From 90fc7298c2b4f7f3c7acb46718a06bb292601d5c Mon Sep 17 00:00:00 2001 From: davdhacs <105243888+davdhacs@users.noreply.github.com> Date: Thu, 13 Aug 2026 15:43:01 -0600 Subject: [PATCH 1/3] stackrox: make mpiit-data-router-reporter best_effort for ACS LP interop The periodic ACS layered-product interop jobs (cr--acs--tests-aws and acs--tests-aws-fips) on ocp-4.22-lpMainline were being marked FAILURE even when all QA e2e tests passed, because the post-phase mpiit-data-router-reporter step intermittently gets a 503 from datarouter.ccitredhat.com (Report Portal / Data Router service). This is a reporting step; its failure should not gate the product test verdict. Tracked upstream (unowned since June) as LPINTEROP-6864. Fix: inline the firewatch-ipi-aws-cr workflow into both tests and mark only the mpiit-data-router-reporter ref best_effort: true, so a Data Router outage no longer fails an otherwise-green job. The inlined pre/post steps reproduce the workflow exactly; firewatch-report-issues still runs and files Jira issues for real failures. Considered instead adding best_effort to the shared ref/workflow (fixes all LP interop consumers) but that is CSPI-QE-owned; this keeps the blast radius to the StackRox jobs we own. Prompt: "how can we wrap or prevent mpiit-data-router-reporter's failure from showing up as a whole-job failure" -> Option A (self-owned config inline). Partially generated with AI assistance (Claude). --- ...aster__ocp-4.22-lpMainline-lp-ocp-compat.yaml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml index 1136d2cc8e071..dbac75ce6ea9e 100644 --- a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml +++ b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml @@ -55,9 +55,15 @@ tests: OCP_VERSION: "4.22" USER_TAGS: | scenario acs + post: + - chain: ipi-aws-post + - ref: mpiit-data-router-reporter + best_effort: true + - ref: firewatch-report-issues + pre: + - chain: ipi-aws-pre test: - ref: stackrox-qa-e2e - workflow: firewatch-ipi-aws-cr - as: acs--tests-aws-fips cron: 0 23 31 2 * reporter_config: @@ -95,9 +101,15 @@ tests: OCP_VERSION: "4.22" USER_TAGS: | scenario acs + post: + - chain: ipi-aws-post + - ref: mpiit-data-router-reporter + best_effort: true + - ref: firewatch-report-issues + pre: + - chain: ipi-aws-pre test: - ref: stackrox-qa-e2e - workflow: firewatch-ipi-aws-cr zz_generated_metadata: branch: master org: stackrox From 214be7cd9ed175d8d9196d48034797d5a3eaacf2 Mon Sep 17 00:00:00 2001 From: davdhacs <105243888+davdhacs@users.noreply.github.com> Date: Thu, 13 Aug 2026 16:21:35 -0600 Subject: [PATCH 2/3] stackrox: use stackrox-firewatch-ipi-aws-cr workflow with best_effort DR reporter Supersedes the previous config-inline attempt: ci-operator's config schema rejects `best_effort` set alongside a `ref` in post steps (it parses it as a malformed literal step). best_effort is only accepted inside the step-registry (a ref definition or a workflow), so the fix has to live there. Add a StackRox-owned workflow stackrox-firewatch-ipi-aws-cr that reproduces the shared firewatch-ipi-aws-cr exactly but sets allow_best_effort_post_steps and marks the mpiit-data-router-reporter post step best_effort. Point both ACS LP interop tests (cr--acs--tests-aws, acs--tests-aws-fips) at it. This keeps the blast radius to the StackRox jobs we own (rather than editing the CSPI-QE-owned shared ref/workflow) while ensuring an intermittent Data Router / Report Portal 503 (LPINTEROP-6864) no longer fails an otherwise-green job. firewatch-report-issues still runs and files Jira for real failures. Validated locally with determinize-ci-operator and ci-operator-checkconfig. Partially generated with AI assistance (Claude). --- ...er__ocp-4.22-lpMainline-lp-ocp-compat.yaml | 16 +---- .../stackrox/firewatch-ipi-aws-cr/OWNERS | 60 +++++++++++++++++ ...irewatch-ipi-aws-cr-workflow.metadata.json | 67 +++++++++++++++++++ ...tackrox-firewatch-ipi-aws-cr-workflow.yaml | 18 +++++ 4 files changed, 147 insertions(+), 14 deletions(-) create mode 100644 ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS create mode 100644 ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json create mode 100644 ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.yaml diff --git a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml index dbac75ce6ea9e..97522c285c9c0 100644 --- a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml +++ b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-4.22-lpMainline-lp-ocp-compat.yaml @@ -55,15 +55,9 @@ tests: OCP_VERSION: "4.22" USER_TAGS: | scenario acs - post: - - chain: ipi-aws-post - - ref: mpiit-data-router-reporter - best_effort: true - - ref: firewatch-report-issues - pre: - - chain: ipi-aws-pre test: - ref: stackrox-qa-e2e + workflow: stackrox-firewatch-ipi-aws-cr - as: acs--tests-aws-fips cron: 0 23 31 2 * reporter_config: @@ -101,15 +95,9 @@ tests: OCP_VERSION: "4.22" USER_TAGS: | scenario acs - post: - - chain: ipi-aws-post - - ref: mpiit-data-router-reporter - best_effort: true - - ref: firewatch-report-issues - pre: - - chain: ipi-aws-pre test: - ref: stackrox-qa-e2e + workflow: stackrox-firewatch-ipi-aws-cr zz_generated_metadata: branch: master org: stackrox diff --git a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS new file mode 100644 index 0000000000000..0668bb0e0f8c3 --- /dev/null +++ b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS @@ -0,0 +1,60 @@ +approvers: +- AlexVulaj +- BradLugo +- cspi-qe-ocp-lp +- dashrews78 +- davdhacs +- dcaravel +- dvail +- ebensh +- erthalion +- janisz +- johannes94 +- JoukoVirtanen +- jvdm +- kovayur +- kurlov +- lvalerom +- Molter73 +- msugakov +- mtesseract +- mtodor +- ovalenti +- pedrottimark +- porridge +- rhybrillou +- robbycochran +- stehessel +- Stringy +- tommartensen +- vikin91 +- vjwilson +reviewers: +- AlexVulaj +- BradLugo +- cspi-qe-ocp-lp +- davdhacs +- dcaravel +- dvail +- ebensh +- erthalion +- janisz +- johannes94 +- JoukoVirtanen +- jvdm +- kovayur +- kurlov +- Molter73 +- msugakov +- mtesseract +- mtodor +- ovalenti +- pedrottimark +- porridge +- rhybrillou +- robbycochran +- stehessel +- Stringy +- tommartensen +- vikin91 +- vjwilson diff --git a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json new file mode 100644 index 0000000000000..e81bc5fe93d1c --- /dev/null +++ b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json @@ -0,0 +1,67 @@ +{ + "path": "stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.yaml", + "owners": { + "approvers": [ + "AlexVulaj", + "BradLugo", + "cspi-qe-ocp-lp", + "dashrews78", + "davdhacs", + "dcaravel", + "dvail", + "ebensh", + "erthalion", + "janisz", + "johannes94", + "JoukoVirtanen", + "jvdm", + "kovayur", + "kurlov", + "lvalerom", + "Molter73", + "msugakov", + "mtesseract", + "mtodor", + "ovalenti", + "pedrottimark", + "porridge", + "rhybrillou", + "robbycochran", + "stehessel", + "Stringy", + "tommartensen", + "vikin91", + "vjwilson" + ], + "reviewers": [ + "AlexVulaj", + "BradLugo", + "cspi-qe-ocp-lp", + "davdhacs", + "dcaravel", + "dvail", + "ebensh", + "erthalion", + "janisz", + "johannes94", + "JoukoVirtanen", + "jvdm", + "kovayur", + "kurlov", + "Molter73", + "msugakov", + "mtesseract", + "mtodor", + "ovalenti", + "pedrottimark", + "porridge", + "rhybrillou", + "robbycochran", + "stehessel", + "Stringy", + "tommartensen", + "vikin91", + "vjwilson" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.yaml b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.yaml new file mode 100644 index 0000000000000..bed674bf4b8e9 --- /dev/null +++ b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.yaml @@ -0,0 +1,18 @@ +workflow: + as: stackrox-firewatch-ipi-aws-cr + steps: + allow_best_effort_post_steps: true + pre: + - chain: ipi-aws-pre + post: + - chain: ipi-aws-post + - ref: mpiit-data-router-reporter + best_effort: true + - ref: firewatch-report-issues + documentation: |- + StackRox-owned variant of firewatch-ipi-aws-cr. Identical to that workflow + except the mpiit-data-router-reporter post step is marked best_effort, so a + recurring outage of the Data Router / Report Portal reporting service + (intermittent 503s from datarouter.ccitredhat.com, tracked as LPINTEROP-6864) + no longer fails an otherwise-green job. firewatch-report-issues still runs and + files Jira issues for real failures. From a0c00d8cf8bc2f103123996e1d5e728c9c9782b9 Mon Sep 17 00:00:00 2001 From: davdhacs <105243888+davdhacs@users.noreply.github.com> Date: Thu, 13 Aug 2026 21:28:40 -0600 Subject: [PATCH 3/3] stackrox: drop untrusted user from new workflow OWNERS verify-owners flagged the new OWNERS file with do-not-merge/invalid-owners-file because it listed mtesseract, who is not currently an openshift org member or collaborator. The parent stackrox/OWNERS is grandfathered, but a newly added OWNERS file may not introduce untrusted users. Remove that entry and regenerate the workflow metadata accordingly. Partially generated with AI assistance (Claude). --- ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS | 2 -- .../stackrox-firewatch-ipi-aws-cr-workflow.metadata.json | 2 -- 2 files changed, 4 deletions(-) diff --git a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS index 0668bb0e0f8c3..2a3c72391df85 100644 --- a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS +++ b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/OWNERS @@ -17,7 +17,6 @@ approvers: - lvalerom - Molter73 - msugakov -- mtesseract - mtodor - ovalenti - pedrottimark @@ -46,7 +45,6 @@ reviewers: - kurlov - Molter73 - msugakov -- mtesseract - mtodor - ovalenti - pedrottimark diff --git a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json index e81bc5fe93d1c..566cc083fbe8a 100644 --- a/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json +++ b/ci-operator/step-registry/stackrox/firewatch-ipi-aws-cr/stackrox-firewatch-ipi-aws-cr-workflow.metadata.json @@ -20,7 +20,6 @@ "lvalerom", "Molter73", "msugakov", - "mtesseract", "mtodor", "ovalenti", "pedrottimark", @@ -50,7 +49,6 @@ "kurlov", "Molter73", "msugakov", - "mtesseract", "mtodor", "ovalenti", "pedrottimark",