ROSAENG-300: Onboard aws-nuke-cf CI, decouple janitor image from rosa-regional-platform (#78106)

typeid · claude · web-flow · commit edb511540b97 · 2026-04-21T16:01:13.000Z
* ROSAENG-300: Add aws-nuke-cf CI config, remove push-ci-image from rosa-regional-platform

Onboard openshift-online/aws-nuke-cf to OpenShift CI with a pre-merge
image build gate and postsubmit push to quay.io/rrp-dev-ci/ci-image.
Remove push-ci-image from rosa-regional-platform since the image now
lives in the aws-nuke-cf repo.

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;

* Remove redundant build-image test, rely on implicit images job

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;

* Add OWNERS files for aws-nuke-cf config and jobs directories

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;

* Remove stale build-image presubmit from generated jobs

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;

* Push aws-nuke-cf image to quay.io/rrp-dev-ci/aws-nuke-cf

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;

---------

Co-authored-by: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/ci-operator/config/openshift-online/aws-nuke-cf/OWNERS b/ci-operator/config/openshift-online/aws-nuke-cf/OWNERS
@@ -0,0 +1,23 @@
+# DO NOT EDIT; this file is auto-generated using https://github.com/openshift/ci-tools.
+# Fetched from https://github.com/openshift-online/aws-nuke-cf root OWNERS
+# If the repo had OWNERS_ALIASES then the aliases were expanded
+# Logins who are not members of 'openshift' organization were filtered out
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+
+approvers:
+- cdoan1
+- iamkirkbater
+- jmelis
+- psav
+- syncrou
+- theautoroboto
+- typeid
+options: {}
+reviewers:
+- cdoan1
+- iamkirkbater
+- jmelis
+- psav
+- syncrou
+- theautoroboto
+- typeid
diff --git a/ci-operator/config/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main.yaml b/ci-operator/config/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main.yaml
@@ -0,0 +1,30 @@
+build_root:
+  image_stream_tag:
+    name: release
+    namespace: openshift
+    tag: golang-1.21
+images:
+  items:
+  - dockerfile_path: Containerfile
+    to: aws-nuke-cf
+resources:
+  '*':
+    limits:
+      memory: 4Gi
+    requests:
+      cpu: 100m
+      memory: 200Mi
+tests:
+- as: push-image
+  postsubmit: true
+  steps:
+    dependencies:
+      CI_COMPONENT_IMAGE: aws-nuke-cf
+    env:
+      ROSA_REGIONAL_QUAY_DEST_REPO: quay.io/rrp-dev-ci/aws-nuke-cf
+    test:
+    - ref: rosa-regional-platform-image-push
+zz_generated_metadata:
+  branch: main
+  org: openshift-online
+  repo: aws-nuke-cf
diff --git a/ci-operator/config/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main.yaml b/ci-operator/config/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main.yaml
@@ -137,15 +137,6 @@ tests:
         requests:
           cpu: 100m
           memory: 200Mi
-- as: push-ci-image
-  postsubmit: true
-  steps:
-    dependencies:
-      CI_COMPONENT_IMAGE: rosa-regional-platform-ci
-    env:
-      ROSA_REGIONAL_QUAY_DEST_REPO: quay.io/rrp-dev-ci/ci-image
-    test:
-    - ref: rosa-regional-platform-image-push
 zz_generated_metadata:
   branch: main
   org: openshift-online
diff --git a/ci-operator/jobs/openshift-online/aws-nuke-cf/OWNERS b/ci-operator/jobs/openshift-online/aws-nuke-cf/OWNERS
@@ -0,0 +1,23 @@
+# DO NOT EDIT; this file is auto-generated using https://github.com/openshift/ci-tools.
+# Fetched from https://github.com/openshift-online/aws-nuke-cf root OWNERS
+# If the repo had OWNERS_ALIASES then the aliases were expanded
+# Logins who are not members of 'openshift' organization were filtered out
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+
+approvers:
+- cdoan1
+- iamkirkbater
+- jmelis
+- psav
+- syncrou
+- theautoroboto
+- typeid
+options: {}
+reviewers:
+- cdoan1
+- iamkirkbater
+- jmelis
+- psav
+- syncrou
+- theautoroboto
+- typeid
diff --git a/ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-postsubmits.yaml b/ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-postsubmits.yaml
@@ -0,0 +1,71 @@
+postsubmits:
+  openshift-online/aws-nuke-cf:
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    cluster: build01
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-openshift-online-aws-nuke-cf-main-push-image
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=push-image
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
diff --git a/ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml b/ci-operator/jobs/openshift-online/aws-nuke-cf/openshift-online-aws-nuke-cf-main-presubmits.yaml
@@ -0,0 +1,57 @@
+presubmits:
+  openshift-online/aws-nuke-cf:
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build01
+    context: ci/prow/images
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-online-aws-nuke-cf-main-images
+    rerun_command: /test images
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=[images]
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )images,?($|\s.*)
diff --git a/ci-operator/jobs/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main-postsubmits.yaml b/ci-operator/jobs/openshift-online/rosa-regional-platform/openshift-online-rosa-regional-platform-main-postsubmits.yaml
@@ -60,79 +60,3 @@ postsubmits:
       - name: result-aggregator
         secret:
           secretName: result-aggregator
-  - agent: kubernetes
-    always_run: true
-    branches:
-    - ^main$
-    cluster: build05
-    decorate: true
-    decoration_config:
-      skip_cloning: true
-    labels:
-      ci.openshift.io/generator: prowgen
-    max_concurrency: 1
-    name: branch-ci-openshift-online-rosa-regional-platform-main-push-ci-image
-    spec:
-      containers:
-      - args:
-        - --gcs-upload-secret=/secrets/gcs/service-account.json
-        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
-        - --lease-server-credentials-file=/etc/boskos/credentials
-        - --report-credentials-file=/etc/report/credentials
-        - --secret-dir=/secrets/ci-pull-credentials
-        - --target=push-ci-image
-        command:
-        - ci-operator
-        env:
-        - name: HTTP_SERVER_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
-        imagePullPolicy: Always
-        name: ""
-        ports:
-        - containerPort: 8080
-          name: http
-        resources:
-          requests:
-            cpu: 10m
-        volumeMounts:
-        - mountPath: /etc/boskos
-          name: boskos
-          readOnly: true
-        - mountPath: /secrets/ci-pull-credentials
-          name: ci-pull-credentials
-          readOnly: true
-        - mountPath: /secrets/gcs
-          name: gcs-credentials
-          readOnly: true
-        - mountPath: /secrets/manifest-tool
-          name: manifest-tool-local-pusher
-          readOnly: true
-        - mountPath: /etc/pull-secret
-          name: pull-secret
-          readOnly: true
-        - mountPath: /etc/report
-          name: result-aggregator
-          readOnly: true
-      serviceAccountName: ci-operator
-      volumes:
-      - name: boskos
-        secret:
-          items:
-          - key: credentials
-            path: credentials
-          secretName: boskos-credentials
-      - name: ci-pull-credentials
-        secret:
-          secretName: ci-pull-credentials
-      - name: manifest-tool-local-pusher
-        secret:
-          secretName: manifest-tool-local-pusher
-      - name: pull-secret
-        secret:
-          secretName: registry-pull-credentials
-      - name: result-aggregator
-        secret:
-          secretName: result-aggregator
diff --git a/core-services/prow/02_config/openshift-online/aws-nuke-cf/_pluginconfig.yaml b/core-services/prow/02_config/openshift-online/aws-nuke-cf/_pluginconfig.yaml
@@ -0,0 +1,82 @@
+approve:
+- commandHelpLink: ""
+  lgtm_acts_as_approve: true
+  repos:
+  - openshift-online/aws-nuke-cf
+  require_self_approval: true
+external_plugins:
+  openshift-online/aws-nuke-cf:
+  - endpoint: http://refresh
+    events:
+    - issue_comment
+    name: refresh
+  - endpoint: http://cherrypick
+    events:
+    - issue_comment
+    - pull_request
+    name: cherrypick
+  - endpoint: http://needs-rebase
+    events:
+    - issue_comment
+    - pull_request
+    name: needs-rebase
+  - endpoint: http://backport-verifier
+    events:
+    - issue_comment
+    - pull_request
+    name: backport-verifier
+  - endpoint: http://payload-testing-prow-plugin
+    events:
+    - issue_comment
+    name: payload-testing-prow-plugin
+  - endpoint: http://jira-lifecycle-plugin
+    events:
+    - issue_comment
+    - pull_request
+    name: jira-lifecycle-plugin
+  - endpoint: http://pipeline-controller
+    events:
+    - pull_request
+    - issue_comment
+    name: pipeline-controller
+  - endpoint: http://multi-pr-prow-plugin
+    events:
+    - issue_comment
+    name: multi-pr-prow-plugin
+lgtm:
+- repos:
+  - openshift-online/aws-nuke-cf
+  review_acts_as_lgtm: true
+plugins:
+  openshift-online/aws-nuke-cf:
+    plugins:
+    - assign
+    - blunderbuss
+    - cat
+    - dog
+    - heart
+    - golint
+    - goose
+    - help
+    - hold
+    - jira
+    - label
+    - lgtm
+    - lifecycle
+    - override
+    - pony
+    - retitle
+    - shrug
+    - sigmention
+    - skip
+    - trigger
+    - verify-owners
+    - owners-label
+    - wip
+    - yuks
+    - approve
+triggers:
+- repos:
+  - openshift-online/aws-nuke-cf
+  trusted_apps:
+  - openshift-merge-bot
diff --git a/core-services/prow/02_config/openshift-online/aws-nuke-cf/_prowconfig.yaml b/core-services/prow/02_config/openshift-online/aws-nuke-cf/_prowconfig.yaml
