From 043d7a8363cdb2cddaaa394d6159f202b7e9eede Mon Sep 17 00:00:00 2001 From: ikrispin Date: Mon, 31 Aug 2026 12:41:57 +0300 Subject: [PATCH] chore: retarget Quay images from personal ns to ecosystem-appeng Move abevalflow red-team, pyrit, eval-base, and Tekton bundle refs to the org registry so CI and cluster pulls no longer depend on rh-ee-ikrispin. --- .github/workflows/push-bundles.yaml | 1 - Docs/infrastructure_ops.md | 14 ++++++++++++++ Docs/konflux-integration-guide.md | 16 ++++++++-------- pipeline/integration/Makefile | 2 +- .../integration/konflux-eval-pipelinerun.yaml | 16 ++++++++-------- pipeline/tasks/konflux/evaluate.yaml | 2 +- pipeline/tasks/konflux/red-team.yaml | 4 ++-- pipeline/tasks/phases/red-team.yaml | 4 ++-- 8 files changed, 36 insertions(+), 23 deletions(-) diff --git a/.github/workflows/push-bundles.yaml b/.github/workflows/push-bundles.yaml index 9832fb84..398d85a7 100644 --- a/.github/workflows/push-bundles.yaml +++ b/.github/workflows/push-bundles.yaml @@ -14,7 +14,6 @@ on: default: '0.1' env: - QUAY_REPO: quay.io/rh-ee-ikrispin/abevalflow-catalog VERSION: ${{ github.event.inputs.version || '0.1' }} jobs: diff --git a/Docs/infrastructure_ops.md b/Docs/infrastructure_ops.md index dd07ca52..da7be4fa 100644 --- a/Docs/infrastructure_ops.md +++ b/Docs/infrastructure_ops.md @@ -8,6 +8,20 @@ Deployment and operations reference for running Agentic Eval Flow on OpenShift. - `oc` CLI authenticated with cluster-admin or namespace-admin - `tkn` CLI (optional, for manual pipeline triggers and PipelineRun cleanup) +## Quay.io images (org registry) + +Published Agentic Eval Flow images live under **`quay.io/ecosystem-appeng/`** (not a personal namespace): + +| Image / bundle | Use | +|---|---| +| `abevalflow-redteam`, `abevalflow-pyrit` | Classic + Konflux red-team Task steps | +| `abevalflow-eval-base` | Konflux evaluate default (classic CI uses the OpenShift internal `eval-base` ImageStream instead) | +| `abevalflow-task-*` | Tekton Bundles for Konflux IntegrationTestScenario | + +**CI push:** GitHub Actions (`push-bundles`) authenticates with robot account `ecosystem-appeng+abevalflow` via repo secrets `QUAY_USERNAME` / `QUAY_TOKEN`. Local pushes use the same robot (`podman login quay.io` then `make bundles` in `pipeline/integration`). + +**Cluster pull (`ab-eval-flow`):** Keep a `quay-pull-secret` dockerconfig secret for `quay.io` with that robot, and attach it to the Tekton `pipeline` ServiceAccount `imagePullSecrets` so red-team / Quay-backed steps can pull if repos are private. Classic Harbor/AEH evaluate steps continue to use `image-registry.openshift-image-registry.svc:5000/ab-eval-flow/eval-base:*` and do not depend on Quay. + ## Namespace Setup ```bash diff --git a/Docs/konflux-integration-guide.md b/Docs/konflux-integration-guide.md index 6491504d..a329f396 100644 --- a/Docs/konflux-integration-guide.md +++ b/Docs/konflux-integration-guide.md @@ -316,14 +316,14 @@ The core tasks are published as Tekton Bundles to Quay.io: | Bundle | Task | |--------|------| -| `quay.io/rh-ee-ikrispin/abevalflow-task-parse-snapshot:0.1` | parse-snapshot | -| `quay.io/rh-ee-ikrispin/abevalflow-task-prepare:0.1` | prepare | -| `quay.io/rh-ee-ikrispin/abevalflow-task-test:0.1` | test | -| `quay.io/rh-ee-ikrispin/abevalflow-task-evaluate:0.1` | evaluate | -| `quay.io/rh-ee-ikrispin/abevalflow-task-analyze-scorecard:0.1` | analyze-scorecard | -| `quay.io/rh-ee-ikrispin/abevalflow-task-store:0.1` | store | -| `quay.io/rh-ee-ikrispin/abevalflow-task-red-team:0.1` | red-team (opt-in) | -| `quay.io/rh-ee-ikrispin/abevalflow-task-emit-result:0.1` | emit-result | +| `quay.io/ecosystem-appeng/abevalflow-task-parse-snapshot:0.1` | parse-snapshot | +| `quay.io/ecosystem-appeng/abevalflow-task-prepare:0.1` | prepare | +| `quay.io/ecosystem-appeng/abevalflow-task-test:0.1` | test | +| `quay.io/ecosystem-appeng/abevalflow-task-evaluate:0.1` | evaluate | +| `quay.io/ecosystem-appeng/abevalflow-task-analyze-scorecard:0.1` | analyze-scorecard | +| `quay.io/ecosystem-appeng/abevalflow-task-store:0.1` | store | +| `quay.io/ecosystem-appeng/abevalflow-task-red-team:0.1` | red-team (opt-in) | +| `quay.io/ecosystem-appeng/abevalflow-task-emit-result:0.1` | emit-result | To rebuild bundles after editing task YAML: ```bash diff --git a/pipeline/integration/Makefile b/pipeline/integration/Makefile index 9e0e4d44..b44731e1 100644 --- a/pipeline/integration/Makefile +++ b/pipeline/integration/Makefile @@ -1,4 +1,4 @@ -QUAY_NS ?= quay.io/rh-ee-ikrispin +QUAY_NS ?= quay.io/ecosystem-appeng VERSION ?= 0.1 TASKS_DIR := ../tasks/konflux diff --git a/pipeline/integration/konflux-eval-pipelinerun.yaml b/pipeline/integration/konflux-eval-pipelinerun.yaml index 016d3891..cd59295a 100644 --- a/pipeline/integration/konflux-eval-pipelinerun.yaml +++ b/pipeline/integration/konflux-eval-pipelinerun.yaml @@ -152,7 +152,7 @@ spec: - name: name value: parse-snapshot - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-parse-snapshot:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-parse-snapshot:0.1 - name: kind value: task params: @@ -170,7 +170,7 @@ spec: - name: name value: prepare - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-prepare:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-prepare:0.1 - name: kind value: task params: @@ -205,7 +205,7 @@ spec: - name: name value: test - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-test:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-test:0.1 - name: kind value: task params: @@ -255,7 +255,7 @@ spec: - name: name value: red-team - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-red-team:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-red-team:0.1 - name: kind value: task params: @@ -301,7 +301,7 @@ spec: - name: name value: evaluate - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-evaluate:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-evaluate:0.1 - name: kind value: task params: @@ -354,7 +354,7 @@ spec: - name: name value: analyze-scorecard - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-analyze-scorecard:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-analyze-scorecard:0.1 - name: kind value: task params: @@ -391,7 +391,7 @@ spec: - name: name value: store - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-store:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-store:0.1 - name: kind value: task params: @@ -426,7 +426,7 @@ spec: - name: name value: emit-result - name: bundle - value: quay.io/rh-ee-ikrispin/abevalflow-task-emit-result:0.1 + value: quay.io/ecosystem-appeng/abevalflow-task-emit-result:0.1 - name: kind value: task params: diff --git a/pipeline/tasks/konflux/evaluate.yaml b/pipeline/tasks/konflux/evaluate.yaml index 8dca1465..21315822 100644 --- a/pipeline/tasks/konflux/evaluate.yaml +++ b/pipeline/tasks/konflux/evaluate.yaml @@ -56,7 +56,7 @@ spec: description: Git branch/tag/SHA of the submission repo - name: eval-base-image type: string - default: "quay.io/rh-ee-ikrispin/abevalflow-eval-base:latest" + default: "quay.io/ecosystem-appeng/abevalflow-eval-base:latest" description: Container image with Harbor + dependencies pre-installed - name: llm-model type: string diff --git a/pipeline/tasks/konflux/red-team.yaml b/pipeline/tasks/konflux/red-team.yaml index abdd5c8c..307588a3 100644 --- a/pipeline/tasks/konflux/red-team.yaml +++ b/pipeline/tasks/konflux/red-team.yaml @@ -159,7 +159,7 @@ spec: echo "Config generated at $CONFIG_DIR/promptfooconfig.yaml" - name: run-redteam - image: quay.io/rh-ee-ikrispin/abevalflow-redteam:latest + image: quay.io/ecosystem-appeng/abevalflow-redteam:latest env: - name: CI value: "true" @@ -274,7 +274,7 @@ spec: echo "Promptfoo complete: $FINDINGS findings, passed=$PASSED" - name: run-crescendo - image: quay.io/rh-ee-ikrispin/abevalflow-pyrit:0.1 + image: quay.io/ecosystem-appeng/abevalflow-pyrit:0.1 script: | #!/usr/bin/env bash set -euo pipefail diff --git a/pipeline/tasks/phases/red-team.yaml b/pipeline/tasks/phases/red-team.yaml index 0c7369a3..2094d217 100644 --- a/pipeline/tasks/phases/red-team.yaml +++ b/pipeline/tasks/phases/red-team.yaml @@ -150,7 +150,7 @@ spec: echo "Config generated at $CONFIG_DIR/promptfooconfig.yaml" - name: run-redteam - image: quay.io/rh-ee-ikrispin/abevalflow-redteam:latest + image: quay.io/ecosystem-appeng/abevalflow-redteam:latest env: - name: CI value: "true" @@ -237,7 +237,7 @@ spec: echo "Promptfoo complete: $FINDINGS findings, passed=$PASSED" - name: run-crescendo - image: quay.io/rh-ee-ikrispin/abevalflow-pyrit:0.1 + image: quay.io/ecosystem-appeng/abevalflow-pyrit:0.1 script: | #!/usr/bin/env bash set -euo pipefail