Skip to content

MCO-2468: Cache backed OSImageStreams for PIS - #6329

Open
pablintino wants to merge 1 commit into
openshift:mainfrom
pablintino:mco-2468
Open

MCO-2468: Cache backed OSImageStreams for PIS#6329
pablintino wants to merge 1 commit into
openshift:mainfrom
pablintino:mco-2468

Conversation

@pablintino

@pablintino pablintino commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

- What I did

This change leverages the recently added inspection cache to allow disconnected environments using PIS to be able to discover streams.

- How to verify it

TBD

- Description for the changelog

This change leverages the recently added inspection cache to allow disconnected environments using PIS to be able to discover streams.

Summary by CodeRabbit

  • New Features
    • Improved caching for images referenced by pinned image sets when stream caching is enabled.
    • Added an automated cache warmer that preloads release payload manifests/references into the inspection cache.
    • Cache warming is triggered when pinned image sets are added or updated.
  • Enhancements
    • Release payload images are now identified via a dedicated label helper for more reliable processing.
  • Chores
    • Standardized the image inspection context timeout to a shared constant (5 minutes).

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 23, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

@pablintino: This pull request references MCO-2468 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

- What I did

This change leverages the recently added inspection cache to allow disconnected environments using PIS to be able to discover streams.

- How to verify it

TBD

- Description for the changelog

This change leverages the recently added inspection cache to allow disconnected environments using PIS to be able to discover streams.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 104c1c63-7c6f-47da-8421-b487c63fe2ce

📥 Commits

Reviewing files that changed from the base of the PR and between b02856f and ada9c66.

📒 Files selected for processing (8)
  • cmd/machine-config-controller/start.go
  • pkg/controller/osimagestream/osimagestream_controller.go
  • pkg/controller/pinnedimageset/cache_warmer.go
  • pkg/controller/pinnedimageset/cache_warmer_test.go
  • pkg/controller/pinnedimageset/pinned_image_set.go
  • pkg/controller/pinnedimageset/pinned_image_set_test.go
  • pkg/osimagestream/image_data.go
  • pkg/osimagestream/osimagestream.go
🚧 Files skipped from review as they are similar to previous changes (6)
  • pkg/osimagestream/image_data.go
  • pkg/controller/pinnedimageset/pinned_image_set_test.go
  • pkg/controller/pinnedimageset/cache_warmer_test.go
  • pkg/controller/pinnedimageset/cache_warmer.go
  • cmd/machine-config-controller/start.go
  • pkg/controller/pinnedimageset/pinned_image_set.go

Walkthrough

Changes

Pinned image cache warming

Layer / File(s) Summary
Inspection contracts and timeout
pkg/osimagestream/image_data.go, pkg/osimagestream/osimagestream.go, pkg/controller/osimagestream/osimagestream_controller.go
Adds release-payload detection and uses a shared five-minute image inspection timeout.
Cache warmer execution
pkg/controller/pinnedimageset/cache_warmer.go
Lists and deduplicates pinned images, warms inspection data, fetches release manifests, retains referenced digests, and coalesces warm requests.
Controller wiring and validation
pkg/controller/pinnedimageset/pinned_image_set.go, cmd/machine-config-controller/start.go, pkg/controller/pinnedimageset/*_test.go
Starts and triggers the optional warmer, wires its dependencies when inspection caching is enabled, and tests PinnedImageSet create/update warming.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PinnedImageSetController
  participant CacheWarmer
  participant PinnedImageSetLister
  participant ImagesInspector
  participant InspectionCache
  PinnedImageSetController->>CacheWarmer: Request warm
  CacheWarmer->>PinnedImageSetLister: List PinnedImageSets
  CacheWarmer->>ImagesInspector: Inspect unique pinned images
  CacheWarmer->>ImagesInspector: Fetch release manifest
  ImagesInspector->>InspectionCache: Populate inspection entries
Loading

Possibly related PRs

Suggested labels: needs-ok-to-test, verified-later

Suggested reviewers: dkhater-redhat, sergiordlr


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error New warning log prints full image pullspecs (r.Image) on fetch errors, which can expose internal registry hostnames/customer repos. Redact or drop the image reference in the warning; log only a non-sensitive identifier such as a digest or truncated name.
Docstring Coverage ⚠️ Warning Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality ⚠️ Warning TestCacheWarmerWarmsOnPISChange bundles create and update warming plus multiple image checks into one test, so it violates single-responsibility and is hard to debug. Split the create and update paths into separate tests (or subtests) with narrower assertions; keep setup shared via helpers.
✅ Passed checks (12 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects the main change: using the inspection cache to back OSImageStreams for PIS.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo-style test titles were added; the new test is a plain Go test with static name TestCacheWarmerWarmsOnPISChange.
Microshift Test Compatibility ✅ Passed The added test is a plain Go unit test, not Ginkgo/e2e, and no MicroShift-specific gating or unsupported OpenShift API assumptions are present.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The added test is a unit test using testing.T, not a Ginkgo e2e test, and it contains no SNO-unsafe multi-node assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only wires a cache warmer into controller startup; it adds no pod specs, replicas, node selectors, affinity, tolerations, or other scheduling constraints.
Ote Binary Stdout Contract ✅ Passed No touched init/main/TestMain/suite setup writes to stdout; new logging uses klog and start.go sets logtostderr before logging.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the new test is a unit test using fake clients/inspectors and placeholder registry.example.com images.
No-Weak-Crypto ✅ Passed No weak-crypto APIs or custom crypto appear in the touched files, and no secret/token comparisons were added.
Container-Privileges ✅ Passed PR changes are Go-only; git diff --name-only HEAD showed no manifest/K8s files, so no new privileged settings were introduced.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pablintino

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 23, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
pkg/controller/pinnedimageset/cache_warmer.go (1)

118-121: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider logging inspection errors, not just fetch errors.

r.Error != nil is silently skipped; only FetchImageFile failures are logged (Line 125-127). Logging inspection failures too would help diagnose why warming silently fails to warm a given image.

📝 Proposed fix
 	for _, r := range results {
-		if r.Error != nil || r.InspectInfo == nil || !osimagestream.IsReleasePayload(r.InspectInfo.Labels) {
+		if r.Error != nil {
+			klog.Warningf("PIS cache warmer: failed to inspect %s: %v", r.Image, r.Error)
+			continue
+		}
+		if r.InspectInfo == nil || !osimagestream.IsReleasePayload(r.InspectInfo.Labels) {
 			continue
 		}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/pinnedimageset/cache_warmer.go` around lines 118 - 121, Update
the results loop in the cache-warming flow to log each non-nil r.Error before
continuing, alongside the existing FetchImageFile failure logging. Include
enough context to identify the affected image, while preserving the current
skips for missing InspectInfo and non-release payloads.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/controller/pinnedimageset/cache_warmer.go`:
- Around line 96-131: Update CacheWarmer.Warm to derive a per-cycle timeout
context from ctx before calling inspector.Inspect and inspector.FetchImageFile.
Use the configured or established warm-cycle timeout symbol, defer its
cancellation, and pass the derived context to both registry calls so each Warm
invocation is bounded while preserving the existing error handling and shutdown
cancellation.

---

Nitpick comments:
In `@pkg/controller/pinnedimageset/cache_warmer.go`:
- Around line 118-121: Update the results loop in the cache-warming flow to log
each non-nil r.Error before continuing, alongside the existing FetchImageFile
failure logging. Include enough context to identify the affected image, while
preserving the current skips for missing InspectInfo and non-release payloads.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: efb19ced-6a2c-47a8-b014-41a4ea05e459

📥 Commits

Reviewing files that changed from the base of the PR and between 6197659 and b02856f.

📒 Files selected for processing (6)
  • cmd/machine-config-controller/start.go
  • pkg/controller/pinnedimageset/cache_warmer.go
  • pkg/controller/pinnedimageset/cache_warmer_test.go
  • pkg/controller/pinnedimageset/pinned_image_set.go
  • pkg/controller/pinnedimageset/pinned_image_set_test.go
  • pkg/osimagestream/image_data.go

Comment thread pkg/controller/pinnedimageset/cache_warmer.go
This change leverages the recently added inspection cache to allow
disconnected environments using PIS to be able to discover streams.

Signed-off-by: Pablo Rodriguez Nava <git@amail.pablintino.eu>
@pablintino

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift

@pablintino

Copy link
Copy Markdown
Contributor Author

/test unit

@openshift-ci

openshift-ci Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

@pablintino: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@isabella-janssen

Copy link
Copy Markdown
Member

/hold

Holding to allow the Kube rebase to land in #6321. Please ensure this will not cause merge conflicts for the Kube rebase before unholding this PR.

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants