OCPBUGS-88483: MCO: Use arm64-latest pattern in the arm64 jobs

[sergiordlr]

upi-installer image is only created for amd64. When the mco-conf-day2-add-mcoqe-robot-to-pull-secret step injects "cli: latest" into the upi-installer image there is an architecture mismatch. The cli is arm64, but the upi-installer image is amd64. Hence the multiarch-tunning-operator doesn't find any common architecture and the step cannot find any nodo to use.

After inspecting how other teams solved this issue, it seems that we need to use an arm64-latest image to install the cluster and a latest image for the injection and helper steps.

In this PR we modify the arm64 configurations in MCO so that they follow this pattern.

A detailed high-level summary could not be generated for this review. Here is an overview derived from the analyzed file changes:

• ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-4.22__arm64-periodics.yaml: ## AI-generated summary of changes
• ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-4.23__arm64-periodics.yaml: ## AI-generated summary of changes
• ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-5.0__arm64-periodics.yaml: ## AI-generated summary of changes

[coderabbitai]

Walkthrough

Three Machine Config Operator periodic job configurations for OCP versions 4.22, 4.23, and 5.0 are updated to introduce arm64-latest release candidates and wire corresponding disruptive e2e tests to use the new architecture-specific release image override.

Changes

MCO ARM64 Release and Test Configuration

Layer / File(s)	Summary
ARM64 Release Candidate Definitions ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-4.22__arm64-periodics.yaml, openshift-machine-config-operator-release-4.23__arm64-periodics.yaml, openshift-machine-config-operator-release-5.0__arm64-periodics.yaml	Three release config files each add a new arm64-latest release candidate with architecture: arm64 targeting OCP nightly stream for versions 4.22, 4.23, and 5.0 respectively. The existing latest candidate is modified to remove or clarify its architecture field in each file.
E2E Test Dependencies for ARM64 Release ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-4.22__arm64-periodics.yaml, openshift-machine-config-operator-release-4.23__arm64-periodics.yaml, openshift-machine-config-operator-release-5.0__arm64-periodics.yaml	The e2e-aws-mco-disruptive and e2e-aws-mco-disruptive-techpreview test steps in all three config files are updated to add OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest dependencies, ensuring these tests execute using the new arm64-specific release image.

Possibly related PRs

• openshift/release#80268: Updates AWS UsgGov custom-dns mini-perm test configuration to set OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest for ARM64 execution, following the same pattern.

Suggested labels

lgtm, approved, rehearsals-ack

Suggested reviewers

• pruan-rht
• dis016
• sadasu

---

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR #80466 only changes 3 ci-operator YAML files; searching those files shows no Ginkgo It/Describe/Context/When test titles containing dynamic values.
Test Structure And Quality	✅ Passed	git diff (HEAD vs main) shows only YAML + hack/generators/*.py changes; no *_test.go or Ginkgo test files were modified, so the Ginkgo quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PR 80466 only updates MCO periodic job YAMLs (adds arm64-latest release + sets OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE); no new Ginkgo e2e tests or test bodies are added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR #80466 changes only MCO arm64 periodic CI YAML (adds arm64-latest release candidate + env deps); no new Ginkgo e2e test code or multi-node assumptions introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates MCO periodic arm64 job YAML (adds arm64-latest release candidate and sets OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE); no affinity/topology/spread/PDB or other HA topology scheduling...
Ote Binary Stdout Contract	✅ Passed	PR only updates 3 YAML MCO release-periodics configs; no OTE/Go binary main/init/test setup code is changed, so stdout JSON contract violations aren’t introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR #80466 changes only 3 .yaml MCO release-periodics files (arm64-latest/dependency wiring); no new Go/Ginkgo e2e test code was added to flag for IPv6/disconnected assumptions. citeturn4view0tur...
No-Weak-Crypto	✅ Passed	PR #80466 only updates MCO arm64 periodics YAML (arm64-latest + OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE); no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB keywords or crypto code found in the diff.
Container-Privileges	✅ Passed	In the PR’s machine-config-operator arm64-periodics YAMLs (4.22/4.23/5.0), none include privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN or allowPrivilegeEscalation/securityContext for root.
No-Sensitive-Data-In-Logs	✅ Passed	In the arm64 MCO release-periodics YAMLs, changes add arm64-latest release candidates and OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE; no password/token/API key/PII/secret values or credential-like st...
Title check	✅ Passed	The title clearly and specifically summarizes the main change: updating MCO arm64 job configurations to use the arm64-latest pattern, which directly addresses the problem described in the PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@sergiordlr: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-images	openshift/machine-config-operator	presubmit	Ci-operator config changed
pull-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-images	openshift/machine-config-operator	presubmit	Ci-operator config changed
pull-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-images	openshift/machine-config-operator	presubmit	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-techpreview-2of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-e2e-aws-mco-disruptive-2of2	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-e2e-aws-mco-disruptive-1of2	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-1of2	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-techpreview-3of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-2of2	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-e2e-aws-mco-disruptive-techpreview-3of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-2of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-2of2	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-3of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-e2e-aws-mco-disruptive-techpreview-2of3	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-1of2	N/A	periodic	Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[isabella-janssen]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: isabella-janssen, sergiordlr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/machine-config-operator/OWNERS [isabella-janssen,sergiordlr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[isabella-janssen]

/retitle OCPBUGS-88483: MCO: Use arm64-latest pattern in the arm64 jobs

[openshift-ci-robot]

@sergiordlr: This pull request references Jira Issue OCPBUGS-88483, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

upi-installer image is only created for amd64. When the mco-conf-day2-add-mcoqe-robot-to-pull-secret step injects "cli: latest" into the upi-installer image there is an architecture mismatch. The cli is arm64, but the upi-installer image is amd64. Hence the multiarch-tunning-operator doesn't find any common architecture and the step cannot find any nodo to use.

After inspecting how other teams solved this issue, it seems that we need to use an arm64-latest image to install the cluster and a latest image for the injection and helper steps.

In this PR we modify the arm64 configurations in MCO so that they follow this pattern.

A detailed high-level summary could not be generated for this review. Here is an overview derived from the analyzed file changes:

• ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-4.22__arm64-periodics.yaml: ## AI-generated summary of changes
• ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-4.23__arm64-periodics.yaml: ## AI-generated summary of changes
• ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-release-5.0__arm64-periodics.yaml: ## AI-generated summary of changes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[isabella-janssen]

/jira refresh

[openshift-ci-robot]

@isabella-janssen: This pull request references Jira Issue OCPBUGS-88483, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sergiordlr]

/pj-rehearse periodic-ci-openshift-machine-config-operator-release-5.0-arm64-periodics-e2e-aws-mco-disruptive-techpreview-3of3 periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-2of3 periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3

[openshift-merge-bot]

@sergiordlr: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[sergiordlr]

/pj-rehearse periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3

[openshift-merge-bot]

@sergiordlr: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@sergiordlr: job(s): either don't exist or were not found to be affected, and cannot be rehearsed

[sergiordlr]

/pj-rehearse periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-2of3

[openshift-merge-bot]

@sergiordlr: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@sergiordlr: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3	3a4cad0	link	unknown	/pj-rehearse periodic-ci-openshift-machine-config-operator-release-4.23-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3
ci/rehearse/periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3	3a4cad0	link	unknown	/pj-rehearse periodic-ci-openshift-machine-config-operator-release-4.22-arm64-periodics-e2e-aws-mco-disruptive-techpreview-1of3

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.