStack with mapped s2i-built images applied to OpenStackVersion during edpm_prepare and runs a Tempest smoke suite. Wired as non-voting in github-check to gate update-sources bumps on real deployment validation without requiring the operator content provider. Expand containers/image-mappings.yaml so nova, neutron, cinder, swift, ovn, and infra images reach OpenStackVersion. Backend maps (cinderVolumeImages, manilaShareImages) and services s2i does not build (nova-compute, placement) stay on operator defaults. Extract build/push logic into includable tasks files so the config repo can delegate build and push operations via include_tasks without exposing quay credentials to untrusted code. Pass REGISTRY_AUTH_FILE through so buildah/podman reuse the trusted wrapper's auth file. Keep GitHub Actions push-on-merge until the Zuul github-post publish job in the config repo is live; workflow_dispatch remains available for manual runs. Fix auto-detect to only return the specific image whose sources.txt matched when the match is at the image level, rather than all images under the project. Fix list-sources to include image-level sources.txt when called at the project level, and deduplicate entries that appear in multiple sources files. Add command documentation to build.sh usage output for resolve, refs, and install-deps. Port auto-detect and list-sources tests from Python to bash, matching existing test patterns. Related-Issue: RHOSRFE-466 Co-Authored-By: Sean Mooney <work@seanmooney.info> Assisted-By: Claude (Anthropic) Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Roberto Alfieri <ralfieri@redhat.com>

Inject s2i-built cinder images through cifmw_set_containers_images during edpm_prepare so they land in OpenStackVersion before the control plane deploys. github-check keeps the operator content provider for the catalog and appends the s2i registry so CRC can pull both. cinder-volume is applied as cinderVolumeImages.volume1 because OpenStackVersion stores volume backends as a map. Depends-On: openstack-k8s-operators/s2i-openstack-containers#91 Depends-On: openstack-k8s-operators/ci-framework#4131 Co-authored-by: Cursor <cursoragent@cursor.com>

Add cinder-s2i-content-provider (child of the s2i content provider) and cinder-s2i-tempest (child of cinder-operator-tempest) so github-check builds s2i cinder images and applies them through cifmw_set_containers_images during edpm_prepare. Keep the operator content provider for the catalog and append the s2i registry so CRC can pull both. cinder-volume is applied as cinderVolumeImages.volume1 because OpenStackVersion stores volume backends as a map. Depends-On: openstack-k8s-operators/s2i-openstack-containers#91 Depends-On: openstack-k8s-operators/ci-framework#4131 Co-authored-by: Cursor <cursoragent@cursor.com>

yazug · 2026-08-25T10:37:04Z

/lgtm

elfiesmelfie

/lgtm

arxcruz · 2026-08-25T12:23:23Z

/lgtm

rebtoor · 2026-08-25T14:56:42Z

/approve

openshift-ci · 2026-08-25T14:56:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rebtoor

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [rebtoor]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot added the do-not-merge/work-in-progress label Aug 18, 2026

rebtoor force-pushed the feature/content-provider-speculative branch from 14823b1 to 77dfb5b Compare August 18, 2026 08:12

rebtoor changed the title ~~Add Zuul image content provider with speculative build support~~ Add speculative build support: auto-detect and source staging Aug 18, 2026

rebtoor force-pushed the feature/content-provider-speculative branch from 77dfb5b to fd37ed7 Compare August 18, 2026 08:21

rebtoor force-pushed the feature/content-provider-speculative branch from fd37ed7 to 7ecf7e8 Compare August 18, 2026 08:55

This was referenced Aug 18, 2026

Add consumer smoke job and deployment key validation #53

Open

Add e2e job for s2i-built tempest container image openstack-k8s-operators/test-operator#492

Open

rebtoor force-pushed the feature/content-provider-speculative branch 7 times, most recently from aac5d56 to e833596 Compare August 19, 2026 09:27

rebtoor force-pushed the feature/content-provider-speculative branch from e833596 to a7983a9 Compare August 19, 2026 10:05

rebtoor force-pushed the feature/content-provider-speculative branch from a7983a9 to 8a95c4a Compare August 19, 2026 12:10

rebtoor marked this pull request as ready for review August 19, 2026 14:03

openshift-ci Bot removed the do-not-merge/work-in-progress label Aug 19, 2026

rebtoor force-pushed the feature/content-provider-speculative branch 2 times, most recently from 0c0c76a to 6e7f529 Compare August 19, 2026 15:51

rebtoor requested review from amoralej, elfiesmelfie and fmount August 19, 2026 15:52

rebtoor force-pushed the feature/content-provider-speculative branch from 2fa33e5 to c6ab223 Compare August 21, 2026 10:46

rebtoor force-pushed the feature/content-provider-speculative branch from c6ab223 to 72119aa Compare August 21, 2026 13:24

rebtoor mentioned this pull request Aug 21, 2026

[ci] Speculative s2i watcher deploy via OpenStackVersion openstack-k8s-operators/watcher-operator#443

Open

3 tasks

rebtoor force-pushed the feature/content-provider-speculative branch 2 times, most recently from 8d8876f to fba8457 Compare August 25, 2026 09:26

rebtoor mentioned this pull request Aug 25, 2026

[ci] Speculative s2i cinder deploy via OpenStackVersion openstack-k8s-operators/cinder-operator#711

Open

3 tasks

rebtoor force-pushed the feature/content-provider-speculative branch from fba8457 to 70b32dc Compare August 25, 2026 09:48

openshift-ci Bot assigned yazug Aug 25, 2026

openshift-ci Bot added the lgtm label Aug 25, 2026

elfiesmelfie approved these changes Aug 25, 2026

View reviewed changes

openshift-ci Bot assigned elfiesmelfie Aug 25, 2026

openshift-ci Bot assigned arxcruz Aug 25, 2026

rebtoor mentioned this pull request Aug 25, 2026

Add S2I speculative deploy testing for telemetry-operator openstack-k8s-operators/telemetry-operator#992

Draft

openshift-ci Bot added the approved label Aug 25, 2026

openshift-merge-bot Bot merged commit 66f9b45 into openstack-k8s-operators:main Aug 25, 2026
5 checks passed

Uh oh!

Conversation

rebtoor commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

1. Plain Docker registry (replaces Zuul buildset registry)

2. Speculative build support (auto-detect + source staging)

3. Consumer job foundation

4. Deployment validation

5. Quay push infrastructure

6. Bug fixes and improvements

Other changes

Test plan

Uh oh!

centosinfra-prod-github-app Bot commented Aug 18, 2026

Uh oh!

rebtoor commented Aug 18, 2026

Uh oh!

coderabbitai Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

centosinfra-prod-github-app Bot commented Aug 19, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Aug 19, 2026

Uh oh!

rebtoor commented Aug 21, 2026

Uh oh!

rebtoor commented Aug 21, 2026

Uh oh!

rebtoor commented Aug 24, 2026

Uh oh!

yazug commented Aug 25, 2026

Uh oh!

elfiesmelfie left a comment

Choose a reason for hiding this comment

Uh oh!

arxcruz commented Aug 25, 2026

Uh oh!

rebtoor commented Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

rebtoor commented Aug 18, 2026 •

edited

Loading

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading