Automated Sync from main to stable

deploy/docker/Dockerfile.konflux.e2e-odh

@@ -106,24 +106,26 @@ RUN OC_ARCH=$(case "${TARGETARCH}" in amd64) echo amd64;; arm64) echo arm64;; *)
     install -m 0555 "/tmp/uv-${UV_ARCH}-unknown-linux-gnu/uv" /usr/local/bin/uv
 
 WORKDIR /home/odh/openshell-e2e-odh
-COPY --chown=1000:1000 Cargo.toml Cargo.lock ./
-COPY --chown=1000:1000 pyproject.toml uv.lock ./
-COPY --chown=1000:1000 .cargo/ .cargo/
-COPY --chown=1000:1000 .config/ .config/
-COPY --chown=1000:1000 crates/ crates/
-COPY --chown=1000:1000 proto/ proto/
-COPY --from=builder --chown=1000:1000 /home/odh/openshell-e2e-odh/python/ python/
-COPY --chown=1000:1000 providers/ providers/
-COPY --chown=1000:1000 examples/ examples/
-COPY --chown=1000:1000 e2e/ e2e/
-COPY --chown=1000:1000 scripts/ scripts/
-COPY --chown=1000:1000 tasks/ tasks/
-COPY --chown=1000:1000 odh/ odh/
-COPY --chown=1000:1000 deploy/helm/openshell/ deploy/helm/openshell/
-COPY --chown=1000:1000 deploy/helm/openshell-workspace/ deploy/helm/openshell-workspace/
-
-RUN install -d -o 1000 -g 1000 results .kube /home/odh/.config/openshell && \
-    chown 1000:1000 /home/odh /home/odh/openshell-e2e-odh
+# Shift-Left runs with --userns=keep-id --user 1001:1001. Keep the home and
+# test workspace writable for that identity, including CLI mTLS storage.
+COPY --chown=1001:1001 Cargo.toml Cargo.lock ./
+COPY --chown=1001:1001 pyproject.toml uv.lock ./
+COPY --chown=1001:1001 .cargo/ .cargo/
+COPY --chown=1001:1001 .config/ .config/
+COPY --chown=1001:1001 crates/ crates/
+COPY --chown=1001:1001 proto/ proto/
+COPY --from=builder --chown=1001:1001 /home/odh/openshell-e2e-odh/python/ python/
+COPY --chown=1001:1001 providers/ providers/
+COPY --chown=1001:1001 examples/ examples/
+COPY --chown=1001:1001 e2e/ e2e/
+COPY --chown=1001:1001 scripts/ scripts/
+COPY --chown=1001:1001 tasks/ tasks/
+COPY --chown=1001:1001 odh/ odh/
+COPY --chown=1001:1001 deploy/helm/openshell/ deploy/helm/openshell/
+COPY --chown=1001:1001 deploy/helm/openshell-workspace/ deploy/helm/openshell-workspace/
+
+RUN install -d -o 1001 -g 1001 results .kube /home/odh/.config /home/odh/.config/openshell && \
+    chown 1001:1001 /home/odh /home/odh/openshell-e2e-odh
 
 # Fail the build if an expected test runtime tool is absent. In particular,
 # sandbox connection uses ssh, and future repository tests need git. cargo
@@ -153,6 +155,6 @@ LABEL com.redhat.component="odh-openshell-e2e-container" \
       io.k8s.display-name="odh-openshell-e2e" \
       io.k8s.description="odh-openshell-e2e"
 
-USER 1000:1000
+USER 1001:1001
 ENTRYPOINT ["/home/odh/openshell-e2e-odh/odh/scripts/e2e-odh-entrypoint.sh"]
 CMD ["smoke"]

deploy/konflux/e2e-odh/README.md

@@ -19,7 +19,9 @@ merges the ordered JUnit files into one `e2e-odh-<tier>.xml` plus its HTML
 companion. Phase reports remain available as
 `e2e-odh-<tier>-<phase>.xml`. The no-deploy option is supported only for
 single-phase tiers. Extracted client mTLS material is stored in a mode `0700`
-directory with mode `0600` files.
+directory with mode `0600` files. The runtime image owns its home and workspace
+as UID/GID `1001:1001`, matching the Shift-Left pipeline's
+`podman run --userns=keep-id --user 1001:1001`.
 
 Each deployed invocation has a DNS-safe run ID. During the temporary upstream
 managed-test compatibility period, the default namespace and Helm release are

deploy/konflux/sandbox/rpms.lock.yaml

@@ -176,13 +176,13 @@ arches:
     name: glibc-headers
     evr: 2.34-283.el9_8
     sourcerpm: glibc-2.34-283.el9_8.src.rpm
-  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/k/kernel-headers-5.14.0-687.57.1.el9_8.x86_64.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/k/kernel-headers-5.14.0-687.58.1.el9_8.x86_64.rpm
     repoid: ubi-9-for-x86_64-appstream-rpms
-    size: 2979225
-    checksum: sha256:c5766b2f8e4531f824575546028de7d8eb9fa95d7246dfafd4883c58312a2ef2
+    size: 2982193
+    checksum: sha256:2c29113a9f860f0e2a14c89ec3a399b3e3d0f9ff699d7f5b565ca5e73b0314a9
     name: kernel-headers
-    evr: 5.14.0-687.57.1.el9_8
-    sourcerpm: kernel-5.14.0-687.57.1.el9_8.src.rpm
+    evr: 5.14.0-687.58.1.el9_8
+    sourcerpm: kernel-5.14.0-687.58.1.el9_8.src.rpm
   - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/l/libxcrypt-devel-4.4.18-3.el9.x86_64.rpm
     repoid: ubi-9-for-x86_64-appstream-rpms
     size: 33101

e2e/rust/tests/odh/README.md

@@ -338,12 +338,17 @@ oc login --token=XXXXXX \
 
 # Run the e2e tests
 podman run --rm \
+  --userns=keep-id --user 1001:1001 \
   -v /path/to/reports:/home/odh/openshell-e2e-odh/results:Z,U \
   -v /path/to/kubeconfig:/home/odh/openshell-e2e-odh/.kube/config:ro,Z \
   --env-file containerEnvFile \
   quay.io/opendatahub/odh-openshell-e2e:odh-stable smoke
 ```
 
+The image runs as UID/GID `1001:1001` and owns `/home/odh`, including the
+OpenShell CLI configuration directory. Keep the pipeline's `--user` setting
+at `1001:1001` so gateway registration and client mTLS material can be written.
+
 The entrypoint assigns each invocation a DNS-safe run ID. For compatibility
 with managed-workspace tests, the namespace and release default to `openshell`
 across both shared and managed phases; the gateway name and Route host are