[COS-4080]openshift/os: add RHCOS 10 node image build

[c4rt0]

Add RHEL 10.2 node image build alongside the existing RHEL 9.8 in the openshift/os CI configs. Currently only the RHEL 9.8 node image is built.

Adds a second base_images entry (rhel-coreos-base:10.2) and a second images entry to build rhel-coreos-10 in:

• openshift-os-master.yaml
• openshift-os-release-5.0.yaml
• openshift-os-release-5.1.yaml

Aditionally disabling 5.1 in the second commit.

Overview

This PR extends the OpenShift OS repository's CI pipeline to test RHEL 10.2-based node images alongside the existing RHEL 9.8 testing. Previously, CI only validated packages against RHEL 9.8 images, leaving RHEL 10-specific package changes untested.

Changes

The PR updates CI job configurations for the openshift/os repository across three branches:

• openshift-os-master.yaml: Adds a new RHEL 10.2 base image (rhel-coreos-base-10) and introduces a corresponding build job for rhel-coreos-10 images
• openshift-os-release-5.0.yaml: Adds the same RHEL 10.2 base image and build job
• openshift-os-release-5.1.yaml: Adds the RHEL 10.2 base image and build job, with promotion rules disabled

Each configuration file also updates promotion rules to handle the new RHEL 10 image appropriately for its respective branch.

Impact

This change enables the CI pipeline to validate that package changes in the openshift/os repository work correctly for both RHEL 9.8 and RHEL 10.2 node images, closing a testing gap that previously allowed RHEL 10-specific issues to go undetected.

[coderabbitai]

Walkthrough

This PR adds RHEL CoreOS 10 support across three CI operator configuration files. Each file receives a new base image entry, a corresponding image build definition, and updated promotion rules for consistent configuration across master and release 5.0/5.1 branches.

Changes

RHEL CoreOS 10 Support

Layer / File(s)	Summary
Base Image Definition ci-operator/config/openshift/os/openshift-os-master.yaml, openshift-os-release-5.0.yaml, openshift-os-release-5.1.yaml	New base image entry rhel-coreos-base-10 with tag 10.2 added to base_images in all three configuration files.
Image Build Configuration ci-operator/config/openshift/os/openshift-os-master.yaml, openshift-os-release-5.0.yaml, openshift-os-release-5.1.yaml	New image build entry rhel-coreos-10 added under images.items, wiring openshift/ose-rhel-coreos-10 with build arguments, IMAGE_NAME, IMAGE_CPE for el10, dockerfile path, and input references to the new base image.
Promotion Rules ci-operator/config/openshift/os/openshift-os-master.yaml, openshift-os-release-5.0.yaml, openshift-os-release-5.1.yaml	Promotion configuration updated: master and 5.0 add rhel-coreos-10 to promotion targets/excluded lists; 5.1 extends excluded_images to include rhel-coreos-10 within disabled promotion rules.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR modifies CI/CD configuration YAML files, not Ginkgo test code. The custom check for stable Ginkgo test names is not applicable to this PR as it contains no Ginkgo tests.
Test Structure And Quality	✅ Passed	PR contains only YAML CI configuration changes for adding RHEL 10.2 image builds. No Ginkgo test code or Go test files are present, making the test quality check not applicable.
Microshift Test Compatibility	✅ Passed	PR contains only CI configuration YAML changes, no new Ginkgo e2e tests. MicroShift compatibility check applies only to test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR adds no Ginkgo e2e tests. Changes are only CI config YAML files for building RHCOS 10 images. SNO check only applies when new tests are added.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies CI operator build configs only, not deployment manifests or operator code. No Kubernetes pod scheduling constraints or topology assumptions introduced.
Ote Binary Stdout Contract	✅ Passed	The custom check applies to OTE binary Go code that may write to stdout. This PR only modifies YAML CI configuration files with no executable code, making the check not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR does not add new Ginkgo e2e tests. Changes are limited to CI configuration YAML files for image builds. Custom check is not applicable.
Title check	✅ Passed	The title accurately summarizes the main change: adding a RHCOS 10 node image build to the openshift/os CI configurations, which is the primary objective of the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: c4rt0

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/os/OWNERS [c4rt0]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

@c4rt0, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not determine changed registry steps: could not load step registry: load cluster profile list: unmarshal file /var/tmp/gitrepo2290977441/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal array into Go value of type api.ClusterProfilesList

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[c4rt0]

/retest

[openshift-ci]

@c4rt0: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/generated-config	cc01d30	link	true	/test generated-config

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.