ART-21088: Add art-publish RBAC permissions for origin-arm64 namespace

[redhat-chai-bot]

Summary

Grant the system:serviceaccount:ocp:art-publish service account permissions to update imagestreams in the origin-arm64 namespace, mirroring the existing permissions in the origin namespace.

Problem

The OKD pipeline's new arm64 imagestream support (openshift-eng/art-tools#3305) needs to tag images into origin-arm64/scos-5.0-art-arm64, but the art-publish SA only has RBAC in the origin namespace. Attempts to tag arm64 images fail with:

Error from server (Forbidden): imagestreams.image.openshift.io "scos-5.0-art-arm64" is forbidden:
User "system:serviceaccount:ocp:art-publish" cannot update resource "imagestreams"
in API group "image.openshift.io" in the namespace "origin-arm64"

Changes

• Generator (hack/generators/release-controllers/content/art_publish_permissions.py): Added RBAC block for origin-arm64 following the same pattern as the existing origin namespace permissions:

  • art-publish RoleBinding granting system:image-builder ClusterRole
  • art-publish-modify-release Role with permissions on imagestreams, imagestreamimports, and imagestreamtags
  • art-publish-modify-release RoleBinding linking the SA to the role

• Generated output (clusters/app.ci/release-controller/admin_deploy-ocp-publish-art.yaml): Regenerated via make release-controllers

---

AI-generated. Review for accuracy.

@locriandev requested via Chai Bot

Summary by CodeRabbit

This PR grants the system:serviceaccount:ocp:art-publish service account permission to update related image stream resources in the origin-arm64 namespace. This enables the OKD arm64 release pipeline to publish artifacts.

The generator now creates the required RoleBinding, Role, and RoleBinding resources. The release-controller deployment manifest includes the regenerated RBAC configuration.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@redhat-chai-bot: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 1db90134-ef78-44f7-aa19-3f9ce170f660

📥 Commits

Reviewing files that changed from the base of the PR and between d2ec2c8 and 26fe287.

📒 Files selected for processing (2)

• clusters/app.ci/release-controller/admin_deploy-ocp-publish-art.yaml
• hack/generators/release-controllers/content/art_publish_permissions.py

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The change grants the art-publish ServiceAccount image-builder and image stream management permissions in the origin-arm64 namespace. The generator and rendered deployment manifest now define the required Role and RoleBindings.

Changes

ARM64 art-publish RBAC

Layer / File(s)	Summary
Generate art-publish permissions hack/generators/release-controllers/content/art_publish_permissions.py	The generator creates an image-builder RoleBinding and a Role plus RoleBinding for image stream operations.
Render origin-arm64 RBAC clusters/app.ci/release-controller/admin_deploy-ocp-publish-art.yaml	The deployment manifest adds the art-publish bindings and the art-publish-modify-release Role in origin-arm64.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 26fe2

This localized change adds the required arm64 publishing permissions and generated configuration; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: deepsm007

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff only adds static Kubernetes RBAC manifests and generator data; it adds no Ginkgo test declarations or test titles.
Test Structure And Quality	✅ Passed	The PR changes only a Python RBAC generator and YAML output; the diff adds no Ginkgo tests or cluster-test operations subject to this check.
Microshift Test Compatibility	✅ Passed	The diff adds only Python RBAC generation and YAML Role/RoleBinding resources; it adds no Ginkgo e2e tests or test constructs requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff adds only RBAC YAML and a Python generator block. It adds no Ginkgo tests or multi-node assumptions, so the SNO test check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The parent-to-HEAD diff adds only Role and RoleBinding RBAC objects plus generator code; it adds no pods, replicas, affinity, topology spread, node selectors, or tolerations.
Ote Binary Stdout Contract	✅ Passed	The diff changes only YAML and a Python RBAC generator; AST inspection found no print, logging, stdout, or OTE suite/process setup writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff adds only Kubernetes YAML and a Python RBAC generator; it adds no Ginkgo e2e tests or IPv4/external-network test behavior.
No-Weak-Crypto	✅ Passed	The commit adds only Kubernetes RBAC resources and generator data; added lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto code, or secret comparisons.
Container-Privileges	✅ Passed	The diff adds only RBAC Role and RoleBinding resources plus generator data; it adds no container manifest or privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation...
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds only Kubernetes RBAC manifests and generator data. It adds no logging calls or log messages containing passwords, tokens, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the RBAC permission changes for the art-publish service account in the origin-arm64 namespace.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[locriandev]

/retitle ART-21088: Add art-publish RBAC permissions for origin-arm64 namespace

[openshift-ci-robot]

@redhat-chai-bot: This pull request references ART-21088 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

Grant the system:serviceaccount:ocp:art-publish service account permissions to update imagestreams in the origin-arm64 namespace, mirroring the existing permissions in the origin namespace.

Problem

The OKD pipeline's new arm64 imagestream support (openshift-eng/art-tools#3305) needs to tag images into origin-arm64/scos-5.0-art-arm64, but the art-publish SA only has RBAC in the origin namespace. Attempts to tag arm64 images fail with:

Error from server (Forbidden): imagestreams.image.openshift.io "scos-5.0-art-arm64" is forbidden:
User "system:serviceaccount:ocp:art-publish" cannot update resource "imagestreams"
in API group "image.openshift.io" in the namespace "origin-arm64"

Changes

• Generator (hack/generators/release-controllers/content/art_publish_permissions.py): Added RBAC block for origin-arm64 following the same pattern as the existing origin namespace permissions:

• art-publish RoleBinding granting system:image-builder ClusterRole

• art-publish-modify-release Role with permissions on imagestreams, imagestreamimports, and imagestreamtags

• art-publish-modify-release RoleBinding linking the SA to the role

• Generated output (clusters/app.ci/release-controller/admin_deploy-ocp-publish-art.yaml): Regenerated via make release-controllers

---

AI-generated. Review for accuracy.

@locriandev requested via Chai Bot

Summary by CodeRabbit

This PR grants the system:serviceaccount:ocp:art-publish service account permission to update related image stream resources in the origin-arm64 namespace. This enables the OKD arm64 release pipeline to publish artifacts.

The generator now creates the required RoleBinding, Role, and RoleBinding resources. The release-controller deployment manifest includes the regenerated RBAC configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bradmwilliams, redhat-chai-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clusters/app.ci/release-controller/OWNERS [bradmwilliams]
• hack/generators/release-controllers/OWNERS [bradmwilliams]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment