HYPERFLEET-1056 - feat: Add helmfile and helm as dependencies for ope…

[ma-hill]

Summary

Adds helmfile and the helm-diff plugin as dependencies to the hyperfleet-infra CI build root image. This enables the repository to use helmfile for managing Helm chart deployments and the diff plugin for visualizing changes before applying them. These tools are required for the infrastructure-as-code workflows in hyperfleet-infra.

HYPERFLEET-1056

Changes

• Added HELMFILE_VERSION=1.5.2 build argument to the build root Dockerfile
• Added HELM_DIFF_VERSION=3.15.7 build argument for the helm-diff plugin version
• Installed helmfile binary by downloading and extracting the release tarball to /usr/local/bin/helmfile
• Installed helm-diff plugin using helm plugin install with version pinning

Test Plan

• make update passes (regenerates CI job configurations)
• make check passes (validates service configs)
• CI jobs for hyperfleet-infra successfully build with new dependencies

Summary by CodeRabbit

This PR updates the OpenShift Hyperfleet infrastructure CI build root image to include helmfile and the helm-diff plugin as dependencies. The change modifies the CI operator configuration for the hyperfleet-infra component repository.

What changed:
The build_root.project_image.dockerfile_literal in the CI operator configuration now includes:

• New build argument HELM_DIFF_VERSION=3.15.7 to pin the helm-diff plugin version
• New build argument HELMFILE_VERSION=1.5.2 for helmfile version
• Installation of helmfile by downloading the release tarball and extracting it to /usr/local/bin
• Installation of the databus23/helm-diff plugin using helm plugin install with version pinning and verification disabled

Impact:
The CI build environment for hyperfleet-infra will now have helmfile available for declarative Helm chart deployment management, along with the helm-diff plugin for visualizing differences between current and target Helm deployments. This enables the build pipeline to use helmfile-based workflows for infrastructure management and provides better visibility into Helm manifest changes.

This configuration change only affects the CI build environment tooling and does not directly impact deployed infrastructure.

[coderabbitai]

Walkthrough

A single OpenShift Hyperfleet CI operator configuration file updates its embedded Dockerfile to parameterize the Helm Diff plugin version (3.15.7), refactor Helmfile binary installation steps, and pin the helm-diff plugin installation to use that version parameter with verification disabled.

Changes

Build Container Tool Configuration

Layer / File(s)	Summary
Helm Diff and Helmfile installation ci-operator/config/openshift-hyperfleet/hyperfleet-infra/openshift-hyperfleet-hyperfleet-infra-main.yaml	Build argument HELM_DIFF_VERSION (3.15.7) is added. Helmfile installation steps are added to download, extract, and install the binary with executable permissions. Helm plugin installation command is updated to use databus23/helm-diff with verification disabled and version pinning via ${HELM_DIFF_VERSION}.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

jira/valid-reference

Suggested reviewers

• rafabene
• vkareh

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title references HYPERFLEET-1056 and mentions adding helmfile and helm as dependencies, which directly aligns with the primary change of adding helmfile and helm-diff plugin dependencies to the CI build image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only CI operator configuration YAML; no Ginkgo test files or test title definitions present. Custom check for Ginkgo test name stability is not applicable.
Test Structure And Quality	✅ Passed	This PR modifies only CI operator YAML configuration files, not Ginkgo test code. The custom check for test structure quality does not apply to infrastructure/CI configuration changes.
Microshift Test Compatibility	✅ Passed	This PR modifies a CI configuration YAML file to add build tooling (helmfile, helm-diff). It does not add any Ginkgo e2e tests, so the MicroShift Test Compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only modifies CI config YAML file (not e2e tests). Custom check applies to new Ginkgo e2e tests; no such tests are added.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies CI container image build config, not Kubernetes deployment manifests or operators, so no topology-aware scheduling constraints are introduced.
Ote Binary Stdout Contract	✅ Passed	PR modifies only a YAML CI configuration file defining Dockerfile steps. The OTE Binary Stdout Contract check applies to test/process-level code, which is absent in this PR.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests are added in this PR. The changes are only to a CI operator YAML configuration file defining build root image dependencies, not test code.
No-Weak-Crypto	✅ Passed	No weak crypto patterns found. PR adds helmfile/helm-diff installation via standard HTTPS and gzip with no weak algorithms (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB).
Container-Privileges	✅ Passed	File contains no Kubernetes manifests with dangerous privilege settings (privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation).
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data exposure in logs found. All curl commands use silent mode (-s), gcloud uses --quiet and --usage-reporting=false, and credentials are not logged or echoed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ma-hill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift-hyperfleet/hyperfleet-infra/OWNERS [ma-hill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@ma-hill: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-hyperfleet-hyperfleet-infra-main-integration	openshift-hyperfleet/hyperfleet-infra	presubmit	Ci-operator config changed
pull-ci-openshift-hyperfleet-hyperfleet-infra-main-validate	openshift-hyperfleet/hyperfleet-infra	presubmit	Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@ma-hill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/openshift-hyperfleet/hyperfleet-infra/openshift-hyperfleet-hyperfleet-infra-main.yaml`:
- Around line 28-30: The helmfile install pipeline currently curls and untars
the release (using HELMFILE_VERSION, extracting to /tmp and moving /tmp/helmfile
to /usr/local/bin/helmfile) with no integrity check; update that block to
download and verify a pinned SHA256 checksum for the helmfile tarball (fetch the
corresponding .sha256 or a known SHA value for HELMFILE_VERSION, validate the
tarball before extracting, and fail on mismatch) and only then extract and move
/tmp/helmfile. For the helm-diff plugin (databus23/helm-diff v3.15.7), don’t
remove --verify=false—instead install from the release tarball and pin/validate
its SHA256 before running helm plugin install (keep --verify=false because no
.prov exists), so replace the current remote install invocation with a
fetch+checksum+install flow that names the exact version (v3.15.7) and verifies
the SHA256 prior to installation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 120eb047-1480-4f4d-9959-2d2fb9fc5169

📥 Commits

Reviewing files that changed from the base of the PR and between 343017a and ea328f8.

📒 Files selected for processing (1)

• ci-operator/config/openshift-hyperfleet/hyperfleet-infra/openshift-hyperfleet-hyperfleet-infra-main.yaml