OCPBUGS-94441: upgrade CLOUDSDK_PYTHON to python3.11 in upi-installer

[savio87]

Summary

• Upgrades CLOUDSDK_PYTHON from Python 3.9 to Python 3.11 in the upi-installer CI image
• Google Cloud CLI dropped Python 3.9 support, producing warnings on every gcloud invocation
• Installs python3.11 via yum and updates pip and env var references accordingly

Fixes https://issues.redhat.com/browse/OCPBUGS-94441

Details

The upi-installer image sets CLOUDSDK_PYTHON=/usr/bin/python (Python 3.9 on RHEL 9). The Google Cloud CLI no longer supports Python 3.9, producing deprecation warnings before every gcloud command. This change installs python3.11, updates the CLOUDSDK_PYTHON env var, and switches pip install commands from pip-3 to pip3.11.

Test plan

• CI image builds successfully with python3.11
• gcloud commands no longer produce Python version warnings
• HyperShift GCP/GKE CI steps pass without regressions

Summary by CodeRabbit

• Chores
  • Updated the CI installer environment to use Python 3.11 for cloud tooling and related packages.
  • Improved consistency across Python package installation and runtime configuration.

[openshift-ci-robot]

@savio87: This pull request references Jira Issue OCPBUGS-94441, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Upgrades CLOUDSDK_PYTHON from Python 3.9 to Python 3.11 in the upi-installer CI image
• Google Cloud CLI dropped Python 3.9 support, producing warnings on every gcloud invocation
• Installs python3.11 via yum and updates pip and env var references accordingly

Fixes https://issues.redhat.com/browse/OCPBUGS-94441

Details

The upi-installer image sets CLOUDSDK_PYTHON=/usr/bin/python (Python 3.9 on RHEL 9). The Google Cloud CLI no longer supports Python 3.9, producing deprecation warnings before every gcloud command. This change installs python3.11, updates the CLOUDSDK_PYTHON env var, and switches pip install commands from pip-3 to pip3.11.

Test plan

• CI image builds successfully with python3.11
• gcloud commands no longer produce Python version warnings
• HyperShift GCP/GKE CI steps pass without regressions

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3bff2797-d4cf-47c6-b097-82f1ce6cf7b2

📥 Commits

Reviewing files that changed from the base of the PR and between cd86568 and 5cadfe4.

📒 Files selected for processing (1)

• images/installer/Dockerfile.upi.ci

🚧 Files skipped from review as they are similar to previous changes (1)

• images/installer/Dockerfile.upi.ci

---

📝 Walkthrough

Walkthrough

Changes

Python 3.11 UPI CI image

Layer / File(s)	Summary
Install and configure Python 3.11 images/installer/Dockerfile.upi.ci	Adds Python 3.11 and its pip package, installs gcloud dependencies with pip3.11, and updates gcloud environment variables to use Python 3.11.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: upgrading CLOUDSDK_PYTHON to Python 3.11 in the upi-installer image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only images/installer/Dockerfile.upi.ci changed; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality	✅ Passed	PR only updates images/installer/Dockerfile.upi.ci; no Ginkgo tests or test patterns were changed.
Microshift Test Compatibility	✅ Passed	Only images/installer/Dockerfile.upi.ci changed; no Ginkgo e2e tests or test code were added, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only images/installer/Dockerfile.upi.ci changed; no new or modified Ginkgo e2e tests, so SNO compatibility is not implicated.
Topology-Aware Scheduling Compatibility	✅ Passed	Only the installer Dockerfile changes Python tooling; no scheduling manifests/controllers or topology-sensitive constraints were added.
Ote Binary Stdout Contract	✅ Passed	Only images/installer/Dockerfile.upi.ci changed; no main/init/TestMain/suite code or stdout logging was touched.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only changes images/installer/Dockerfile.upi.ci, so the IPv6/disconnected test check is not applicable.
No-Weak-Crypto	✅ Passed	The only changes are Python/package env updates in the Dockerfile; the diff contains no MD5/SHA1/DES/RC4/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	No privileged/K8s settings found; the Dockerfile’s runtime user is 1000, and root is only used for image build/install steps.
No-Sensitive-Data-In-Logs	✅ Passed	The only change is package/version updates in a Dockerfile; it adds no logging of secrets, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @savio87. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign patrickdillon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

images/installer/Dockerfile.upi.ci (1)

56-63: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Install python3.11-pip for the versioned pip3.11 commands.

RHEL 9 installs python3-pip for the default Python 3 environment, while python3.11-pip provides /usr/bin/pip3.11 used by lines 77 and 83. Replace python3-pip with python3.11-pip, or run python3.11 -m pip if no separate package is desired.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/installer/Dockerfile.upi.ci` around lines 56 - 63, Update the package
list in the Dockerfile’s dependency installation block to install python3.11-pip
instead of python3-pip, ensuring the pip3.11 commands used later in the image
build resolve correctly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/installer/Dockerfile.upi.ci`:
- Line 77: Update both pip3.11 install commands in the Dockerfile to include the
--no-cache-dir option, ensuring neither installation retains pip cache data in
the final image.

---

Outside diff comments:
In `@images/installer/Dockerfile.upi.ci`:
- Around line 56-63: Update the package list in the Dockerfile’s dependency
installation block to install python3.11-pip instead of python3-pip, ensuring
the pip3.11 commands used later in the image build resolve correctly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f19af0ae-de3c-40db-9c49-a7de7295795d

📥 Commits

Reviewing files that changed from the base of the PR and between d8f6a96 and cd86568.

📒 Files selected for processing (1)

• images/installer/Dockerfile.upi.ci

[savio87]

Note: The Jira bot flagged OCPBUGS-94441 as invalid because it doesn't have a target version set. I don't have permissions to update the target version on the Jira issue. Could a maintainer set the target version to 5.0.0 on OCPBUGS-94441? I can then comment /jira refresh to re-validate.