Add openshift-core-networking to qci-image-puller RBAC

[mkowalski]

Grant the openshift-core-networking Rover group read access to QCI images (quay-proxy.ci.openshift.org) on app.ci, so members of the group can pull CI-built images for local development and debugging.

This follows the same pattern as the other groups already listed in clusters/app.ci/assets/admin_qci-image-puller_rbac.yaml.

---

This message was generated using AI. Please verify before acting on it.

Summary by CodeRabbit

• Grants the openshift-core-networking Rover group read access to QCI images through the qci-image-puller RBAC configuration on app.ci.
• Supports local development and debugging workflows using quay-proxy.ci.openshift.org.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@mkowalski: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: b9a3abb4-6139-4227-bd77-456d9cdad28d

📥 Commits

Reviewing files that changed from the base of the PR and between eb58676 and 954a598.

📒 Files selected for processing (1)

• clusters/app.ci/assets/admin_qci-image-puller_rbac.yaml

---

Walkthrough

The qci-image-puller RoleBinding now authorizes the openshift-core-networking group.

Changes

QCI image puller access

Layer / File(s)	Summary
Add networking group subject clusters/app.ci/assets/admin_qci-image-puller_rbac.yaml	Adds the openshift-core-networking group to the qci-image-puller RoleBinding subjects.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: malayparida2000

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of the openshift-core-networking group to qci-image-puller RBAC.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only an RBAC YAML file and adds a static group name; it adds or modifies no Ginkgo test titles.
Test Structure And Quality	✅ Passed	The PR changes only a RoleBinding YAML file; it adds no Ginkgo tests, so the listed test-structure requirements do not apply.
Microshift Test Compatibility	✅ Passed	Not applicable. The commit changes only one RBAC YAML file and adds no Ginkgo e2e tests or MicroShift-relevant test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only a RoleBinding YAML file and adds a group subject; it adds no Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The change only adds the openshift-core-networking Group subject to a RoleBinding. It adds no deployment, controller, replica, affinity, topology, node, taint, or disruption scheduling constraint.
Ote Binary Stdout Contract	✅ Passed	The pull request changes only a YAML RoleBinding and adds no OTE binary or process-level code that can write to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only a YAML RoleBinding and adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The patch only adds the openshift-core-networking RBAC group subject; no weak-crypto algorithm, custom crypto, or secret comparison appears in the added lines.
Container-Privileges	✅ Passed	The only change adds a Group subject to a RoleBinding. The manifest contains no containers or privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only a Kubernetes RoleBinding group name and API group. It adds no logging code or sensitive values.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mkowalski
Once this PR has been reviewed and has the lgtm label, please assign pruan-rht for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• clusters/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@mkowalski: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.