NO-ISSUE: switch default CI registry to quay-proxy.ci.openshift.org

[andfasano]

As per the latest CI change described here https://docs.ci.openshift.org/how-tos/use-registries-in-build-farm/#container-image-data-flows, the CI default registry is now quay-proxy.ci.openshift.org

[andfasano]

/hold

Fine tuning the non-CI access as per the latest CI docs recommendations

[andfasano]

/hold cancel

[bfournie]

When I test this locally I don't see theregistries.ci.openshift.org creds in pull-secret getting updated to the latest.

[andfasano]

/hold

With this patch the registries.ci.openshift.org does not get update in the pull-secret anymore, because the CI doc explicitly mentioned to not use it. So probably we should remove any reference to it?

[bfournie]

/hold

With this patch the registries.ci.openshift.org does not get update in the pull-secret anymore, because the CI doc explicitly mentioned to not use it. So probably we should remove any reference to it?

In get_latest_ci_image() it does
if curl -L "https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestream/${OPENSHIFT_RELEASE_STREAM}.0-0.${OPENSHIFT_RELEASE_TYPE}/latest"| grep -o 'registry.ci.openshift.org[^"]\+'; then

but there is only a registry.ci. pull-spec, not one for quay-proxy at https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestream/5.0.0-0.nightly/latest

 {                                                                                                                                                                          
    "pullSpec": "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-21-234123"                                                                                  
  }    

So recommend adding the quay-proxy url instead of replacing registry.ci.openshift.org similar to https://github.com/openshift-metal3/dev-scripts/compare/65de2b30af827b8a5271722d276ae80dc385c620..e6cd719f0675227a509719b0e9fd11599b4708bf#diff-35a54395325de0227bbdd613dbf61c3265b5f6ab205cf32348e3538399cf1b9eL1029-L1034

[andfasano]

cc @elfosardo

Let's wait for a more detailed feedback from ART about the URL management, since potentially we may need to update all the reference to registry.ci.openshift.org (apart the references in the Dockerfiles due the custom builds)

[andfasano]

Meanwhile, this new version keeps updating the pull-secret with both (registry.ci.openshift.org and quay-proxy.ci.openshift.org

[bfournie]

/approve
Tested this and it looks good.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bfournie

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bfournie]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@andfasano: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ipi-ovn-ipv4	9df26fc	link	true	/test e2e-metal-ipi-ovn-ipv4

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[andfasano]

/hold cancel

[andfasano]

cc @elfosardo @tdomnesc

[tdomnesc]

/test e2e-metal-ipi-ovn-ipv4