OCPBUGS-83693: Fix rhel10 rhocp repo configuration in RPM install

[ggiguash]

Summary by CodeRabbit

• Tests
  • Improved testing infrastructure for RHEL 10 environments with updated repository configuration.
  • Enhanced security configuration with GPG verification and TLS authentication support.

[openshift-ci-robot]

@ggiguash: This pull request references Jira Issue OCPBUGS-83693, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (agullon+dev1@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

Modified an RHEL 10 boot container test script to replace subscription-manager-based repo configuration with a new configure_cdn_repo workflow that generates repo files, enables GPG checking, and configures TLS client authentication using entitlement certificates.

Changes

Cohort / File(s)	Summary
Repo Configuration Refactor test/scenarios-bootc/el10/presubmits/el102-src@rpm-install.sh	Replaced subscription-manager repo enabling with new configure_cdn_repo workflow for RHEL 9 CDN layered repos; adds arch-parameterized repo file generation under /etc/yum.repos.d/, GPG checking enablement, and TLS client certificate/key configuration using VM entitlements.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: fixing RHEL10 rhocp repo configuration in the RPM install script, which directly aligns with the changeset that replaces subscription-manager repo enabling with a new CDN repo configuration workflow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only bash shell script for RPM configuration, not Ginkgo test files. Check is not applicable.
Test Structure And Quality	✅ Passed	Custom check for Ginkgo test code does not apply; PR only modifies shell scripts, not Go test files.
Microshift Test Compatibility	✅ Passed	The custom check applies only to new Ginkgo e2e tests. The PR modifies a bash shell script for repository configuration, not a Ginkgo test file.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR modifies only a shell script with bash helper functions, not Ginkgo e2e test code. SNO compatibility check applies only to new test definitions.
Topology-Aware Scheduling Compatibility	✅ Passed	The custom check for topology-aware scheduling is not applicable. The PR modifies only a test automation shell script, not deployment manifests, operator code, or controllers.
Ote Binary Stdout Contract	✅ Passed	The OTE Binary Stdout Contract check is not applicable to this pull request as the modified file is a shell script containing test helper functions, not a compiled OTE binary.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The custom check for IPv6 and disconnected network test compatibility only applies to Ginkgo e2e tests, but this pull request modifies only a shell script for bootc test scenario configuration.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/scenarios-bootc/el10/presubmits/el102-src`@rpm-install.sh:
- Line 77: The arch variable is currently defaulting to the test runner's uname
-m (local) which can differ from the VM/host1; change the default for local -r
arch=${4:-$(uname -m)} (and the similar uses at the other occurrences around
lines 131-141 and 143-146) to resolve architecture by querying host1 instead
(e.g., replace the local uname -m with the project’s remote-exec helper or an
ssh to host1 to run uname -m) so CDN URLs use the VM's architecture; update
every reference that falls back to $(uname -m) to use the host1-resolved
architecture variable.
- Around line 52-53: The current selection picks cert and key independently and
can choose different entitlement IDs; change the logic so you first determine a
single entitlement basename/ID (e.g., via run_command_on_vm used to list
/etc/pki/entitlement/[0-9]*.pem and pick one entry), then derive both cert and
key paths from that same basename/ID (construct cert as "<basename>.pem" and key
as "<basename>-key.pem") so variables cert and key refer to a matching pair;
update the code that sets local -r cert and local -r key to use that single
derived basename instead of two separate ls/grep calls.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a38969e3-0e53-44ad-b5c0-8a559490828b

📥 Commits

Reviewing files that changed from the base of the PR and between 224fcf9 and 754babe.

📒 Files selected for processing (1)

• test/scenarios-bootc/el10/presubmits/el102-src@rpm-install.sh

[agullon]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: agullon, ggiguash

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [agullon,ggiguash]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ggiguash]

/verified by ci

[openshift-ci-robot]

@ggiguash: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@ggiguash: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@ggiguash: Jira Issue OCPBUGS-83693: All pull requests linked via external trackers have merged:

• openshift/microshift#6587
• openshift/microshift#6606

All linked pull requests have the verified tag. Jira Issue OCPBUGS-83693 has been moved to the VERIFIED state.

Details

In response to this:

Summary by CodeRabbit

• Tests
• Improved testing infrastructure for RHEL 10 environments with updated repository configuration.
• Enhanced security configuration with GPG verification and TLS authentication support.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.