Add jobs for Istio release-3.5 by bmangoen · Pull Request #84062 · openshift/release

bmangoen · 2026-08-26T07:42:55Z

Summary by CodeRabbit

Adds OpenShift CI configuration for the OpenShift Service Mesh Istio 1.31 release.

Defines build inputs and release metadata for the release-1.31 branch of openshift-service-mesh/istio.
Configures resource settings and linting.
Adds Helm integration suites for security, pilot, telemetry, and ambient modes.
Adds a postsubmit job that updates the Istio module.

coderabbitai · 2026-08-26T07:43:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ed59402-9e66-4f03-90e4-1a6c1864b462

📥 Commits

Reviewing files that changed from the base of the PR and between 142f76e and 776f351.

⛔ Files ignored due to path filters (2)

ci-operator/jobs/openshift-service-mesh/istio/openshift-service-mesh-istio-release-1.31-postsubmits.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift-service-mesh/istio/openshift-service-mesh-istio-release-1.31-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

ci-operator/config/openshift-service-mesh/istio/openshift-service-mesh-istio-release-1.31.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

Walkthrough

This change adds the OpenShift Service Mesh Istio 1.31 release configuration. It defines build and release settings, linting, AWS integration suites, postsubmit module maintenance, and generated repository metadata.

Changes

Istio 1.31 release

Layer / File(s)	Summary
Release build and test configuration `ci-operator/config/openshift-service-mesh/istio/openshift-service-mesh-istio-release-1.31.yaml`	Defines build inputs, release metadata, resources, images, cache, architecture, channel, version, linting, and AWS integration suites for Helm, security, pilot, telemetry, and ambient modes.
Postsubmit release maintenance `ci-operator/config/openshift-service-mesh/istio/openshift-service-mesh-istio-release-1.31.yaml`	Adds postsubmit automation that updates the Istio module from `release-1.31`, runs generation, creates an automator change on `release-3.5`, and reports failures.
Generated release metadata `ci-operator/config/openshift-service-mesh/istio/openshift-service-mesh-istio-release-1.31.yaml`	Records the `release-1.31` branch and the `openshift-service-mesh/istio` repository.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 776f3

The PR is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The new release config activates the privilege-bearing `servicemesh-istio-e2e-profile` workflow for five integration jobs. That workflow runs `servicemesh-istio-e2e`, which creates a Pod with `securit…	Use an unprivileged workflow and builder Pod for the new jobs. Remove `privileged: true`, remove the `SYS_ADMIN` capability, and run the builder as a non-root user. Do not reference the existing privilege-bearing workflow unless its Pod sec…
Title check	⚠️ Warning	The title refers to adding Istio release jobs, which is related to the pull request. However, it specifies release-3.5 while the reviewed configuration targets Istio release-1.31, so the title is misl…	Update the title to identify the Istio 1.31 release configuration or jobs, such as "Add jobs for Istio release-1.31".
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	The pull request adds five integration test jobs. Each job sets `TEST_HUB: quay.io/sail-dev` and runs `servicemesh-istio-images-build` followed by `servicemesh-istio-int-tests`. The step definitions s…	IPv6 and disconnected network compatibility notice: This test may contain IPv4 assumptions or external connectivity requirements that will fail in IPv6-only disconnected environments. Please verify your test works on IPv6 by running an …

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request adds CI configuration and generated Prow jobs, not Ginkgo test source. The changed files contain no It(), Describe(), Context(), When(), or other Ginkgo title calls. The test an…
Test Structure And Quality	✅ Passed	PASS: The pull request adds only CI YAML configuration and generated Prow job YAML. The committed diff contains no Ginkgo source, It blocks, assertions, resource setup, or Eventually/Consistently call…
Microshift Test Compatibility	✅ Passed	PASS — The pull request adds only CI configuration and generated job YAML files. The complete diff contains no new Ginkgo test definitions or test-source files, and the configuration only references e…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The check is not applicable. The commit adds only YAML CI configuration and generated Prow job files. It adds no Go or other test source files and no Ginkgo declarations such as It(), Describe(), Cont…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The commit adds only CI Operator configuration and generated Prow job definitions. The changed files contain no Deployment, StatefulSet, PDB, affinity, topology spread, node selector, toleration…
Ote Binary Stdout Contract	✅ Passed	PASS. The commit adds only YAML configuration and generated Prow job files. It adds no Go source or OTE binary entry points. Added commands invoke `make lint`, integration shell steps, and module auto…
No-Weak-Crypto	✅ Passed	PASS. The pull request adds only CI YAML configuration and generated Prow jobs. The exact 734 added lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, no custom crypto implementation,…
No-Sensitive-Data-In-Logs	✅ Passed	No changed code adds logging of sensitive data. The new configuration passes only the GitHub token file path (`-f /creds-github/token`); it does not print the token. The generated jobs mount secrets b…

Full details: Title check

Explanation

The title refers to adding Istio release jobs, which is related to the pull request. However, it specifies release-3.5 while the reviewed configuration targets Istio release-1.31, so the title is misleading.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request adds CI configuration and generated Prow jobs, not Ginkgo test source. The changed files contain no It(), Describe(), Context(), When(), or other Ginkgo title calls. The test and job identifiers are static, such as integ-helm, integ-security, and Istio Integration telemetry. The only run-dependent value found is status.podIP, and it is assigned to HTTP_SERVER_IP in job setup, not used in a test title. The fixed pod and namespace values also do not have generated suffixes.

Full details: Test Structure And Quality

Explanation

PASS: The pull request adds only CI YAML configuration and generated Prow job YAML. The committed diff contains no Ginkgo source, It blocks, assertions, resource setup, or Eventually/Consistently calls. The referenced Istio integration step is pre-existing and is not changed by this pull request, so the Ginkgo test-structure requirements are not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request adds only CI configuration and generated job YAML files. The complete diff contains no new Ginkgo test definitions or test-source files, and the configuration only references external integration suites. The MicroShift Test Compatibility check is therefore not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

The check is not applicable. The commit adds only YAML CI configuration and generated Prow job files. It adds no Go or other test source files and no Ginkgo declarations such as It(), Describe(), Context(), or When(). The new jobs reference CI workflows and test steps; they do not introduce a new test body with a multi-node assumption.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The commit adds only CI Operator configuration and generated Prow job definitions. The changed files contain no Deployment, StatefulSet, PDB, affinity, topology spread, node selector, toleration, replica, or maxUnavailable scheduling declarations. cluster_profile: ossm-aws and CI resource requests select the test environment; they do not constrain deployed workloads. The referenced workflow and test steps are existing, unchanged code, so they do not establish pull-request causality for this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The commit adds only YAML configuration and generated Prow job files. It adds no Go source or OTE binary entry points. Added commands invoke make lint, integration shell steps, and module automation; they contain no openshift-tests, RunSpecs, BeforeSuite, klog, or stdout logging configuration. The integration jobs reuse existing Service Mesh steps and match the existing release-1.30 configuration pattern. No explicit OTE stdout contract violation is introduced.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

The pull request adds five integration test jobs. Each job sets TEST_HUB: quay.io/sail-dev and runs servicemesh-istio-images-build followed by servicemesh-istio-int-tests. The step definitions state that the build step pushes images to quay.io/sail-dev and that the test step pulls images from TEST_HUB. This is public-registry connectivity with no internal test-image registry. The integration test command also downloads parse-test-config.sh from https://raw.githubusercontent.com/openshift-service-mesh/ci-utils/.... The new jobs have no Skipped:Disconnected marker. No IPv4-specific address was found, but the external-connectivity condition is sufficient for failure.

Resolution

IPv6 and disconnected network compatibility notice: This test may contain IPv4 assumptions or external connectivity requirements that will fail in IPv6-only disconnected environments. Please verify your test works on IPv6 by running an additional CI job: /payload-job periodic-ci-openshift-release-master-nightly-4.22-e2e-metal-ipi-ovn-ipv6 In the openshift/origin repo, use GetIPAddressFamily() or GetIPFamilyForCluster() to detect the cluster IP family when applicable. For this CI configuration, replace the direct quay.io/sail-dev test-image push and pull with an internal registry or a configured mirror. Mirror or vendor parse-test-config.sh instead of downloading it from raw.githubusercontent.com. If the external dependency cannot be adapted, add [Skipped:Disconnected] to the affected test name so disconnected clusters skip it.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request adds only CI YAML configuration and generated Prow jobs. The exact 734 added lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, no custom crypto implementation, and no secret or token comparison. Secret mounts and the GitHub token path only provide CI credentials; they do not compare or process them cryptographically.

Full details: Container-Privileges

Explanation

The new release config activates the privilege-bearing servicemesh-istio-e2e-profile workflow for five integration jobs. That workflow runs servicemesh-istio-e2e, which creates a Pod with securityContext.privileged: true, adds SYS_ADMIN, and sets runAsUser: 0. The workflow and script predate this pull request, but the new config invokes them and creates new jobs that use the privileged Pod. This matches explicit failure conditions.

Resolution

Use an unprivileged workflow and builder Pod for the new jobs. Remove privileged: true, remove the SYS_ADMIN capability, and run the builder as a non-root user. Do not reference the existing privilege-bearing workflow unless its Pod security settings are changed and all dependent jobs are verified.

Full details: No-Sensitive-Data-In-Logs

Explanation

No changed code adds logging of sensitive data. The new configuration passes only the GitHub token file path (-f /creds-github/token); it does not print the token. The generated jobs mount secrets by path and report only job status and a log URL. The referenced image-build step disables shell tracing while reading and using QUAY_USERNAME and QUAY_PASSWORD, then restores tracing. Its traced commands contain no credential values. The internal BASE_DOMAIN value and report URL are configuration/reporting data, not added log output, and the same pattern exists in the established 1.30 release configuration.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-merge-bot · 2026-08-26T07:46:27Z

[REHEARSALNOTIFIER]
@bmangoen: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-service-mesh-istio-release-1.31-integ-ambient	openshift-service-mesh/istio	presubmit	Presubmit changed
pull-ci-openshift-service-mesh-istio-release-1.31-integ-helm	openshift-service-mesh/istio	presubmit	Presubmit changed
pull-ci-openshift-service-mesh-istio-release-1.31-integ-pilot	openshift-service-mesh/istio	presubmit	Presubmit changed
pull-ci-openshift-service-mesh-istio-release-1.31-integ-security	openshift-service-mesh/istio	presubmit	Presubmit changed
pull-ci-openshift-service-mesh-istio-release-1.31-integ-telemetry	openshift-service-mesh/istio	presubmit	Presubmit changed
pull-ci-openshift-service-mesh-istio-release-1.31-lint	openshift-service-mesh/istio	presubmit	Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

unsortedhashsets

LGTM, lets see tests result

unsortedhashsets · 2026-08-26T07:59:14Z

/pj-rehearse auto-ack

openshift-merge-bot · 2026-08-26T07:59:53Z

@unsortedhashsets: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-ci · 2026-08-26T09:24:19Z

@bmangoen: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift-service-mesh/istio/release-1.31/integ-telemetry	`776f351`	link	unknown	`/pj-rehearse pull-ci-openshift-service-mesh-istio-release-1.31-integ-telemetry`
ci/rehearse/openshift-service-mesh/istio/release-1.31/integ-helm	`776f351`	link	unknown	`/pj-rehearse pull-ci-openshift-service-mesh-istio-release-1.31-integ-helm`
ci/rehearse/openshift-service-mesh/istio/release-1.31/integ-pilot	`776f351`	link	unknown	`/pj-rehearse pull-ci-openshift-service-mesh-istio-release-1.31-integ-pilot`
ci/rehearse/openshift-service-mesh/istio/release-1.31/integ-ambient	`776f351`	link	unknown	`/pj-rehearse pull-ci-openshift-service-mesh-istio-release-1.31-integ-ambient`
ci/rehearse/openshift-service-mesh/istio/release-1.31/integ-security	`776f351`	link	unknown	`/pj-rehearse pull-ci-openshift-service-mesh-istio-release-1.31-integ-security`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

unsortedhashsets · 2026-08-26T10:20:02Z

Ignore rehearse as it will fail till downstream changed wont applied: openshift-service-mesh/istio#915

FilipB · 2026-08-26T12:45:20Z

/pj-rehearse ack

openshift-ci · 2026-08-26T12:46:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bmangoen, FilipB, unsortedhashsets

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift-service-mesh/istio/OWNERS~~ [FilipB,bmangoen]
~~ci-operator/jobs/openshift-service-mesh/istio/OWNERS~~ [FilipB,bmangoen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-08-26T12:49:13Z

@FilipB: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

Add jobs for Istio release-3.5

776f351

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 26, 2026

openshift-ci Bot requested review from fjglira and yxun August 26, 2026 07:47

unsortedhashsets approved these changes Aug 26, 2026

View reviewed changes

openshift-ci Bot assigned unsortedhashsets Aug 26, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 26, 2026

FilipB approved these changes Aug 26, 2026

View reviewed changes

openshift-ci Bot assigned FilipB Aug 26, 2026

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Aug 26, 2026

openshift-merge-bot Bot merged commit 537eb5e into openshift:main Aug 26, 2026
16 of 21 checks passed

Navigation Menu

Uh oh!

Add jobs for Istio release-3.5 - #84062

Add jobs for Istio release-3.5#84062
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
bmangoen:add-istio-35

bmangoen commented Aug 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

Pre-merge checks failed

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

unsortedhashsets left a comment

Uh oh!

unsortedhashsets commented Aug 26, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

unsortedhashsets commented Aug 26, 2026

Uh oh!

FilipB commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

bmangoen commented Aug 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 error, 2 warnings)

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

unsortedhashsets left a comment

Choose a reason for hiding this comment

Uh oh!

unsortedhashsets commented Aug 26, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

unsortedhashsets commented Aug 26, 2026

Uh oh!

FilipB commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bmangoen commented Aug 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading