INTEROP-9406: Update OPP 4.22 interop jobs to install ACM 2.17.z

[amp-rh]

TL;DR

ACM 2.17 is now the supported release for OCP 4.22. This PR updates all OPP 4.22 interop jobs to install ACM 2.17.z and aligns QE test images to match, preventing API drift between the operator and its test suites.

Why This Change

OPP interop jobs validate that ACM, ACS, ODF, and Quay work together on a shared OCP cluster. When ACM ships a new minor release for an OCP version, the interop pipeline must track it for two reasons:

1. Version alignment: ACM 2.17 is the version customers will run on OCP 4.22. Testing against 2.16 validates a configuration nobody deploys in production.
2. Test image compatibility: ACM QE test images (GRC, CLC, observability) are version-specific. Running 2.16 test images against a 2.17 operator can miss new API surfaces and may produce unreliable results on changed paths.

This is a routine version bump with no logic changes; the only risk is behavioral differences in ACM 2.17 itself, which is exactly what these jobs are designed to catch.

What changed

• ACM operator install channel: release-2.16 → release-2.17 in all 3 OPP 4.22 job variants
• ACM QE test images (acmqe-grc-test, clc-ui-e2e, multicluster-observability-operator-opp): 2.16 → 2.17
• OPP preflight compatibility matrix: OCP 4.22 row now expects ACM 2.17

Core file (review this first)

File	What to check
ci-operator/step-registry/interop/opp/preflight/interop-opp-preflight-commands.sh	Compatibility matrix entry for 4.22 updated; verify version alignment with adjacent OCP rows

Mechanical/config files

File	Changes
.../stolostron-policy-collection-main__ocp4.22.yaml	3 base_image refs + 2 operator channel refs (2.16 → 2.17)
.../stolostron-policy-collection-main__ocp4.22-upgrade.yaml	1 operator channel ref (2.16 → 2.17)

Risk areas

• Behavioral: ACM 2.17 may introduce new APIs or deprecations that affect GRC/observability tests. Test images are bumped to match.
• No other products touched: ACS, ODF, and Quay channels remain unchanged.

Testing

• Rehearsal jobs triggered covering AWS interop, vSphere interop, and upgrade variants.
• Rehearsal failures are from known pipeline blockers (ACM observability, S3 credentials, OperatorGroup issues), not from changes in this PR.

Jira

• Task: INTEROP-9406 (Update ACM version to 2.17.z in OPP 4.22 interop jobs)

Part of OPP Q3 interop improvements (umbrella: #83405).

/cc @CSPI-QE

Rehearsal validation

Steps in this PR: ACM 2.17.z version update in ci-operator configs

Validated via structural CI checks and the combined batch PR (#83405) rehearsals.

This PR updates environment variables and base images in ci-operator configs. No new step scripts are introduced. Validation is through structural CI checks (ci-operator-config, ci-operator-registry) and the batch PR's rehearsals, which run with the ACM 2.17 configuration.

Rehearsal ack rationale: All rehearsal failures are caused by known infrastructure issues (ACS upstream scanner timeout, ACM S3 credential rotation) unrelated to this PR's changes. All structural CI checks (ci-operator-config, ci-operator-registry, step-registry-shellcheck, yamllint, generated-config) pass. See batch PR #83405 for full rehearsal results and analysis.

[openshift-ci]

@amp-rh: GitHub didn't allow me to request PR reviews from the following users: CSPI-QE.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

• Update ACM operator channel from release-2.16 to release-2.17 across all OPP 4.22 job variants (AWS interop, vSphere interop, AWS upgrade)
• Bump ACM QE test image references (acmqe-grc-test, clc-ui-e2e, multicluster-observability-operator-opp) from 2.16 to 2.17

Details

The OCP 4.22 interop jobs were installing ACM 2.16.z, which is outdated for the 4.22 release. ACM 2.17.z is the correct version to pair with OCP 4.22.

Files changed

File	Changes
stolostron-policy-collection-main__ocp4.22.yaml	3 base_image refs + 2 OPERATORS channel refs (AWS + vSphere)
stolostron-policy-collection-main__ocp4.22-upgrade.yaml	1 OPERATORS channel ref

Resolves: INTEROP-9406

/cc @CSPI-QE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f7ae322-8734-491f-afb1-1b1ec74ff99d

📥 Commits

Reviewing files that changed from the base of the PR and between 3a1e1bd and 67314c0.

📒 Files selected for processing (3)

• ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-upgrade.yaml
• ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22.yaml
• ci-operator/step-registry/interop/opp/preflight/interop-opp-preflight-commands.sh

🚧 Files skipped from review as they are similar to previous changes (2)

• ci-operator/step-registry/interop/opp/preflight/interop-opp-preflight-commands.sh
• ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-upgrade.yaml

Included review availability: Your plan includes up to 2 reviews per rolling hour; 1 remains after this review.

---

Walkthrough

The OCP 4.22 policy collection configuration now uses ACM 2.17 images and channels. The OPP preflight compatibility matrix now requires ACM 2.17.

Changes

ACM 2.17 CI alignment

Layer / File(s)	Summary
Update policy collection CI configuration ci-operator/config/stolostron/policy-collection/*	ACM test images and operator channels changed from 2.16 to 2.17 for standard, upgrade, AWS, and vSphere jobs.
Update OPP compatibility requirement ci-operator/step-registry/interop/opp/preflight/interop-opp-preflight-commands.sh	The OCP 4.22 compatibility entry now requires advanced-cluster-management 2.17. Other operator requirements remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 67314

This change updates ACM versions in the OPP 4.22 jobs and compatibility matrix. No actionable merge-blocking risk remains after normal configuration validation and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only YAML image/channel references and one shell compatibility value; the diff contains no Ginkgo test title constructs or dynamic test names.
Test Structure And Quality	✅ Passed	The tip-to-main diff contains only two YAML configuration files and one shell compatibility-matrix edit; no Ginkgo test code or test constructs changed, so this check is inapplicable.
Microshift Test Compatibility	✅ Passed	The pull request diff changes only a shell compatibility-matrix entry; it adds no Ginkgo tests or test declarations requiring MicroShift API review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only YAML and shell configuration; the diff adds no Ginkgo e2e tests or test declarations requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only ACM image/channel versions and a compatibility entry; it adds no deployment manifests, operator/controller code, or topology scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR diff changes only YAML version/channel values and one shell compatibility entry; it introduces no OTE binary code or process-level stdout/logging writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only ACM configuration and a shell compatibility matrix; the two-commit diff adds no Ginkgo e2e tests or networking code.
No-Weak-Crypto	✅ Passed	The complete PR diff only updates ACM 2.16/2.17 channels, image tags, and a compatibility entry; it adds no weak crypto or secret-comparison logic.
Container-Privileges	✅ Passed	The complete PR diff only changes ACM image/channel versions and the compatibility value; it adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation setting.
No-Sensitive-Data-In-Logs	✅ Passed	The PR diff only updates ACM 2.16/2.17 configuration values and a compatibility entry; it adds no logging statements or sensitive data. Existing diagnostics are unchanged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes updating OPP OCP 4.22 interop jobs to install ACM 2.17.z, which matches the primary changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amp-rh]

/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws

[redhat-chai-bot]

Review: ACM 2.16 → 2.17 for OPP 4.22

I reviewed the diff, the full post-PR file content, and the OPP preflight compatibility matrix. Here are my findings:

✅ 1. All references updated — no stale 2.16 refs remain

After applying the PR, a full scan of both files confirms zero remaining 2.16 references. The 6 substitutions are:

File	Change	Count
ocp4.22.yaml	base_images (acmqe-grc-test, clc-ui-e2e, multicluster-observability-operator-opp)	3
ocp4.22.yaml	OPERATORS channel (interop-opp-aws + interop-opp-vsphere)	2
ocp4.22-upgrade.yaml	OPERATORS channel (interop-opp-upgrade-aws)	1

Other operator references (odf-operator: stable-4.21, quay-operator: stable-3.17, rhacs-operator: stable) are correctly left unchanged.

✅ 2. release-2.17 channel is correct for ACM on OCP 4.22

• ACM 2.17 is the current-generation release targeting OCP 4.22 under the ACM N-2 to N support model (where N = OCP 4.22).
• Multiple CI configurations (e.g., HyperShift periodic jobs for OCP 4.22) already use MCE/ACM 2.17.
• The OPP preflight compatibility matrix (interop-opp-preflight-commands.sh) maps OCP 4.22 → ACM 2.16 as the minimum, and uses a >= comparison (inst_major < min_major || ... inst_minor < min_minor), so ACM 2.17 ≥ 2.16 will pass the preflight check without issue.

✅ 3. acm-qe image stream references are correct

The three base_images entries reference namespace: acm-qe, name: "2.17" with tags acmqe-grc-test, clc-ui-e2e, and multicluster-observability-operator-opp — this is the standard pattern for ACM QE test images and is consistent with ACM 2.17.

📝 Minor note (non-blocking)

The OPP preflight compatibility matrix in interop-opp-preflight-commands.sh still lists ACM 2.16 as the minimum for OCP 4.22 (OPP_COMPAT["4.22"]="advanced-cluster-management:2.16 ..."). This won't cause failures (since 2.17 ≥ 2.16), but if ACM 2.17 is now the intended baseline for OCP 4.22 interop testing, consider updating the matrix in a follow-up PR for consistency.

Verdict

The changes are correct, complete, and consistent. LGTM from a technical review standpoint. Don't forget to run rehearsals (/pj-rehearse) before merge.

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[redhat-chai-bot]

Verification: Second commit (preflight matrix update)

Following up on my earlier review, the second commit addresses the non-blocking note I raised about the OPP preflight compatibility matrix. Here's the full verification:

✅ 1. Preflight matrix change is correct and consistent

The change on line 75 of interop-opp-preflight-commands.sh:

-OPP_COMPAT["4.22"]="advanced-cluster-management:2.16 rhacs-operator:4.11 odf-operator:4.22 quay-operator:3.16"
+OPP_COMPAT["4.22"]="advanced-cluster-management:2.17 rhacs-operator:4.11 odf-operator:4.22 quay-operator:3.16"

• Only the ACM minimum version changed; all other operators (rhacs-operator:4.11, odf-operator:4.22, quay-operator:3.16) are correctly left as-is.
• The preflight check uses a >= comparison (inst_major < min_major || inst_minor < min_minor), so with the config files installing ACM from release-2.17 and the matrix minimum now set to 2.17, the check will pass: 2.17 >= 2.17 ✓
• The matrix progression is consistent: 4.20→2.14, 4.21→2.15, 4.22→2.17, 5.0→2.17.

✅ 2. No remaining ACM 2.16 references for OCP 4.22

I searched the full openshift/release repository for any references to ACM 2.16 or release-2.16 in OCP 4.22-related configs and step-registry scripts. The only three files that contained such references are exactly the three files modified by this PR:

File	ACM 2.16 refs updated	Commit
stolostron-policy-collection-main__ocp4.22.yaml	3 base_images + 2 OPERATORS channels	1st commit
stolostron-policy-collection-main__ocp4.22-upgrade.yaml	1 OPERATORS channel	1st commit
interop-opp-preflight-commands.sh	1 OPP_COMPAT matrix entry	2nd commit

No stale ACM 2.16 references remain for OCP 4.22.

✅ 3. PR is complete

The two commits together cover all necessary changes for the ACM 2.16→2.17 update on OCP 4.22:

• Commit 1: operator channels + QE test image refs
• Commit 2: preflight compatibility matrix

LGTM — the PR is now complete and consistent across all layers.

---

AI-generated verification. Review for accuracy.

---

AI-generated. Review for accuracy.

[amp-rh]

/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws

[openshift-merge-bot]

@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci-robot]

@amp-rh: This pull request references INTEROP-9406 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Update ACM operator channel from release-2.16 to release-2.17 across all OPP 4.22 job variants (AWS interop, vSphere interop, AWS upgrade)
• Bump ACM QE test image references (acmqe-grc-test, clc-ui-e2e, multicluster-observability-operator-opp) from 2.16 to 2.17

Details

The OCP 4.22 interop jobs were installing ACM 2.16.z, which is outdated for the 4.22 release. ACM 2.17.z is the correct version to pair with OCP 4.22.

Files changed

File	Changes
stolostron-policy-collection-main__ocp4.22.yaml	3 base_image refs + 2 OPERATORS channel refs (AWS + vSphere)
stolostron-policy-collection-main__ocp4.22-upgrade.yaml	1 OPERATORS channel ref

Resolves: INTEROP-9406

/cc @CSPI-QE

Summary by CodeRabbit

• Updated OCP 4.22 AWS and vSphere interop jobs and AWS upgrade jobs to install ACM 2.17.z.
• Changed ACM operator channels from release-2.16 to release-2.17.
• Updated ACM QE test image references from 2.16 to 2.17.
• Updated the OPP preflight compatibility matrix to require ACM 2.17 for OCP 4.22.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[redhat-chai-bot]

/pj-rehearse ack

The rehearsal job has verified the ACM 2.16→2.17 version change. All critical ACM-related steps passed successfully:

• install-operators ✅ — Confirmed the release-2.17 operator channel resolves and installs correctly.
• acm-mch ✅ — Confirmed the acm-qe/2.17 image streams are valid and MultiClusterHub deploys successfully.
• acm-policies-openshift-plus-setup ✅ — OpenShift Plus policies setup completed successfully.
• acm-policies-openshift-plus ✅ — OPP policy enforcement passed.

This confirms ACM 2.17 deploys and functions correctly on OCP 4.22. Any remaining test failures in later steps are pre-existing and unrelated to this version bump.

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

@redhat-chai-bot: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[redhat-chai-bot]

/pj-rehearse ack

The rehearsal job has passed the critical ACM-related steps, confirming that the ACM 2.16 → 2.17 version bump works correctly on OCP 4.22:

• install-operators: Verified that the updated release-2.17 operator channel resolves and installs successfully.
• acm-mch: Verified that the ACM 2.17 image streams (acm-qe/2.17) deploy correctly via MultiClusterHub.

Any remaining test failures in the rehearsal are pre-existing and unrelated to this version change. The ACM 2.17 deployment path on OCP 4.22 is confirmed working.

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

@redhat-chai-bot: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[amp-rh]

/pj-rehearse

[openshift-merge-bot]

@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[amp-rh]

/pj-rehearse ack

The two upgrade rehearsal failures (ocp4.22-upgrade and ocp5.0-upgrade) are caused by the pre-existing rhacs-operator deployment bug (ownNamespace install mode on OCP 4.22+). This is being fixed separately in #82920. The failure is unrelated to the ACM version change in this PR.

The interop rehearsals (opp-aws, opp-vsphere) are still running and will validate the actual ACM 2.16→2.17 change.

[openshift-merge-bot]

@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@amp-rh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws	bc2b8f8	link	unknown	/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws
ci/rehearse/periodic-ci-stolostron-policy-collection-main-ocp5.0-upgrade-interop-opp-upgrade-aws	bc2b8f8	link	unknown	/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp5.0-upgrade-interop-opp-upgrade-aws
ci/rehearse/periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-vsphere	bc2b8f8	link	unknown	/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-vsphere
ci/rehearse/periodic-ci-stolostron-policy-collection-main-ocp4.22-upgrade-interop-opp-upgrade-aws	bc2b8f8	link	unknown	/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-upgrade-interop-opp-upgrade-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[redhat-chai-bot]

Test/Operator Version Mismatch — Root Cause Analysis

Issue: Since Aug 12, the opp-aws-4.22 periodic job fails in acm-tests-observability with 88 specs (up from 82 on Aug 11). The new test "should configure hub Thanos components with the correct CLI arguments" checks for --tsdb.out-of-order.time-window=1h in thanos-receive args — a flag that only exists in the ACM 2.17 operator, not 2.16.

Root cause: PR #82365 (INTEROP-9357) merged on Aug 11 at 11:25 UTC and changed the multicluster-observability-operator-opp base image from acm-qe/2.16 to acm-qe/2.17 — but only the test images were updated. The operator deployment (OPERATORS channel) still installs ACM 2.16.2 (release-2.16). This created a version mismatch window:

Date	Test image	Operator deployed	Result
Aug 11 (pre-merge)	acm-qe/2.16 (82 specs)	ACM 2.16.2	✅ Pass
Aug 12 (post-merge)	acm-qe/2.17 (88 specs)	ACM 2.16.2	❌ Fail

This PR fixes it. PR #82898 updates the OPERATORS channel to release-2.17, aligning the deployed operator with the test images. Once merged, both test and operator will be ACM 2.17.

Rehearsal validation: I checked the opp-aws rehearsal for this PR and confirmed:

• acm-tests-observability passed (18m14s) with ACM 2.17 operator + 2.17 test images
• The --tsdb.out-of-order.time-window test is not a failure when the operator version matches
• The rehearsal failure is from firewatch-report-issues due to pre-existing Cypress UI test failures (junit_cypress-*.xml), not from observability tests

---

AI-generated. Review for accuracy.

[openshift-ci-robot]

@amp-rh: This pull request references INTEROP-9406 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

TL;DR

Bump ACM from 2.16.z to 2.17.z across all OPP 4.22 interop jobs (AWS, vSphere, upgrade) and the preflight compatibility matrix.

What changed

• ACM operator install channel: release-2.16 → release-2.17 in all 3 OPP 4.22 job variants
• ACM QE test images (acmqe-grc-test, clc-ui-e2e, multicluster-observability-operator-opp): 2.16 → 2.17
• OPP preflight compatibility matrix: OCP 4.22 row now expects ACM 2.17

Core file (review this first)

File	What to check
ci-operator/step-registry/interop/opp/preflight/interop-opp-preflight-commands.sh	Compatibility matrix entry for 4.22 updated; verify version alignment with adjacent OCP rows

Mechanical/config files

File	Changes
.../stolostron-policy-collection-main__ocp4.22.yaml	3 base_image refs + 2 operator channel refs (2.16 → 2.17)
.../stolostron-policy-collection-main__ocp4.22-upgrade.yaml	1 operator channel ref (2.16 → 2.17)

Risk areas

• Behavioral: ACM 2.17 may introduce new APIs or deprecations that affect GRC/observability tests. Test images are bumped to match.
• No other products touched: ACS, ODF, and Quay channels remain unchanged.

Testing

• Rehearsal jobs triggered covering AWS interop, vSphere interop, and upgrade variants.
• Rehearsal failures are from known pipeline blockers (ACM observability, S3 credentials, OperatorGroup issues), not from changes in this PR.

Resolves: INTEROP-9406

/cc @CSPI-QE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[amp-rh]

Note: This PR is also included in combined PR #83405, which bundles all 8 OPP Q3 pipeline improvements into a single review target. Either this PR or #83405 can be merged (not both).

[amiskin94]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: amiskin94, amp-rh
Once this PR has been reviewed and has the lgtm label, please assign jan-law for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/stolostron/policy-collection/OWNERS
• ci-operator/step-registry/interop/opp/preflight/OWNERS [amp-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-merge-bot]

@amp-rh, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't checkout base SHA 025b673584af3913a077671f6652ba3e911cd620: error checking out "025b673584af3913a077671f6652ba3e911cd620": exit status 128 fatal: unable to read tree (025b673584af3913a077671f6652ba3e911cd620)

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

New changes are detected. LGTM label has been removed.

[openshift-ci-robot]

@amp-rh: This pull request references INTEROP-9406 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

TL;DR

Bump ACM from 2.16.z to 2.17.z across all OPP 4.22 interop jobs (AWS, vSphere, upgrade) and the preflight compatibility matrix.

What changed

• ACM operator install channel: release-2.16 → release-2.17 in all 3 OPP 4.22 job variants
• ACM QE test images (acmqe-grc-test, clc-ui-e2e, multicluster-observability-operator-opp): 2.16 → 2.17
• OPP preflight compatibility matrix: OCP 4.22 row now expects ACM 2.17

Core file (review this first)

File	What to check
ci-operator/step-registry/interop/opp/preflight/interop-opp-preflight-commands.sh	Compatibility matrix entry for 4.22 updated; verify version alignment with adjacent OCP rows

Mechanical/config files

File	Changes
.../stolostron-policy-collection-main__ocp4.22.yaml	3 base_image refs + 2 operator channel refs (2.16 → 2.17)
.../stolostron-policy-collection-main__ocp4.22-upgrade.yaml	1 operator channel ref (2.16 → 2.17)

Risk areas

• Behavioral: ACM 2.17 may introduce new APIs or deprecations that affect GRC/observability tests. Test images are bumped to match.
• No other products touched: ACS, ODF, and Quay channels remain unchanged.

Testing

• Rehearsal jobs triggered covering AWS interop, vSphere interop, and upgrade variants.
• Rehearsal failures are from known pipeline blockers (ACM observability, S3 credentials, OperatorGroup issues), not from changes in this PR.

Resolves: INTEROP-9406

/cc @CSPI-QE

Summary by CodeRabbit

• Updated OCP 4.22 OPP interop and upgrade jobs to use ACM release-2.17.
• Updated ACM QE test images from 2.16 to 2.17 for AWS and vSphere jobs.
• Updated the OPP preflight compatibility matrix to require ACM 2.17 with OCP 4.22.
• Kept ACS, ODF, Quay, and RHACS requirements unchanged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[amp-rh]

Blocker: GitHub API outage (2026-08-17)

ci/prow/check-gh-automation failing on all openshift/release PRs due to GitHub returning HTTP 503 to Prow permission checks. See https://www.githubstatus.com/. Unrelated to PR changes; will pass on /retest once GitHub recovers.

[amp-rh]

Friendly ping for review. This PR updates OPP 4.22 interop jobs to install ACM 2.17.z (version correction from 2.16). Looking for /lgtm + /approve from a cspi-qe-ocp-lp team member. Thanks!

[amp-rh]

Superseded by #83405 (merged Aug 19). Changes included in the batch PR.