CNTRLPLANE-3380: Add rebasebot periodic for openshift/apiserver-network-proxy

[bryan-cox]

Summary

• Adds a rebasebot periodic job to automatically rebase openshift/apiserver-network-proxy onto upstream kubernetes-sigs/apiserver-network-proxy:master
• Runs Mon/Thu at 12:00 UTC using a new HyperShift Rebase Bot GitHub App (ID: 3706026)
• Uses a single GitHub App for both app and cloner roles (same-org pattern, like the autoscaling team)
• Credentials stored in Vault at selfservice/hypershift-team/ops/rebase-bot, synced to hypershift-rebasebot-credentials in test-credentials

Test plan

• Local dry run completed successfully — rebasebot correctly identified 2 carry commits and rebased onto upstream master
• Verify Vault secret has synced to test-credentials namespace on CI clusters
• After merge, confirm periodic job periodic-ci-openshift-eng-rebasebot-main-apiserver-network-proxy appears in Prow
• Verify first automated rebase PR is created on openshift/apiserver-network-proxy

/cc @openshift/hypershift-team

🤖 Generated with Claude Code

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3380 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds a rebasebot periodic job to automatically rebase openshift/apiserver-network-proxy onto upstream kubernetes-sigs/apiserver-network-proxy:master
• Runs Mon/Thu at 12:00 UTC using a new HyperShift Rebase Bot GitHub App (ID: 3706026)
• Uses a single GitHub App for both app and cloner roles (same-org pattern, like the autoscaling team)
• Credentials stored in Vault at selfservice/hypershift-team/ops/rebase-bot, synced to hypershift-rebasebot-credentials in test-credentials

Test plan

• Local dry run completed successfully — rebasebot correctly identified 2 carry commits and rebased onto upstream master
• Verify Vault secret has synced to test-credentials namespace on CI clusters
• After merge, confirm periodic job periodic-ci-openshift-eng-rebasebot-main-apiserver-network-proxy appears in Prow
• Verify first automated rebase PR is created on openshift/apiserver-network-proxy

/cc @openshift/hypershift-team

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@bryan-cox: GitHub didn't allow me to request PR reviews from the following users: openshift/hypershift-team.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

• Adds a rebasebot periodic job to automatically rebase openshift/apiserver-network-proxy onto upstream kubernetes-sigs/apiserver-network-proxy:master
• Runs Mon/Thu at 12:00 UTC using a new HyperShift Rebase Bot GitHub App (ID: 3706026)
• Uses a single GitHub App for both app and cloner roles (same-org pattern, like the autoscaling team)
• Credentials stored in Vault at selfservice/hypershift-team/ops/rebase-bot, synced to hypershift-rebasebot-credentials in test-credentials

Test plan

• Local dry run completed successfully — rebasebot correctly identified 2 carry commits and rebased onto upstream master
• Verify Vault secret has synced to test-credentials namespace on CI clusters
• After merge, confirm periodic job periodic-ci-openshift-eng-rebasebot-main-apiserver-network-proxy appears in Prow
• Verify first automated rebase PR is created on openshift/apiserver-network-proxy

/cc @openshift/hypershift-team

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 28f538d6-5c06-421c-9fe1-49027381b527

📥 Commits

Reviewing files that changed from the base of the PR and between d2db14c and 12e284a.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/openshift-eng/rebasebot/openshift-eng-rebasebot-main-periodics.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift-eng/rebasebot/openshift-eng-rebasebot-main.yaml

---

Walkthrough

A new apiserver-network-proxy rebasebot job is added to the OpenShift CI configuration. The job runs on a schedule (Monday and Thursday at 12 PM UTC), rebasing the kubernetes-sigs/apiserver-network-proxy repository against OpenShift targets, with Go module updates and strict tagging policy enabled.

Changes

Apiserver Network Proxy Rebasebot Job

Layer / File(s)	Summary
Job configuration and credentials ci-operator/config/openshift-eng/rebasebot/openshift-eng-rebasebot-main.yaml	New apiserver-network-proxy test job entry with cron scheduling, rebasebot command parameters (source, destination, rebase target, Go module updates), GitHub credentials/bot identity, and mounted secret volume for authentication.
Resource allocation ci-operator/config/openshift-eng/rebasebot/openshift-eng-rebasebot-main.yaml	CPU and memory resource requests and limits configured for the job, sized appropriately for the rebasebot workload.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a rebasebot periodic job for openshift/apiserver-network-proxy. It is specific, clear, and directly reflects the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The custom check is for Ginkgo test names stability. This PR modifies only a YAML CI configuration file with no Ginkgo tests, making the check not applicable.
Test Structure And Quality	✅ Passed	This PR adds a YAML CI configuration file, not Ginkgo test code. The check targets Ginkgo test structure patterns. No Ginkgo tests are present, so the check is not applicable.
Microshift Test Compatibility	✅ Passed	PR adds CI job configuration (YAML), not Ginkgo e2e tests. MicroShift compatibility check only applies to new e2e test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests are being added in this PR. The changes only add a CI job configuration for rebasebot periodic execution. The SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR adds a CI-operator test job config for rebasebot, not a deployment/operator/controller. No scheduling constraints introduced. This is CI infrastructure config, not code affecting clusters.
Ote Binary Stdout Contract	✅ Passed	PR modifies only CI config YAML file. OTE Binary Stdout Contract check applies to Go test binaries, not CI configuration.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added. PR modifies only CI configuration (YAML) for a rebasebot periodic job. Check not applicable to CI infrastructure files.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[bryan-cox]

/pj-rehearse periodic-ci-openshift-eng-rebasebot-main-apiserver-network-proxy

[openshift-merge-bot]

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bryan-cox: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-openshift-eng-rebasebot-main-apiserver-network-proxy	N/A	periodic	Periodic changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[bryan-cox]

/pj-rehearse ack

It opened openshift/apiserver-network-proxy#108

[openshift-merge-bot]

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[JoelSpeed]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift-eng/rebasebot/OWNERS [JoelSpeed]
• ci-operator/jobs/openshift-eng/rebasebot/OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.