Revert "DPF: Release image support"

[josecastillolema]

Reverts #83995

Summary by CodeRabbit

• Reverts DPF release image support in the hypervisor cluster deployment workflow.
• Passes RELEASE_IMAGE_LATEST directly to the remote environment as PAYLOAD_URL.
• Removes local release payload resolution and public registry URL construction.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 280acdbb-f12d-4dff-8843-832cd445761a

📥 Commits

Reviewing files that changed from the base of the PR and between 3a89375 and 0362bd2.

📒 Files selected for processing (1)

• ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

Walkthrough

The deployment script now forwards RELEASE_IMAGE_LATEST directly as PAYLOAD_URL. It removes local payload resolution, public registry URL conversion, version extraction, and related failure handling.

Changes

Payload forwarding

Layer / File(s)	Summary
Direct payload assignment ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh	The script assigns RELEASE_IMAGE_LATEST to PAYLOAD_URL, defaults to an empty value when unset, and logs the assignment state. It removes local release resolution and version validation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0362b

This localized revert is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The change causes an internal registry hostname to be written to logs. The parent script converted RELEASE_IMAGE_LATEST from the build-cluster-internal registry (registry.buildXX.ci.openshift.org,…	Do not expose the raw release pullspec through logged environment output. Restore conversion to a public pullspec before export, or remove the broad remote env commands and log only an allowlist of non-sensitive variables. Verify that gen…

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states that the pull request reverts "DPF: Release image support," which matches the stated objective and changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only one shell command file. The diff adds no Ginkgo test declarations or test titles. The dynamic timestamp and runtime values in the file are operational paths and log…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh (+3/-20). The diff contains no Ginkgo tests or It, `BeforeEach…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only the DPF hypervisor deployment shell script. The committed diff adds no Ginkgo tests or test constructs such as It(), Describe(), Context(), or When(). There…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The pull request changes only dpf-hypervisor-deploy-cluster-commands.sh. The diff adds no Ginkgo tests (It, Describe, Context, or When) and contains no SNO topology assumptions. The c…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only dpf-hypervisor-deploy-cluster-commands.sh. The diff replaces local release-image resolution with direct PAYLOAD_URL forwarding. It adds no deployment manifest, …
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh. The diff contains shell echo statements and no OTE binary cod…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only one shell script and adds no Ginkgo e2e tests. The diff only replaces payload resolution logic with direct RELEASE_IMAGE_LATEST forwarding. Therefore, the custom …
No-Weak-Crypto	✅ Passed	PASS. The commit changes only PAYLOAD_URL handling in one shell script. Added code assigns RELEASE_IMAGE_LATEST and logs whether the value is set. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowf…
Container-Privileges	✅ Passed	PASS. The pull request changes only a shell script and replaces local release-image resolution with PAYLOAD_URL assignment. The diff adds no privileged, hostPID, hostNetwork, hostIPC, `SYS_A…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only one shell command file. The diff adds no Ginkgo test declarations or test titles. The dynamic timestamp and runtime values in the file are operational paths and log messages, not test names. The changed payload-handling lines contain no test-title constructs.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh (+3/-20). The diff contains no Ginkgo tests or It, BeforeEach, AfterEach, Eventually, or Consistently blocks. Therefore the stated Test Structure and Quality requirements are not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only the DPF hypervisor deployment shell script. The committed diff adds no Ginkgo tests or test constructs such as It(), Describe(), Context(), or When(). Therefore, the MicroShift test compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS — The pull request changes only dpf-hypervisor-deploy-cluster-commands.sh. The diff adds no Ginkgo tests (It, Describe, Context, or When) and contains no SNO topology assumptions. The check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only dpf-hypervisor-deploy-cluster-commands.sh. The diff replaces local release-image resolution with direct PAYLOAD_URL forwarding. It adds no deployment manifest, operator code, controller code, replica setting, affinity, topology spread, node selector, toleration, or PDB. Therefore, it introduces no topology scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh. The diff contains shell echo statements and no OTE binary code or process-level Go setup such as main, TestMain, BeforeSuite, RunSpecs, or klog configuration. The OTE Binary Stdout Contract does not apply to this change.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only one shell script and adds no Ginkgo e2e tests. The diff only replaces payload resolution logic with direct RELEASE_IMAGE_LATEST forwarding. Therefore, the custom check's IPv4 and disconnected-network test conditions do not apply.

Full details: No-Weak-Crypto

Explanation

PASS. The commit changes only PAYLOAD_URL handling in one shell script. Added code assigns RELEASE_IMAGE_LATEST and logs whether the value is set. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token comparison.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only a shell script and replaces local release-image resolution with PAYLOAD_URL assignment. The diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root security settings. The referenced step manifest has no privilege fields. Existing ssh root@${REMOTE_HOST} usage is unchanged and is not a container/Kubernetes manifest change.

Full details: No-Sensitive-Data-In-Logs

Explanation

The change causes an internal registry hostname to be written to logs. The parent script converted RELEASE_IMAGE_LATEST from the build-cluster-internal registry (registry.buildXX.ci.openshift.org, documented in the parent code) to a public pullspec before exporting PAYLOAD_URL. The changed script assigns the raw RELEASE_IMAGE_LATEST to PAYLOAD_URL and exports it on the remote host. The subsequent remote env commands print PAYLOAD_URL=<raw pullspec> to the SSH output, so the internal hostname can appear in CI logs. The new local status message is masked, but it does not prevent the remote env output.

Resolution

Do not expose the raw release pullspec through logged environment output. Restore conversion to a public pullspec before export, or remove the broad remote env commands and log only an allowlist of non-sensitive variables. Verify that generated deployment logs contain neither the internal registry hostname nor other sensitive environment values.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@josecastillolema: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-rh-ecosystem-edge-openshift-dpf-main-deploy-cluster	rh-ecosystem-edge/openshift-dpf	presubmit	Registry content changed
pull-ci-rh-ecosystem-edge-openshift-dpf-main-deploy-cluster-doca4	rh-ecosystem-edge/openshift-dpf	presubmit	Registry content changed
pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-deploy-cluster	rh-ecosystem-edge/openshift-dpf	presubmit	Registry content changed
pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-deploy-cluster-doca4	rh-ecosystem-edge/openshift-dpf	presubmit	Registry content changed
pull-ci-rh-ecosystem-edge-openshift-dpf-release-4.22-deploy-cluster	rh-ecosystem-edge/openshift-dpf	presubmit	Registry content changed
pull-ci-rh-ecosystem-edge-openshift-dpf-release-4.22-deploy-cluster-doca4	rh-ecosystem-edge/openshift-dpf	presubmit	Registry content changed
periodic-ci-rh-ecosystem-edge-openshift-dpf-main-daily-network-doca4	N/A	periodic	Registry content changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@josecastillolema: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[josecastillolema]

/pj-rehearse ack

[openshift-merge-bot]

@josecastillolema: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[tsorya]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: josecastillolema, tsorya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/dpf/hypervisor/deploy-cluster/OWNERS [josecastillolema,tsorya]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment