Skip to content

NE-2829: images/router/f5: Delete F5 router Dockerfile - #826

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:masterfrom
redhat-chai-bot:delete-f5-router-dockerfile
Jul 30, 2026
Merged

NE-2829: images/router/f5: Delete F5 router Dockerfile#826
openshift-merge-bot[bot] merged 1 commit into
openshift:masterfrom
redhat-chai-bot:delete-f5-router-dockerfile

Conversation

@Miciah

@Miciah Miciah commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Delete the images/router/f5/ directory, which contained the Dockerfile and supporting files for the F5 BIG-IP router plugin image. These are the last remaining artifacts of the F5 router plugin, whose Go implementation was already removed.

The F5 router code was deleted in three stages:

  1. The Go source and tests were removed from this repository in PR Delete obsolete F5 code #46 (commit 2c04e3a).

  2. The F5 router image was removed from the Prow CI configuration in router: Remove F5 image release#74313 (commit openshift/release@7a5d5f1).

  3. The F5 router image was removed from the ART build configuration in openshift-eng/ocp-build-data (commit openshift-eng/ocp-build-data@ccb97c7).

This PR completes the cleanup by deleting the four files that remained under images/router/f5/:

  • Dockerfile (CentOS-based image definition)
  • Dockerfile.rhel (RHEL-based image definition)
  • .cccp.yml (container build service config)
  • bin/.gitignore (placeholder for copied binary)

Delete the images/router/f5/ directory, which contained the
Dockerfile and supporting files for the F5 BIG-IP router plugin image.
These are the last remaining artifacts of the F5 router plugin, whose
Go implementation was already removed.

The F5 router code was deleted in three stages:

  1. The Go source and tests were removed from this repository in
     PR openshift#46 (commit 2c04e3a).

  2. The F5 router image was removed from the Prow CI
     configuration in openshift/release PR #74313 (commit
     7a5d5f1a3cd66a16ae8d28a8c4e7ffdd43f8fde1).

  3. The F5 router image was removed from the ART build
     configuration in openshift-eng/ocp-build-data (commit
     ccb97c75b58a1706d2111c396cf6c3437bc6e05e).

This commit completes the cleanup by deleting the four files that
remained under images/router/f5/:

  - Dockerfile           (CentOS-based image definition)
  - Dockerfile.rhel      (RHEL-based image definition)
  - .cccp.yml            (container build service config)
  - bin/.gitignore        (placeholder for copied binary)

This commit resolves NE-2829.

https://issues.redhat.com/browse/NE-2829

* images/router/f5/Dockerfile: Delete file.
* images/router/f5/Dockerfile.rhel: Delete file.
* images/router/f5/.cccp.yml: Delete file.
* images/router/f5/bin/.gitignore: Delete file.

Assisted-by: Chai Bot (OpenShift AI Helpdesk)
@openshift-ci-robot

openshift-ci-robot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

@Miciah: This pull request references NE-2829 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Delete the images/router/f5/ directory, which contained the Dockerfile and supporting files for the F5 BIG-IP router plugin image. These are the last remaining artifacts of the F5 router plugin, whose Go implementation was already removed.

The F5 router code was deleted in three stages:

  1. The Go source and tests were removed from this repository in PR Delete obsolete F5 code #46 (commit 2c04e3a).

  2. The F5 router image was removed from the Prow CI configuration in router: Remove F5 image release#74313 (commit openshift/release@7a5d5f1).

  3. The F5 router image was removed from the ART build configuration in openshift-eng/ocp-build-data (commit openshift-eng/ocp-build-data@ccb97c7).

This PR completes the cleanup by deleting the four files that remained under images/router/f5/:

  • Dockerfile (CentOS-based image definition)
  • Dockerfile.rhel (RHEL-based image definition)
  • .cccp.yml (container build service config)
  • bin/.gitignore (placeholder for copied binary)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 27, 2026
@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 02fad818-f76d-4bb3-b100-46910b7e8495

📥 Commits

Reviewing files that changed from the base of the PR and between 682319a and b701b2d.

📒 Files selected for processing (4)
  • images/router/f5/.cccp.yml
  • images/router/f5/Dockerfile
  • images/router/f5/Dockerfile.rhel
  • images/router/f5/bin/.gitignore
💤 Files with no reviewable changes (4)
  • images/router/f5/bin/.gitignore
  • images/router/f5/.cccp.yml
  • images/router/f5/Dockerfile.rhel
  • images/router/f5/Dockerfile

📝 Walkthrough

Walkthrough

Removed the F5 router image configuration, both Dockerfiles, and the bin/.gitignore rules under images/router/f5/.

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Title check ✅ Passed The title is specific and matches the main change: removing the F5 router Dockerfile and related files.
Description check ✅ Passed The description accurately explains the directory deletion and the context for removing the deprecated F5 router artifacts.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only four non-test files were deleted; no Ginkgo test declarations or titles were added or modified.
Test Structure And Quality ✅ Passed PR only deletes four F5 image config files; no Ginkgo tests were added or modified, so the test-quality check is not applicable.
Microshift Test Compatibility ✅ Passed Only four F5 router image files were deleted; no Ginkgo e2e tests or OpenShift API usages were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Only four F5 router image files were deleted; no Go/Ginkgo test files or test constructs were changed.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only deletes the F5 router image files; no deployment, operator, or controller scheduling logic was added or modified.
Ote Binary Stdout Contract ✅ Passed PR only deletes four F5 router files; no process-level code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Only four f5 support files were deleted; no new Ginkgo tests or networking logic were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto ✅ Passed PR only deletes four F5 router image files; scanned removed contents and found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto usage.
Container-Privileges ✅ Passed PASS: The PR only deletes four files under images/router/f5; the diff adds no container/K8s manifests or security-context settings.
No-Sensitive-Data-In-Logs ✅ Passed PR only deletes four F5 router files; parent contents show no logging or sensitive-data patterns.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from gcs278 and rfredette July 27, 2026 15:46
@openshift-ci openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Jul 27, 2026
@rikatz

rikatz commented Jul 27, 2026

Copy link
Copy Markdown
Member

/lgtm
/approve

sorry, I was here, saw this PR and though "well this is a fast one to get it done" :)

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 27, 2026
@openshift-ci

openshift-ci Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rikatz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 27, 2026
@rikatz

rikatz commented Jul 29, 2026

Copy link
Copy Markdown
Member

/verified by e2e

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 29, 2026
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@rikatz: This PR has been marked as verified by e2e.

Details

In response to this:

/verified by e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@Miciah

Miciah commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

/jira refresh

@coderabbitai, please analyse the CI failures on this PR.

@openshift-ci-robot

openshift-ci-robot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@Miciah: This pull request references NE-2829 which is a valid jira issue.

Details

In response to this:

/jira refresh

@coderabbitai, please analyse the CI failures on this PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="openshift/router"
pr="826"

head_sha="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf 'PR head SHA: %s\n\n' "$head_sha"

echo "== Combined commit status =="
gh api "repos/$repo/commits/$head_sha/status" \
  --jq '.statuses[] | [.state, .context, (.description // ""), (.target_url // "")] | `@tsv`' \
  || true

echo
echo "== Check runs (non-successful first) =="
gh api --paginate "repos/$repo/commits/$head_sha/check-runs?per_page=100" \
  --jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | [.status, (.conclusion // ""), .name, (.details_url // ""), (.output.title // ""), (.output.summary // "")] | `@tsv`' \
  || true

echo
echo "== Recent PR workflow runs =="
gh run list --repo "$repo" --branch "$(gh pr view "$pr" --repo "$repo" --json headRefName --jq '.headRefName')" --limit 30 \
  --json databaseId,name,status,conclusion,event,workflowName,url,headSha \
  --jq --arg sha "$head_sha" '.[] | select(.headSha == $sha) | [.databaseId, .workflowName, .name, .status, (.conclusion // ""), .url] | `@tsv`' \
  || true

Length of output: 5741


🏁 Script executed:

#!/bin/bash
set -euo pipefail

urls=(
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-fips/2082481587663933440"
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-serial-2of2/2082481177322590208"
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-agnostic/2082481955089158144"
)

for url in "${urls[@]}"; do
  job="${url##*/}"
  page="/tmp/prow-${job}.html"

  echo "===== $job: result page ====="
  curl --fail --silent --show-error --location "$url" -o "$page"

  echo "-- Job-state/failure excerpts --"
  grep -Ein -m 30 \
    'failure|failed|error|infra|test|artifact|build-log|finished\.json' \
    "$page" \
    | sed -E 's/<[^>]*>/ /g; s/[[:space:]]+/ /g' \
    || true

  echo "-- Candidate artifact URLs --"
  grep -Eo 'https?://[^"<> ]+|href="[^"]+"' "$page" \
    | sed -E 's/^href="//; s/"$//' \
    | grep -E 'build-log\.txt|finished\.json|junit|artifacts|gcsweb' \
    | head -n 40 \
    || true
  echo
done

Length of output: 11357


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_router/826"
jobs=(
  "pull-ci-openshift-router-master-e2e-aws-fips/2082481587663933440:artifacts/e2e-aws-fips"
  "pull-ci-openshift-router-master-e2e-aws-serial-2of2/2082481177322590208:artifacts/e2e-aws-serial"
  "pull-ci-openshift-router-master-e2e-agnostic/2082481955089158144:artifacts/e2e-agnostic"
)

for entry in "${jobs[@]}"; do
  job="${entry%%:*}"
  artifact_root="${entry#*:}"
  root="$base/$job"

  echo "===== $job ====="
  echo "-- Job completion --"
  curl --fail --silent --show-error --location "$root/finished.json" | jq -c . || true
  echo

  echo "-- Step completion records with nonzero/failed values --"
  for step in \
    "ipi-install-install" \
    "openshift-e2e-test" \
    "ipi-deprovision-deprovision" \
    "aws-deprovision-verification"; do
    url="$root/$artifact_root/$step/finished.json"
    response="$(curl --silent --show-error --location "$url" || true)"
    if [ -n "$response" ]; then
      printf '%s: %s\n' "$step" "$response"
    fi
  done
  echo

  echo "-- Build-log failure excerpts --"
  curl --fail --silent --show-error --location "$root/build-log.txt" \
    | grep -Ein -C 3 \
      'FAIL|FAILURE|ERROR|panic:|timed out|timeout|test.*failed|exit code [^0]|non-zero|unable to' \
    | tail -n 160 \
    || true
  echo
done

Length of output: 164254


@openshift-ci-robot, CI analysis for #826:

Failed job Failure Assessment
ci/prow/e2e-aws-fips One blocking [Feature:Router][OCPFeatureGate:RouteExternalCertificate] test: routes were unreachable after the external-certificate secret was deleted/recreated with RBAC permissions dropped. Not caused by this PR. The job installed and deprovisioned successfully; failure was in the e2e test phase.
ci/prow/e2e-agnostic One blocking instance of the same Router RouteExternalCertificate test: routes were unreachable after the external-certificate secret was updated. Not caused by this PR. This reproduces across a separate platform/job, pointing to a payload or test-level issue rather than the deleted F5 artifacts.
ci/prow/e2e-aws-serial-2of2 MonitorTest failure following substantial control-plane instability: kube-apiserver readiness HTTP 500s, etcd readiness connection refusals, and related alerts. Infrastructure/control-plane instability; unrelated to this change.

The remaining relevant checks passed, including verify, verify-deps, unit, images, fips-image-scan-haproxy-router, e2e-upgrade, and e2e-aws-serial-1of2.

This PR only removes the obsolete F5 BIG-IP image Dockerfiles/configuration; it does not alter the HAProxy router implementation or payload. No code change to this PR is indicated by these failures.

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="openshift/router"
pr="826"

echo "== Pull request =="
gh pr view "$pr" --repo "$repo" --json number,url,headRefName,headRefOid,baseRefName,mergeStateStatus,statusCheckRollup \
  --jq '{number,url,headRefName,headRefOid,baseRefName,mergeStateStatus,checks: [.statusCheckRollup[] | {name,conclusion,status,detailsUrl,workflowName}]}'

sha="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"

echo
echo "== Check runs for head SHA: $sha =="
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
  --jq '.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at,output:{title:.output.title,summary:.output.summary}}'

echo
echo "== Legacy commit statuses for head SHA: $sha =="
gh api "repos/$repo/commits/$sha/status" \
  --jq '{state, statuses: [.statuses[] | {context,state,target_url,description,created_at}]}'

echo
echo "== GitHub Actions jobs associated with this PR (if any) =="
gh api "repos/$repo/actions/runs?event=pull_request&per_page=100" \
  --jq --argjson pr "$pr" '.workflow_runs[] | select(.pull_requests[]?.number == $pr) | {id,name,status,conclusion,html_url,created_at,updated_at}' || true

Length of output: 7443


🏁 Script executed:

#!/bin/bash
set -euo pipefail

urls=(
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-fips/2082481587663933440"
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-serial-2of2/2082481177322590208"
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-agnostic/2082481955089158144"
)

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

for url in "${urls[@]}"; do
  job="${url##*/}"
  page="$tmp/$job.html"
  echo "===== JOB $job: page metadata and artifact links ====="
  curl --fail --location --silent --show-error "$url" -o "$page"
  grep -Eio 'https?://[^"<> ]+|href="[^"]+"' "$page" \
    | sed -E 's/^href="//; s/"$//' \
    | grep -Ei '(build-log|finished\.json|junit|artifacts|gcs|storage\.googleapis|log)' \
    | head -80 || true

  echo
  echo "===== JOB $job: relevant visible failure text ====="
  sed -E 's/<[^>]*>/ /g; s/&nbsp;/ /g; s/&quot;/"/g; s/&amp;/\&/g' "$page" \
    | tr -s '[:space:]' ' ' \
    | grep -Eio '.{0,180}(fail(ed|ure)?|error|timeout|panic|flake).{0,360}' \
    | head -30 || true
  echo
done

Length of output: 4253


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base_paths=(
  "pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-fips/2082481587663933440"
  "pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-serial-2of2/2082481177322590208"
  "pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-agnostic/2082481955089158144"
)
bucket="test-platform-results"
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

for path in "${base_paths[@]}"; do
  job="${path##*/}"
  echo "===== JOB $job: available artifacts ====="
  index="$tmp/$job-index.html"
  curl --fail --location --silent --show-error \
    "https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/$bucket/$path/" \
    -o "$index"

  grep -Eio 'href="[^"]+"' "$index" | sed -E 's/^href="//;s/"$//' | head -200 || true

  echo
  echo "===== JOB $job: finished metadata ====="
  for name in finished.json metadata.json; do
    if curl --fail --location --silent \
      "https://storage.googleapis.com/$bucket/$path/$name" -o "$tmp/$job-$name"; then
      cat "$tmp/$job-$name"
      echo
    fi
  done

  echo
  echo "===== JOB $job: build-log failure excerpts ====="
  if curl --fail --location --silent \
    "https://storage.googleapis.com/$bucket/$path/build-log.txt" -o "$tmp/$job-build-log.txt"; then
    echo "-- final 250 lines --"
    tail -250 "$tmp/$job-build-log.txt"
    echo "-- error/failure matches (last 80) --"
    grep -Ein '(error|failed|failure|panic|timeout|unable to|not found|test .* fail)' \
      "$tmp/$job-build-log.txt" | tail -80 || true
  else
    echo "build-log.txt was not accessible at the expected root path."
  fi
  echo
done

Length of output: 186230


@openshift-ci-robot CI analysis for #826:

  • ci/prow/e2e-aws-fips failed one blocking Router test: the RouteExternalCertificate scenario could not reach routes after the external-certificate Secret was deleted/recreated and its RBAC permissions were removed. Log
  • ci/prow/e2e-agnostic failed the related RouteExternalCertificate scenario: routes were unreachable after updating the external-certificate Secret. Log
  • ci/prow/e2e-aws-serial-2of2 failed due to a monitor test, amid significant cluster-health disruption: repeated etcd readiness connection refusals plus etcdMembersDown/etcdNoLeader alerts and metric-endpoint downtime. Log

The failures are not attributable to this PR’s removal of the deprecated F5 image files. verify, dependency verification, unit tests, all image jobs, the HAProxy FIPS image scan, upgrade e2e, and AWS serial shard 1 all passed. The two Router failures exercise the active router’s external-certificate behavior, not the removed F5 Dockerfiles; the serial failure is cluster/infrastructure health related.

Recommendation: retry the three failed Prow jobs; no code change to this cleanup PR is indicated by these logs.

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="openshift/router"
pr="826"

echo "== PR checks =="
gh pr checks "$pr" --repo "$repo" --json name,state,link,workflow,bucket,completedAt,startedAt 2>&1 || true

echo
echo "== Check runs with non-success conclusions =="
gh api "repos/$repo/commits/$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)/check-runs?per_page=100" \
  --jq '.check_runs[] | select(.conclusion != "success" and .conclusion != null) | {name, status, conclusion, details_url, output: {title: .output.title, summary: .output.summary, text: .output.text}, started_at, completed_at}' 2>&1 || true

echo
echo "== Recent workflow runs for PR =="
gh run list --repo "$repo" --branch "$(gh pr view "$pr" --repo "$repo" --json headRefName --jq .headRefName)" --limit 30 \
  --json databaseId,name,status,conclusion,event,url,createdAt,updatedAt,headSha 2>&1 || true

Length of output: 5096


🏁 Script executed:

#!/bin/bash
set -euo pipefail

urls=(
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-agnostic/2082481955089158144"
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-fips/2082481587663933440"
  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_router/826/pull-ci-openshift-router-master-e2e-aws-serial-2of2/2082481177322590208"
)

workdir="$(mktemp -d)"
trap 'rm -rf "$workdir"' EXIT

for url in "${urls[@]}"; do
  job="$(basename "$(dirname "$url")")"
  build="$(basename "$url")"
  prefix="https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_router/826/${job}/${build}"

  echo "===== ${job} (${build}) : Prow page ====="
  curl --fail --location --silent --show-error "$url" -o "$workdir/${build}.html" || true
  grep -Eio '.{0,180}(error|fail(ed|ure)?|panic|timeout|installer|cluster|test).{0,300}' "$workdir/${build}.html" \
    | head -80 || true

  echo "===== ${job} (${build}) : build-log ====="
  curl --fail --location --silent --show-error "$prefix/build-log.txt" -o "$workdir/${build}.log" || true
  if [[ -s "$workdir/${build}.log" ]]; then
    grep -Ein '(^|[^[:alpha:]])(error|failed|failure|panic|fatal|timeout|timed out|flake|aborted)([^[:alpha:]]|$)' "$workdir/${build}.log" \
      | tail -120 || true
  else
    echo "build-log.txt unavailable at $prefix/build-log.txt"
  fi

  echo "===== ${job} (${build}) : finished metadata ====="
  curl --fail --location --silent --show-error "$prefix/finished.json" || true
  echo
  echo
done

Length of output: 128558


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_router/826"
workdir="$(mktemp -d)"
trap 'rm -rf "$workdir"' EXIT

declare -A jobs=(
  [agnostic]="pull-ci-openshift-router-master-e2e-agnostic/2082481955089158144/artifacts/e2e-agnostic/openshift-e2e-test/artifacts/junit/junit_e2e__20260729-161925.xml"
  [fips]="pull-ci-openshift-router-master-e2e-aws-fips/2082481587663933440/artifacts/e2e-aws-fips/openshift-e2e-test/artifacts/junit/junit_e2e__20260729-162425.xml"
  [serial]="pull-ci-openshift-router-master-e2e-aws-serial-2of2/2082481177322590208/artifacts/e2e-aws-serial/openshift-e2e-test/artifacts/junit/junit_e2e__20260729-162021.xml"
)

for name in agnostic fips serial; do
  echo "===== ${name} failed JUnit cases ====="
  curl --fail --location --silent --show-error "${base}/${jobs[$name]}" -o "$workdir/${name}.xml"
  python3 - "$workdir/${name}.xml" <<'PY'
import sys
import xml.etree.ElementTree as ET

root = ET.parse(sys.argv[1]).getroot()
count = 0
for case in root.iter("testcase"):
    failures = list(case.findall("failure")) + list(case.findall("error"))
    if not failures:
        continue
    count += 1
    print(f"name: {case.get('name', '')}")
    print(f"classname: {case.get('classname', '')}")
    for failure in failures:
        print(f"type: {failure.get('type', '')}")
        print(f"message: {failure.get('message', '')}")
        text = (failure.text or "").strip().replace("\x1b", "")
        print("details:", text[:3000])
    print("---")
print(f"failed_cases={count}")
PY
done

Length of output: 7553


@Miciah, I analyzed the three failed Prow jobs. There is no evidence that this deletion-only PR caused any of them. In particular, ci/prow/images, unit, verify, verify-deps, upgrade, and AWS serial shard 1 all passed; the successful image job confirms the removed F5 image files are not part of the active image build graph.

Check Finding Assessment
e2e-aws-serial-2of2 Failed solely on a MonitorTest; there were no failed JUnit cases. The cluster suffered persistent etcd readiness connection refusals, kube-apiserver readyz HTTP 500 responses, and machine-config degradation because AWS kube-cloud-config was missing. Confirmed CI/cluster infrastructure failure.
e2e-agnostic External-certificate route test timed out while making HTTPS requests; an OAuth token-expiration test received EOF from its route. There were also informing-only network-segmentation and oc payload-extraction failures. Likely transient e2e environment/route availability issue; unrelated to F5 artifact deletion.
e2e-aws-fips The route external-certificate test was interrupted. Informing failures included a network-segmentation load-balancer timeout and the known generic oc payload-extraction test, which attempted to use an empty image reference. Likely unrelated e2e test instability/environment issue. The failing router test exercises the active route stack, not the deleted F5 plugin image.

Recommendation: retrigger the three failed e2e jobs. No code change to this PR is indicated by the logs.

@Miciah

Miciah commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

@coderabbitai, can we accurately attribute these failures to OCPBUGS-77056?

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🔍 Additional research query:

Retrieve Jira issue OCPBUGS-77056, including its summary, description, status, affected/fix versions, labels/components, and all linked issues or comments that identify impacted CI jobs, test names, or failure signatures.

Length of output: 32


🤖 web_search executed:

OCPBUGS-77056

Length of output: 10393


🤖 web_search executed:

"OCPBUGS-77056" "RouteExternalCertificate"

Length of output: 12230


🤖 web_search executed:

"RouteExternalCertificate" "external-certificate Secret" OpenShift routes unreachable

Length of output: 17986


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="openshift/router"
pr_head="$(gh pr view 826 --repo "$repo" --json headRefOid,updatedAt --jq '[.headRefOid, .updatedAt] | `@tsv`')"
bug_pr="$(gh pr view 822 --repo "$repo" --json mergeCommit,mergedAt,state,url --jq '{mergeCommit: (.mergeCommit.oid // ""), mergedAt, state, url}')"

printf 'PR `#826` head and update time:\n%s\n\n' "$pr_head"
printf 'OCPBUGS-77056 PR `#822`:\n%s\n\n' "$bug_pr"

head_sha="$(printf '%s\n' "$pr_head" | cut -f1)"
bug_sha="$(printf '%s\n' "$bug_pr" | jq -r '.mergeCommit')"

if [[ -n "$bug_sha" && "$bug_sha" != "null" ]]; then
  echo "== Is OCPBUGS-77056 merge commit an ancestor of PR `#826` head? =="
  gh api "repos/$repo/compare/$bug_sha...$head_sha" \
    --jq '{status,ahead_by,behind_by,merge_base_commit: .merge_base_commit.sha}' \
    || true

  echo
  echo "== Commit metadata =="
  gh api "repos/$repo/commits/$head_sha" --jq '{sha: .sha, date: .commit.committer.date, message: .commit.message}'
  gh api "repos/$repo/commits/$bug_sha" --jq '{sha: .sha, date: .commit.committer.date, message: .commit.message}'
fi

Length of output: 3495


@Miciah, yes for the two RouteExternalCertificate failures, but not for the AWS serial MonitorTest failure.

OCPBUGS-77056 was merged as #822 (13f62cbb2…) and is an ancestor of this PR’s tested head (b701b2dc…; #826 is five commits ahead). Therefore, these Prow jobs did include the OCPBUGS-77056 change.

Failed job Attribution Evidence
e2e-aws-fips High-confidence OCPBUGS-77056 regression Its external-certificate test failed after Secret deletion/recreation and RBAC changes. The bug specifically changed asynchronous SAR/RBAC validation and secret-event processing, including deletion handling.
e2e-agnostic High-confidence OCPBUGS-77056 regression Its failure was in the same RouteExternalCertificate secret-update path affected by the asynchronous validation / secret-watch changes.
e2e-aws-serial-2of2 No This was an etcd / kube-apiserver health MonitorTest failure. There is no overlap with external-certificate validation, so it should remain classified as CI or cluster instability.

So I would revise the earlier recommendation: do not treat the two router e2e failures as unrelated flakes; they are credibly attributable to OCPBUGS-77056 and should be linked to that bug. Retrying may confirm the failure, but does not resolve the underlying regression. The serial failure can be retried independently as infrastructure-related.

@Miciah

Miciah commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Let's wait for #829 to merge and then rerun the failed CI jobs.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD c73bada and 2 for PR HEAD b701b2d in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD d6ddfd8 and 1 for PR HEAD b701b2d in total

@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

@Miciah: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 6248720 into openshift:master Jul 30, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants