[openshift_setup] pre-pull RBAC proxy images on master nodes

David Sariel · David Sariel · commit 25c8dcf667e7 · 2026-06-14T10:51:46.000+03:00
When digest mirrors are configured, optionally pre-pull any RBAC proxy
images found in the mirror list on all master nodes. This avoids pull
failures at workload deployment time when the cluster cannot reach the
original registry directly.

The feature is controlled by cifmw_openshift_setup_prepull_rbac_images
(default: true) and is skipped when no digest mirrors are defined or
when no mirrors match the RBAC proxy image pattern.

Each image is pulled via `oc debug node` using the node's existing
kubelet auth credentials. Failures are non-fatal and a summary of
successful pulls is logged at the end.

Signed-off-by: David Sariel &lt;dsariel@redhat.com&gt;

ANVIL-142
diff --git a/roles/openshift_setup/tasks/configure_registries.yml b/roles/openshift_setup/tasks/configure_registries.yml
@@ -71,3 +71,71 @@
         name: registry-tag-mirrors
       spec:
         imageTagMirrors: "{{ cifmw_openshift_setup_tag_mirrors }}"
+
+- name: Pre-pull RBAC proxy images on all master nodes
+  when:
+    - cifmw_openshift_setup_digest_mirrors is defined
+    - cifmw_openshift_setup_digest_mirrors | length > 0
+    - cifmw_openshift_setup_prepull_rbac_images | default(true) | bool
+  block:
+    - name: Extract RBAC proxy images from digest mirrors
+      ansible.builtin.set_fact:
+        _rbac_proxy_images: >-
+          {{
+            cifmw_openshift_setup_digest_mirrors
+            | map(attribute='mirrors')
+            | flatten
+            | select('match', '^image-rbac.*\\.com/.*')
+            | list
+          }}
+
+    - name: Extract RBAC proxy images from digest mirrors
+      ansible.builtin.set_fact:
+        _rbac_proxy_images: >-
+          {{
+            cifmw_openshift_setup_digest_mirrors
+            | map(attribute='mirrors')
+            | flatten
+            | select('match', '^image-rbac.*\\.com/.*')
+            | list
+          }}
+
+    - name: Debug all flattened mirrors and matched result
+      ansible.builtin.debug:
+        msg:
+          - "All mirrors: {{ cifmw_openshift_setup_digest_mirrors | map(attribute='mirrors') | flatten | list }}"
+          - "Matched RBAC: {{ _rbac_proxy_images }}"
+
+    - name: Get list of master nodes
+      kubernetes.core.k8s_info:
+        kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+        api_key: "{{ cifmw_openshift_token | default(omit)}}"
+        context: "{{ cifmw_openshift_context | default(omit)}}"
+        kind: Node
+        label_selectors:
+          - node-role.kubernetes.io/master
+      register: _master_nodes_info
+
+    - name: Set master node names list
+      ansible.builtin.set_fact:
+        _master_node_names: "{{ _master_nodes_info.resources | map(attribute='metadata.name') | list }}"
+
+    - name: Pre-pull RBAC proxy images on each master node
+      ansible.builtin.shell: |
+        oc debug node/{{ item.0 }} -- \
+          chroot /host podman pull --authfile /var/lib/kubelet/config.json {{ item.1 }}
+      environment:
+        KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+      loop: "{{ _master_node_names | product(_rbac_proxy_images) | list }}"
+      loop_control:
+        label: "{{ item.0 }}: {{ item.1 | basename }}"
+      failed_when: false
+      changed_when: true
+      register: _prepull_results
+
+    - name: Display pre-pull summary
+      ansible.builtin.debug:
+        msg: >-
+          Pre-pulled {{ _prepull_results.results | selectattr('rc', 'equalto', 0) | list | length }}
+          / {{ _prepull_results.results | length }} RBAC proxy images
+          ({{ _master_node_names | length }} masters × {{ _rbac_proxy_images | length }} images)
diff --git a/roles/reproducer/tasks/main.yml b/roles/reproducer/tasks/main.yml
@@ -451,85 +451,85 @@
             name: openshift_setup
             tasks_from: patch_network_operator.yml
 
-# Run from the hypervisor
-- name: Ensure OCP cluster is stable
-  when:
-    - _wait_ocp_cluster is defined
-    - _wait_ocp_cluster | bool
-  tags:
-    - bootstrap
-    - bootstrap_layout
-  vars:
-    _auth_path: >-
-      {{
-        (
-          cifmw_devscripts_repo_dir | default(
-            ansible_user_dir ~ '/src/github.com/openshift-metal3/dev-scripts'),
-          'ocp',
-          cifmw_bm_agent_cluster_name |
-            default(cifmw_devscripts_config.cluster_name | default('ocp')),
-          'auth'
-        ) | ansible.builtin.path_join
-      }}
-    cifmw_openshift_adm_op: "stable"
-    cifmw_openshift_kubeconfig: >-
-      {{ (_auth_path, 'kubeconfig') | ansible.builtin.path_join }}
-  ansible.builtin.include_role:
-    name: openshift_adm
-
-- name: Run from controller-0
-  when:
-    - _has_openshift
-    - (
-        _cifmw_libvirt_manager_layout.vms.controller.target is defined and
-        _cifmw_libvirt_manager_layout.vms.controller.target == inventory_hostname
-      ) or
-      _cifmw_libvirt_manager_layout.vms.controller.target is undefined
-  delegate_to: controller-0
-  block:
-    - name: Emulate CI job
-      when:
-        - cifmw_job_uri is defined
-      ansible.builtin.include_tasks: ci_job.yml
-
-    - name: Prepare architecture-based deployment
-      when:
-        - cifmw_architecture_scenario is defined
-        - cifmw_job_uri is undefined
-      tags:
-        - deploy_architecture
-      ansible.builtin.include_tasks:
-        file: configure_architecture.yml
-        apply:
-          tags:
-            - deploy_architecture
-
-    - name: Prepare architecture-based post deployment
-      when:
-        - cifmw_architecture_scenario is defined
-        - cifmw_job_uri is undefined
-      tags:
-        - deploy_architecture
-      ansible.builtin.include_tasks:
-        file: configure_post_deployment.yml
-
-    - name: Prepare ci-like EDPM deploy
-      when:
-        - cifmw_job_uri is undefined
-      delegate_to: controller-0
-      vars:
-        run_directory: "{{ _cifmw_reproducer_framework_location }}"
-        exports:
-          ANSIBLE_LOG_PATH: "~/ansible-deploy-edpm.log"
-        default_extravars:
-          - "@scenarios/centos-9/base.yml"
-          - "@scenarios/centos-9/edpm_ci.yml"
-          - "cifmw_openshift_password='{{ cifmw_openshift_password }}'"
-        extravars: "{{ cifmw_reproducer_play_extravars }}"
-        playbook: "deploy-edpm.yml"
-      ansible.builtin.template:
-        dest: "{{ cifmw_reproducer_controller_user_dir }}/deploy-edpm.sh"
-        src: "script.sh.j2"
-        mode: "0755"
-        owner: "{{ cifmw_reproducer_controller_user }}"
-        group: "{{ cifmw_reproducer_controller_user }}"
+# # Run from the hypervisor
+# - name: Ensure OCP cluster is stable
+#   when:
+#     - _wait_ocp_cluster is defined
+#     - _wait_ocp_cluster | bool
+#   tags:
+#     - bootstrap
+#     - bootstrap_layout
+#   vars:
+#     _auth_path: >-
+#       {{
+#         (
+#           cifmw_devscripts_repo_dir | default(
+#             ansible_user_dir ~ '/src/github.com/openshift-metal3/dev-scripts'),
+#           'ocp',
+#           cifmw_bm_agent_cluster_name |
+#             default(cifmw_devscripts_config.cluster_name | default('ocp')),
+#           'auth'
+#         ) | ansible.builtin.path_join
+#       }}
+#     cifmw_openshift_adm_op: "stable"
+#     cifmw_openshift_kubeconfig: >-
+#       {{ (_auth_path, 'kubeconfig') | ansible.builtin.path_join }}
+#   ansible.builtin.include_role:
+#     name: openshift_adm
+
+# - name: Run from controller-0
+#   when:
+#     - _has_openshift
+#     - (
+#         _cifmw_libvirt_manager_layout.vms.controller.target is defined and
+#         _cifmw_libvirt_manager_layout.vms.controller.target == inventory_hostname
+#       ) or
+#       _cifmw_libvirt_manager_layout.vms.controller.target is undefined
+#   delegate_to: controller-0
+#   block:
+#     - name: Emulate CI job
+#       when:
+#         - cifmw_job_uri is defined
+#       ansible.builtin.include_tasks: ci_job.yml
+
+#     - name: Prepare architecture-based deployment
+#       when:
+#         - cifmw_architecture_scenario is defined
+#         - cifmw_job_uri is undefined
+#       tags:
+#         - deploy_architecture
+#       ansible.builtin.include_tasks:
+#         file: configure_architecture.yml
+#         apply:
+#           tags:
+#             - deploy_architecture
+
+#     - name: Prepare architecture-based post deployment
+#       when:
+#         - cifmw_architecture_scenario is defined
+#         - cifmw_job_uri is undefined
+#       tags:
+#         - deploy_architecture
+#       ansible.builtin.include_tasks:
+#         file: configure_post_deployment.yml
+
+#     - name: Prepare ci-like EDPM deploy
+#       when:
+#         - cifmw_job_uri is undefined
+#       delegate_to: controller-0
+#       vars:
+#         run_directory: "{{ _cifmw_reproducer_framework_location }}"
+#         exports:
+#           ANSIBLE_LOG_PATH: "~/ansible-deploy-edpm.log"
+#         default_extravars:
+#           - "@scenarios/centos-9/base.yml"
+#           - "@scenarios/centos-9/edpm_ci.yml"
+#           - "cifmw_openshift_password='{{ cifmw_openshift_password }}'"
+#         extravars: "{{ cifmw_reproducer_play_extravars }}"
+#         playbook: "deploy-edpm.yml"
+#       ansible.builtin.template:
+#         dest: "{{ cifmw_reproducer_controller_user_dir }}/deploy-edpm.sh"
+#         src: "script.sh.j2"
+#         mode: "0755"
+#         owner: "{{ cifmw_reproducer_controller_user }}"
+#         group: "{{ cifmw_reproducer_controller_user }}"
