chore: promote aro-hcp-e2e-tools image from ARO-HCP CI

[bryan-cox]

Summary

Add aro-hcp-e2e-tools to the ARO-HCP CI promotion config so it is available as a base image for downstream consumers.

This is a prerequisite for PR #79926 which adds hypershift e2e testing against ARO-HCP. The hypershift CI workflow needs both aro-hcp-e2e-tests (already promoted) and aro-hcp-e2e-tools (this PR) as base images.

What changed

• Added aro-hcp-e2e-tools: aro-hcp-e2e-tools to additional_images in the ARO-HCP promotion config
• Regenerated prow jobs via make update

Ref: CNTRLPLANE-3465

Test plan

• make update passes
• Once merged, verify the image is promoted after a successful ARO-HCP postsubmit

🤖 Generated with Claude Code

Summary by CodeRabbit

This PR adds the aro-hcp-e2e-tools container image to the ARO-HCP CI promotion configuration, enabling it to be automatically promoted and made available as a base image for downstream consumers in the CI/CD pipeline.

The change modifies the ARO-HCP main CI workflow configuration to include aro-hcp-e2e-tools in the additional_images section of the promotion step. This is a prerequisite for implementing hypershift e2e testing against ARO-HCP, which requires two promoted base images: aro-hcp-e2e-tests (already available) and aro-hcp-e2e-tools (added by this PR).

The implementation consists of a single-line addition to ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yaml with make update run to regenerate the associated Prow job definitions. The author has verified that the build configuration updates successfully.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: bryan-cox
Once this PR has been reviewed and has the lgtm label, please assign raelga for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/Azure/ARO-HCP/OWNERS
• ci-operator/jobs/Azure/ARO-HCP/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a30cae55-112b-408a-b5a6-d131c86b15a2

📥 Commits

Reviewing files that changed from the base of the PR and between 026d9c3 and 5b1ca75.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/Azure/ARO-HCP/Azure-ARO-HCP-main-postsubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/Azure/ARO-HCP/Azure-ARO-HCP-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yaml

---

Walkthrough

The CI operator configuration for Azure/ARO-HCP main adds aro-hcp-e2e-tools: aro-hcp-e2e-tools to the promotion.additional_images list, causing that image to be promoted alongside aro-hcp-e2e-tests during the promotion phase.

Changes

CI Promotion Image Update

Layer / File(s)	Summary
Add aro-hcp-e2e-tools to additional_images ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yaml	Adds aro-hcp-e2e-tools: aro-hcp-e2e-tools to the promotion.additional_images map so the image is promoted alongside aro-hcp-e2e-tests.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding aro-hcp-e2e-tools to the promotion configuration in the ARO-HCP CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	This PR modifies only CI/CD configuration (YAML) to add aro-hcp-e2e-tools to image promotion. No Ginkgo test code or test files are modified, making the test names check not applicable.
Test Structure And Quality	✅ Passed	Check not applicable: PR modifies only YAML CI configuration, not Ginkgo test code. Custom check requires reviewing Ginkgo test structure and quality.
Microshift Test Compatibility	✅ Passed	This PR does not add any new Ginkgo e2e tests—it only modifies a YAML CI configuration file to include aro-hcp-e2e-tools in the promotion config. The MicroShift compatibility check is not applica...
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR modifies a CI configuration file only (YAML), not test code. It adds an image reference to promotion config without introducing any Ginkgo e2e tests, so the SNO compatibility check does not...
Topology-Aware Scheduling Compatibility	✅ Passed	The PR modifies only a CI-operator image promotion config file, not deployment manifests, operator code, or controllers with scheduling constraints. The check does not apply.
Ote Binary Stdout Contract	✅ Passed	PR only modifies a YAML CI/CD configuration file, not binary code. The OTE Binary Stdout Contract check applies exclusively to process-level code in Go binaries, which is not present in this change.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR does not add any Ginkgo e2e tests. It only promotes the aro-hcp-e2e-tools image in CI config; the check is inapplicable.
No-Weak-Crypto	✅ Passed	PR modifies only CI configuration (YAML) to register an image for promotion. No cryptographic code, algorithms, or secret handling is present, so the no-weak-crypto check does not apply.
Container-Privileges	✅ Passed	File is a CI Operator config, not K8s manifests. No container privilege flags (privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, runAsUser) present.
No-Sensitive-Data-In-Logs	✅ Passed	Change adds a Docker image name to CI promotion config with no passwords, tokens, API keys, PII, session IDs, hostnames, or customer data exposure.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bryan-cox: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-Azure-ARO-HCP-main-images	Azure/ARO-HCP	presubmit	Presubmit changed
pull-ci-Azure-ARO-HCP-main-api-validation	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-baseimage-generator-go-smoke-test	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-baseimage-generator-images	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-bicep-lint	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-config-change-detection	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-e2e-images	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-e2e-parallel	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-image-updater-images	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-integration	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-integration-e2e-parallel	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-integration-e2e-parallel-ocp-fast	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-integration-e2e-parallel-ocp-nightly	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-integration-e2e-parallel-ocp-stable	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-lint	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-mega-linter	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-observability-prometheus	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-observability-verify	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-periodic-healthcheck-images	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-prod-e2e-parallel	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-prod-e2e-parallel-ocp-fast	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-prod-e2e-parallel-ocp-nightly	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-prod-e2e-parallel-ocp-stable	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-secrets-validation	Azure/ARO-HCP	presubmit	Ci-operator config changed
pull-ci-Azure-ARO-HCP-main-stage-e2e-parallel	Azure/ARO-HCP	presubmit	Ci-operator config changed

A total of 52 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.