hack/secret-manager: always pull the latest container image

[redhat-chai-bot]

The script currently only pulls the container image when it doesn't exist locally. This means users can run with a stale cached image indefinitely.

Replace the conditional pull block with --pull=always on the container run command, ensuring the latest image is always used. Both podman and docker support this flag.

Changes

• Remove the if ! image exists ... pull ... fi conditional block
• Add --pull=always to the exec "$CONTAINER_ENGINE" run line

---

AI-generated. Review for accuracy.

@Prucek requested via Chai Bot

Summary by CodeRabbit

• Updates the openshift/release secret-manager tooling.
• Forces Podman or Docker to pull the latest configured image before each run.
• Removes the previous conditional image check and pull logic.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@redhat-chai-bot: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign bear-redhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 92e2832f-1036-403e-bda3-eddd78ab3b9b

📥 Commits

Reviewing files that changed from the base of the PR and between 1653540 and 3dbaf02.

📒 Files selected for processing (1)

• hack/secret-manager.sh

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The secret manager script now passes --pull=always when it runs the container. It no longer checks whether the image exists locally or pulls the image in a separate command.

Changes

Secret manager image pull

Layer / File(s)	Summary
Always pull the container image hack/secret-manager.sh	The container run command uses --pull=always. The previous local image check and separate pull command were removed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: ccardenosa

Merge Risk: ⚪ Minimal · up to 3dbaf

The change implements the stated image-pull behavior without an identified merge-blocking impact.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: the hack/secret-manager script always pulls the latest container image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only hack/secret-manager.sh. The diff removes a shell image-pull block and adds --pull=always to the container run command. It introduces no Ginkgo tests or test titles, s…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only hack/secret-manager.sh (+1/-4). The patch contains no Ginkgo test code, It blocks, cluster operations, waits, or assertions. The test-structure requirements are…
Microshift Test Compatibility	✅ Passed	The pull request changes only hack/secret-manager.sh. The diff removes a conditional image pull and adds --pull=always to the container run command. It adds no Ginkgo e2e tests or test declaration…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The pull request changes only hack/secret-manager.sh. The authoritative diff removes a conditional container-image pull and adds --pull=always to container_engine run; it adds no Ginkgo e…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only hack/secret-manager.sh. The diff removes a conditional image pull and adds --pull=always to the container run command. It does not add or modify deployment mani…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only hack/secret-manager.sh. It removes a conditional image pull and adds --pull=always to the container engine command. It does not change an OTE binary, Go suite s…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only hack/secret-manager.sh. The diff adds --pull=always to a container run command and removes a local image-existence check. It adds no Ginkgo e2e tests and introduces n…
No-Weak-Crypto	✅ Passed	PASS: The pull request changes only hack/secret-manager.sh. The authoritative diff removes a conditional image pull and adds --pull=always to the container run command. The changed lines contain…
Container-Privileges	✅ Passed	The pull request changes only hack/secret-manager.sh. The diff removes a conditional image pull and adds --pull=always to the existing container run command. It does not add --privileged, host P…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request changes only hack/secret-manager.sh: it removes the conditional pull block and adds --pull=always to the existing container run command. It adds no logging, output interpolati…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.