CM-716: Add HTTP01 proxy image build to cert-manager-operator CI

[sebrandon1]

Summary

• Adds cert-manager-http01-proxy image build to the cert-manager-operator ci-operator config
• Adds operator substitution so the proxy pullspec in the OLM bundle is replaced with the CI-built image

The proxy binary source and CI Dockerfile were added in openshift/cert-manager-operator#458. This PR enables CI to build the FIPS-compliant proxy image alongside the existing operator and cert-manager operand images.

Related PRs

• Proxy binary & Dockerfile: CM-716: Add HTTP01 Challenge Proxy binary and CI Dockerfile cert-manager-operator#458
• HTTP01Proxy controller: CM-716: Add HTTP01 Challenge Proxy controller cert-manager-operator#398
• Baremetal CI job: CM-716: Add baremetal e2e CI job for cert-manager-operator #81902

Changes

ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml:

Image build entry:

- dockerfile_path: images/ci/http01proxy.Dockerfile
  from: base-rhel9
  to: cert-manager-http01-proxy

Operator substitution:

- pullspec: quay.io/openshift/cert-manager-http01-proxy:.*
  with: pipeline:cert-manager-http01-proxy

Test plan

• YAML validates
• CI passes

[openshift-ci-robot]

@sebrandon1: This pull request references CM-716 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds cert-manager-http01-proxy image build to the cert-manager-operator ci-operator config
• Adds operator substitution so the proxy pullspec in the OLM bundle is replaced with the CI-built image

The proxy binary source and CI Dockerfile were added in openshift/cert-manager-operator#458. This PR enables CI to build the FIPS-compliant proxy image alongside the existing operator and cert-manager operand images.

Related PRs

• Proxy binary & Dockerfile: CM-716: Add HTTP01 Challenge Proxy binary and CI Dockerfile cert-manager-operator#458
• HTTP01Proxy controller: CM-716: Add HTTP01 Challenge Proxy controller cert-manager-operator#398
• Consoleless CI job: OCPBUGS-85579: Add consoleless e2e CI job for cert-manager-operator #81900
• Baremetal CI job: CM-716: Add baremetal e2e CI job for cert-manager-operator #81902

Changes

ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml:

Image build entry:

- dockerfile_path: images/ci/http01proxy.Dockerfile
 from: base-rhel9
 inputs:
   ocp_builder_rhel-9-golang-1.25-openshift-4.21:
     as:
     - registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21
 to: cert-manager-http01-proxy

Operator substitution:

- pullspec: quay.io/openshift/cert-manager-http01-proxy:.*
 with: pipeline:cert-manager-http01-proxy

Test plan

• YAML validates
• CI rehearsal validates the image builds successfully

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The cert-manager operator CI configuration now builds and publishes the cert-manager-http01-proxy image and maps its Quay pullspec to the corresponding pipeline image.

Changes

HTTP01 proxy image pipeline

Layer / File(s)	Summary
Build and pipeline wiring ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml	Adds the HTTP01 proxy image build using images/ci/http01proxy.Dockerfile and maps its Quay pullspec to pipeline:cert-manager-http01-proxy.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: tashirj

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only a CI YAML config changed; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality	✅ Passed	PR only changes a ci-operator YAML config; no Ginkgo tests were added or modified, so the test-quality checklist is not applicable.
Microshift Test Compatibility	✅ Passed	Only ci-operator YAML changed; no new Ginkgo tests or MicroShift-unsafe APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only a ci-operator YAML changed; no new or modified Ginkgo tests were added, so SNO compatibility concerns are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI operator config changed: an image build and bundle substitution. No replicas, affinities, node selectors, tolerations, or topology-sensitive manifests were added.
Ote Binary Stdout Contract	✅ Passed	PR only changes ci-operator YAML; no binary code, init/TestMain, or stdout/logging writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only ci-operator YAML changed; no Ginkgo e2e tests or network logic were added.
No-Weak-Crypto	✅ Passed	Patch only adds a CI image build and pullspec substitution in YAML; no MD5/SHA1/DES/RC4/3DES, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	Only ci-operator config changed; it adds an image build and substitution, with no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation fields.
No-Sensitive-Data-In-Logs	✅ Passed	The only diff adds CI image/substitution config; no logging statements or sensitive-data strings (password/token/PII/internal hostnames) appear.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding the HTTP01 proxy image build to cert-manager-operator CI.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@sebrandon1, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto 1e6ffeefec9d59da21662708221b5106c727e443 due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign bharath-b-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/cert-manager-operator/OWNERS
• ci-operator/jobs/openshift/cert-manager-operator/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@sebrandon1: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-cert-manager-operator-master-ci-bundle-cert-manager-operator-bundle	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-aws-proxy	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-aws-sts	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-aws-upi-proxy	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-azure-ovn	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-azure-workload-identity	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-gcp-ovn	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-gcp-workload-identity	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-e2e-operator-tech-preview	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-fips-image-scan-cert-manager	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-fips-image-scan-istio-csr	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-fips-image-scan-operator	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-fips-image-scan-trust-manager	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-images	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-unit	openshift/cert-manager-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cert-manager-operator-master-verify	openshift/cert-manager-operator	presubmit	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@sebrandon1: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[sebrandon1]

Closing — the HTTP01 proxy image is no longer needed. The DNAT+SNAT experiment replaces the proxy binary with nftables rules delivered via MachineConfig, eliminating the need for a separate container image and CI build pipeline.

See openshift/cert-manager-operator for the new approach.