NO-ISSUE: switch default CI registry to quay-proxy.ci.openshift.org

[andfasano]

As per the latest CI change described here https://docs.ci.openshift.org/how-tos/use-registries-in-build-farm/#container-image-data-flows, the CI default registry is now quay-proxy.ci.openshift.org

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dtantsur for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[andfasano]

/hold

Fine tuning the non-CI access as per the latest CI docs recommendations

[andfasano]

/hold cancel

[openshift-ci]

@andfasano: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-agent-bad-dns	a21bbb1	link	false	/test e2e-agent-bad-dns
ci/prow/e2e-agent-5control-ipv4	a21bbb1	link	false	/test e2e-agent-5control-ipv4
ci/prow/e2e-metal-ipi-ovn-dualstack	a21bbb1	link	false	/test e2e-metal-ipi-ovn-dualstack

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bfournie]

When I test this locally I don't see theregistries.ci.openshift.org creds in pull-secret getting updated to the latest.

[andfasano]

/hold

With this patch the registries.ci.openshift.org does not get update in the pull-secret anymore, because the CI doc explicitly mentioned to not use it. So probably we should remove any reference to it?

[bfournie]

/hold

With this patch the registries.ci.openshift.org does not get update in the pull-secret anymore, because the CI doc explicitly mentioned to not use it. So probably we should remove any reference to it?

In get_latest_ci_image() it does
if curl -L "https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestream/${OPENSHIFT_RELEASE_STREAM}.0-0.${OPENSHIFT_RELEASE_TYPE}/latest"| grep -o 'registry.ci.openshift.org[^"]\+'; then

but there is only a registry.ci. pull-spec, not one for quay-proxy at https://amd64.ocp.releases.ci.openshift.org/api/v1/releasestream/5.0.0-0.nightly/latest

 {                                                                                                                                                                          
    "pullSpec": "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-21-234123"                                                                                  
  }    

So recommend adding the quay-proxy url instead of replacing registry.ci.openshift.org similar to https://github.com/openshift-metal3/dev-scripts/compare/65de2b30af827b8a5271722d276ae80dc385c620..e6cd719f0675227a509719b0e9fd11599b4708bf#diff-35a54395325de0227bbdd613dbf61c3265b5f6ab205cf32348e3538399cf1b9eL1029-L1034