NO-ISSUE: Fix CentOS 9/10 CI image creation and runtime

[ggiguash]

Implements workarounds for:

• USHIFT-7337 until the problem is fixed in OVN-k upstream.
• USHIFT-7321 until the problem is fixed in RHEL-193507

Summary by CodeRabbit

Summary by CodeRabbit

• New Features

  • Expanded image-builder support to include CentOS Stream and CentOS Linux references (e.g., Stream 9/10, COS 9/10).

• Bug Fixes

  • Improved container cleanup to terminate containers started from the new CentOS-based builder image.
  • Enhanced image selection to better match RHEL 9, CentOS Stream 9/10, and CentOS Linux 9/10 inputs.
  • Added a CentOS Stream 9 installer workaround to ensure ostree runs reliably.
  • Updated the test agent image to include an additional kernel module package for CentOS 10-based environments.

[openshift-ci-robot]

@ggiguash: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[ggiguash]

/test ?

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds CentOS-family bootc image handling, a cos10 test agent package update, and a CentOS Stream 9 kickstart workaround.

Changes

CentOS bootc support updates

Layer / File(s)	Summary
Builder image mapping test/bin/pyutils/build_bootc_images.py	Adds BIB_IMAGE_CENTOS, includes it in cleanup filtering, and maps CentOS Stream/CentOS Linux refs to it while keeping the existing RHEL9 path.
cos10 test agent package test/image-blueprints-bootc/upstream/group1/cos10-test-agent.containerfile	Installs kernel-modules-extra and documents why it is needed.
CentOS Stream 9 ostree wrapper test/kickstart-templates/includes/main-ostreecontainer.cfg	Adds a CentOS Stream 9-specific %pre-install wrapper around ostree that clears INVOCATION_ID and restores SELinux context.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The router deployment adds a haproxy container with allowPrivilegeEscalation: true, which this check flags.	Remove allowPrivilegeEscalation: true or document why this privilege is required.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR’s main CentOS 9/10 CI image creation and runtime fixes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo specs or dynamic titles were changed; the touched files are Python/Containerfile/CFG, and the diff contains no Go test files.
Test Structure And Quality	✅ Passed	PR only changes a Python helper, a containerfile, and a kickstart script; no Ginkgo specs, It blocks, Eventuallys, or test setup/cleanup to review.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes build/template files, so MicroShift API compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the diff only changes a Python helper, a containerfile, and a kickstart template.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a kickstart ostree workaround changed; no scheduling constraints, replicas, node selectors, or topology-sensitive manifests/controllers were added.
Ote Binary Stdout Contract	✅ Passed	No stdout writes were added: the Python helper logs via common.print_msg/default stderr, and the touched containerfile/kickstart changes contain no process-level prints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only changes build/image/kickstart configs; no new Ginkgo e2e tests or IPv4-only/external-network test code was added.
No-Weak-Crypto	✅ Passed	Scanned all PR-touched files; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or digest/secret comparisons found, and the edits are TLS policy/docs only.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging of secrets/PII/internal hosts was added; the changes are a CentOS ostree workaround and image/build tweaks only.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ggiguash]

/test e2e-aws-tests-bootc-upstream
/test e2e-aws-tests-bootc-upstream-arm

[ggiguash]

/test e2e-aws-tests-bootc-upstream
/test e2e-aws-tests-bootc-upstream-arm

[ggiguash]

/test e2e-aws-tests-bootc-upstream
/test e2e-aws-tests-bootc-upstream-arm

[ggiguash]

/test e2e-aws-tests-bootc-upstream
/test e2e-aws-tests-bootc-upstream-arm

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@assets/components/ovn/single-node/master/daemonset.yaml`:
- Around line 358-367: The change in the OVN master daemonset manifest is in a
rebase-managed asset, so the nftables conntrack fix must also be added to the
corresponding rebase patch under scripts/auto-rebase/ rather than relying on the
YAML edit alone. Update the patch source that drives the daemonset manifest
generation, keeping the nft/NOTRACK changes in sync with the manifest via the
relevant rebase-managed patch file for the OVN master daemonset.
- Around line 363-367: The nft setup in the startup script is not idempotent, so
repeated pod restarts can fail when `nft add table inet raw` and the `nft add
chain inet raw ...` commands hit existing objects. Update the command sequence
in the `daemonset.yaml` startup logic to make the `raw` table and its
`prerouting`/`output` chains safe to re-run on every boot, using the existing
nftables setup block that precedes `exec ovnkube`; the fix should ensure the
hostNetwork namespace can already contain these objects without aborting
startup.
- Around line 363-367: The NOTRACK setup in the OVN daemonset is still using the
legacy iptables/ip6tables path in the multi-node node manifest, while the
single-node path already uses nftables. Update the NOTRACK rule programming to
follow the nft flow used in the single-node manifest by switching the relevant
setup in the daemonset’s OVN init logic to nft commands, keeping both paths
consistent for the xt_CT/xt_NOTRACK removal case.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 81ef0feb-cc94-4efc-aa9b-2be8fdf97697

📥 Commits

Reviewing files that changed from the base of the PR and between 4e9711d and e6c6124.

📒 Files selected for processing (1)

• assets/components/ovn/single-node/master/daemonset.yaml

[ggiguash]

/test e2e-aws-tests-bootc-upstream
/test e2e-aws-tests-bootc-upstream-arm

[ggiguash]

/test e2e-aws-tests-bootc-upstream
/test e2e-aws-tests-bootc-upstream-arm

[coderabbitai]

🧹 Nitpick comments (1)

test/kickstart-templates/includes/main-ostreecontainer.cfg (1)

27-30: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use the repo-standard shell prologue.

The wrapper is shell code, so it should use #!/usr/bin/bash and set -euo pipefail to match the repository shell standard. As per coding guidelines, Shell: #!/usr/bin/bash; set -euo pipefail.

♻️ Proposed fix

-#!/bin/bash
+#!/usr/bin/bash
+set -euo pipefail

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/kickstart-templates/includes/main-ostreecontainer.cfg` around lines 27 -
30, The ostree wrapper script in the bootstrap template is using a non-standard
shell header and missing the repository’s required safety prologue. Update the
heredoc in the `ostree` wrapper to use the repo-standard shell prologue
(`#!/usr/bin/bash` plus `set -euo pipefail`) before the existing `unset
INVOCATION_ID` and `exec /usr/bin/ostree.real "$@"` logic.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/kickstart-templates/includes/main-ostreecontainer.cfg`:
- Around line 27-30: The ostree wrapper script in the bootstrap template is
using a non-standard shell header and missing the repository’s required safety
prologue. Update the heredoc in the `ostree` wrapper to use the repo-standard
shell prologue (`#!/usr/bin/bash` plus `set -euo pipefail`) before the existing
`unset INVOCATION_ID` and `exec /usr/bin/ostree.real "$@"` logic.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 48281e84-0c91-49ea-b2bd-c7c423348910

📥 Commits

Reviewing files that changed from the base of the PR and between a4e22cd and 155f943.

📒 Files selected for processing (1)

• test/kickstart-templates/includes/main-ostreecontainer.cfg

[ggiguash]

Bootc periodics failed due to low-latency errors

/override ci/prow/e2e-aws-tests-bootc-periodic-arm-el10 ci/prow/e2e-aws-tests-bootc-periodic-el9 ci/prow/e2e-aws-tests-bootc-periodic-el10

Upstream tests failed due to optional scenario issues - will be handled elsewhere.

/override ci/prow/e2e-aws-tests-bootc-upstream ci/prow/e2e-aws-tests-bootc-upstream-arm

[openshift-ci]

@ggiguash: Overrode contexts on behalf of ggiguash: ci/prow/e2e-aws-tests-bootc-periodic-arm-el10, ci/prow/e2e-aws-tests-bootc-periodic-el10, ci/prow/e2e-aws-tests-bootc-periodic-el9, ci/prow/e2e-aws-tests-bootc-upstream, ci/prow/e2e-aws-tests-bootc-upstream-arm

Details

In response to this:

Bootc periodics failed due to low-latency errors

/override ci/prow/e2e-aws-tests-bootc-periodic-arm-el10 ci/prow/e2e-aws-tests-bootc-periodic-el9 ci/prow/e2e-aws-tests-bootc-periodic-el10

Upstream tests failed due to optional scenario issues - will be handled elsewhere.

/override ci/prow/e2e-aws-tests-bootc-upstream ci/prow/e2e-aws-tests-bootc-upstream-arm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ggiguash]

/verified by ci

[openshift-ci-robot]

@ggiguash: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[pacevedom]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ggiguash, pacevedom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ggiguash,pacevedom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 2be4d6c and 2 for PR HEAD 155f943 in total

[openshift-ci]

@ggiguash: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.