Fix OKD release-controller-api registry auth

[hoxhaeris]

The OKD API deployment created in #83116 is missing the HOME and XDG_RUNTIME_DIR environment variables and the oc-prepare init container that the OCP API deployment has. Without these, oc cannot locate registry credentials and all release info requests fail with:

unauthorized: authentication required

This adds get_oc_env_vars() and get_oc_prepare_container() to the OKD API deployment template in origin_resources.py, matching the OCP API template in osd_rc_deployments.py.

Summary by CodeRabbit

• Updates the OKD release-controller API deployment for AMD64 and ARM64.
• Sets HOME and XDG_RUNTIME_DIR so oc can find registry credentials.
• Adds an oc-prepare init container to configure Git credentials, authenticate to the registry, and populate release changelog data.
• Prevents release information requests from failing with unauthorized: authentication required.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@hoxhaeris: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

Walkthrough

The release-controller generator now adds shared runtime environment variables and an oc-prepare init container. The init container configures credentials, authenticates to the registry, retrieves accepted releases, and populates the shared Git cache.

Changes

Release controller preparation

Layer / File(s)	Summary
Generator preparation wiring hack/generators/release-controllers/content/origin_resources.py	The API deployment uses get_oc_prepare_container() and get_oc_env_vars().
Runtime and release cache preparation clusters/app.ci/release-controller/deploy-origin-controller.yaml, clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml	The API containers set HOME and XDG_RUNTIME_DIR. The oc-prepare init containers configure credentials, authenticate to the registry, retrieve accepted releases when available, and populate /tmp/git with release changelogs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant oc-prepare
  participant ReleaseRegistry
  participant GitCache
  participant ReleaseControllerAPI
  oc-prepare->>ReleaseRegistry: Authenticate and query accepted releases
  oc-prepare->>GitCache: Populate release changelogs
  oc-prepare->>ReleaseControllerAPI: Complete initialization
  ReleaseControllerAPI->>GitCache: Use the shared Git cache

Loading

Possibly related PRs

• openshift/release#83116: Modifies the same release-controller manifests and generator logic for oc-prepare and runtime environment configuration.

Suggested reviewers: bradmwilliams

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch changes only deployment YAML and a generator; it adds no It, Describe, Context, When, or other test titles.
Test Structure And Quality	✅ Passed	The commit changes only two YAML files and one Python generator; no Ginkgo tests, Go files, or Ginkgo markers are added or modified.
Microshift Test Compatibility	✅ Passed	The pull request changes only YAML deployments and a Python generator; it adds no Ginkgo e2e tests or test constructs requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only release-controller YAML and Python deployment generation; the diff adds no Ginkgo e2e tests or topology-sensitive test logic, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR adds env vars, an init container, and volume mounts only. The parent diff adds no affinity, spread, node targeting, tolerations, PDB, or replica-count scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only deployment YAML and Python; it changes no Go/OTE binary, suite setup, or process-level stdout code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only YAML and Python deployment generation; it adds no Ginkgo e2e tests, so the IPv6/disconnected test compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	The added lines only wire existing environment and registry-preparation helpers; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	Changed manifests and the shared helper add no privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation:true, or explicit root settings.
No-Sensitive-Data-In-Logs	✅ Passed	The added init script emits only generic status and duration messages; it has no xtrace and captures curl results, while registry credentials remain in mounted files.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: fixing registry authentication for the OKD release-controller API.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml`:
- Around line 285-306: Update get_oc_prepare_container() to add a restrictive
container securityContext with runAsNonRoot, readOnlyRootFilesystem,
allowPrivilegeEscalation: false, and dropped capabilities, plus CPU and memory
requests and limits; then regenerate both manifests so the hardened oc-prepare
container is rendered in
clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml:285-306
and clusters/app.ci/release-controller/deploy-origin-controller.yaml:285-306.

In `@hack/generators/release-controllers/content/origin_resources.py`:
- Line 299: Update get_oc_prepare_container so both release-stream curl fetches
use connection and total timeouts, and handle nonzero curl results without
triggering set -e. Preserve the existing fallback values when either discovery
request fails, allowing the init container to complete.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5fa856c7-79ef-4122-8fdd-8dcf409bcbe4

📥 Commits

Reviewing files that changed from the base of the PR and between 7f6bc53 and b0a3607.

📒 Files selected for processing (3)

• clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml
• clusters/app.ci/release-controller/deploy-origin-controller.yaml
• hack/generators/release-controllers/content/origin_resources.py

[thiagoalessio]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bradmwilliams, hoxhaeris, thiagoalessio

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/app.ci/release-controller/OWNERS [bradmwilliams]
• hack/generators/release-controllers/OWNERS [bradmwilliams]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@hoxhaeris: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.