Use OCP internal registry image for workload test pods

[ugreener]

Summary

Replace external registry images (registry.access.redhat.com/ubi9/ubi-minimal, registry.k8s.io/pause:3.9) with the OCP internal registry openshift/tools ImageStream for test workload pods. This fixes disconnected (air-gapped) test failures and follows the proven pattern used by openshift/origin and other OCP E2E test suites.

Changes

• Shared constant (medik8sparams/const.go): Added DefaultWorkloadImage to centralize the image string in one place
• FAR (farparams/const.go): registry.access.redhat.com/ubi9/ubi-minimal replaced with medik8sparams.DefaultWorkloadImage
• SBR (sbrparams/const.go): same replacement for the WatchdogDebugImage default
• SNR (snrparams/const.go): registry.k8s.io/pause:3.9 replaced with medik8sparams.DefaultWorkloadImage; constant renamed from PauseImage to WorkloadTestImage
• SNR helpers (helpers.go): workload pod container changed from pause//pause to workload/sleep infinity
• SNR README: Updated environment description to reflect disconnected cluster support

The openshift/tools ImageStream is part of every OCP release payload and is automatically mirrored during cluster installation, making it available on both connected and disconnected clusters without any additional configuration.

Prior art: openshift/origin (test/extended/util/image/image.go), openshift/cluster-etcd-operator, openshift/external-dns-operator, openshift/aws-load-balancer-operator all use image-registry.openshift-image-registry.svc:5000/openshift/tools:latest for test workload pods.

[coderabbitai]

Warning

Review limit reached

@ugreener, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2455e556-46be-414c-bb3c-468fcba1ea55

📥 Commits

Reviewing files that changed from the base of the PR and between eddf0ae and 16d54e0.

📒 Files selected for processing (6)

• tests/far-operator/internal/farparams/const.go
• tests/internal/medik8sparams/const.go
• tests/sbr-operator/internal/sbrparams/const.go
• tests/snr-operator/README.md
• tests/snr-operator/internal/snrparams/const.go
• tests/snr-operator/tests/helpers.go

📝 Walkthrough

Walkthrough

Introduces a shared default workload image constant and updates FAR, SBR, and SNR test parameters to reference it. SNR documentation now describes internal registry usage and support for connected or disconnected environments.

Changes

Workload image defaults

Layer / File(s)	Summary
Define shared workload image tests/internal/medik8sparams/const.go	Adds DefaultWorkloadImage for test workload pods.
Adopt shared image in operator tests tests/far-operator/..., tests/sbr-operator/..., tests/snr-operator/..., tests/snr-operator/README.md	Updates workload, watchdog, and pause image defaults to use the shared constant and revises SNR environment documentation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: lgtm

Suggested reviewers: mhabashrh, maximunited

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: switching workload test pods to the OCP internal registry image.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-2-for-medik8s]

PR Summary by Qodo

Use OpenShift internal registry image for test workload pods

🐞 Bug fix ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Replace external workload pod images with the OCP internal openshift/tools ImageStream.
• Prevent ImagePullBackOff failures on disconnected (air-gapped) clusters.
• Align FAR/SBR/SNR tests with established OpenShift E2E image-pinning patterns.

Diagram

graph TD
  FAR["FAR params"] --> Pods["Test workload pods"] --> IR{{"OCP internal registry"}}
  SBR["SBR params"] --> Pods --> IR
  SNR["SNR params"] --> Pods --> IR
  Pods -. "previously external" .-> EXT{{"External registries"}}

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Make the workload image configurable (env var/flag)

• ➕ Allows running the same tests on non-OCP or custom registry setups
• ➕ Enables easy pinning to a specific digest/tag when investigating failures
• ➖ Adds configuration surface area to test harness
• ➖ Still needs a safe default for disconnected clusters (which this PR provides)

2. Resolve ImageStreamTag dynamically at runtime

• ➕ Avoids hardcoding the registry service hostname and tag
• ➕ Can validate the image exists before creating pods
• ➖ Requires API calls/RBAC to read ImageStreams or ImageStreamTags
• ➖ More moving parts for minimal practical gain in OCP CI where the IST is stable

Recommendation: Using image-registry.openshift-image-registry.svc:5000/openshift/tools:latest is the most practical default for OCP E2E/disconnected environments and matches established OpenShift test patterns. If these tests are expected to run outside OCP, consider adding an override mechanism; otherwise, the current hardcoded internal reference is appropriate and keeps the change minimal.

Files changed (3) +4 / -4

Bug fix (3) +4 / -4

const.goSwitch FAR workload test image to OCP internal registry +1/-1

Switch FAR workload test image to OCP internal registry

• Updates 'WorkloadTestImage' to use the in-cluster OpenShift registry 'openshift/tools:latest' instead of 'registry.access.redhat.com/ubi9/ubi-minimal', improving disconnected test reliability.

tests/far-operator/internal/farparams/const.go

const.goUse internal registry image for SBR watchdog/debug default +1/-1

Use internal registry image for SBR watchdog/debug default

• Replaces the default UBI-minimal image string with 'image-registry.openshift-image-registry.svc:5000/openshift/tools:latest' so test pods can pull images on air-gapped clusters.

tests/sbr-operator/internal/sbrparams/const.go

const.goReplace SNR pause image with internal registry tools image +2/-2

Replace SNR pause image with internal registry tools image

• Updates 'PauseImage' from 'registry.k8s.io/pause:3.9' to the OpenShift internal 'openshift/tools:latest' image. Also includes a minor comment punctuation tweak near the destructive test constants header.

tests/snr-operator/internal/snrparams/const.go

[qodo-2-for-medik8s]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 13 rules

1. Missing /pause in image ✓ Resolved 🐞 Bug ≡ Correctness

Description

createWorkloadPodOnNode hard-codes Command: ["/pause"], but the PR changes
snrparams.PauseImage from the Kubernetes pause image to openshift/tools, so the workload pod may
fail to start due to the command not existing in the new image. This can break SNR destructive
remediation tests that rely on the workload pod reaching Running/Ready.

Code

tests/snr-operator/internal/snrparams/const.go[R122-123]

	// PauseImage is the container image used for test workload pods.
-	PauseImage = "registry.k8s.io/pause:3.9"
+	PauseImage = "image-registry.openshift-image-registry.svc:5000/openshift/tools:latest"

Relevance

⭐⭐⭐ High

Team previously accepted fixing PauseImage issues to prevent SNR test failures; command/image
mismatch is a clear breakage risk.

PR-#52

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The helper that creates the workload pod requires the image to execute /pause, but after this PR
the configured image is no longer the Kubernetes pause image, creating a command/image mismatch that
can prevent the pod from starting.

tests/snr-operator/internal/snrparams/const.go[118-124]
tests/snr-operator/tests/helpers.go[496-513]
PR-#52

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`snrparams.PauseImage` was switched to `image-registry.../openshift/tools:latest`, but the workload pod helper explicitly runs `/pause`. If the selected image does not provide an executable at `/pause`, the pod will not start (CrashLoopBackOff / CreateContainerError), breaking remediation workload/eviction assertions.

### Issue Context
The workload pod is intended to be a simple “always-running” pod pinned to a node; it does not inherently require the pause image, but it *does* require that whatever image is used can execute the configured command.

### Fix Focus Areas
- tests/snr-operator/internal/snrparams/const.go[118-124]
- tests/snr-operator/tests/helpers.go[496-546]

### Implementation guidance
Choose one of:
1) Keep using an actual pause image (but mirrored/internal) so `/pause` remains valid; **or**
2) Keep `openshift/tools` (or another internal image), but change the workload container command to something the image is expected to have (e.g., `sh -c 'sleep infinity'`), and update naming/comments (`PauseImage`/container name) to reflect it’s no longer a pause container.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/snr-operator/internal/snrparams/const.go`:
- Line 127: Update PauseImage in the SNR test parameters to use a workload image
that provides /pause, or adjust the SNR workload setup in helpers.go so its
container command matches the selected image. Preserve successful workload pod
creation while keeping the existing SNR test configuration consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2081d984-aa22-493e-8cfd-f728c5316687

📥 Commits

Reviewing files that changed from the base of the PR and between 9e39d54 and eddf0ae.

📒 Files selected for processing (5)

• tests/far-operator/internal/farparams/const.go
• tests/internal/medik8sparams/const.go
• tests/sbr-operator/internal/sbrparams/const.go
• tests/snr-operator/README.md
• tests/snr-operator/internal/snrparams/const.go

[ugreener]

/test 4.22-konflux-e2e-far-aws
/test 4.22-konflux-e2e-sbr-aws-odf
/test 4.22-konflux-e2e-sbr-aws-efs
/test 4.22-konflux-e2e-snr-aws
/test 4.22-konflux-e2e-nmo-aws
/test 4.22-konflux-e2e-mdr-aws
/test 4.22-konflux-e2e-nhc-aws
/test 4.22-upgrade-e2e-far-upgrade-presubmit-aws

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: razo7, ugreener

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [razo7,ugreener]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment