infra-periodics.yaml

periodics:
- agent: kubernetes
  cluster: build01
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build01-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build01` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build05
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build03-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build03` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build04
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build04-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build04` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build06
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build06-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build06` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build07
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build07-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build07` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build08
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build08-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build08` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build09
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build09-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build09` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build10
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build10-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build10` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: build11
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-build11-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `build11` has not been completed over 24 hours. Please check if anything blocks
        the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: hosted-mgmt
  cron: 30 7 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-hosted-mgmt-upgrade
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the upgrade of
        `hosted-mgmt` has not been completed over 24 hours. Please check if anything
        blocks the process.
  spec:
    containers:
    - args:
      - adm
      - upgrade
      - --to-latest
      command:
      - /usr/bin/oc
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.17_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: upgrader
- agent: kubernetes
  cluster: app.ci
  cron: 0 5 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-hosted-mgmt-hypershift-deployment
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed which indicates that the hypershift
        deployment on `hosted-mgmt` has not been completed. Please check if anything
        blocks the process.
  spec:
    containers:
    - args:
      - install
      - --enable-uwm-telemetry-remote-write=false
      - --hypershift-image=quay-proxy.ci.openshift.org/openshift/ci:hypershift_hypershift-operator_latest
      - --oidc-storage-provider-s3-bucket-name=dptp-hypershift-oidc-provider
      - --oidc-storage-provider-s3-credentials=/mgmt-aws/credentials
      - --oidc-storage-provider-s3-region=us-east-1
      command:
      - /usr/bin/hypershift
      env:
      - name: KUBECONFIG
        value: /etc/build-farm-credentials/sa.config-updater.hosted-mgmt.config
      image: quay-proxy.ci.openshift.org/openshift/ci:hypershift_hypershift-operator_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
      - mountPath: /mgmt-aws
        name: mgmt-aws-s3-credentials
        readOnly: true
    volumes:
    - name: build-farm-credentials
      secret:
        secretName: config-updater
    - name: mgmt-aws-s3-credentials
      secret:
        secretName: hypershift-operator-oidc-provider-s3-credentials
- agent: kubernetes
  cluster: app.ci
  cron: 0 8 * * 2-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-sprint-automation
  spec:
    containers:
    - args:
      - --jira-endpoint=https://issues.redhat.com
      - --jira-bearer-token-file=/etc/jira/token
      - --slack-token-path=/etc/slack/oauth_token
      - --pager-duty-token-file=/etc/pagerduty/token
      - --kubeconfig-dir=/etc/build-farm-credentials
      - --kubeconfig-suffix=config
      command:
      - /usr/bin/sprint-automation
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_sprint-automation_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/slack
        name: slack
        readOnly: true
      - mountPath: /etc/jira
        name: jira
        readOnly: true
      - mountPath: /etc/pagerduty
        name: pagerduty
        readOnly: true
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
    volumes:
    - name: slack
      secret:
        secretName: slack-credentials-dptp-bot
    - name: jira
      secret:
        secretName: jira-token-dptp-bot
    - name: pagerduty
      secret:
        secretName: pagerduty
    - name: build-farm-credentials
      secret:
        secretName: sprint-automation
- agent: kubernetes
  cluster: app.ci
  cron: 0 8 * * 1
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-sprint-automation-week-start
  spec:
    containers:
    - args:
      - --jira-endpoint=https://issues.redhat.com
      - --jira-bearer-token-file=/etc/jira/token
      - --slack-token-path=/etc/slack/oauth_token
      - --pager-duty-token-file=/etc/pagerduty/token
      - --kubeconfig-dir=/etc/build-farm-credentials
      - --kubeconfig-suffix=config
      - --week-start=true
      command:
      - /usr/bin/sprint-automation
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_sprint-automation_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/slack
        name: slack
        readOnly: true
      - mountPath: /etc/jira
        name: jira
        readOnly: true
      - mountPath: /etc/pagerduty
        name: pagerduty
        readOnly: true
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
    volumes:
    - name: slack
      secret:
        secretName: slack-credentials-dptp-bot
    - name: jira
      secret:
        secretName: jira-token-dptp-bot
    - name: pagerduty
      secret:
        secretName: pagerduty
    - name: build-farm-credentials
      secret:
        secretName: sprint-automation
- agent: kubernetes
  cluster: app.ci
  cron: 0 8 * * 1-5
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-pr-reminder
  spec:
    containers:
    - args:
      - -c
      - |
        set -o errexit
        set -o nounset
        set -o pipefail
        tar -C /tmp -xvzf /etc/github-users/users.yaml.tar.gz
        /usr/bin/pr-reminder \
        --log-level=debug \
        --config-path=/etc/config/_config.yaml \
        --github-users-file=/tmp/users.yaml \
        --slack-token-path=/etc/slack/oauth_token \
        --github-endpoint=http://ghproxy \
        --github-endpoint=https://api.github.com \
        --github-token-path=/etc/oauth/oauth
      command:
      - /bin/bash
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_pr-reminder_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/slack
        name: slack
        readOnly: true
      - mountPath: /etc/config
        name: config
        readOnly: true
      - mountPath: /etc/github-users
        name: github-users
        readOnly: true
      - mountPath: /etc/oauth
        name: github-token
    volumes:
    - name: slack
      secret:
        secretName: slack-credentials-dptp-bot
    - configMap:
        name: pr-reminder-config
      name: config
    - configMap:
        name: sync-rover-groups
      name: github-users
    - name: github-token
      secret:
        secretName: github-credentials-openshift-ci-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@yearly'
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-bugzilla-refresh-main
  spec:
    containers:
    - args:
      - |-
        --query=is:pr
        comments:<2500
        state:open
        base:main
        label:bugzilla/valid-bug
        label:lgtm
        label:approved
        -label:needs-rebase
      - --token=/etc/oauth/oauth
      - --updated=0
      - |-
        --comment=/bugzilla refresh

        The requirements for Bugzilla bugs have changed (BZs linked to PRs on main branch need to target different OCP), recalculating validity.
      - --ceiling=0
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: '@yearly'
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-bugzilla-refresh-master
  spec:
    containers:
    - args:
      - |-
        --query=is:pr
        comments:<2500
        state:open
        base:master
        label:bugzilla/valid-bug
        label:lgtm
        label:approved
        -label:needs-rebase
      - --token=/etc/oauth/oauth
      - --updated=0
      - |-
        --comment=/bugzilla refresh

        The requirements for Bugzilla bugs have changed (BZs linked to PRs on main branch need to target different OCP), recalculating validity.
      - --ceiling=0
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: '@yearly'
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-jira-refresh-main
  spec:
    containers:
    - args:
      - |-
        --query=is:pr
        comments:<2500
        state:open
        base:main
        label:jira/valid-bug
        label:lgtm
        label:approved
        -label:needs-rebase
      - --token=/etc/oauth/oauth
      - --updated=0
      - |-
        --comment=/jira refresh

        The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.
      - --ceiling=0
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: '@yearly'
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-jira-refresh-master
  spec:
    containers:
    - args:
      - |-
        --query=is:pr
        comments:<2500
        state:open
        base:master
        label:jira/valid-bug
        label:lgtm
        label:approved
        -label:needs-rebase
      - --token=/etc/oauth/oauth
      - --updated=0
      - |-
        --comment=/jira refresh

        The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.
      - --ceiling=0
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: '@yearly'
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-rotate-serviceaccount-secrets
  spec:
    containers:
    - args:
      - --namespace=ci
      - --dry-run=true
      - --kubeconfig-dir=/etc/build-farm-credentials
      - --kubeconfig-suffix=config
      command:
      - /usr/bin/serviceaccount-secret-rotation-trigger
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_serviceaccount-secret-rotation-trigger_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
    volumes:
    - name: build-farm-credentials
      secret:
        secretName: config-updater
- agent: kubernetes
  cluster: app.ci
  cron: 0 1 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-daily-bugzilla-refresh
  prowjob_defaults:
    tenant_id: gangway-api
  spec:
    containers:
    - args:
      - |-
        --query=is:pr
        state:open
        label:bugzilla/invalid-bug
        comments:<2500
        label:lgtm
        -label:bugzilla/valid-bug
        -label:do-not-merge
        -label:do-not-merge/work-in-progress
        -label:do-not-merge/hold
        -label:needs-rebase
        -label:needs-ok-to-test
      - --token=/etc/oauth/oauth
      - --updated=0
      - |-
        --comment=/bugzilla refresh

        Recalculating validity in case the underlying Bugzilla bug has changed.
      - --ceiling=0
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 0,8 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-issue-close
  spec:
    containers:
    - args:
      - |-
        --query=org:openshift
        comments:<2500
        repo:operator-framework/operator-sdk
        repo:openshift-eng/ai-helpers
        -label:lifecycle/frozen
        -label:tide/merge-blocker
        label:lifecycle/rotten
      - --updated=720h
      - --token=/etc/oauth/oauth
      - |-
        --comment=Rotten issues close after 30d of inactivity.

        Reopen the issue by commenting `/reopen`.
        Mark the issue as fresh by commenting `/remove-lifecycle rotten`.
        Exclude this issue from closing again by commenting `/lifecycle frozen`.

        /close
      - --template
      - --ceiling=10
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 15 0,8 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-enhancements-close
  spec:
    containers:
    - args:
      - |-
        --query=repo:openshift/enhancements
        comments:<2500
        -label:lifecycle/frozen
        -label:tide/merge-blocker
        label:lifecycle/rotten
      - --updated=168h
      - --token=/etc/oauth/oauth
      - |-
        --comment=Rotten enhancement proposals close after 7d of inactivity.

        See https://github.com/openshift/enhancements#life-cycle for details.

        Reopen the proposal by commenting `/reopen`.
        Mark the proposal as fresh by commenting `/remove-lifecycle rotten`.
        Exclude this proposal from closing again by commenting `/lifecycle frozen`.

        /close
      - --template
      - --ceiling=10
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 30 0,8 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-issue-rotten
  spec:
    containers:
    - args:
      - |-
        --query=org:openshift
        comments:<2500
        repo:operator-framework/operator-sdk
        repo:openshift-eng/ai-helpers
        -label:tide/merge-blocker
        -label:lifecycle/frozen
        label:lifecycle/stale
        -label:lifecycle/rotten
      - --updated=720h
      - --token=/etc/oauth/oauth
      - |-
        --comment=Stale issues rot after 30d of inactivity.

        Mark the issue as fresh by commenting `/remove-lifecycle rotten`.
        Rotten issues close after an additional 30d of inactivity.
        Exclude this issue from closing by commenting `/lifecycle frozen`.

        If this issue is safe to close now please do so with `/close`.

        /lifecycle rotten
        /remove-lifecycle stale
      - --template
      - --ceiling=10
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 45 0,8 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-enhancements-rotten
  spec:
    containers:
    - args:
      - |-
        --query=repo:openshift/enhancements
        comments:<2500
        -label:tide/merge-blocker
        -label:lifecycle/frozen
        label:lifecycle/stale
        -label:lifecycle/rotten
      - --updated=168h
      - --token=/etc/oauth/oauth
      - |-
        --comment=Stale enhancement proposals rot after 7d of inactivity.

        See https://github.com/openshift/enhancements#life-cycle for details.

        Mark the proposal as fresh by commenting `/remove-lifecycle rotten`.
        Rotten proposals close after an additional 7d of inactivity.
        Exclude this proposal from closing by commenting `/lifecycle frozen`.

        If this proposal is safe to close now please do so with `/close`.

        /lifecycle rotten
        /remove-lifecycle stale
      - --template
      - --ceiling=10
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 1,9 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-issue-stale
  spec:
    containers:
    - args:
      - |-
        --query=org:openshift
        comments:<2500
        repo:operator-framework/operator-sdk
        repo:openshift-eng/ai-helpers
        -label:lifecycle/frozen
        -label:lifecycle/stale
        -label:lifecycle/rotten
        -label:tide/merge-blocker
      - --updated=2160h
      - --token=/etc/oauth/oauth
      - |-
        --comment=Issues go stale after 90d of inactivity.

        Mark the issue as fresh by commenting `/remove-lifecycle stale`.
        Stale issues rot after an additional 30d of inactivity and eventually close.
        Exclude this issue from closing by commenting `/lifecycle frozen`.

        If this issue is safe to close now please do so with `/close`.

        /lifecycle stale
      - --template
      - --ceiling=10
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 15 1,9 * * *
  decorate: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-enhancements-stale
  spec:
    containers:
    - args:
      - |-
        --query=repo:openshift/enhancements
        comments:<2500
        -label:lifecycle/frozen
        -label:lifecycle/stale
        -label:lifecycle/rotten
        -label:tide/merge-blocker
      - --updated=672h
      - --token=/etc/oauth/oauth
      - |-
        --comment=Inactive enhancement proposals go stale after 28d of inactivity.

        See https://github.com/openshift/enhancements#life-cycle for details.

        Mark the proposal as fresh by commenting `/remove-lifecycle stale`.
        Stale proposals rot after an additional 7d of inactivity and eventually close.
        Exclude this proposal from closing by commenting `/lifecycle frozen`.

        If this proposal is safe to close now please do so with `/close`.

        /lifecycle stale
      - --template
      - --ceiling=10
      - --confirm
      command:
      - /ko-app/commenter
      image: quay.io/openshift/ci:ci_commenter_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/oauth
        name: token
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 0 * * 3
  decorate: true
  decoration_config:
    timeout: 12h0m0s
  labels:
    ci.openshift.io/role: infra
  name: periodic-label-sync
  spec:
    containers:
    - args:
      - --config=/etc/config/labels.yaml
      - --confirm=true
      - --orgs=openshift,cri-o,dora-metrics,operator-framework,openshift-priv,redhat-openshift-ecosystem,openshift-psap,openshift-metal3,shipwright-io,openshift-assisted,openshift-eng,openshift-kni,openshift-online
      - --github-throttle-org=openshift:600:200
      - --github-throttle-org=cri-o:600:200
      - --github-throttle-org=dora-metrics:600:200
      - --github-throttle-org=operator-framework:600:200
      - --github-throttle-org=openshift-priv:600:200
      - --github-throttle-org=redhat-openshift-ecosystem:600:200
      - --github-throttle-org=openshift-psap:600:200
      - --github-throttle-org=openshift-metal3:600:200
      - --github-throttle-org=shipwright-io:600:200
      - --github-throttle-org=openshift-assisted:600:200
      - --github-throttle-org=konveyor:600:200
      - --github-throttle-org=openshift-eng:600:200
      - --github-app-id=$(GITHUB_APP_ID)
      - --github-app-private-key-path=/etc/github/cert
      - --github-endpoint=http://ghproxy
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --debug
      command:
      - /ko-app/label_sync
      env:
      - name: GITHUB_APP_ID
        valueFrom:
          secretKeyRef:
            key: appid
            name: openshift-prow-github-app
      image: quay.io/openshift/ci:ci_label-sync_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: github-app-credentials
        readOnly: true
      - mountPath: /etc/config
        name: config
        readOnly: true
    volumes:
    - name: github-app-credentials
      secret:
        secretName: openshift-prow-github-app
    - configMap:
        name: labels
      name: config
- agent: kubernetes
  cluster: app.ci
  cron: 0 22 * * 3
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  labels:
    ci.openshift.io/role: infra
  name: periodic-prow-image-autobump-openshift-release
  spec:
    containers:
    - args:
      - --config=core-services/prow/02_config/_release-bumper.yaml
      command:
      - /ko-app/generic-autobumper
      image: us-docker.pkg.dev/k8s-infra-prow/images/generic-autobumper:v20260217-999e46ca7
      imagePullPolicy: IfNotPresent
      name: autobump
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 22 * * 3
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: ci-tools
    workdir: true
  - base_ref: main
    org: openshift
    repo: release
  labels:
    ci.openshift.io/role: infra
  name: periodic-prow-image-autobump-openshift-ci-tools
  spec:
    containers:
    - args:
      - --config=../release/core-services/prow/02_config/_ci-tools-bumper.yaml
      command:
      - /ko-app/generic-autobumper
      image: us-docker.pkg.dev/k8s-infra-prow/images/generic-autobumper:v20260217-999e46ca7
      imagePullPolicy: IfNotPresent
      name: autobump
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 */4 * * 1-5
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  - base_ref: openshift-4.21
    org: openshift
    repo: ocp-build-data
  labels:
    ci.openshift.io/role: infra
  name: periodic-prow-auto-config-brancher
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --confirm=true
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --target-dir=.
      - --config-dir=./ci-operator/config
      - --current-release=4.22
      - --future-release=4.23
      - --future-release=5.0
      - --self-approve=true
      - --assign=openshift/test-platform
      - --rebalancer-cron=0 0 * * 2,5
      - --whitelist-file=./core-services/openshift-priv/_whitelist.yaml
      command:
      - /usr/bin/auto-config-brancher
      image: quay.io/openshift/ci-public:ci_auto-config-brancher_latest
      imagePullPolicy: Always
      name: auto-config-brancher
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
      - mountPath: /etc/prometheus
        name: prometheus
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
    - name: prometheus
      secret:
        items:
        - key: sa.ci-monitoring.app.ci.token.txt
          path: token
        secretName: app-ci-openshift-user-workload-monitoring-credentials
- agent: kubernetes
  cluster: app.ci
  cron: 0 0 1 6 *
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  labels:
    ci.openshift.io/role: infra
  name: periodic-auto-prow-job-dispatcher
  spec:
    containers:
    - args:
      - --upstream-branch=master
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --github-login=openshift-bot
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --target-dir=.
      - --config-path=./core-services/sanitize-prow-jobs/_config.yaml
      - --prow-jobs-dir=./ci-operator/jobs
      - --self-approve=true
      - --prometheus-bearer-token-path=/etc/prometheus/token
      - --create-pr=true
      command:
      - /usr/bin/prow-job-dispatcher
      image: quay.io/openshift/ci-public:ci_prow-job-dispatcher_latest
      imagePullPolicy: Always
      name: auto-prow-job-dispatcher
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/prometheus
        name: prometheus
        readOnly: true
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: prometheus
      secret:
        items:
        - key: sa.ci-monitoring.app.ci.token.txt
          path: token
        secretName: app-ci-openshift-user-workload-monitoring-credentials
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 0 * * *
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: operator-framework-olm
  labels:
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  name: periodic-auto-olm-downstreaming
  reporter_config:
    slack:
      channel: '#team-operator-fw'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed. https://prow.ci.openshift.org/?job={{.Spec.Job}}
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --github-login=openshift-bot
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --staging-dir=./staging
      - --mode=publish
      - --central-ref=FETCH_HEAD
      - --fetch-mode=https
      - --log-level=debug
      - --self-approve=true
      - --dry-run=false
      command:
      - /usr/bin/bumper
      env:
      - name: HOME
        value: /home/prow/go
      - name: GOROOT
        value: /usr/lib/golang
      image: quay-proxy.ci.openshift.org/openshift/ci:operator-lifecycle-manager_olm-v0-bumper_latest
      imagePullPolicy: Always
      name: bumper
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    serviceAccountName: olm-image-puller
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 0 * * *
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: operator-framework-operator-controller
  labels:
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  name: periodic-auto-olm-v1-downstreaming
  reporter_config:
    slack:
      channel: '#team-operator-fw'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed. https://prow.ci.openshift.org/?job={{.Spec.Job}}
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --github-login=openshift-bot
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --operator-controller-dir=/home/prow/go/src/github.com/openshift/operator-framework-operator-controller
      - --mode=publish
      - --fetch-mode=https
      - --log-level=debug
      - --self-approve=true
      - --dry-run=false
      - --jira=OCPBUGS
      - --jira=OPRUN
      command:
      - /usr/bin/bumper
      env:
      - name: HOME
        value: /home/prow/go
      - name: GOROOT
        value: /usr/lib/golang
      image: quay-proxy.ci.openshift.org/openshift/ci:operator-lifecycle-manager_olm-v1-bumper_latest
      imagePullPolicy: Always
      name: bumper
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    serviceAccountName: olm-image-puller
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 30 7 * * *
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  labels:
    ci.openshift.io/role: infra
  name: periodic-prow-auto-owners
  spec:
    containers:
    - args:
      - --pr-base-branch=main
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --target-dir=.
      - --self-approve=true
      - --assign=openshift/test-platform
      - --plugin-config=core-services/prow/02_config/_plugins.yaml
      - --ignore-repo=openshift/jenkins
      - --ignore-repo=redhat-developer/helm
      - --ignore-repo=redhat-developer/odo
      - --ignore-repo=redhat-developer/service-binding-operator
      - --ignore-repo=redhat-developer/gitops-operator
      - --ignore-repo=stolostron/acmqe-autotest
      - --ignore-repo=openshift/kubernetes-metrics-server
      - --ignore-repo=openshift/origin-metrics
      - --ignore-repo=openshift/origin-web-console
      - --ignore-repo=origin-web-console-server
      - --ignore-repo=openshift/csi-driver-registrar
      - --ignore-repo=openshift/csi-external-resizer
      - --ignore-repo=openshift/csi-external-snapshotter
      - --ignore-repo=openshift/csi-livenessprobe
      - --ignore-repo=openshift/sig-storage-local-static-provisioner
      - --ignore-repo=openshift/oauth-apiserver
      - --ignore-repo=openshift/build-machinery-go
      - --ignore-repo=openshift/etcd
      - --ignore-repo=opendatahub-io/manifests
      - --ignore-repo=openshift/cluster-api-provider-kubevirt
      - --ignore-repo=serverless-operator
      - --ignore-repo=ci-operator/config/openshift/velero
      - --ignore-repo=openshift/velero
      - --ignore-repo=redhat-appstudio/rhtap-cli
      - --ignore-org=openshift-priv
      - --ignore-org=kubernetes-sigs
      - --ignore-org=CSPI-QE
      - --ignore-org=openshift-online/ocm-cli
      - --ignore-org=netobserv
      - --extra-config-dir=core-services/prow/02_config/
      command:
      - /usr/bin/autoowners
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_autoowners_latest
      imagePullPolicy: Always
      name: autoowners
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  annotations:
    ci.openshift.io/description: This job runs Prow branchprotector to reconcile the
      settings of the GitHub Branch Protection based on Prow configuration. This job
      only manages repositories in the openshift GitHub organization. For repos outside
      of openshift, see periodic-branch-protection.
    ci.openshift.io/sop: https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/infrastructure-jobs.md#periodic-branch-protector-openshift-org
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
    workdir: true
  interval: 6h
  labels:
    ci.openshift.io/role: infra
  name: periodic-branch-protector-openshift-org
  spec:
    containers:
    - args:
      - --config-path=./core-services/prow/02_config/_config.yaml
      - --supplemental-prow-config-dir=./core-services/prow/02_config
      - --job-config-path=./ci-operator/jobs
      - --confirm=true
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --github-hourly-tokens=2000
      - --github-enabled-org=openshift
      command:
      - /ko-app/branchprotector
      image: us-docker.pkg.dev/k8s-infra-prow/images/branchprotector:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  annotations:
    ci.openshift.io/description: This job runs Prow branchprotector to reconcile the
      settings of the GitHub Branch Protection based on Prow configuration. This job
      only manages repositories outside the openshift GitHub organization. For repos
      in openshift, see periodic-branch-protection-openshift-org.
    ci.openshift.io/sop: https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/infrastructure-jobs.md#periodic-branch-protector
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
    workdir: true
  interval: 6h
  labels:
    ci.openshift.io/role: infra
  name: periodic-branch-protector
  spec:
    containers:
    - args:
      - --config-path=./core-services/prow/02_config/_config.yaml
      - --supplemental-prow-config-dir=./core-services/prow/02_config
      - --job-config-path=./ci-operator/jobs
      - --confirm=true
      - --github-app-id=$(GITHUB_APP_ID)
      - --github-app-private-key-path=/etc/github/cert
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --github-hourly-tokens=10000
      - --github-disabled-org=openshift
      - --github-client.max-retries=10
      - --github-client.max-404-retries=3
      - --github-client.initial-delay=5s
      command:
      - /ko-app/branchprotector
      env:
      - name: GITHUB_APP_ID
        valueFrom:
          secretKeyRef:
            key: appid
            name: openshift-prow-github-app
      image: us-docker.pkg.dev/k8s-infra-prow/images/branchprotector:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: github-app-credentials
        readOnly: true
    volumes:
    - name: github-app-credentials
      secret:
        secretName: openshift-prow-github-app
- agent: kubernetes
  annotations:
    ci.openshift.io/description: 'This job runs Prow peribolos to reconcile members,
      teams, team membership and other properties of the openshift GitHub organization
      based on configuration stored in private openshift/config repository. We share
      the ownership of this job with DPP: we make sure that peribolos works and DPP
      owns the config in openshift/config. Most problems with this job are caused
      by the configuration, so we often just ping @dpp-triage to resolve them.'
    ci.openshift.io/sop: https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/infrastructure-jobs.md#periodic-org-sync
  cluster: app.ci
  decorate: true
  decoration_config:
    oauth_token_secret:
      key: oauth
      name: github-credentials-openshift-ci-robot-private-git-cloner
    timeout: 6h0m0s
  extra_refs:
  - base_ref: master
    org: openshift
    repo: config
    workdir: true
  interval: 6h
  labels:
    ci.openshift.io/role: infra
  name: periodic-org-sync
  spec:
    containers:
    - command:
      - sh
      - -c
      - |
        set -euo pipefail

        echo "Filtering openshift-priv from org/config.yaml"

        # Safety check: ensure openshift-priv exists exactly once
        count=$(grep -cE '^  openshift-priv:' org/config.yaml || true)
        if [ "$count" -ne 1 ]; then
            echo "ERROR: expected exactly one 'openshift-priv:' key, found $count" >&2
            exit 1
        fi

        # Remove the openshift-priv org block using range deletion
        # This deletes from "  openshift-priv:" line up to (but not including) the next org
        sed -E '/^  openshift-priv:/,/^  [a-zA-Z0-9_-]+:/{/^  openshift-priv:/d; /^  [a-zA-Z0-9_-]+:/!d;}' \
            org/config.yaml > /tmp/stripped-config.yaml

        # Verify the result is valid
        if ! grep -qE '^orgs:' /tmp/stripped-config.yaml; then
            echo "ERROR: Output YAML appears malformed (no 'orgs:' found)" >&2
            exit 1
        fi

        if grep -qE '^  openshift-priv:' /tmp/stripped-config.yaml; then
            echo "ERROR: openshift-priv still present in output" >&2
            exit 1
        fi

        echo "Successfully removed openshift-priv from configuration"

        # Run peribolos with the filtered config
        exec /ko-app/peribolos \
          --config-path=/tmp/stripped-config.yaml \
          --confirm=true \
          --github-token-path=/etc/github/oauth \
          --github-endpoint=http://ghproxy \
          --github-endpoint=https://api.github.com \
          --github-graphql-endpoint=http://ghproxy/graphql \
          --fix-org \
          --fix-org-members \
          --fix-teams \
          --fix-team-members \
          --fix-team-repos \
          --fix-repos \
          --github-hourly-tokens=600 \
          --github-allowed-burst=600 \
          --allow-repo-archival
      image: us-docker.pkg.dev/k8s-infra-prow/images/peribolos:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot-peribolos-token
- agent: kubernetes
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  interval: 12h
  labels:
    ci.openshift.io/role: infra
  name: periodic-openshift-release-main-app-ci-apply
  spec:
    containers:
    - args:
      - --config-dir=clusters/app.ci
      - --confirm=true
      - --as=
      command:
      - applyconfig
      env:
      - name: SLACK_API_URL
        valueFrom:
          secretKeyRef:
            key: url
            name: ci-slack-api-url
      - name: PAGERDUTY_INTEGRATION_KEY
        valueFrom:
          secretKeyRef:
            key: integration_key
            name: pagerduty
      image: quay.io/openshift/ci-public:ci_applyconfig_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 10m
    serviceAccountName: config-updater
- agent: kubernetes
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  interval: 1h
  labels:
    ci.openshift.io/role: infra
  name: openshift-release-main-config-bootstrapper
  spec:
    containers:
    - args:
      - --kubeconfig-dir=/etc/build-farm-credentials
      - --kubeconfig-suffix=config
      command:
      - hack/config-bootstrapper.sh
      image: us-docker.pkg.dev/k8s-infra-prow/images/config-bootstrapper:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 10m
      volumeMounts:
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
    serviceAccountName: config-updater
    volumes:
    - name: build-farm-credentials
      secret:
        secretName: hook
- agent: kubernetes
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  interval: 2h
  labels:
    ci.openshift.io/role: infra
  name: periodic-openshift-release-fast-forward
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/
      - --current-release=4.22
      - --future-release=5.0
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      - --ignore=Azure/ARO-HCP
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  interval: 2h
  labels:
    ci.openshift.io/role: infra
  name: periodic-openshift-release-fast-forward-5.0-to-4.23
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/
      - --current-release=5.0
      - --future-release=4.23
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      - --ignore=Azure/ARO-HCP
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  annotations:
    ci.openshift.io/sop: https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/infrastructure-jobs.md#periodic-openshift-release-private-org-sync
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  hidden: true
  interval: 2h
  labels:
    ci.openshift.io/role: infra-internal
  max_concurrency: 1
  name: periodic-openshift-release-private-org-sync
  spec:
    containers:
    - args:
      - --config-path=./ci-operator/config/
      - --target-org=openshift-priv
      - --token-path=/etc/github/oauth
      - --only-org=openshift
      - --confirm
      - --whitelist-file=./core-services/openshift-priv/_whitelist.yaml
      - --git-name=openshift-merge-robot
      - --git-email=openshift-merge-robot@redhat.com
      command:
      - private-org-sync
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_private-org-sync_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: "1"
          memory: 1Gi
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  interval: 2h
  labels:
    ci.openshift.io/role: infra
  name: periodic-openshift-release-merge-blockers
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      - --config-dir=./ci-operator/config/
      - --current-release=4.22
      - --future-release=4.23
      - --future-release=5.0
      command:
      - blocking-issue-creator
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_blocking-issue-creator_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@weekly'
  decorate: true
  decoration_config:
    skip_cloning: true
  labels:
    ci.openshift.io/role: infra
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  max_concurrency: 1
  name: periodic-imagestream-importer
  spec:
    containers:
    - args:
      - -c
      - |
        set -o errexit
        set -o nounset
        set -o pipefail
        for is in python; do
          echo "importing ${is} ..."
          oc import-image -n openshift "${is}" --all
        done
      command:
      - /bin/bash
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_4.12_cli
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
    serviceAccountName: imagestream-importer
- agent: kubernetes
  cluster: app.ci
  decorate: true
  decoration_config:
    oauth_token_secret:
      key: oauth
      name: github-credentials-openshift-ci-robot-private-git-cloner
  extra_refs:
  - base_ref: master
    org: openshift
    repo: config
    workdir: true
  - base_ref: main
    org: openshift
    repo: release
  hidden: true
  interval: 12h
  labels:
    ci.openshift.io/role: infra-internal
  name: periodic-auto-private-org-peribolos-sync
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      - --self-approve=true
      - --github-login=openshift-merge-robot
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --peribolos-config=./org/config.yaml
      - --release-repo-path=/home/prow/go/src/github.com/openshift/release
      - --whitelist-file=/home/prow/go/src/github.com/openshift/release/core-services/openshift-priv/_whitelist.yaml
      - --only-org=openshift
      command:
      - /usr/bin/auto-peribolos-sync
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_auto-peribolos-sync_latest
      imagePullPolicy: Always
      name: auto-peribolos-sync
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
    workdir: true
  interval: 12h
  labels:
    ci.openshift.io/role: infra
  name: periodic-auto-publicize-config
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      - --self-approve=true
      - --github-login=openshift-merge-robot
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --publicize-config=./clusters/app.ci/publicize/_config.yaml
      - --release-repo-path=./
      - --whitelist-file=./core-services/openshift-priv/_whitelist.yaml
      command:
      - /usr/bin/autopublicizeconfig
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_autopublicizeconfig_latest
      imagePullPolicy: Always
      name: auto-publicize-config
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  decoration_config:
    gcs_configuration:
      bucket: origin-ci-private
      job_url_prefix: https://deck-internal-ci.apps.ci.l2s4.p1.openshiftapps.com/view/
      mediaTypes:
        log: text/plain
    gcs_credentials_secret: gce-sa-credentials-gcs-private
  hidden: true
  interval: 12h
  labels:
    ci.openshift.io/role: infra-internal
  name: periodic-ci-secret-generator
  spec:
    containers:
    - command:
      - /usr/bin/ci-secret-generator
      - --vault-addr=https://vault.ci.openshift.org
      - --vault-role=secret-generator
      - --vault-prefix=kv/dptp
      - --bootstrap-config=/etc/ci-secret-bootstrap/_config.yaml
      - --config=/etc/ci-secret-generator/_config.yaml
      - --enable-gsm-sync=false
      - --gsm-credentials-file=/etc/gcp-credentials/key.json
      - --dry-run=false
      env:
      - name: GCP_PROJECT_ID
        value: openshift-ci-secrets
      - name: GCP_PROJECT_NUMBER
        value: "384486694155"
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-secret-generator_latest
      imagePullPolicy: Always
      name: ci-secret-generator
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/ci-secret-bootstrap
        name: ci-secret-bootstrap
      - mountPath: /tmp/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
      - mountPath: /etc/ci-secret-generator
        name: ci-secret-generator
      - mountPath: /etc/gcp-credentials
        name: gcp-sa-key
        readOnly: true
    serviceAccountName: secret-generator
    volumes:
    - configMap:
        name: ci-secret-generator
      name: ci-secret-generator
    - configMap:
        name: ci-secret-bootstrap
      name: ci-secret-bootstrap
    - name: build-farm-credentials
      secret:
        secretName: config-updater
    - name: gcp-sa-key
      secret:
        secretName: gsm-secrets-reconciler-sa-credentials
- agent: kubernetes
  cluster: app.ci
  decorate: true
  decoration_config:
    gcs_configuration:
      bucket: origin-ci-private
      job_url_prefix: https://deck-internal-ci.apps.ci.l2s4.p1.openshiftapps.com/view/
      mediaTypes:
        log: text/plain
    gcs_credentials_secret: gce-sa-credentials-gcs-private
  hidden: true
  interval: 30m
  labels:
    ci.openshift.io/role: infra-internal
  name: periodic-ci-secret-bootstrap
  spec:
    containers:
    - args:
      - --vault-addr=https://vault.ci.openshift.org
      - --vault-role=secret-bootstrap
      - --vault-prefix=kv
      - --config=/etc/ci-secret-bootstrap/_config.yaml
      - --log-level=debug
      - --dry-run=false
      - --force=true
      - --validate-bitwarden-items-usage
      - --bw-allow-unused=dptp/aos-cicd@redhat.com
      - --bw-allow-unused=dptp/aos-team-dp-testplatform@redhat.com mailing list
      - --bw-allow-unused=dptp/AWS ci-longlivedcluster-bot
      - --bw-allow-unused=dptp/bugzilla.redhat.com
      - --bw-allow-unused=dptp/build_farm
      - --bw-allow-unused=dptp/build_farm_osd_aws
      - --bw-allow-unused=dptp/build_farm_osd_gcp
      - --bw-allow-unused=dptp/cluster-bot-aws-account-for-ephemeral-osd
      - --bw-allow-unused=dptp/cluster-bot-cloud-sso-for-ocm-ephemeral-osd
      - --bw-allow-unused=dptp/gitops-cluster-build01
      - --bw-allow-unused=dptp/gitops-cluster-build02
      - --bw-allow-unused=dptp/gitops-cluster-build03
      - --bw-allow-unused=dptp/gitops-cluster-build04
      - --bw-allow-unused=dptp/gitops-cluster-build05
      - --bw-allow-unused=dptp/gitops-cluster-build06
      - --bw-allow-unused=dptp/gitops-cluster-build07
      - --bw-allow-unused=dptp/gitops-cluster-build08
      - --bw-allow-unused=dptp/gitops-cluster-build09
      - --bw-allow-unused=dptp/gitops-cluster-build10
      - --bw-allow-unused=dptp/gitops-cluster-build11
      - --bw-allow-unused=dptp/gitops-cluster-core-ci
      - --bw-allow-unused=dptp/gitops-cluster-hosted-mgmt
      - --bw-allow-unused=dptp/kata-jenkins-ci.westus2.cloudapp.azure.com
      - --bw-allow-unused=dptp/openshift-bot
      - --bw-allow-unused=dptp/openshift-bugzilla-robot
      - --bw-allow-unused=dptp/openshift-bugzilla-robot@redhat.com
      - --bw-allow-unused=dptp/openshift-build-robot
      - --bw-allow-unused=dptp/openshift-cherrypick-robot
      - --bw-allow-unused=dptp/openshift-ci-robot
      - --bw-allow-unused=dptp/openshift-github-robots@redhat.com
      - --bw-allow-unused=dptp/openshift-merge-robot
      - --bw-allow-unused=dptp/openshift-publish-robot
      - --bw-allow-unused=dptp/quay.io
      - --bw-allow-unused=dptp/quay.io/multi-arch
      - --kubeconfig-dir=/etc/build-farm-credentials
      - --kubeconfig-suffix=config
      - --enable-gsm=true
      - --gsm-config=/etc/gsm-config/gsm-config.yaml
      command:
      - /usr/bin/ci-secret-bootstrap
      env:
      - name: GCP_PROJECT_ID
        value: openshift-ci-secrets
      - name: GCP_PROJECT_NUMBER
        value: "384486694155"
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-secret-bootstrap_latest
      imagePullPolicy: Always
      name: ci-secret-bootstrap
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
      - mountPath: /.config
        name: config-volume
      - mountPath: /etc/ci-secret-bootstrap
        name: ci-secret-bootstrap
      - mountPath: /etc/gsm-config
        name: gsm-config
        readOnly: true
    serviceAccountName: secret-bootstrap
    volumes:
    - configMap:
        name: ci-secret-bootstrap
      name: ci-secret-bootstrap
    - configMap:
        name: gsm-config
      name: gsm-config
    - name: build-farm-credentials
      secret:
        secretName: config-updater
    - emptyDir: {}
      name: config-volume
- agent: kubernetes
  cluster: app.ci
  cron: '@yearly'
  decorate: true
  extra_refs:
  - base_ref: openshift-4.22
    org: openshift
    repo: ocp-build-data
  labels:
    ci.openshift.io/role: infra
  name: periodic-ocp-build-data-enforcer
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --ocp-build-data-repo-dir=./
      - --create-prs=true
      - --minor=22
      - --pr-creation-ceiling=1000
      command:
      - /usr/bin/ocp-build-data-enforcer
      env:
      - name: CLICOLOR_FORCE
        value: "1"
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ocp-build-data-enforcer_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: '@daily'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  - base_ref: master
    org: kubernetes
    repo: test-infra
    workdir: true
  labels:
    ci.openshift.io/role: infra
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  name: periodic-prow-auto-testgrid-generator
  spec:
    containers:
    - args:
      - --upstream-branch=master
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --github-login=openshift-bot
      - --git-name=openshift-bot
      - --git-email=openshift-bot@redhat.com
      - --working-dir=.
      - --assign=droslean
      - --testgrid-config=./config/testgrids/openshift
      - --release-config=../../openshift/release/core-services/release-controller/_releases
      - --prow-jobs-dir=../../openshift/release/ci-operator/jobs
      - --allow-list=../../openshift/release/core-services/testgrid-config-generator/_allow-list.yaml
      command:
      - /usr/bin/auto-testgrid-generator
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_auto-testgrid-generator_latest
      imagePullPolicy: Always
      name: auto-testgrid-generator
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  interval: 4h
  labels:
    ci.openshift.io/role: infra
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  name: periodic-openshift-release-main-accept-invitations-cherrypick-robot
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      command:
      - /ko-app/invitations-accepter
      image: us-docker.pkg.dev/k8s-infra-prow/images/invitations-accepter:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 10m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-cherrypick-robot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  interval: 4h
  labels:
    ci.openshift.io/role: infra
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  name: periodic-openshift-release-main-accept-invitations-merge-robot
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      command:
      - /ko-app/invitations-accepter
      image: us-docker.pkg.dev/k8s-infra-prow/images/invitations-accepter:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 10m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  decorate: true
  interval: 4h
  labels:
    ci.openshift.io/role: infra
    pj-rehearse.openshift.io/can-be-rehearsed: "true"
  name: periodic-openshift-release-main-accept-invitations-ci-robot
  spec:
    containers:
    - args:
      - --github-token-path=/etc/github/oauth
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-graphql-endpoint=http://ghproxy/graphql
      - --dry-run=false
      command:
      - /ko-app/invitations-accepter
      image: us-docker.pkg.dev/k8s-infra-prow/images/invitations-accepter:v20260217-999e46ca7
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 10m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-ci-robot
- agent: kubernetes
  cluster: app.ci
  cron: 30 7 * * *
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  labels:
    ci.openshift.io/role: infra
  name: periodic-promoted-image-governor
  spec:
    containers:
    - command:
      - /usr/bin/promoted-image-governor
      - --ci-operator-config-path=ci-operator/config
      - --release-controller-mirror-config-dir=core-services/release-controller/_releases
      - --ignored-image-stream-tags
      - ^ocp\S*/\S+:machine-os-content$
      - --ignored-image-stream-tags
      - ^ocp\S*/\S+:rhel-coreos-.+
      - --ignored-image-stream-tags
      - ^ocp\S*/\S+:rhel-coreos
      - --ignored-image-stream-tags
      - ^ocp\S*/\S+:base-rhel\d+
      - --ignored-image-stream-tags
      - '^openshift/origin-v3.11:'
      - --ignored-image-stream-tags
      - '^origin/[4-9]\.\d+:'
      - --ignored-image-stream-tags
      - '^origin/scos-[4-9]\.\d+:'
      - --ignored-image-stream-tags
      - '^origin/scos-[4-9]\.\d+-art:'
      - --ignored-image-stream-tags
      - cincinnati-ci-public/cincinnati-graph-data:6420f7fbf3724e1e5e329ae8d1e2985973f60c14
      - --kubeconfig-dir=/etc/build-farm-credentials
      - --kubeconfig-suffix=config
      - --dry-run=false
      image: quay.io/openshift/ci-public:ci_promoted-image-governor_latest
      imagePullPolicy: Always
      name: promoted-image-governor
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
    serviceAccountName: promoted-image-governor
    volumes:
    - name: build-farm-credentials
      secret:
        secretName: promoted-image-governor
- agent: kubernetes
  cluster: app.ci
  cron: '@hourly'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-fast-forward-assisted-image-service
  reporter_config:
    slack:
      channel: '#assisted-deployment-ci'
      job_states_to_report:
      - failure
      - error
      report_template: '{{ if eq .Status.State "success" }} :green_jenkins_circle:
        {{ else }} :red_jenkins_circle: {{ end }} Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
        <{{.Status.URL}}|View logs>'
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/openshift/assisted-image-service
      - --current-promotion-namespace=edge-infrastructure
      - --current-release=ocm-2.17
      - --future-release=ocm-2.17
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@hourly'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-fast-forward-cluster-api-provider-agent
  reporter_config:
    slack:
      channel: '#assisted-deployment-ci'
      job_states_to_report:
      - failure
      - error
      report_template: '{{ if eq .Status.State "success" }} :green_jenkins_circle:
        {{ else }} :red_jenkins_circle: {{ end }} Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
        <{{.Status.URL}}|View logs>'
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/openshift/cluster-api-provider-agent
      - --current-promotion-namespace=edge-infrastructure
      - --current-release=ocm-2.17
      - --future-release=ocm-2.17
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@hourly'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-fast-forward-assisted-installer
  reporter_config:
    slack:
      channel: '#assisted-deployment-ci'
      job_states_to_report:
      - failure
      - error
      report_template: '{{ if eq .Status.State "success" }} :green_jenkins_circle:
        {{ else }} :red_jenkins_circle: {{ end }} Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
        <{{.Status.URL}}|View logs>'
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/openshift/assisted-installer
      - --current-promotion-namespace=edge-infrastructure
      - --current-release=ocm-2.17
      - --future-release=ocm-2.17
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@hourly'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-fast-forward-assisted-installer-agent
  reporter_config:
    slack:
      channel: '#assisted-deployment-ci'
      job_states_to_report:
      - failure
      - error
      report_template: '{{ if eq .Status.State "success" }} :green_jenkins_circle:
        {{ else }} :red_jenkins_circle: {{ end }} Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
        <{{.Status.URL}}|View logs>'
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/openshift/assisted-installer-agent
      - --current-promotion-namespace=edge-infrastructure
      - --current-release=ocm-2.17
      - --future-release=ocm-2.17
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@hourly'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-fast-forward-assisted-service
  reporter_config:
    slack:
      channel: '#assisted-deployment-ci'
      job_states_to_report:
      - failure
      - error
      report_template: '{{ if eq .Status.State "success" }} :green_jenkins_circle:
        {{ else }} :red_jenkins_circle: {{ end }} Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
        <{{.Status.URL}}|View logs>'
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/openshift/assisted-service
      - --current-promotion-namespace=edge-infrastructure
      - --current-release=ocm-2.17
      - --future-release=ocm-2.17
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: '@hourly'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-fast-forward-assisted-test-infra
  reporter_config:
    slack:
      channel: '#assisted-deployment-ci'
      job_states_to_report:
      - failure
      - error
      report_template: '{{ if eq .Status.State "success" }} :green_jenkins_circle:
        {{ else }} :red_jenkins_circle: {{ end }} Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
        <{{.Status.URL}}|View logs>'
  spec:
    containers:
    - args:
      - --config-dir=./ci-operator/config/openshift/assisted-test-infra
      - --current-promotion-namespace=edge-infrastructure
      - --current-release=ocm-2.17
      - --future-release=ocm-2.17
      - --fast-forward
      - --confirm
      - --username=openshift-merge-robot
      - --token-path=/etc/github/oauth
      command:
      - repo-brancher
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_repo-brancher_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-merge-robot
- agent: kubernetes
  cluster: app.ci
  cron: 30 1 * * *
  decorate: true
  decoration_config:
    gcs_configuration:
      bucket: origin-ci-private
      job_url_prefix: https://deck-internal-ci.apps.ci.l2s4.p1.openshiftapps.com/view/
      mediaTypes:
        log: text/plain
    gcs_credentials_secret: gce-sa-credentials-gcs-private
    oauth_token_secret:
      key: oauth
      name: github-credentials-openshift-ci-robot-private-git-cloner
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
    workdir: true
  - base_ref: master
    org: openshift
    repo: config
  hidden: true
  labels:
    ci.openshift.io/role: infra-internal
  name: periodic-github-ldap-user-group-creator
  spec:
    containers:
    - args:
      - -c
      - |
        set -o errexit
        set -o nounset
        set -o pipefail
        tar -C /tmp -xvzf /etc/sync-rover-groups/users.yaml.tar.gz
        /usr/bin/github-ldap-user-group-creator \
        --kubeconfig-dir=/tmp/build-farm-credentials \
        --kubeconfig-suffix=config \
        --groups-file=/etc/sync-rover-groups/groups.yaml \
        --config-file=./core-services/sync-rover-groups/_config.yaml \
        --github-users-file=/tmp/users.yaml \
        --gcp-credentials-file=/etc/gcp-credentials/openshift-gce-devel-ci-infra-users-to-bigquery.json \
        --peribolos-config=../config/org/config.yaml \
        --log-level=debug \
        --delete-invalid-users \
        --skip-ocp-priv-admin=RH-Cachito \
        --skip-ocp-priv-admin=openshift-bot \
        --skip-ocp-priv-admin=openshift-ci-robot \
        --skip-ocp-priv-admin=openshift-merge-robot \
        --skip-ocp-priv-admin=openshift-cherrypick-robot \
        --skip-ocp-priv-admin=openshift-art-build-bot \
        --dry-run=false
      command:
      - /bin/bash
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_github-ldap-user-group-creator_latest
      imagePullPolicy: Always
      name: github-ldap-user-group-creator
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/sync-rover-groups
        name: sync-rover-groups
      - mountPath: /tmp/build-farm-credentials
        name: build-farm-credentials
        readOnly: true
      - mountPath: /etc/gcp-credentials
        name: gcp-credentials
        readOnly: true
    serviceAccountName: github-ldap-user-group-creator
    volumes:
    - configMap:
        name: sync-rover-groups
      name: sync-rover-groups
    - name: build-farm-credentials
      secret:
        secretName: github-ldap-user-group-creator
    - name: gcp-credentials
      secret:
        secretName: openshift-gce-devel-ci-infra-users-to-bigquery-credentials
- agent: kubernetes
  annotations:
    ci.openshift.io/description: This runs the check-gh-automation tool to verify
      that all repos with CI configured are accessible by test-platform's bots
    ci.openshift.io/sop: https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/infrastructure-jobs.md#periodic-check-gh-automation
  cluster: app.ci
  cron: 0 3 * * 1
  decorate: true
  decoration_config:
    timeout: 6h0m0s
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
    workdir: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-check-gh-automation
  spec:
    containers:
    - args:
      - --config-path=./core-services/prow/02_config/_config.yaml
      - --supplemental-prow-config-dir=./core-services/prow/02_config
      - --plugin-config=./core-services/prow/02_config/_plugins.yaml
      - --supplemental-plugin-config-dir=./core-services/prow/02_config
      - --job-config-path=./ci-operator/jobs
      - --github-app-id=$(GITHUB_APP_ID)
      - --github-app-private-key-path=/etc/github/cert
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-hourly-tokens=600
      - --github-allowed-burst=600
      - --app=openshift-ci
      - --app-check-mode=standard
      - --bot=openshift-merge-robot
      - --bot=openshift-ci-robot
      - --check-branch-protection=false
      - --ignore=Azure/ARO-HCP
      - --ignore=openshift
      - --ignore=openshift-priv
      - --ignore=kata-containers/kata-containers
      - --ignore=containers/gvisor-tap-vsock
      - --ignore=containers/podman-py
      - --ignore=red-hat-storage/mcg-osd-deployer
      - --ignore=CSPI-QE
      - --ignore=redhat-openshift-ecosystem/certified-operators-prod
      - --ignore=redhat-openshift-ecosystem/preflight
      - --ignore=insights-qe/iqe-cost-management-plugin
      - --ignore=ansible/tower-qa
      - --ignore=rh-openjdk/jdkContainerOcpTests
      - --ignore=ran-telco5g/kpi-results
      - --ignore=jws-qe/interop-ocp-ci
      - --ignore=openshift-logging/extended-logging-tests-interop
      - --ignore=Azure/ARO-HCP
      command:
      - ./hack/check-gh-automation.sh
      env:
      - name: GITHUB_APP_ID
        valueFrom:
          secretKeyRef:
            key: appid
            name: openshift-prow-github-app
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_check-gh-automation_latest
      imagePullPolicy: Always
      name: check-gh-automation
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: github-app-credentials
        readOnly: true
    volumes:
    - name: github-app-credentials
      secret:
        secretName: openshift-prow-github-app
- agent: kubernetes
  annotations:
    ci.openshift.io/description: This runs the check-gh-automation tool to verify
      that all repos with tide configured allow access to openshift-merge-bot
    ci.openshift.io/sop: https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/infrastructure-jobs.md#periodic-check-gh-automation
  cluster: app.ci
  cron: 0 3 * * 2
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
    workdir: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-check-gh-automation-tide
  spec:
    containers:
    - args:
      - --config-path=./core-services/prow/02_config/_config.yaml
      - --supplemental-prow-config-dir=./core-services/prow/02_config
      - --job-config-path=./ci-operator/jobs
      - --github-app-id=$(GITHUB_APP_ID)
      - --github-app-private-key-path=/etc/github/cert
      - --github-endpoint=http://ghproxy
      - --github-endpoint=https://api.github.com
      - --github-hourly-tokens=600
      - --github-allowed-burst=600
      - --app=openshift-merge-bot
      - --app-check-mode=tide
      - --check-branch-protection=false
      - --ignore=openshift
      - --ignore=openshift-priv
      - --ignore=kata-containers/kata-containers
      - --ignore=containers/gvisor-tap-vsock
      - --ignore=containers/podman-py
      - --ignore=red-hat-storage/mcg-osd-deployer
      - --ignore=CSPI-QE
      - --ignore=redhat-openshift-ecosystem/certified-operators-prod
      - --ignore=redhat-openshift-ecosystem/preflight
      - --ignore=insights-qe/iqe-cost-management-plugin
      - --ignore=ansible/tower-qa
      - --ignore=rh-openjdk/jdkContainerOcpTests
      - --ignore=jws-qe/interop-ocp-ci
      - --ignore=red-hat-storage/rook
      - --ignore=Azure/ARO-HCP
      command:
      - ./hack/check-gh-automation.sh
      env:
      - name: GITHUB_APP_ID
        valueFrom:
          secretKeyRef:
            key: appid
            name: openshift-merge-bot
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_check-gh-automation_latest
      imagePullPolicy: Always
      name: check-gh-automation
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: github-app-credentials
        readOnly: true
    volumes:
    - name: github-app-credentials
      secret:
        secretName: openshift-merge-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 10,22 * * *
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  - base_ref: main
    org: openshift
    repo: sippy
    workdir: true
  labels:
    ci.openshift.io/role: infra
  name: periodic-prow-auto-sippy-config-generator
  spec:
    containers:
    - args:
      - -c
      - |
        set -o errexit
        set -o nounset
        set -o pipefail
        # Generate Sippy Configuration
        /usr/bin/sippy-config-generator \
          --prow-jobs-dir ../release/ci-operator/jobs \
          --release-config ../release/core-services/release-controller/_releases \
          --customization-file ./config/openshift-customizations.yaml > ./config/openshift.yaml.new


        # Compare everything but the header of the file to see if they're identical
        diff <(tail -n +2 ./config/openshift.yaml.new) <(tail -n +2 ./config/openshift.yaml) 2>&1 > /dev/null && \
        echo "Files are identical, no update needed." && \
        exit 0

        mv ./config/openshift.yaml.new ./config/openshift.yaml
        make update-variants

        # Initiate prcreator to open a PR against sippy
        /usr/bin/prcreator \
        -github-token-path=/etc/github/oauth \
        -organization=openshift -repo=sippy -branch=main \
        -pr-title="Automated - Update config ./config/openshift.yaml"
      command:
      - /bin/bash
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_auto-sippy-config-generator_latest
      imagePullPolicy: Always
      name: auto-sippy-config-generator
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
- agent: kubernetes
  cluster: app.ci
  cron: 0 1 * * 5
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: origin
  labels:
    ci.openshift.io/role: infra
  name: periodic-update-origin-disruption-alert-data
  reporter_config:
    slack:
      channel: '#trt-alert'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed. See https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-update-origin-disruption-alert-data/{{.Status.BuildID}}
        for details. This job runs weekly to sync latest observed percentiles into
        origin to use in testing. All failures of this job should be investigated.
  spec:
    containers:
    - args:
      - -c
      - |
        set -o errexit
        set -o nounset
        set -o pipefail

        leeway_percent=30

        echo "Updating disruptions data"
        /usr/bin/job-run-aggregator analyze-historical-data \
        --current ./pkg/monitortestlibrary/allowedbackenddisruption/query_results.json \
        --output-file ./pkg/monitortestlibrary/allowedbackenddisruption/query_results.json \
        --data-type disruptions \
        --leeway $leeway_percent \
        --google-service-account-credential-file /etc/bigquery/token

        echo "Updating alerts data"
        /usr/bin/job-run-aggregator analyze-historical-data \
        --current ./pkg/monitortestlibrary/allowedalerts/query_results.json \
        --output-file ./pkg/monitortestlibrary/allowedalerts/query_results.json \
        --data-type alerts \
        --leeway $leeway_percent \
        --google-service-account-credential-file /etc/bigquery/token

        echo "Updating tests data"
        /usr/bin/job-run-aggregator analyze-historical-data \
        --output-file ./pkg/test/ginkgo/test_summaries.json \
        --data-type tests \
        --google-service-account-credential-file /etc/bigquery/token

        mv pr_message.md /var/tmp/

        extra_flag=""
        if [ -f "require_review" ]; then
            echo "review required"
            cat require_review
            extra_flag="-pr-assignee xueqzhan,neisw,smg247"
            rm require_review
        else
            echo "review not required"
            # off for now
            # extra_flag="-self-approve"
        fi

        /usr/bin/prcreator \
        -github-token-path=/etc/github/oauth \
        -organization=openshift \
        -repo=origin \
        -branch=main \
        -git-message="Updated synthetic tests" \
        -pr-message "$(cat /var/tmp/pr_message.md)" \
        -pr-title="NO-ISSUE: Automated - Update synthetic test data" \
        $extra_flag
      command:
      - /bin/bash
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_job-run-aggregator_latest
      imagePullPolicy: Always
      name: job-run-aggregator
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/github
        name: token
        readOnly: true
      - mountPath: /etc/bigquery
        name: bg-token
        readOnly: true
    volumes:
    - name: token
      secret:
        secretName: github-credentials-openshift-bot
    - name: bg-token
      secret:
        secretName: ci-data-bigquery-readonly
- agent: kubernetes
  cluster: app.ci
  cron: '@daily'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  name: periodic-openshift-release-image-graph-generator
  spec:
    containers:
    - args:
      - --release-repo=./
      - --graphql-endpoint-address=http://dgraph-public:8080/graphql
      command:
      - image-graph-generator
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_image-graph-generator_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
- agent: kubernetes
  cluster: app.ci
  cron: '@daily'
  decorate: true
  decoration_config:
    timeout: 12h0m0s
  name: periodic-openshift-release-qci-pruner
  reporter_config:
    slack:
      channel: '#ops-testplatform'
      job_states_to_report:
      - failure
      report_template: Job {{.Spec.Job}} failed. <https://github.com/openshift/release/blob/main/docs/dptp-triage-sop/qci-pruner-timeout.md|SOP>
  spec:
    containers:
    - args:
      - --confirm
      command:
      - ./qci_registry_pruner.py
      env:
      - name: QUAY_OAUTH_TOKEN
        valueFrom:
          secretKeyRef:
            key: token
            name: qci-pruner-credentials
      - name: QUAY_DOCKERCONFIGJSON_PATH
        value: /etc/push/.dockerconfigjson
      image: quay-proxy.ci.openshift.org/openshift/ci:ci_qci-pruner_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 500m
      volumeMounts:
      - mountPath: /etc/push
        name: registry-push-credentials
        readOnly: true
    volumes:
    - name: registry-push-credentials
      secret:
        secretName: registry-push-credentials-ci-images-mirror
- agent: kubernetes
  cluster: build10
  cron: '@daily'
  decorate: true
  extra_refs:
  - base_ref: main
    org: openshift
    repo: release
  labels:
    ci-operator.openshift.io/cluster: build10
    ci.openshift.io/role: infra
  name: periodic-trigger-mabc-images
  spec:
    containers:
    - command:
      - hack/manage_mabc_builds.sh
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_cli-jq_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 100m
    nodeSelector:
      kubernetes.io/arch: amd64
    serviceAccountName: mabc-updater
- agent: kubernetes
  cluster: build02
  cron: '@yearly'
  decorate: true
  labels:
    ci-operator.openshift.io/cluster: build02
  name: periodic-etcd-defragger
  spec:
    containers:
    - args:
      - -c
      - |
        #!/bin/bash
        set -euox pipefail

        # Inspired by:
        # https://github.com/openshift/cluster-etcd-operator/blob/fd67e610d5b01b8326a10bb92286877130dc1451/pkg/operator/defragcontroller/defragcontroller.go

        FRAGMENTATION_RATIO_THRESHOLD=45
        DB_SIZE_THRESHOLD=$((100 * 1024 * 1024)) # 100MB

        # Get a pod to issue queries against
        etcd_pod=$(head -1 <(oc -n openshift-etcd get pods -letcd -oname))

        # endpoint_statuses JSON schema:
        #
        # [
        #   {
        #     "Endpoint": "https://10.0.0.3:2379",
        #     "Status": {
        #       "header": {
        #         "member_id": 14942490142531888693,
        #         "revision": 437385818,,
        #         ...
        #       },
        #       "leader": 11239076790641432752,
        #       "dbSize": 2851442688,
        #       "dbSizeInUse": 1183555584
        #       ...
        #     }
        #   }
        # ]
        endpoint_statuses=$(oc -n openshift-etcd exec "$etcd_pod" -- etcdctl endpoint status --cluster -w json)

        # Transform endpoint_statuses into:
        #
        # [
        #   {
        #     "ep": "https://10.0.0.3:2379",
        #     "lead": 0,                        <- whether is leader or not
        #     "ratio": 60,                      <- fragmentation ratio
        #     "size": 2851442688                <- db size in bytes
        #   }
        # ]
        endpoints_info=$(jq '[.[]|{ep: (.Endpoint), lead: (if .Status.leader==.Status.header.member_id then 1 else 0 end), ratio: ((.Status.dbSize-.Status.dbSizeInUse)/.Status.dbSize*100|round), size: (.Status.dbSize)}]' <<<"$endpoint_statuses")
        printf "endpoints info:\n$endpoints_info\n\n"

        # Create "etcd_host to related_podname" map:
        # { "10.0.0.5": "etcd_pod_name", ... }
        declare -A etcd_pods
        for etcd_pod in $(oc -n openshift-etcd get pods -letcd -ojson | jq -r '.items[]|.metadata.name + "|" + .status.podIP'); do
            name="$(cut -d'|' -f1 <<<"$etcd_pod")"
            ip="$(cut -d'|' -f2 <<<"$etcd_pod")"
            etcd_pods["$ip"]="$name"
        done

        compacted=0
        force="${FORCE:-0}"  # set to 1 to force defrag regardless of fragmentation ratio and db size
        # Defragment an endpoint only if needed, leader must be the last one
        for endpoint_info in $(jq -r 'sort_by(.lead)[]| .ep + "|" + (.ratio|tostring) + "|" + (.size|tostring)' <<<"$endpoints_info"); do
            printf '\n***\n'
            # Skip if this endpoint is not fragmented
            fragmentation_ratio=$(cut -d'|' -f2 <<<"$endpoint_info")
            dbsize=$(cut -d'|' -f3 <<<"$endpoint_info")
            if [[ $force -eq 0 ]]; then
                if [[ $fragmentation_ratio -lt $FRAGMENTATION_RATIO_THRESHOLD && $dbsize -lt $DB_SIZE_THRESHOLD ]]; then
                    echo "endpoint $endpoint_info is not fragmented, skipping."
                    continue
                fi
            fi

            ip=$(cut -d' ' -f1 <<<"$endpoint_info" | sed 's|https://||g' | cut -d':' -f1)
            pod_name="${etcd_pods[$ip]}"

            # Comact only once per run
            if [[ $compacted -eq 0 ]]; then
                echo "Compacting $pod_name - $ip"
                oc -n openshift-etcd exec pod/"$pod_name" -- sh -c 'unset ETCDCTL_ENDPOINTS;
                rev=$(ETCDCTL_API=3 etcdctl --insecure-skip-tls-verify=true --endpoints=:2379 endpoint status --write-out="json" | jq ".[0].Status.header.revision");
                ETCDCTL_API=3 etcdctl compact $rev;'
                compacted=1
            fi

            # Defragment
            echo "Defragmenting $pod_name - $ip"
            oc -n openshift-etcd exec pod/"$pod_name" -- sh -c 'unset ETCDCTL_ENDPOINTS;
            etcdctl --command-timeout=30s --endpoints=https://localhost:2379 defrag;
            etcdctl endpoint status -w table --cluster;'

            # Wait for the etcd cluster to become healthy
            for i in $(seq 1 20); do
                if [[ $(oc -n openshift-etcd exec pod/"$pod_name" -- etcdctl endpoint --cluster health | grep -ic healthy ) -eq 3 ]]; then
                    break
                fi
                echo "Cluster is not healthy yet. Waiting 6s ($i/20)"
                sleep 6s
            done
        done
      command:
      - /bin/bash
      env:
      - name: FORCE
        value: "0"
      image: quay-proxy.ci.openshift.org/openshift/ci:ocp_cli-jq_latest
      imagePullPolicy: Always
      name: ""
      resources:
        requests:
          cpu: 100m
    serviceAccountName: etcd-defragger