Remove Konflux e2e pipeline

[avinal]

Changes

• break E2E pipeline in smaller tasks
• add new parameters for finer control
• add a custom CI image for running e2e
• improve e2e execution by combining tasks logically

Signed-off-by: Avinal Kumar avinal@redhat.com

[qodo-code-review]

Review Summary by Qodo

Modularize Konflux e2e pipeline with reusable tasks and custom CI image

✨ Enhancement

Walkthroughs

Description

• Modularize e2e pipeline into separate reusable tasks
• Add custom CI image with operator-sdk, oc, kubectl, ginkgo
• Introduce new parameters for flexible task repository control
• Extract inline task logic into dedicated task files for maintainability

Diagram

flowchart LR
  A["Monolithic Pipeline"] -->|"Extract Tasks"| B["validate-snapshot"]
  A -->|"Extract Tasks"| C["provision-cluster"]
  A -->|"Extract Tasks"| D["verify-fips"]
  A -->|"Extract Tasks"| E["install-pipelines"]
  A -->|"Extract Tasks"| F["deploy-operator"]
  A -->|"Extract Tasks"| G["verify-images"]
  A -->|"Extract Tasks"| H["run-tests"]
  B --> I["Modular Pipeline"]
  C --> I
  D --> I
  E --> I
  F --> I
  G --> I
  H --> I
  J["Custom CI Image"] -->|"Provides Tools"| I

Loading

File Changes

1. README.md 📝 Documentation +59/-0

Document e2e pipeline parameters and execution flow

README.md

---

2. images/e2e-ci/Dockerfile ✨ Enhancement +34/-0

Create custom CI image with required tools

images/e2e-ci/Dockerfile

---

3. pipelines/konflux-e2e-complete-pipeline.yaml ✨ Enhancement +183/-664

Refactor pipeline to use external task definitions

pipelines/konflux-e2e-complete-pipeline.yaml

---

View more (7)

4. tasks/e2e-validate-snapshot.yaml ✨ Enhancement +137/-0

Extract snapshot validation into standalone task

tasks/e2e-validate-snapshot.yaml

---

5. tasks/e2e-provision-cluster.yaml ✨ Enhancement +74/-0

Extract cluster provisioning into standalone task

tasks/e2e-provision-cluster.yaml

---

6. tasks/e2e-verify-fips.yaml ✨ Enhancement +81/-0

Extract FIPS verification into standalone task

tasks/e2e-verify-fips.yaml

---

7. tasks/e2e-install-openshift-pipelines.yaml ✨ Enhancement +113/-0

Extract pipelines operator installation into task

tasks/e2e-install-openshift-pipelines.yaml

---

8. tasks/e2e-deploy-operator.yaml ✨ Enhancement +178/-0

Extract operator deployment and verification into task

tasks/e2e-deploy-operator.yaml

---

9. tasks/e2e-verify-images.yaml ✨ Enhancement +94/-0

Extract operand image verification into standalone task

tasks/e2e-verify-images.yaml

---

10. tasks/e2e-run-tests.yaml ✨ Enhancement +162/-0

Extract e2e test execution into standalone task

tasks/e2e-run-tests.yaml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (5) 📘 Rule violations (0)

1. Python missing in CI image 🐞 Bug ≡ Correctness

Description

e2e-validate-snapshot extracts bundle relatedImages via python3/PyYAML, but the new
images/e2e-ci image does not install python or PyYAML, causing the extraction to fail and the task
to exit successfully (WARN) instead of validating the bundle.

Code

tasks/e2e-validate-snapshot.yaml[R98-109]

+        BUNDLE_RELATED_IMAGES=$(python3 -c "
+        import yaml
+        with open('${CSV_FILE}') as f:
+            csv = yaml.safe_load(f)
+        for img in csv.get('spec', {}).get('relatedImages', []):
+            print(img.get('image', ''))
+        " 2>/dev/null || echo "")
+
+        if [ -z "$BUNDLE_RELATED_IMAGES" ]; then
+            echo "WARN: No relatedImages found in bundle CSV, skipping comparison"
+            exit 0
+        fi

Evidence

The task shells out to python3 -c 'import yaml' and on failure sets BUNDLE_RELATED_IMAGES empty
and then exits 0, masking the validation. The CI image Dockerfile installs jq/skopeo/git/go/make
only, so python/yaml parsing cannot work.

tasks/e2e-validate-snapshot.yaml[98-109]
images/e2e-ci/Dockerfile[18-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`tasks/e2e-validate-snapshot.yaml` uses `python3` + `import yaml` to parse the bundle CSV, but the `images/e2e-ci` image doesn’t include python or PyYAML, so the relatedImages validation silently becomes a no-op.

### Issue Context
The task currently treats missing/failed extraction of `relatedImages` as a warning + success (`exit 0`), so this missing dependency makes the fail-fast check ineffective.

### Fix Focus Areas
- images/e2e-ci/Dockerfile[18-24]
- tasks/e2e-validate-snapshot.yaml[98-109]

### Suggested fix
- Add `python3` and `python3-pyyaml` (or equivalent) to the `dnf -y install` list in the e2e-ci Dockerfile.
- Consider making the task fail (`exit 1`) if python/yaml parsing fails rather than treating it as “no relatedImages”.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Snapshot validation skips bundle 🐞 Bug ≡ Correctness

Description

e2e-validate-snapshot returns success when the snapshot has no bundle image, when the bundle CSV
can’t be found, or when relatedImages can’t be extracted, which defeats the pipeline’s intended
“fail-fast before cluster provisioning” behavior.

Code

tasks/e2e-validate-snapshot.yaml[R70-95]

+        BUNDLE_IMAGE=$(echo "$SNAPSHOT" | jq -r '.components[] | select(.name | startswith("openshift-builds-operator-bundle")) | .containerImage' | head -1)
+        if [ -z "$BUNDLE_IMAGE" ]; then
+            echo "WARN: No bundle image found in snapshot, skipping relatedImages check"
+            exit 0
+        fi
+        echo "Bundle image: $BUNDLE_IMAGE"
+
+        BUNDLE_DIR=$(mktemp -d)
+        trap "rm -rf $BUNDLE_DIR" EXIT
+
+        echo "Pulling bundle image..."
+        skopeo copy "docker://${BUNDLE_IMAGE}" "oci:${BUNDLE_DIR}:latest"
+
+        MANIFEST_DIGEST=$(jq -r '.manifests[0].digest' "${BUNDLE_DIR}/index.json" | sed 's/sha256://')
+        LAYERS=$(jq -r '.layers[].digest' "${BUNDLE_DIR}/blobs/sha256/${MANIFEST_DIGEST}" | sed 's/sha256://')
+
+        EXTRACT_DIR=$(mktemp -d)
+        for LAYER in $LAYERS; do
+            tar -xf "${BUNDLE_DIR}/blobs/sha256/${LAYER}" -C "${EXTRACT_DIR}" 2>/dev/null || true
+        done
+
+        CSV_FILE=$(find "${EXTRACT_DIR}" -path "*/manifests/*clusterserviceversion*" -type f | head -1)
+        if [ -z "$CSV_FILE" ]; then
+            echo "WARN: Could not find CSV in bundle image, skipping relatedImages check"
+            exit 0
+        fi

Evidence

The task explicitly exit 0s on missing bundle or missing CSV, and the pipeline relies on this task
to gate cluster provisioning. This allows expensive provisioning to proceed even when the
snapshot/bundle is invalid or unverifiable.

tasks/e2e-validate-snapshot.yaml[70-75]
tasks/e2e-validate-snapshot.yaml[91-95]
tasks/e2e-validate-snapshot.yaml[106-109]
pipelines/konflux-e2e-complete-pipeline.yaml[59-78]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`e2e-validate-snapshot` is meant to fail-fast before provisioning, but currently succeeds (`exit 0`) when it cannot validate the bundle (missing bundle image, missing CSV, missing relatedImages).

### Issue Context
This causes wasted cluster provisioning time/cost and can hide a broken snapshot/bundle until later tasks fail.

### Fix Focus Areas
- tasks/e2e-validate-snapshot.yaml[70-75]
- tasks/e2e-validate-snapshot.yaml[91-95]
- tasks/e2e-validate-snapshot.yaml[106-109]

### Suggested fix
- Change the warning/success paths to hard failures (`exit 1`) when:
 - the bundle image is missing from snapshot, or
 - the CSV cannot be located/extracted, or
 - relatedImages cannot be parsed.
- If there are legitimate scenarios where this should be skippable, add an explicit param like `SKIP_BUNDLE_RELATEDIMAGES_CHECK` defaulting to `false` and gate the behavior on that param (rather than implicit success).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Personal CI image referenced 🐞 Bug ⛨ Security

Description

e2e-install-openshift-pipelines runs using quay.io/avinkuma/...:latest, unlike the other tasks
which use the project-controlled rh-openshift-builds-tenant/e2e-ci:latest, creating a supply-chain
and reliability risk if the personal image changes or disappears.

Code

tasks/e2e-install-openshift-pipelines.yaml[R36-38]

+    - name: install-pipelines
+      image: quay.io/avinkuma/rh-openshift-builds/ci:latest
+      env:

Evidence

Only this task pulls from a personal Quay namespace; other e2e tasks consistently use the
tenant-owned e2e-ci:latest image, indicating this is likely unintended and risky for CI stability
and provenance.

tasks/e2e-install-openshift-pipelines.yaml[36-38]
tasks/e2e-run-tests.yaml[55-57]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The OpenShift Pipelines install task uses a personal image (`quay.io/avinkuma/...:latest`), which is not project-controlled and can break CI or introduce supply-chain risk.

### Issue Context
All other e2e tasks in this PR use `quay.io/redhat-user-workloads/rh-openshift-builds-tenant/e2e-ci:latest`.

### Fix Focus Areas
- tasks/e2e-install-openshift-pipelines.yaml[36-38]

### Suggested fix
- Switch the `install-pipelines` step image to the same tenant-owned CI image used elsewhere (or another project-owned, maintained image).
- Prefer pinning to an immutable digest instead of `:latest` once the image publishing flow is established.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Unpinned binary downloads 🐞 Bug ⛨ Security

Description

The new images/e2e-ci Dockerfile uses mutable :latest base images and downloads
operator-sdk/oc binaries via curl without checksum verification, making the build
non-reproducible and increasing supply-chain risk.

Code

images/e2e-ci/Dockerfile[R1-14]

+FROM registry.access.redhat.com/ubi9/ubi:latest AS builder
+
+ARG OPERATOR_SDK_VERSION=1.36.1
+ARG OC_VERSION=4.17
+ARG TARGETARCH=amd64
+
+RUN curl -Lo /tmp/operator-sdk \
+    "https://github.com/operator-framework/operator-sdk/releases/download/v${OPERATOR_SDK_VERSION}/operator-sdk_linux_${TARGETARCH}" && \
+    chmod +x /tmp/operator-sdk
+
+RUN curl -Lo /tmp/oc.tar.gz \
+    "https://mirror.openshift.com/pub/openshift-v4/${TARGETARCH}/clients/ocp/stable-${OC_VERSION}/openshift-client-linux.tar.gz" && \
+    tar -xzf /tmp/oc.tar.gz -C /tmp oc kubectl && \
+    chmod +x /tmp/oc /tmp/kubectl

Evidence

The Dockerfile uses ubi:latest and fetches release artifacts over HTTPS without validating
checksums/signatures; it also installs ginkgo at @latest, which changes over time. These patterns
make rebuilds potentially different and weaken provenance/integrity.

images/e2e-ci/Dockerfile[1-14]
images/e2e-ci/Dockerfile[30-32]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The CI image build is not reproducible and lacks integrity checks for downloaded artifacts.

### Issue Context
This image is used to run privileged cluster operations (`oc adm`, `oc debug`, bundle install), so tightening supply-chain hygiene is important.

### Fix Focus Areas
- images/e2e-ci/Dockerfile[1-14]
- images/e2e-ci/Dockerfile[30-32]

### Suggested fix
- Pin the UBI base image to a specific digest (or at least a minor version tag).
- For `operator-sdk` and `oc`, download and verify published checksums/signatures (e.g., SHA256SUMS) before installing.
- Pin ginkgo to a specific version (e.g., `@v2.x.y`) instead of `@latest`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

5. Placeholder snapshot will fail 🐞 Bug ⚙ Maintainability

Description

The pipeline’s default SNAPSHOT example uses a tag-only image (...:latest), but
e2e-validate-snapshot compares registry digests against the snapshot’s @sha256 digest; running
the pipeline with defaults (outside Konflux) will fail validation unexpectedly.

Code

pipelines/konflux-e2e-complete-pipeline.yaml[R10-15]

+    - name: SNAPSHOT
      type: string
-    - description: Builds for OpenShift Version
-      name: VERSION
-      default: "-1-6"
+      description: Snapshot of the application
+      default: '{"components": [{"name":"test-app", "containerImage":
+        "quay.io/example/repo:latest"}]}'
+    - name: VERSION

Evidence

The default SNAPSHOT value contains no @sha256 digest, while the validation task’s logic extracts
the digest using ${IMAGE##*@} and compares it to skopeo inspect’s digest output, so tag-only
examples won’t pass.

pipelines/konflux-e2e-complete-pipeline.yaml[10-15]
tasks/e2e-validate-snapshot.yaml[42-53]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The default `SNAPSHOT` parameter is a placeholder that doesn’t match the validation expectations (digest-pinned images).

### Issue Context
Konflux likely always supplies a real snapshot with digests, but the placeholder default can confuse local/manual executions.

### Fix Focus Areas
- pipelines/konflux-e2e-complete-pipeline.yaml[10-15]
- tasks/e2e-validate-snapshot.yaml[42-53]

### Suggested fix
- Update the default SNAPSHOT example to include digest-pinned images, or
- Adjust validation logic to only enforce digest equality when the snapshot image includes an `@sha256:...` digest (otherwise just check the image exists).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---