ci-operator-configresolver: Add upstream config resolver

[danilo-gemoli]

e2e tests use a real ci-operator-configresolver that is expected to find IS ocp/X.Y within the cluster the test is running on, but these streams exist on app.ci only.

As a consequence of that, we experience failures like this.
This PR overcomes the problem by adding a new parameter on ci-operator-configresolver:

--upstream-resolver-address=...

that e2es set to the production endpoint https://config.ci.openshift.org/.

The upstream resolver is used to retrieve information about the integrated streams.

Upstream Resolver Support for ci-operator-configresolver

This PR adds an optional upstream resolver path for resolving OpenShift “integrated streams” so e2e tests in isolated clusters don’t fail when the test cluster lacks ocp/X.Y ImageStreams (those exist only on app.ci). When configured, ci-operator-configresolver delegates integrated-stream lookups to the production config service.

What changed

ci-operator-configresolver (cmd/ci-operator-configresolver/main.go)

• Added a new CLI flag: --upstream-resolver-address.
• Implemented a new TTL-backed cache for integrated stream resolution:
  • Uses local resolution when no upstream is configured.
  • Uses an upstream resolver client when --upstream-resolver-address is set.
• Updated the server wiring so the /integratedStream endpoint serves from the new integration cache (replacing the prior in-memory/mutex cache approach).

Unit tests (cmd/ci-operator-configresolver/main_test.go)

• Refactored integrated-stream tests to exercise the TTL cache for both:
  • Local integrated stream resolution
  • Upstream integrated stream resolution, including an upstream miss case with the expected HTTP 400 error.

E2E framework + tests

• Extended test/e2e/framework/framework.go:
  • Added ConfigResolverOptions.UpstreamResolverAddress
  • Passed it through to ci-operator-configresolver as --upstream-resolver-address.
• Updated e2e callers to set the upstream resolver address using the CI API config service endpoint (api.URLForService("config")):
  • test/e2e/multi-stage/e2e_test.go
  • test/e2e/observer/e2e_test.go
• Also removed per-iteration loop-variable shadowing in the e2e tests to ensure the intended testCase is used.
• test/e2e/multi-stage/integration-releases.yaml: adjusted the 4.18 “latest” checks to read /release-manifests/release-metadata instead of grepping cluster-version-operator version / oc version.

Practical impact

• Default behavior is unchanged: if the flag is not set, integrated streams are resolved locally as before.
• Opt-in behavior: e2e environments can point ci-operator-configresolver to https://config.ci.openshift.org/ (via the framework wiring) to resolve integrated streams even when ocp/X.Y ImageStreams are missing from the test cluster.

Test/validation notes

• The PR author requested e2e runs and reruns via PR commands (/test e2e, /hold, /retest-required) while validating the change.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 4cc9190e-4e5f-43cd-87b7-05a9d4bfb4e2

📥 Commits

Reviewing files that changed from the base of the PR and between 85be9fb and 254317f.

📒 Files selected for processing (6)

• cmd/ci-operator-configresolver/main.go
• cmd/ci-operator-configresolver/main_test.go
• test/e2e/framework/framework.go
• test/e2e/multi-stage/e2e_test.go
• test/e2e/multi-stage/integration-releases.yaml
• test/e2e/observer/e2e_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift/release (manual)
• openshift/ci-docs (manual)
• openshift/release-controller (manual)
• openshift/ci-chat-bot (manual)

🚧 Files skipped from review as they are similar to previous changes (5)

• test/e2e/observer/e2e_test.go
• test/e2e/framework/framework.go
• cmd/ci-operator-configresolver/main.go
• cmd/ci-operator-configresolver/main_test.go
• test/e2e/multi-stage/e2e_test.go

---

📝 Walkthrough

Walkthrough

Adds optional upstream integrated-stream resolution to configresolver, switches the integrated-stream cache to a TTL-backed implementation, and threads the new resolver address through the e2e framework and affected e2e tests.

Changes

Upstream integrated-stream resolver

Layer / File(s)	Summary
CLI flag and cache path cmd/ci-operator-configresolver/main.go	upstreamResolverAddress is added to options, parsed from --upstream-resolver-address, and used to initialize an optional resolver client and the new TTL-based stream cache for /integratedStream.
Integrated stream test coverage cmd/ci-operator-configresolver/main_test.go	Integrated-stream tests add upstream fixtures, a fake resolver client, TTL-based cache construction, and parallel subtests covering local and upstream lookups.
E2E framework wiring test/e2e/framework/framework.go	ConfigResolverOptions gains UpstreamResolverAddress, and ConfigResolver passes it as --upstream-resolver-address.
E2E suite updates test/e2e/multi-stage/e2e_test.go, test/e2e/observer/e2e_test.go, test/e2e/multi-stage/integration-releases.yaml	The multi-stage and observer suites pass the upstream resolver address into ConfigResolver; the multi-stage release checks switch to release metadata and OS_GIT_VERSION.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	E2E startup logs print full cmd.Args, so the new --upstream-resolver-address value (config.ci.openshift.org) is exposed in logs.	Stop logging full args/env for accessory startup or redact --upstream-resolver-address before emitting the command line.
Docstring Coverage	⚠️ Warning	Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	New e2e tests set UpstreamResolverAddress to api.URLForService("config"), which resolves to https://config.ci.openshift.org and needs public connectivity.	Use a cluster-internal resolver or test stub, or mark the test [Skipped:Disconnected]/gate it behind an IPv6/disconnected-compatible job instead of calling the public config service.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding upstream resolver support to ci-operator-configresolver.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	New error paths wrap with %w, nil upstream resolver is checked, and the only panic is in init() for scheme registration.
Test Coverage For New Features	✅ Passed	PASS: main_test.go covers the new cache/resolver path with table-driven local, upstream, and invalid-stream cases; e2e tests exercise the new flag.
Stable And Deterministic Test Names	✅ Passed	No changed test titles use generated or runtime values; added/kept names are static strings only.
Test Structure And Quality	✅ Passed	PASS: The touched tests are table-driven and isolated; e2e cases use framework.Run, which handles cleanup/timeouts, and assertions carry context. No cluster-scoped resources or indefinite waits.
Microshift Test Compatibility	✅ Passed	No new Ginkgo specs were added; the changed e2e files are table-driven framework.Run tests, and the new upstream-resolver wiring adds no MicroShift-unsupported API use.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo specs were added; the touched e2e files use table-driven testing harnesses and contain no multi-node or SNO-sensitive assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	No pod spec, controller, or manifest scheduling fields were added; changes only add upstream-resolver plumbing and tests, so no topology assumptions.
Ote Binary Stdout Contract	✅ Passed	No new stdout writes were added in main/init/setup paths; the change only adds resolver wiring and cache logic, with logging still via logrus/stderr.
No-Weak-Crypto	✅ Passed	No weak-crypto APIs or custom crypto were added; scanned changed Go/YAML files found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret compares.
Container-Privileges	✅ Passed	Reviewed all PR-touched files; none add privileged:true, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[danilo-gemoli]

/test e2e

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 074066f and 2 for PR HEAD 7773952 in total

[danilo-gemoli]

/hold

[danilo-gemoli]

/retest-required

[danilo-gemoli]

/test e2e

[danilo-gemoli]

/test e2e

[danilo-gemoli]

/override ci/prow/breaking-changes
I'm fixing this with openshift/release#81013

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/breaking-changes

Details

In response to this:

/override ci/prow/breaking-changes
I'm fixing this with openshift/release#81013

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[danilo-gemoli]

/override ci/prow/breaking-changes
/override ci/prow/e2e
/override ci/prow/integration
/override ci/prow/images

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/breaking-changes, ci/prow/e2e, ci/prow/images, ci/prow/integration

Details

In response to this:

/override ci/prow/breaking-changes
/override ci/prow/e2e
/override ci/prow/integration
/override ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[danilo-gemoli]

/unhold

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danilo-gemoli, droslean

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [danilo-gemoli,droslean]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 86bf880 and 2 for PR HEAD 254317f in total

[danilo-gemoli]

/override ci/prow/images
/override ci/prow/integration

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/images, ci/prow/integration

Details

In response to this:

/override ci/prow/images
/override ci/prow/integration

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@danilo-gemoli: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.