CNTRLPLANE-3871: add temporary e2e-v2-aws-techpreview-osimagestream job

[jparrill]

Summary

Add a dedicated CI job e2e-v2-aws-techpreview-osimagestream that creates the hosted cluster with TechPreviewNoUpgrade feature set to validate the dual-stream RHEL 9/10 (OSStreams) feature in HyperShift E2E tests.

• Presubmit: always_run: true, optional: true — runs on every HyperShift PR, non-blocking
• Periodic: cron: 0 0,6,12,18 * * * — 4x/day against release-5.0

Why a separate job?

The existing e2e-v2-aws creates hosted clusters with Default feature set — the MCO ignores 99_osimagestream.yaml because the OSStreams FG is not active in Default for the Hypershift cluster profile. This new job runs only the nodepool-osimagestream labeled tests against a TechPreview hosted cluster.

This is temporary

Once the OSStreams feature gate is graduated to Default for Hypershift (openshift/api#2950), this job can be removed and the osimagestream tests can move back to the standard e2e-v2-aws workflow. TODOs are placed in the code to track this.

New files

• ci-operator/step-registry/hypershift/e2e-v2/osimagestream/ — chain filtering --ginkgo.label-filter='nodepool-osimagestream'
• ci-operator/step-registry/hypershift/aws/e2e-v2-osimagestream/ — workflow (same pre/post as hypershift-aws-e2e-v2, uses osimagestream chain)
• Presubmit job in openshift-hypershift-main.yaml
• Periodic job in openshift-hypershift-release-5.0__periodics.yaml

Dependency chain

This PR must merge first to register the new job in Prow. Then:

1. This PR → registers e2e-v2-aws-techpreview-osimagestream job (presubmit + periodic)
2. openshift/hypershift#9099 → removes StreamRHEL9 hardcode + consolidates osImageStream tests under this job
3. openshift/api#2950 → graduates OSStreams FG to Default for Hypershift
4. After #3 merges → remove this job and lifecycle label (tests move back to e2e-v2-aws)

Already merged

• openshift/machine-config-operator#6308 — remove ExternalTopologyMode guard from OSImageStream bootstrap

Fixes

• https://issues.redhat.com/browse/CNTRLPLANE-3871

🤖 Generated with Claude Code

[openshift-ci-robot]

@jparrill: This pull request references CNTRLPLANE-3871 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Set GUEST_FEATURE_SET=TechPreviewNoUpgrade on the e2e-v2-aws job so hosted clusters are created with TechPreview feature set
• This enables the MCO to process 99_osimagestream.yaml manifests written by the ignition-server, validating the dual-stream RHEL 9/10 (OSStreams) feature in HyperShift E2E tests
• The management cluster HO already runs with TechPreview (TECH_PREVIEW_NO_UPGRADE=true), but the hosted cluster was using Default — the MCO ignored the OSImageStream manifest because the feature gate wasn't active

Context

The e2e-v2-aws job has a split: the HyperShift Operator runs with TechPreview (CRDs include spec.osImageStream), but the hosted cluster uses Default (MCO ignores OSImageStream). This causes the NodePoolOSImageStreamDefaultStatusTest to fail — nodes boot with RHEL 10 AMI but MCO serves RHEL 9 ignition.

The GUEST_FEATURE_SET env var and --feature-set flag already exist in the hypershift-aws-create chain — this PR simply sets the variable. The e2e-aws-ovn-conformance-techpreview job already uses this pattern successfully.

Dependencies

• CNTRLPLANE-3871: resolve RHEL stream dynamically for boot images hypershift#9099 (remove StreamRHEL9 hardcode)
• CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift api#2950 (graduate OSStreams FG to Default for Hypershift)
• CNTRLPLANE-3840: Remove ExternalTopologyMode guard from OSImageStream bootstrap machine-config-operator#6308 (remove ExternalTopologyMode guard — merged)

Fixes

• https://issues.redhat.com/browse/CNTRLPLANE-3871

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds an optional HyperShift AWS TechPreviewNoUpgrade job, workflow registration, lifecycle orchestration, and a dedicated nodepool-osimagestream E2E test chain with JUnit reporting.

Changes

HyperShift OSImageStream validation

Layer / File(s)	Summary
AWS workflow registration and lifecycle ci-operator/config/openshift/hypershift/..., ci-operator/step-registry/hypershift/aws/e2e-v2-osimagestream/*	Registers the optional job and defines the AWS HyperShift workflow with TechPreviewNoUpgrade settings, setup, hosted-cluster creation, testing, cleanup, metadata, and ownership.
OSImageStream test chain ci-operator/step-registry/hypershift/e2e-v2/osimagestream/*	Runs the filtered nodepool-osimagestream E2E test with hosted-cluster environment variables, JUnit output, timeout, grace period, resource requests, metadata, and ownership.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: clebs, bryan-cox

Sequence Diagram(s)

sequenceDiagram
  participant CIJob
  participant HyperShiftWorkflow
  participant AWSCluster
  participant E2ETestChain
  CIJob->>HyperShiftWorkflow: run AWS OSImageStream workflow
  HyperShiftWorkflow->>AWSCluster: create TechPreviewNoUpgrade cluster
  HyperShiftWorkflow->>E2ETestChain: run nodepool-osimagestream tests
  E2ETestChain-->>HyperShiftWorkflow: write JUnit results
  HyperShiftWorkflow->>AWSCluster: destroy cluster

Loading

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles were added; the PR only introduces static CI/YAML job and workflow definitions, with a fixed label filter.
Test Structure And Quality	✅ Passed	PR only adds CI/job and step-registry YAML; no Ginkgo It/BeforeEach/Eventually test code changed, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo test bodies were added; only CI/job YAML and a chain/workflow wrapper, so MicroShift API compatibility isn’t implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo test code was added; the PR only adds CI/job YAML and metadata, so there are no new SNO assumptions to review.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR only adds CI job/workflow/chain files; no deployment manifests or controllers, and no nodeSelector/affinity/PDB/topology-spread constraints were introduced.
Ote Binary Stdout Contract	✅ Passed	Diff only adds CI YAML/OWNERS files; no main/init/TestMain/suite code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only adds CI/job wiring; no new Ginkgo test code or IPv4/external-network assumptions were introduced.
No-Weak-Crypto	✅ Passed	Diff only adds CI job/step YAML and OWNERS; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparisons found.
Container-Privileges	✅ Passed	The added CI manifests only set cluster_profile/env and label filters; no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation fields are present.
No-Sensitive-Data-In-Logs	✅ Passed	Touched CI configs only; no added logging of secrets/PII/internal hostnames was found in the new job, workflow, or chain files.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a temporary e2e-v2-aws-techpreview-osimagestream job.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jparrill]

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-v2-aws-techpreview-osimagestream

[openshift-merge-bot]

@jparrill: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jparrill]

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-v2-aws-techpreview-osimagestream

[openshift-merge-bot]

@jparrill: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@jparrill: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-hypershift-main-e2e-v2-aws-techpreview-osimagestream	openshift/hypershift	presubmit	Presubmit changed
periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-v2-aws-techpreview-osimagestream	N/A	periodic	Periodic changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@jparrill: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/hypershift/main/e2e-v2-aws-techpreview-osimagestream	25b65a0	link	unknown	/pj-rehearse pull-ci-openshift-hypershift-main-e2e-v2-aws-techpreview-osimagestream

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[csrwng]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csrwng, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/hypershift/OWNERS [csrwng,jparrill]
• ci-operator/jobs/openshift/hypershift/OWNERS [csrwng,jparrill]
• ci-operator/step-registry/hypershift/OWNERS [csrwng,jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment