WIP: Add a helper to generate yaml to test scripts

[feichashao]

What type of PR is this?

• fix (Bug Fix)
• feat (New Feature)
• docs (Documentation)
• test (Test Coverage)
• chore (Clean Up / Maintenance Tasks)
• other (Anything that doesn't fit the above)

What this PR does / Why we need it?

Assisted by Claude.

This is a helper function to generate yaml files from a managed scripts (with metadata). This is for local test on a staging cluster manually when developing a managed script.

WIP: I haven't reviewed/validate this command yet. Raising it for discussion. If we want to go with it, I will review it closely and validate it in a staging cluster.

Test steps provided by Claude:

Step 1 — Create mock metadata and script files

metadata.yaml

file: script.sh
name: example-test
description: An example test script for validating managed-script behavior
author: testuser
language: bash
rbac:
  clusterRoleRules:
    - verbs: ["get", "list"]
      apiGroups: [""]
      resources: ["pods", "nodes"]
  roles:
    - namespace: openshift-monitoring
      rules:
        - verbs: ["get", "list"]
          apiGroups: [""]
          resources: ["configmaps"]
envs:
  - key: CLUSTER_NAME
    description: Name of the cluster
    optional: false
  - key: DRY_RUN
    description: Enable dry run mode
    optional: true
allowedGroups:
  - SREP

script.sh

#!/bin/bash
set -euo pipefail

echo "Hello from test script"
echo "Cluster: $CLUSTER_NAME"

echo "Listing pods in openshift-monitoring..."
oc get pods -n openshift-monitoring

echo "Listing nodes..."
oc get nodes

Step 2 — Run the render command

ocm backplane testjob render \
  -s ./scripts/SREP/example \
  -p CLUSTER_NAME=my-staging-cluster \
  -o test-job.yaml

Step 3 — Generated YAML

The command produces a multi-document YAML file containing all the Kubernetes objects needed to run the test script. This matches what the backplane-api's server-side dry-run generates:

apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  creationTimestamp: null
  labels:
    managed.openshift.io/backplane-job-canonical-namespace: TEST
    managed.openshift.io/backplane-job-canonical-script-name: example-test
    managed.openshift.io/backplane-job-id: openshift-job-dev-1786430381
    managed.openshift.io/backplane-job-is-test: "true"
  name: openshift-job-dev-1786430381
  namespace: openshift-backplane-managed-scripts
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: null
  labels:
    managed.openshift.io/backplane-job-canonical-namespace: TEST
    managed.openshift.io/backplane-job-canonical-script-name: example-test
    managed.openshift.io/backplane-job-id: openshift-job-dev-1786430381
    managed.openshift.io/backplane-job-is-test: "true"
  name: openshift-job-dev-1786430381
  namespace: openshift-monitoring
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  labels:
    managed.openshift.io/backplane-job-canonical-namespace: TEST
    managed.openshift.io/backplane-job-canonical-script-name: example-test
    managed.openshift.io/backplane-job-id: openshift-job-dev-1786430381
    managed.openshift.io/backplane-job-is-test: "true"
  name: openshift-job-dev-1786430381
  namespace: openshift-monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: openshift-job-dev-1786430381
subjects:
- kind: ServiceAccount
  name: openshift-job-dev-1786430381
  namespace: openshift-backplane-managed-scripts
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  labels:
    managed.openshift.io/backplane-job-canonical-namespace: TEST
    managed.openshift.io/backplane-job-canonical-script-name: example-test
    managed.openshift.io/backplane-job-id: openshift-job-dev-1786430381
    managed.openshift.io/backplane-job-is-test: "true"
  name: openshift-job-dev-1786430381
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  labels:
    managed.openshift.io/backplane-job-canonical-namespace: TEST
    managed.openshift.io/backplane-job-canonical-script-name: example-test
    managed.openshift.io/backplane-job-id: openshift-job-dev-1786430381
    managed.openshift.io/backplane-job-is-test: "true"
  name: openshift-job-dev-1786430381
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: openshift-job-dev-1786430381
subjects:
- kind: ServiceAccount
  name: openshift-job-dev-1786430381
  namespace: openshift-backplane-managed-scripts
---
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    managed.openshift.io/backplane-job-canonical-namespace: TEST
    managed.openshift.io/backplane-job-canonical-script-name: example-test
    managed.openshift.io/backplane-job-id: openshift-job-dev-1786430381
    managed.openshift.io/backplane-job-is-test: "true"
  name: openshift-job-dev-1786430381
  namespace: openshift-backplane-managed-scripts
spec:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - preference:
          matchExpressions:
          - key: node-role.kubernetes.io/infra
            operator: Exists
        weight: 100
  containers:
  - command:
    - /bin/sh
    - -c
    - echo 'IyEvYmluL2Jhc2gKc2V0IC1ldW8gcGlwZWZhaWwKC...<base64>'
      | base64 -d | /bin/bash
    env:
    - name: CLUSTER_NAME
      value: my-staging-cluster
    image: quay.io/redhat-user-workloads/rosa-tenant/managed-scripts:latest
    name: job
    resources:
      limits:
        cpu: 500m
        memory: 2Gi
      requests:
        cpu: 10m
        memory: 100Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
  restartPolicy: Never
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  serviceAccountName: openshift-job-dev-1786430381
  tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/infra
    operator: Exists
status: {}

Step 4 — Apply on a staging cluster

# Log in to a staging cluster where you have cluster-admin access
ocm backplane login <staging-cluster-id>

# Apply the generated YAML
oc apply -f test-job.yaml

# Watch logs
oc logs -f openshift-job-dev-<timestamp> -n openshift-backplane-managed-scripts

# Clean up when done
oc delete -f test-job.yaml

Which Jira/Github issue(s) does this PR fix?

• Related Issue #
• Closes #

Special notes for your reviewer

Unit Test Coverage

Guidelines

• If it's a new sub-command or new function to an existing sub-command, please cover at least 50% of the code
• If it's a bug fix for an existing sub-command, please cover 70% of the code

Test coverage checks

• Added unit tests
• Created jira card to add unit test
• This PR may not need unit tests

Pre-checks (if applicable)

• Ran unit tests locally
• Validated the changes in a cluster
• Included documentation changes with PR
• Backward compatible

/label tide/merge-method-squash

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (3)

• WIP
• deps
• Do Not Merge

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1bfefd4c-3d01-4b27-8eb5-5f7f020aacd3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: feichashao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [feichashao]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@feichashao: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 87.64706% with 42 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.27%. Comparing base (8d18130) to head (c036c4e).

Files with missing lines	Patch %	Lines
cmd/ocm-backplane/testJob/renderTestJob.go	87.50%	23 Missing and 19 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #980      +/-   ##
==========================================
+ Coverage   54.54%   56.27%   +1.72%     
==========================================
  Files          82       83       +1     
  Lines        6308     6648     +340     
==========================================
+ Hits         3441     3741     +300     
- Misses       2417     2439      +22     
- Partials      450      468      +18     

Files with missing lines	Coverage Δ
cmd/ocm-backplane/testJob/createTestJob.go	74.61% <100.00%> (+0.13%)	⬆️
cmd/ocm-backplane/testJob/getTestJob.go	59.18% <100.00%> (+0.85%)	⬆️
cmd/ocm-backplane/testJob/getTestJobLogs.go	21.56% <100.00%> (+1.56%)	⬆️
cmd/ocm-backplane/testJob/testJob.go	100.00% <100.00%> (ø)
cmd/ocm-backplane/testJob/renderTestJob.go	87.50% <87.50%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.