Skip to content

fix(ISV-7300): remove the need for authentication in test pipeline #478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BorekZnovustvoritel merged 1 commit into from
Jun 25, 2026
Merged

fix(ISV-7300): remove the need for authentication in test pipeline #478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion roles/install_operator_prereqs/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@

- name: "Download and extract go binary to {{ testing_bin_path }}"
unarchive:
src: "https://storage.googleapis.com/golang/go{{ go_version }}.linux-amd64.tar.gz"
src: "https://dl.google.com/go/go{{ go_version }}.linux-amd64.tar.gz"

@BorekZnovustvoritel BorekZnovustvoritel Jun 25, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This URL changed (the original no longer works, the image was not buildable).

dest: "{{ testing_bin_path }}"
remote_src: yes
tags:
Expand Down
3 changes: 2 additions & 1 deletion upstream/ansible.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
roles_path = ../roles
display_skipped_hosts = no
display_ok_hosts = yes
stdout_callback = yaml
stdout_callback = ansible.builtin.default
result_format = yaml
Comment on lines +5 to +6

@BorekZnovustvoritel BorekZnovustvoritel Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These were missed previously. stdout_callback = yaml has been removed from Ansible and the image was not buildable without this change.

callback_whitelist = log_plays

[callback_log_plays]
Expand Down
2 changes: 1 addition & 1 deletion upstream/roles/install_operator_prereqs/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@

- name: "Download and extract go binary to {{ testing_bin_path }}"
unarchive:
src: "https://storage.googleapis.com/golang/go{{ go_version }}.linux-amd64.tar.gz"
src: "https://dl.google.com/go/go{{ go_version }}.linux-amd64.tar.gz"
dest: "{{ testing_bin_path }}"
remote_src: true
register: download_and_unpack_go
Expand Down
1 change: 0 additions & 1 deletion upstream/roles/multiarch_fbc/tasks/process_archs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
---
- name: "Pull the base image {{ container_tool }} pull --arch={{ mfbc_architecture }} {{ mirror_multiarch_image }}"
shell: "{{ container_tool }} pull --arch={{ mfbc_architecture }} {{ mirror_multiarch_image }}"
when: registry_redhat_io_user is defined and registry_redhat_io_token is defined

@BorekZnovustvoritel BorekZnovustvoritel Jun 25, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This condition did not make sense since the image is retagged in the next step unconditionally. If the user and/or token were not defined, this playbook just failed.


- name: "Retag the base image"
shell: "{{ container_tool }} tag {{ mirror_multiarch_image }} {{ mirror_multiarch_image }}-{{ mfbc_architecture }}"
Expand Down
24 changes: 2 additions & 22 deletions upstream/roles/produce_fbc/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,28 +105,8 @@
state: directory
mode: 01777

- name: "Fail on registry.redhat.io login "
fail:
msg: "Unable to login to registry.redhat.io with user '{{ registry_redhat_io_user }}'"
when:
- (registry_redhat_io_user is undefined and registry_redhat_io_token is undefined) or (registry_redhat_io_user|length == 0 or registry_redhat_io_token|length == 0)

- name: "Login to registry.redhat.io"
shell: "{{ container_tool }} login -u='{{ registry_redhat_io_user }}' -p='{{ registry_redhat_io_token }}' registry.redhat.io"
# no_log: true
when:
- registry_redhat_io_user is defined and registry_redhat_io_token is defined
- registry_redhat_io_user|length > 0 or registry_redhat_io_token|length > 0
- mirror_multiarch_image.startswith('registry.redhat.io')

- name: "Generate cache locally"
# shell: "{{ opm_bin_path }} serve {{ pfbc_fbc_config_path }} --cache-dir={{ pfbc_local_cache_dir }} --cache-only --termination-log /dev/null"
shell: "{{ container_tool }} run -it --rm --entrypoint /bin/opm -v {{ pfbc_extracted_fbc_location }}:/conf -u 1001:0 {{ mirror_multiarch_image }} serve /conf/configs --cache-dir=/conf/cache --cache-only --termination-log /dev/null"

# - name: "Copy cache"
# synchronize:
# src: "{{ pfbc_local_cache_dir }}/"
# dest: "{{ pfbc_extracted_fbc_location }}/cache/"
- name: "Generate cache locally using host opm to solve arch issues"
shell: "{{ opm_bin_path }} serve {{ pfbc_fbc_config_path }} --cache-dir={{ pfbc_extracted_fbc_location }}/cache --cache-only --termination-log /dev/null"

@BorekZnovustvoritel BorekZnovustvoritel Jun 25, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found out that the custom cache IS needed. It's because without it, the playbook would try to run opm from within the multuarch image. It passed for amd64, but other arches failed immediately because the opm binary was not runnable.

However the cache can be created without ever reaching out to registry.redhat.io, so the credential requirement can be removed from here.


when: pfbc_opm_bug_line.found

Expand Down
Loading