Log rox-ci-image digest in stackrox prow steps#77727
Conversation
openshift-ci
Bot
added
do-not-merge/hold
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a non-failing startup diagnostic block to a CI shell script that prints probe markers, attempts to echo imagestreamtag fields for Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@ci-operator/step-registry/stackrox/stackrox/begin/stackrox-stackrox-begin-commands.sh`:
- Around line 5-7: The kubectl lookup can return an empty string with exit code
0, so replace the inline fallback chain using "kubectl get pod \"$HOSTNAME\" -o
jsonpath='{.status.containerStatuses[0].imageID}' || grep '^imageid='
/run/.containerenv || echo \"unknown\"" with a robust sequence that captures the
kubectl output into a variable (e.g., image=$(kubectl get pod ... 2>/dev/null ||
true)), if [ -z "$image" ] then try the grep fallback (image=$(grep '^imageid='
/run/.containerenv 2>/dev/null || true)); if still empty set image="unknown";
finally printf that variable. Apply the same change to the other identical
blocks that use the same kubectl jsonpath + grep fallback.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: b1921e90-5392-480b-8d64-ec85e11fb85a
📒 Files selected for processing (3)
ci-operator/step-registry/stackrox/stackrox/begin/stackrox-stackrox-begin-commands.shci-operator/step-registry/stackrox/stackrox/e2e-test/stackrox-stackrox-e2e-test-commands.shci-operator/step-registry/stackrox/stackrox/end/stackrox-stackrox-end-commands.sh
|
/cc @tommartensen |
|
Do you have a rehearse job where I can see that |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-nongroovy-e2e-tests pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Ty! What I had before was naive in expecting only one pod. We have a "sidecar" that original query found first. And once I fixed that I found that the image digest listed is the upper-step manifest. This new version grabs the name so we know which "flavor" like "stackrox-ui-tes" and it asks Quay for what group of images included the manifest digest (It lists all of them, so we just take the first and cut out the version part of the tag: the first one may not match the flavor that is running, but they all have the same "version" in the tag). |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
439a16c to
f7c3619
Compare
|
The quay query was not consistent. It turned out that when a new (0.5.8) tag was pushed, the query then found that instead of the tag(s) matching the manifest digest which I thought was unique to the 0.5.7 set of images. |
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Only log Created date and Labels from dockerImageMetadata. Avoid logging the full Config (which includes Env) to prevent accidental secret exposure. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
/pj-rehearse pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
/cc @tommartensen |
The -latest tag was used temporarily to test /i-am-rox-ci-image content. Reverting to -stable for the final PR. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
[REHEARSALNOTIFIER]
A total of 317 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/unhold |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: davdhacs, tommartensen The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: davdhacs, tommartensen The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse ack |
|
@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
3b8306f
into
openshift:main
* debug: log rox-ci-image info via internal registry API Query the internal registry directly with the SA token to get the full image config (labels, env, etc). Also temporarily switch to -latest tag to test /i-am-rox-ci-image content. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: log rox-ci-image source tag and metadata in begin step Print the imagestreamtag source reference and full dockerImageMetadata (includes labels, env, created date when available). Also cat /i-am-rox-ci-image for version info baked into the image. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: narrow rox-ci-image logging to safe fields only Only log Created date and Labels from dockerImageMetadata. Avoid logging the full Config (which includes Env) to prevent accidental secret exposure. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * revert: switch build_root back to stackrox-ui-test-stable The -latest tag was used temporarily to test /i-am-rox-ci-image content. Reverting to -stable for the final PR. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* debug: log rox-ci-image info via internal registry API Query the internal registry directly with the SA token to get the full image config (labels, env, etc). Also temporarily switch to -latest tag to test /i-am-rox-ci-image content. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: log rox-ci-image source tag and metadata in begin step Print the imagestreamtag source reference and full dockerImageMetadata (includes labels, env, created date when available). Also cat /i-am-rox-ci-image for version info baked into the image. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: narrow rox-ci-image logging to safe fields only Only log Created date and Labels from dockerImageMetadata. Avoid logging the full Config (which includes Env) to prevent accidental secret exposure. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * revert: switch build_root back to stackrox-ui-test-stable The -latest tag was used temporarily to test /i-am-rox-ci-image content. Reverting to -stable for the final PR. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* debug: log rox-ci-image info via internal registry API Query the internal registry directly with the SA token to get the full image config (labels, env, etc). Also temporarily switch to -latest tag to test /i-am-rox-ci-image content. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: log rox-ci-image source tag and metadata in begin step Print the imagestreamtag source reference and full dockerImageMetadata (includes labels, env, created date when available). Also cat /i-am-rox-ci-image for version info baked into the image. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: narrow rox-ci-image logging to safe fields only Only log Created date and Labels from dockerImageMetadata. Avoid logging the full Config (which includes Env) to prevent accidental secret exposure. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * revert: switch build_root back to stackrox-ui-test-stable The -latest tag was used temporarily to test /i-am-rox-ci-image content. Reverting to -stable for the final PR. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* debug: log rox-ci-image info via internal registry API Query the internal registry directly with the SA token to get the full image config (labels, env, etc). Also temporarily switch to -latest tag to test /i-am-rox-ci-image content. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: log rox-ci-image source tag and metadata in begin step Print the imagestreamtag source reference and full dockerImageMetadata (includes labels, env, created date when available). Also cat /i-am-rox-ci-image for version info baked into the image. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: narrow rox-ci-image logging to safe fields only Only log Created date and Labels from dockerImageMetadata. Avoid logging the full Config (which includes Env) to prevent accidental secret exposure. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * revert: switch build_root back to stackrox-ui-test-stable The -latest tag was used temporarily to test /i-am-rox-ci-image content. Reverting to -stable for the final PR. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 participants
Summary
kubectl get podto query the container's metadataNew output including /i-am-rox-ci-image content:
https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_release/77727/rehearse-77727-pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests/2045232982628765696/artifacts/gke-qa-e2e-tests/stackrox-stackrox-begin/build-log.txt
🤖 Assisted with Claude Code