KONFLUX-6210 Allow release pipeline to access ibm-public-key-stage

[sbhagate-byte]

Summary

Grant the release pipeline permission to read the ibm-public-key-stage secret in addition to the existing ibm-public-key secret.

Changes

• Update components/release/development/ibm-public-key-patch.yaml
• Update components/release/staging/ibm-public-key-patch.yaml
• Add ibm-public-key-stage to the list of allowed secret resourceNames for the release-pipeline-resource-role

Why

The staging release pipeline uses ibm-public-key-stage during Conforma verification. Without RBAC permission, the verify-conforma task fails with:

[openshift-ci]

Hi @sbhagate-byte. Thanks for your PR.

I'm waiting for a redhat-appstudio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Kustomize Render Diff

Comparing 47ef909c5 → 6c1ef1869

Component	Environment	Changes
components/release/development	development	+1 -0
components/release/staging	staging	+1 -0

Total: 2 components, +2 -0 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

[seanconroy2021]

/lgtm
/approve

[seanconroy2021]

/ok-to-test

[seanconroy2021]

/lgtm
/approve

[seanconroy2021]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbhagate-byte, seanconroy2021

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• components/release/OWNERS [seanconroy2021]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[seanconroy2021]

/ok-to-test

[konflux-ci-qe-bot]

🤖 Pipeline Failure Analysis

Category: Infrastructure

The pipeline failed to install Konflux components due to a step timeout, which was caused by underlying OpenShift API server unreachability preventing application refreshes.

📋 Technical Details

Immediate Cause

The konflux-ci-install-konflux step timed out after one of 43 ArgoCD applications failed to complete its refresh operation within the allocated time. The entrypoint received an interrupt due to this timeout, terminating the installation process.

Contributing Factors

The OpenShift API server became unreachable, evidenced by dial tcp: i/o timeout errors when attempting to connect to port 6443, and lookup ...: no such host DNS resolution failures. This infrastructure instability likely prevented the ArgoCD application from refreshing successfully, leading to the timeout in the konflux-ci-install-konflux step. These API server issues were explicitly observed during the subsequent gather-must-gather step, confirming a pervasive cluster-level problem.

Impact

The inability to complete the Konflux installation due to the timeout and underlying API server issues blocked the pipeline from progressing to the e2e tests. Furthermore, the API server unreachability also prevented the collection of comprehensive diagnostic information via must-gather.

🔍 Evidence

appstudio-e2e-tests/gather-must-gather

Category: infrastructure
Root Cause: The OpenShift API server was unreachable, evidenced by consistent network I/O timeouts and DNS resolution failures for its hostname. This points to a problem with the underlying OpenShift cluster's health or its network accessibility from the job runner.

Logs:

artifacts/appstudio-e2e-tests/gather-must-gather/build-log.txt

Error running must-gather collection:
    creating temp namespace: Post "https://api.konflux-4-19-us-west-2-72rfs.konflux-qe.devcluster.openshift.com:6443/api/v1/namespaces": dial tcp [REDACTED: Public IP (ipv4)]: i/o timeout

artifacts/appstudio-e2e-tests/gather-must-gather/build-log.txt

E0720 11:36:27.656084      54 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://api.konflux-4-19-us-west-2-72rfs.konflux-qe.devcluster.openshift.com:6443/api?timeout=32s\": dial tcp [REDACTED: Public IP (ipv4)]: i/o timeout"

artifacts/appstudio-e2e-tests/gather-must-gather/build-log.txt

E0720 11:36:27.670209      54 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://api.konflux-4-19-us-west-2-72rfs.konflux-qe.devcluster.openshift.com:6443/api?timeout=32s\": dial tcp: lookup api.konflux-4-19-us-west-2-72rfs.konflux-qe.devcluster.openshift.com on 172.30.0.10:53: no such host"

artifacts/appstudio-e2e-tests/gather-must-gather/build-log.txt

error: creating temp namespace: Post "https://api.konflux-4-19-us-west-2-72rfs.konflux-qe.devcluster.openshift.com:6443/api/v1/namespaces": dial tcp [REDACTED: Public IP (ipv4)]: i/o timeout

appstudio-e2e-tests/konflux-ci-install-konflux

Category: timeout
Root Cause: The step timed out because one of the 43 ArgoCD applications failed to complete its refresh operation within the allowed time, causing the job executor to terminate the step. This indicates a potential issue with the lingering ArgoCD application or general cluster slowness.

Logs:

artifacts/appstudio-e2e-tests/konflux-ci-install-konflux/build-log.txt line 200

[2026-07-20 11:22:52] [PROGRESS] Refresh: 0/43 complete | 43 still refreshing (5s elapsed)

artifacts/appstudio-e2e-tests/konflux-ci-install-konflux/build-log.txt line 235

[2026-07-20 11:31:36] [PROGRESS] Refresh: 42/43 complete | 1 still refreshing (460s elapsed)

artifacts/appstudio-e2e-tests/konflux-ci-install-konflux/build-log.txt line 236

{"component":"entrypoint","file":"sigs.k8s.io/prow/pkg/entrypoint/run.go:173","func":"sigs.k8s.io/prow/pkg/entrypoint.Options.ExecuteProcess","level":"error","msg":"Entrypoint received interrupt: terminated","severity":"error","time":"2026-07-20T11:31:38Z"}

artifacts/appstudio-e2e-tests/konflux-ci-install-konflux/build-log.txt line 251

{"component":"entrypoint","error":"os: process already finished","file":"sigs.k8s.io/prow/pkg/entrypoint/run.go:269","func":"sigs.k8s.io/prow/pkg/entrypoint.gracefullyTerminate","level":"error","msg":"Could not kill process after grace period","severity":"error","time":"2026-07-20T11:32:38Z"}

---

Analysis powered by prow-failure-analysis | Build: 2079162111769972736