Skip to content

HyperShift Operator Konflux Release Gating

The HyperShift Operator (HO) uses a Konflux-based release gating pipeline to validate nightly builds before promoting them to downstream consumers. A nightly CronJob selects the latest Snapshot, triggers Prow-hosted E2E tests against it, and only promotes the image when all blocking tests pass.

Prerequisites

The following access is required to operate on the HO release gate pipeline:

  • Access to the stone-prd-rh01 cluster (login via OpenShift console > username > "Copy login command")
  • Contributor access to the crt-redhat-acm-tenant namespace (RoleBinding required to operate on pipeline resources)
  • Access to the konflux-release-data GitLab repo (required for opening MRs to modify ITS, RBAC, ReleasePlan, etc.)

If any of these are missing, request them in #forum-ocp-hypershift specifying what you need and why.

Additionally:

  • oc CLI installed
  • Red Hat VPN active (required for gitlab.cee.redhat.com links)
  • jq installed (for troubleshooting commands only)

How It Works

Every night, a CronJob triggers a new HO build in Konflux. Once the build completes and a Snapshot is created, the Integration Service evaluates an IntegrationTestScenario (ITS) that launches the release gating pipeline. The pipeline:

  1. Extracts the HO container image from the Snapshot
  2. Triggers blocking and informing E2E tests via Gangway (Prow CI)
  3. Evaluates the test results against the gate criteria
  4. Creates a Release CR if the gate passes, which triggers image promotion
  5. Sends a Slack notification with the outcome
  6. Checks for stale promotion (consecutive days of gate failures) and sends a dedicated alert if the threshold is exceeded

Documentation Pages

Page Description
Release Strategy Why release gating exists, blocking vs informing tests, gate verdict logic, stale promotion alerting
Architecture End-to-end flow, RBAC, Tekton pipeline internals, integration points
Adding E2E Tests How to add, remove, or reclassify E2E tests in the gate
Extending to Other Services How to set up release gating for a new managed service
Operations and Troubleshooting Manual triggers, inspecting runs, common failure scenarios