fix(disconnected): parse proxy credentials and fix nested podman

Three issues fixed:

1. Playwright proxy credentials not parsed:
   HTTPS_PROXY is http://user:pass@host:3128 (credentials in URL).
   Playwright requires credentials as separate username/password
   fields, not embedded in the server URL. Add parseProxy() helper
   that extracts them via URL parsing.

2. Operator podman build fails with nested user namespaces:
   'newuidmap: open of uid_map failed: Permission denied'
   BUILDAH_ISOLATION=chroot alone is insufficient — the error occurs
   during podman's rootless storage setup before build isolation
   applies. Set _CONTAINERS_USERNS_CONFIGURED=1 to skip newuidmap
   and force vfs storage driver to avoid fuse-overlayfs userns ops.

3. Added debug logging for proxy config and podman environment to
   aid future CI troubleshooting.

Assisted-by: OpenCode

Author: zdrapela

.ci/pipelines/jobs/ocp-disconnected-helm.sh

@@ -220,6 +220,10 @@ handle_ocp_disconnected_helm() {
 
   log::section "Smoke Test"
 
+  if [[ -n "${HTTPS_PROXY:-}" ]]; then
+    log::info "HTTPS_PROXY is set (Playwright will use it): ${HTTPS_PROXY%%@*}@***"
+  fi
+
   local url="https://${RELEASE_NAME}-developer-hub-${NAME_SPACE}.${K8S_CLUSTER_ROUTER_BASE}"
   testing::check_and_test "${RELEASE_NAME}" "${NAME_SPACE}" "${PW_PROJECT_SMOKE_TEST}" "${url}"
 

.ci/pipelines/jobs/ocp-disconnected-operator.sh

@@ -52,10 +52,21 @@ handle_ocp_disconnected_operator() {
   fi
 
   # The CI pod runs with nested_podman: true (hostUsers: false), placing it
-  # inside a Linux user namespace. podman build tries to create another user
-  # namespace, which fails with "newuidmap: open of uid_map failed: Permission
-  # denied". BUILDAH_ISOLATION=chroot uses chroot instead of nested namespaces.
+  # inside a Linux user namespace. podman's rootless setup calls newuidmap to
+  # create a nested user namespace, which fails with:
+  #   newuidmap: open of uid_map failed: Permission denied
+  # Fix:
+  #   _CONTAINERS_USERNS_CONFIGURED=1 — skip newuidmap (userns already set up)
+  #   BUILDAH_ISOLATION=chroot — chroot instead of user namespace for builds
+  #   storage driver=vfs — avoid fuse-overlayfs which may need userns ops
+  export _CONTAINERS_USERNS_CONFIGURED=1
   export BUILDAH_ISOLATION=chroot
+  mkdir -p "${HOME}/.config/containers"
+  printf '[storage]\ndriver = "vfs"\n' > "${HOME}/.config/containers/storage.conf"
+
+  log::info "Podman environment: uid=$(id -u), BUILDAH_ISOLATION=${BUILDAH_ISOLATION}"
+  log::info "Storage config: $(cat "${HOME}/.config/containers/storage.conf" | tr '\n' ' ')"
+  log::info "subuid: $(cat /etc/subuid 2> /dev/null || echo 'not found')"
 
   bash "${DISCONNECTED_TMPDIR}/prepare-restricted-environment.sh" "${prepare_args[@]}" \
     || {

e2e-tests/playwright.config.ts

@@ -6,6 +6,24 @@ import { PW_PROJECT } from "./playwright/projects";
 process.env.JOB_NAME = process.env.JOB_NAME ?? "";
 process.env.IS_OPENSHIFT = process.env.IS_OPENSHIFT ?? "";
 
+// Parse HTTPS_PROXY (http://user:pass@host:port) into Playwright's proxy
+// config with separate username/password fields. No-op for connected envs.
+function parseProxy(
+  proxyUrl: string | undefined,
+): { server: string; username?: string; password?: string } | undefined {
+  if (proxyUrl === undefined || proxyUrl === "") return undefined;
+  try {
+    const u = new URL(proxyUrl);
+    return {
+      server: `${u.protocol}//${u.host}`,
+      ...(u.username !== "" && { username: decodeURIComponent(u.username) }),
+      ...(u.password !== "" && { password: decodeURIComponent(u.password) }),
+    };
+  } catch {
+    return { server: proxyUrl };
+  }
+}
+
 // Set LOCALE based on which project is being run
 const args = process.argv;
 
@@ -60,10 +78,7 @@ export default defineConfig({
     ignoreHTTPSErrors: true,
     // Proxy for disconnected environments where the CI runner reaches the
     // cluster through a squid proxy (HTTPS_PROXY set by proxy-conf.sh).
-    proxy:
-      process.env.HTTPS_PROXY !== undefined && process.env.HTTPS_PROXY !== ""
-        ? { server: process.env.HTTPS_PROXY }
-        : undefined,
+    proxy: parseProxy(process.env.HTTPS_PROXY),
     trace: "on",
     screenshot: "on",
     ...devices["Desktop Chrome"],