CNTRLPLANE-3434

CNTRLPLANE-3434 (ARO HCP Release Promotion Pipeline) introduces a Konflux-based nightly pipeline that gates HyperShift Operator image promotion on e2e test results. A key requirement is that the Prow jobs triggered by the pipeline run against the specific HO image extracted from the Konflux Snapshot, not the default CI image.

The initial approach used ci-operator's built-in OVERRIDE_IMAGE_HYPERSHIFT_OPERATOR mechanism to inject the Snapshot image into the Prow jobs via Gangway. However, this mechanism is affected by a race condition in ci-operator: when the override env var is set, ci-operator creates two concurrent steps that both write to the same pipeline:hypershift-operator ImageStream tag:

1. The override step, which tags the Konflux snapshot image
2. The base_images step, which tags hypershift/hypershift-operator:latest (the default)

Both steps launch as concurrent goroutines with no ordering guarantee. The override step is typically faster (it has the pullspec ready), so it writes first. But the base_images step writes second, and since writing an ImageStreamTag to an existing tag is effectively an upsert, it overwrites the override.

Since ci-operator's OVERRIDE_IMAGE_* mechanism is inherently racy and cannot be fixed without an upstream change, we bypassed it entirely with two PRs on openshift/release:

• PR #81877 openshift/release
  Added an OVERRIDE_HYPERSHIFT_OPERATOR_IMAGE parameter to the hypershift-install step registry ref, settable via Gangway's MULTISTAGE_PARAM_OVERRIDE_ mechanism. The script reads this variable directly and overrides OPERATOR_IMAGE at the shell level, completely bypassing ci-operator's ImageStream-based override.
• PR #82061 openshift/release
  Fixed a missing pull secret that prevented extract_hcp_cli from pulling the override image (Konflux images on quay.io/redhat-user-workloads require the CI pull secret).

The pipeline itself was merged as PR #8602 openshift/hypershift

For each Prow job triggered via Gangway, the hypershift-install step build-log should show:

1. WARNING: Overriding OPERATOR_IMAGE - the override branch was taken
2. Override: line containing the expected digest sha256:6d4d63...e2c8d3
3. extract_hcp_cli invoked with the override image - both operator image and CLI binary were overridden

For each job that reached HO installation, the operator Deployment YAML dumped as a test artifact should show:

1. Pod Image - the container image: field matches the expected digest
2. CLI Commit - the hypershift.openshift.io/install-cli-version annotation contains commit aa7db2343a5e5b4f26058ea99caba7e6a6fc9db3

Jobs 3 and 4 failed during the aks-provision step, before hypershift-install ever ran. The override could not be verified at either layer because HO was never installed.

Both are Azure infrastructure failures (NAP node provisioning timeout), unrelated to the override mechanism. The hypershift-install step is downstream of aks-provision in the workflow DAG, so it was never reached.