stackrox: make mpiit-data-router-reporter best_effort for ACS LP interop

[davdhacs]

The interop jobs' post-phase mpiit-data-router-reporter step intermittently gets a 503 Service Unavailable from the Report Portal.

Fix: add best_effort: true, so a Data Router outage no longer fails an otherwise-green job.

Partially generated with AI assistance (Claude).

Summary by CodeRabbit

This PR updates StackRox ACS AWS and AWS FIPS interop jobs on ocp-4.22-lpMainline.

• Adds a StackRox-owned workflow with best-effort post steps enabled.
• Marks mpiit-data-router-reporter as best effort.
• Prevents intermittent 503 Service Unavailable responses from failing successful jobs.
• Keeps firewatch-report-issues active.
• Limits the change to StackRox-owned jobs and leaves the shared workflow unchanged.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 71bf6278-ccf9-4f74-adb9-c65d2ff286cf

📥 Commits

Reviewing files that changed from the base of the PR and between 90fc729 and a0c00d8.

📒 Files selected for processing (4)

• ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml
• ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS
• ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json
• ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.yaml

---

Walkthrough

The change adds the stackrox-firewatch-ipi-aws-cr workflow, its ownership metadata, and its owner lists. AWS ACS and AWS FIPS ACS configurations now reference the new workflow.

Changes

StackRox Firewatch AWS workflow

Layer / File(s)	Summary
Define and own the workflow ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/*	The new workflow runs IPI AWS setup and teardown chains. It uses best-effort post-step handling, best-effort Data Router reporting, and Jira issue reporting. Ownership metadata and maintainer lists are included.
Wire AWS ACS configurations ci-operator/config/stackrox/stackrox/...yaml	The AWS ACS and AWS FIPS ACS configurations now reference stackrox-firewatch-ipi-aws-cr.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to a0c00

The PR adds a post-only workflow wrapper and changes workflow selection in CI configuration. It is mergeable with owner awareness, but the workflow contract and regenerated CI metadata/job definitions should be validated before merge to avoid landing an invalid or incomplete configuration.

Suggested reviewers: msugakov, tommartensen

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: making mpiit-data-router-reporter best effort for StackRox ACS layered-product interop jobs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only CI YAML, ownership, metadata, and workflow references; the diff contains no Ginkgo It/Describe/Context/When test titles or dynamic test-title values.
Test Structure And Quality	✅ Passed	The PR diff changes only CI YAML, OWNERS, and metadata files; it adds or modifies no Ginkgo test code, so the listed test-quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The PR adds only CI YAML, metadata, and OWNERS files; it adds no Ginkgo tests or MicroShift-sensitive API references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The full PR diff adds only CI workflow/configuration and ownership files; it adds no Ginkgo tests or multi-node test assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only CI workflow/configuration and ownership metadata; the diff adds no deployment, operator, controller, or Kubernetes scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only CI YAML/JSON/OWNERS and composes existing steps; it adds no main or suite-setup code and no process-level stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes CI workflow/configuration only; it adds no Ginkgo test declarations or test files. The external hostname appears only in workflow documentation.
No-Weak-Crypto	✅ Passed	The PR changes only CI workflow/config and ownership metadata; scans of all changed files found no weak algorithms, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	The aggregate diff adds only workflow routing, best_effort, ownership, and metadata; changed files contain no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or root settings.
No-Sensitive-Data-In-Logs	✅ Passed	The aggregate diff adds no logging code or secret values; it reuses the unchanged reporter step. The only hostname appears in workflow documentation, not logs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@davdhacs, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 12 errors:

 * tests[0].post[1]: only one of `ref`, `chain`, or a literal test step can be set
 * tests[0].post[1]: `as` is required
 * tests[0].post[1]: `from` or `from_image` is required
 * tests[0].post[1]: `commands` is required
 * test  contains best_effort without timeout
 * 'tests[0].post[1].resources' should have at least one request or limit
 * tests[1].post[1]: only one of `ref`, `chain`, or a literal test step can be set
 * tests[1].post[1]: `as` is required
 * tests[1].post[1]: `from` or `from_image` is required
 * tests[1].post[1]: `commands` is required
 * test  contains best_effort without timeout
 * 'tests[1].post[1].resources' should have at least one request or limit

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[davdhacs]

/cc @tommartensen @msugakov

[davdhacs]

/ok-to-test

[davdhacs]

/uncc dvail
/uncc rhybrillou

[davdhacs]

/pj-rehearse

[openshift-merge-bot]

@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@davdhacs: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-stackrox-stackrox-master-ocp-4.22-lpMainline-lp-ocp-compat-acs--tests-aws-fips	N/A	periodic	Ci-operator config changed
periodic-ci-stackrox-stackrox-master-ocp-4.22-lpMainline-lp-ocp-compat-cr--acs--tests-aws	N/A	periodic	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[davdhacs]

/verify-owners

[tommartensen]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davdhacs, tommartensen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/stackrox/OWNERS [davdhacs,tommartensen]
• ci-operator/step-registry/stackrox/OWNERS [davdhacs,tommartensen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[davdhacs]

/pj-rehearse ack

[openshift-merge-bot]

@davdhacs: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@davdhacs: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.