AGENT-1577: Use master branch of appliance as image builder

[zaneb]

Switch to the agent-release-iso-builder CI image that is built from the current OCP release branch.

This replaces agent-preinstall-image-builder, which is now built from the branch of the same name and does not use stable branches.

This depends on openshift/release#83022

Summary by CodeRabbit

• Chores
  • Updated ISO construction to use the latest release ISO builder image.
  • Updated the live ISO creation workflow to reference the new builder image.
  • Revised related documentation to reflect the updated image name.

[openshift-ci-robot]

@zaneb: This pull request references AGENT-1577 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Switch to the agent-release-iso-builder CI image that is built from the current OCP release branch.

This replaces agent-preinstall-image-builder, which is now built from the branch of the same name and does not use stable branches.

This depends on openshift/release#83022

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Walkthrough

The ISO builder now uses agent-release-iso-builder for its documented image, Dockerfile builder stage, and live ISO default appliance image.

Changes

ISO Builder Image Update

Layer / File(s)	Summary
Update ISO builder image references tools/iso_builder/CLAUDE.md, tools/iso_builder/Dockerfile, tools/iso_builder/hack/build-ove-image.sh	The documented image, Dockerfile base image, and live ISO fallback image now use agent-release-iso-builder. The previous preinstall image reference is removed.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: bfournie

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title identifies the image builder change but incorrectly states that it uses the master branch; the change uses the current OCP release branch.	Update the title to state that the image builder uses the current OCP release branch or the agent-release-iso-builder image.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only image references in documentation, Dockerfile, and shell setup; it adds no Ginkgo tests or test titles, so the check is not applicable.
Test Structure And Quality	✅ Passed	The PR changes only documentation, a Dockerfile, and a shell script. It adds or modifies no Ginkgo tests, so the test-structure requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The patch changes only image references in documentation, Dockerfile, and a shell script. It adds no Ginkgo e2e tests or MicroShift-incompatible test usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only documentation, a Dockerfile base image, and a shell-script default; it adds no Ginkgo e2e tests requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch changes only three appliance image references in documentation, a Dockerfile, and a shell script; it adds no deployment, operator, controller, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR only changes ISO-builder image references; the repository has no OTE/openshift-tests binary or suite setup. Its sole main is the unrelated agent-tui tool.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only ISO-builder documentation, Dockerfile, and shell image selection; no new Ginkgo e2e tests or test network assumptions were added.
No-Weak-Crypto	✅ Passed	The PR changes only three appliance-image strings; introduced lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto implementation, or secret comparison.
Container-Privileges	✅ Passed	The PR only changes appliance image references. Existing --privileged, --net=host, and privileged-nested settings are unchanged; no new privilege setting is added.
No-Sensitive-Data-In-Logs	✅ Passed	The diff changes only image references in documentation, Dockerfile, and a default variable; it adds no logging or passwords, tokens, keys, PII, session IDs, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zaneb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [zaneb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tools/iso_builder/Dockerfile (1)

2-30: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Add a separate final stage.

AS builder on Line 2 does not create a multi-stage build. The builder becomes the final image and retains build tools, /openshift-appliance, and the generated appliance-config.yaml. The configuration is created from the mounted pull secret, and the cleanup commands do not remove it.

Add a final stage that copies only the generated ISO and runs as a non-root user.

As per path instructions, Dockerfiles must use multi-stage builds and must not keep build tools or secrets in the final image.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/iso_builder/Dockerfile` around lines 2 - 30, Add a separate final stage
after the existing builder stage, copying only the generated ISO from builder
and configuring a non-root runtime user. Ensure the final image excludes build
tools, /openshift-appliance, appliance-config.yaml, and any secret-derived
files, while preserving the ISO output.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@tools/iso_builder/Dockerfile`:
- Around line 2-30: Add a separate final stage after the existing builder stage,
copying only the generated ISO from builder and configuring a non-root runtime
user. Ensure the final image excludes build tools, /openshift-appliance,
appliance-config.yaml, and any secret-derived files, while preserving the ISO
output.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 681f43aa-64de-42a9-95dc-f81855d71215

📥 Commits

Reviewing files that changed from the base of the PR and between c031572 and e17ddff.

📒 Files selected for processing (3)

• tools/iso_builder/CLAUDE.md
• tools/iso_builder/Dockerfile
• tools/iso_builder/hack/build-ove-image.sh