ROSAENG-66958: add rosa-capa secret collection to hp-sre-rosa-ci rover group

[andclt]

Summary

The rosa-capa Vault collection was missed during the Vault-to-GSM migration, causing CAPA e2e CI jobs to fail with:

cat: /var/run/rosa-hcp-e2e-secrets/ocmClientID: No such file or directory

This adds rosa-capa to the hp-sre-rosa-ci rover group so its secrets can be migrated to GSM.

Vault collection: selfservice/rosa-capa/ (contains: placeholder, rosa-e2e-aws-creds, rosa-hcp-e2e-secrets)

References

• Same issue/fix as rosa-boundary: sync-rover-groups: add rosa-boundary secret collection to hp-sre-rosa-ci #85083
• Original rover group setup: Assign hp-sre-rosa-ci rover group to GSM secret collections #84996
• Failing job: https://prow.ci.openshift.org/job-history/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-e2e-main_capa-e2e-capa-e2e

Post-merge

@psalajova — once merged, could you run the one-time Vault→GSM migration for the rosa-capa collection?

Summary by CodeRabbit

Adds the selfservice/rosa-capa/ Vault collection to the hp-sre-rosa-ci rover group. This makes ocmClientID and other CAPA e2e secrets available to the group's CI jobs and supports their migration to GSM.

After merge, run the requested one-time Vault-to-GSM migration.

[openshift-ci]

[REHEARSALNOTIFIER]
@andclt: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: b701b1ad-0869-4f16-aa62-54aadc53ab61

📥 Commits

Reviewing files that changed from the base of the PR and between 066482b and 60d9be0.

📒 Files selected for processing (1)

• core-services/sync-rover-groups/_config.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The hp-sre-rosa-ci group configuration now includes the rosa-capa secret collection.

Changes

Rover group secret configuration

Layer / File(s)	Summary
Update group secret collection core-services/sync-rover-groups/_config.yaml	The hp-sre-rosa-ci group now lists rosa-capa in its secret collections.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: psalajova

Merge Risk: ⚪ Minimal · up to 60d9b

The requested secret collection is included in the target rover group, with no merge-blocking concerns identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes only core-services/sync-rover-groups/_config.yaml by adding the static rosa-capa secret collection to hp-sre-rosa-ci. The diff contains no test files, Ginkgo test …
Test Structure And Quality	✅ Passed	The check is not applicable. The review-scoped diff changes only core-services/sync-rover-groups/_config.yaml, adding rosa-capa to hp-sre-rosa-ci.secret_collections. It introduces no Ginkgo test…
Microshift Test Compatibility	✅ Passed	The pull request changes only core-services/sync-rover-groups/_config.yaml. It adds rosa-capa to the hp-sre-rosa-ci secret collection list. It adds no Ginkgo tests and references no MicroShift-i…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only core-services/sync-rover-groups/_config.yaml. It adds rosa-capa to the hp-sre-rosa-ci secret collection list. It adds no Ginkgo tests or test code, so the SNO compa…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only core-services/sync-rover-groups/_config.yaml by adding rosa-capa to a secret collection list. It adds no deployment manifest, operator code, controller code, re…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request changes only core-services/sync-rover-groups/_config.yaml, adding rosa-capa to the hp-sre-rosa-ci secret collections. It changes no OTE binary code, suite setup, logging c…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only core-services/sync-rover-groups/_config.yaml. It adds rosa-capa to the hp-sre-rosa-ci secret collection list. The diff adds no Ginkgo tests, test files, netwo…
No-Weak-Crypto	✅ Passed	The pull request changes only core-services/sync-rover-groups/_config.yaml and adds the rosa-capa collection name to hp-sre-rosa-ci. The diff introduces no MD5, SHA1, DES, RC4, Blowfish, ECB, cu…
Container-Privileges	✅ Passed	The pull request changes only core-services/sync-rover-groups/_config.yaml. It adds rosa-capa to the hp-sre-rosa-ci.secret_collections list. The diff contains no container or Kubernetes privileg…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request changes only _config.yaml by adding the rosa-capa collection to hp-sre-rosa-ci. The diff adds no logging, output, or secret-value handling. Existing rosa-capa references only …
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the rosa-capa secret collection to the hp-sre-rosa-ci rover group.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@andclt: This pull request references ROSAENG-66958 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

The rosa-capa Vault collection was missed during the Vault-to-GSM migration, causing CAPA e2e CI jobs to fail with:

cat: /var/run/rosa-hcp-e2e-secrets/ocmClientID: No such file or directory

This adds rosa-capa to the hp-sre-rosa-ci rover group so its secrets can be migrated to GSM.

Vault collection: selfservice/rosa-capa/ (contains: placeholder, rosa-e2e-aws-creds, rosa-hcp-e2e-secrets)

References

• Same issue/fix as rosa-boundary: sync-rover-groups: add rosa-boundary secret collection to hp-sre-rosa-ci #85083
• Original rover group setup: Assign hp-sre-rosa-ci rover group to GSM secret collections #84996
• Failing job: https://prow.ci.openshift.org/job-history/gs/test-platform-results/logs/periodic-ci-openshift-online-rosa-e2e-main_capa-e2e-capa-e2e

Post-merge

@psalajova — once merged, could you run the one-time Vault→GSM migration for the rosa-capa collection?

Summary by CodeRabbit

Adds the selfservice/rosa-capa/ Vault collection to the hp-sre-rosa-ci rover group. This makes ocmClientID and other CAPA e2e secrets available to the group's CI jobs and supports their migration to GSM.

After merge, run the requested one-time Vault-to-GSM migration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@andclt: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[dustman9000]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: andclt, dustman9000
Once this PR has been reviewed and has the lgtm label, please assign danilo-gemoli for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• core-services/sync-rover-groups/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment