prowgen: allow ci-operator config to enable CSI secrets store

[Prucek]

Summary

• Add enable_secrets_store_csi_driver to the prowgen section of ci-operator config
• Jobs can now enable CSI secrets store directly in ci-operator config instead of requiring a .config.prowgen file
• Second step toward deprecating .config.prowgen (follows prowgen: allow ci-operator config to override .config.prowgen #5119 which added rehearsal control)

Test plan

• New test case: "multi-stage test with CSI enabled via ci-operator config"
• Fixture output identical to existing .config.prowgen-based CSI test
• All existing tests pass (go test ./pkg/prowgen/...)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Enable Secrets Store CSI Driver via Prowgen overrides for multi-stage jobs, causing generated jobs to include Secrets Store CSI driver configuration when set.
• Tests
  • Added a test case and fixture validating CSI enablement through Prowgen overrides and the resulting job configuration.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 390425d6-9431-42f7-aecc-8614b0af538f

📥 Commits

Reviewing files that changed from the base of the PR and between feb4d7f and 3042633.

⛔ Files ignored due to path filters (1)

• pkg/webreg/zz_generated.ci_operator_reference.go is excluded by !**/zz_generated*

📒 Files selected for processing (4)

• pkg/api/types.go
• pkg/prowgen/jobbase.go
• pkg/prowgen/jobbase_test.go
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_CSI_enabled_via_ci_operator_config.yaml

✅ Files skipped from review due to trivial changes (1)

• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_CSI_enabled_via_ci_operator_config.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/prowgen/jobbase.go

---

Walkthrough

Adds an optional Prowgen override EnableSecretsStoreCSIDriver, makes the prow job builder honor that flag from either runtime ProwgenInfo or ci-operator config, and adds a test plus fixture validating CSI enablement via ci-operator-driven Prowgen config.

Changes

Cohort / File(s)	Summary
API Types pkg/api/types.go	Added EnableSecretsStoreCSIDriver bool to ProwgenOverrides (enable_secrets_store_csi_driver,omitempty) and adjusted alignment of nearby flags.
Job Builder Logic pkg/prowgen/jobbase.go	NewProwJobBaseBuilderForTest now checks configSpec.Prowgen.EnableSecretsStoreCSIDriver in addition to info.Config.EnableSecretsStoreCSIDriver before attaching GSMConfig()/CSI-related pod spec in multi-stage branches.
Tests & Fixtures pkg/prowgen/jobbase_test.go, pkg/prowgen/testdata/...zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_CSI_enabled_via_ci_operator_config.yaml	Added a test case enabling CSI via the ci-operator Prowgen override and a fixture YAML that includes CSI volume (secrets-store.csi.k8s.io), secretProviderClass, GSM/GCS mounts, and related secret/config volumes.

Sequence Diagram(s)

sequenceDiagram
  participant CI as ci-operator config (configSpec)
  participant Info as runtime ProwgenInfo (info.Config)
  participant Builder as NewProwJobBaseBuilderForTest
  participant Pod as PodSpec
  participant K8s as Kubernetes

  CI->>Builder: provide configSpec (may include Prowgen.EnableSecretsStoreCSIDriver)
  Info->>Builder: provide ProwgenInfo (may include EnableSecretsStoreCSIDriver)
  Builder->>Builder: evaluate Info.EnableSecretsStoreCSIDriver OR configSpec.Prowgen.EnableSecretsStoreCSIDriver
  alt CSI enabled
    Builder->>Pod: add GSMConfig() and CSI volume/mounts
    Pod->>K8s: rendered pod spec with CSI volume, secretProviderClass, mounts
  else CSI disabled
    Builder->>Pod: leave pod spec without GSMConfig()/CSI mounts
    Pod->>K8s: rendered pod spec without CSI additions
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: enabling CSI secrets store configuration through ci-operator config instead of just through separate prowgen files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Test file uses standard Go table-driven tests with t.Run(), not Ginkgo. All test names are static descriptive strings with no dynamic values.
Test Structure And Quality	✅ Passed	The test file uses standard Go testing with table-driven tests, not Ginkgo. The new CSI test case follows the established fixture-based testing pattern and is properly integrated.
Microshift Test Compatibility	✅ Passed	This PR does not add any Ginkgo e2e tests. Changes consist of modifications to standard Go unit tests in pkg/prowgen/jobbase_test.go with no Ginkgo patterns present.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR does not add Ginkgo e2e tests; it only adds standard Go unit tests to pkg/prowgen/jobbase_test.go.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies ci-operator configuration generator, not deployment manifests or operators. No topology-unfriendly scheduling constraints, affinity rules, or node selectors introduced.
Ote Binary Stdout Contract	✅ Passed	PR modifies only library code in pkg/prowgen and pkg/api packages for Prow job configuration generation, with no process-level entry points or stdout writes that could corrupt OTE JSON communication protocol.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR does not add Ginkgo e2e tests; changes are limited to configuration generation code and standard Go unit tests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

pkg/prowgen/jobbase.go (1)

150-168: Extract CSI enablement predicate once to avoid branch drift.

The same condition is duplicated in both multi-stage branches. Consider computing it once before the switch and reusing it.

♻️ Proposed refactor

+	enableSecretsStoreCSI := info.Config.EnableSecretsStoreCSIDriver ||
+		(configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver)
+
 	switch {
 	case test.MultiStageTestConfigurationLiteral != nil:
 		p.PodSpec.Add(LeaseClient())
@@
-		if info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver) {
+		if enableSecretsStoreCSI {
 			p.PodSpec.Add(
 				GSMConfig(),
 			)
 		}
 	case test.MultiStageTestConfiguration != nil:
@@
-		if info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver) {
+		if enableSecretsStoreCSI {
 			p.PodSpec.Add(
 				GSMConfig(),
 			)
 		}
 	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/prowgen/jobbase.go` around lines 150 - 168, Extract the repeated CSI
enablement predicate into a single boolean before the switch and reuse it in
both branches: compute something like csiEnabled :=
info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil &&
configSpec.Prowgen.EnableSecretsStoreCSIDriver) and replace both occurrences of
the long condition used to decide p.PodSpec.Add(GSMConfig()) in the case
handling test.MultiStageTestConfiguration and the other branch so the switch
body uses the single csiEnabled variable.

pkg/prowgen/jobbase_test.go (1)

357-369: Add a sibling test for literal multi-stage + ci-operator CSI override.

This covers the non-literal multi-stage path well. Consider adding the same scenario for MultiStageTestConfigurationLiteral to lock in behavior for both branches updated in NewProwJobBaseBuilderForTest.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/prowgen/jobbase_test.go` around lines 357 - 369, Add a sibling
table-driven test case that mirrors the existing "multi-stage test with CSI
enabled via ci-operator config" but uses MultiStageTestConfigurationLiteral
instead of MultiStageTestConfiguration so the literal-path in
NewProwJobBaseBuilderForTest is covered; create a case with name like
"multi-stage literal test with CSI enabled via ci-operator config", cfg:
ProwgenOverrides{EnableSecretsStoreCSIDriver: true}, test:
ciop.TestStepConfiguration{As: "simple", MultiStageTestConfigurationLiteral:
&ciop.MultiStageTestConfigurationLiteral{Workflow:
pointer.StringPtr("workflow")}}, and info: defaultInfo, then run the same
assertions as the non-literal case.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@pkg/prowgen/jobbase_test.go`:
- Around line 357-369: Add a sibling table-driven test case that mirrors the
existing "multi-stage test with CSI enabled via ci-operator config" but uses
MultiStageTestConfigurationLiteral instead of MultiStageTestConfiguration so the
literal-path in NewProwJobBaseBuilderForTest is covered; create a case with name
like "multi-stage literal test with CSI enabled via ci-operator config", cfg:
ProwgenOverrides{EnableSecretsStoreCSIDriver: true}, test:
ciop.TestStepConfiguration{As: "simple", MultiStageTestConfigurationLiteral:
&ciop.MultiStageTestConfigurationLiteral{Workflow:
pointer.StringPtr("workflow")}}, and info: defaultInfo, then run the same
assertions as the non-literal case.

In `@pkg/prowgen/jobbase.go`:
- Around line 150-168: Extract the repeated CSI enablement predicate into a
single boolean before the switch and reuse it in both branches: compute
something like csiEnabled := info.Config.EnableSecretsStoreCSIDriver ||
(configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver)
and replace both occurrences of the long condition used to decide
p.PodSpec.Add(GSMConfig()) in the case handling test.MultiStageTestConfiguration
and the other branch so the switch body uses the single csiEnabled variable.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 96d2694c-c9af-41a5-9493-6f7b651be28e

📥 Commits

Reviewing files that changed from the base of the PR and between 8d45148 and 141a5a4.

⛔ Files ignored due to path filters (1)

• pkg/webreg/zz_generated.ci_operator_reference.go is excluded by !**/zz_generated*

📒 Files selected for processing (4)

• pkg/api/types.go
• pkg/prowgen/jobbase.go
• pkg/prowgen/jobbase_test.go
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_CSI_enabled_via_ci_operator_config.yaml

[danilo-gemoli]

/lgtm

[Prucek]

/skip
/override ci/prow/images
/override ci/prow/e2e

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[openshift-ci]

@Prucek: Overrode contexts on behalf of Prucek: ci/prow/e2e, ci/prow/images

Details

In response to this:

/skip
/override ci/prow/images
/override ci/prow/e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[coderabbitai]

🧹 Nitpick comments (1)

pkg/prowgen/jobbase.go (1)

150-150: De-duplicate CSI enablement predicate across both branches.

The condition is correct, but it is repeated in two places. Extracting it into a helper keeps future changes safer and reduces drift risk.

♻️ Proposed refactor

+func enableSecretsStoreCSIDriver(info *ProwgenInfo, configSpec *cioperatorapi.ReleaseBuildConfiguration) bool {
+	return info.Config.EnableSecretsStoreCSIDriver ||
+		(configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver)
+}
...
-		if info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver) {
+		if enableSecretsStoreCSIDriver(info, configSpec) {
 			p.PodSpec.Add(
 				GSMConfig(),
 			)
 		}
...
-		if info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver) {
+		if enableSecretsStoreCSIDriver(info, configSpec) {
 			p.PodSpec.Add(
 				GSMConfig(),
 			)
 		}

Also applies to: 164-164

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/prowgen/jobbase.go` at line 150, Extract the repeated predicate into a
single helper to avoid duplication: create a function (e.g.,
enableSecretsStoreCSIDriver(info, configSpec) bool or a method on the enclosing
type) that returns true if info.Config.EnableSecretsStoreCSIDriver ||
(configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver).
Replace both occurrences of the inline condition in jobbase.go (the branches
that currently check info.Config.EnableSecretsStoreCSIDriver ||
(configSpec.Prowgen != nil && configSpec.Prowgen.EnableSecretsStoreCSIDriver))
with a call to this new helper.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@pkg/prowgen/jobbase.go`:
- Line 150: Extract the repeated predicate into a single helper to avoid
duplication: create a function (e.g., enableSecretsStoreCSIDriver(info,
configSpec) bool or a method on the enclosing type) that returns true if
info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil &&
configSpec.Prowgen.EnableSecretsStoreCSIDriver). Replace both occurrences of the
inline condition in jobbase.go (the branches that currently check
info.Config.EnableSecretsStoreCSIDriver || (configSpec.Prowgen != nil &&
configSpec.Prowgen.EnableSecretsStoreCSIDriver)) with a call to this new helper.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 789d6a55-c091-427f-b6ff-d5b0bb0b7109

📥 Commits

Reviewing files that changed from the base of the PR and between 6b0b37d and feb4d7f.

⛔ Files ignored due to path filters (1)

• pkg/webreg/zz_generated.ci_operator_reference.go is excluded by !**/zz_generated*

📒 Files selected for processing (4)

• pkg/api/types.go
• pkg/prowgen/jobbase.go
• pkg/prowgen/jobbase_test.go
• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_CSI_enabled_via_ci_operator_config.yaml

✅ Files skipped from review due to trivial changes (1)

• pkg/prowgen/testdata/zz_fixture_TestNewProwJobBaseBuilderForTest_multi_stage_test_with_CSI_enabled_via_ci_operator_config.yaml

[danilo-gemoli]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danilo-gemoli, Prucek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Prucek,danilo-gemoli]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Prucek]

/skip
/override ci/prow/images
/override ci/prow/e2e

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e

[openshift-ci]

@Prucek: Overrode contexts on behalf of Prucek: ci/prow/e2e, ci/prow/images

Details

In response to this:

/skip
/override ci/prow/images
/override ci/prow/e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@Prucek: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e	3042633	link	true	/test e2e
ci/prow/breaking-changes	3042633	link	false	/test breaking-changes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.