From a618573536e0c487775e611ba2dc23d72f869689 Mon Sep 17 00:00:00 2001 From: Lin Gao Date: Thu, 4 Sep 2025 22:42:01 +0800 Subject: [PATCH 1/2] [CNTRLPLANE-1364] Adds CI for global pull secret for AWS platform --- ...s-private-release-4.19__amd64-nightly.yaml | 16 ++++ ...s-private-release-4.20__amd64-nightly.yaml | 16 ++++ ...-tests-private-release-4.19-periodics.yaml | 82 +++++++++++++++++++ ...-tests-private-release-4.20-periodics.yaml | 82 +++++++++++++++++++ ...ws-ipi-ovn-hypershift-provision-chain.yaml | 3 + .../create/hypershift-aws-create-chain.yaml | 7 ++ 6 files changed, 206 insertions(+) diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly.yaml index 4a5226486a64a..cebc237591e6f 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly.yaml @@ -808,6 +808,22 @@ tests: test: - chain: openshift-e2e-test-hypershift-qe-mgmt workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift +- as: aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + cron: 45 23 7,14,21,28 * * + steps: + cluster_profile: aws-qe + env: + ADDITIONAL_CA_BUNDLE_FILE: additional-ca.crt + BASE_DOMAIN: qe.devcluster.openshift.com + DYNAMIC_ADDITIONAL_TRUST_BUNDLE_ENABLED: "true" + DYNAMIC_GLOBAL_PULL_SECRET_ENABLED: "true" + DYNAMIC_IMAGE_REGISTRY_ENABLED: "true" + HYPERSHIFT_FEATURE_SET: TechPreviewNoUpgrade + PUBLIC_ONLY: "true" + TEST_IMPORTANCE: Critical + test: + - chain: openshift-e2e-test-hypershift-qe-mgmt + workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift - as: aws-ipi-ovn-hypershift-mgmt-f7 cron: 9 22 2,9,18,25 * * steps: diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml index 105f1cfa9e579..f2528216d380f 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml @@ -825,6 +825,22 @@ tests: test: - chain: openshift-e2e-test-hypershift-qe-mgmt workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift +- as: aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + cron: 45 23 7,14,21,28 * * + steps: + cluster_profile: aws-qe + env: + ADDITIONAL_CA_BUNDLE_FILE: additional-ca.crt + BASE_DOMAIN: qe.devcluster.openshift.com + DYNAMIC_ADDITIONAL_TRUST_BUNDLE_ENABLED: "true" + DYNAMIC_GLOBAL_PULL_SECRET_ENABLED: "true" + DYNAMIC_IMAGE_REGISTRY_ENABLED: "true" + HYPERSHIFT_FEATURE_SET: TechPreviewNoUpgrade + PUBLIC_ONLY: "true" + TEST_IMPORTANCE: Critical + test: + - chain: openshift-e2e-test-hypershift-qe-mgmt + workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift - as: aws-ipi-ovn-hypershift-mgmt-f7 cron: 30 19 1,8,17,24 * * steps: diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml index ea338e38a4b15..d7afcb073d41b 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml @@ -19780,6 +19780,88 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 45 23 7,14,21,28 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.19 + org: openshift + repo: openshift-tests-private + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: aws-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.19" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + - --variant=amd64-nightly + command: + - ci-operator + image: ci-operator:latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 55 3 3,10,19,26 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml index 4ffc19f9e39ae..685787255cfbc 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml @@ -21033,6 +21033,88 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 45 23 7,14,21,28 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.20 + org: openshift + repo: openshift-tests-private + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: aws-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.20" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.20-amd64-nightly-aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + - --variant=amd64-nightly + command: + - ci-operator + image: ci-operator:latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 52 22 4,11,20,27 * * diff --git a/ci-operator/step-registry/cucushift/installer/rehearse/aws/ipi/ovn/hypershift/provision/cucushift-installer-rehearse-aws-ipi-ovn-hypershift-provision-chain.yaml b/ci-operator/step-registry/cucushift/installer/rehearse/aws/ipi/ovn/hypershift/provision/cucushift-installer-rehearse-aws-ipi-ovn-hypershift-provision-chain.yaml index edefbe4514c75..5b017dbaf80c1 100644 --- a/ci-operator/step-registry/cucushift/installer/rehearse/aws/ipi/ovn/hypershift/provision/cucushift-installer-rehearse-aws-ipi-ovn-hypershift-provision-chain.yaml +++ b/ci-operator/step-registry/cucushift/installer/rehearse/aws/ipi/ovn/hypershift/provision/cucushift-installer-rehearse-aws-ipi-ovn-hypershift-provision-chain.yaml @@ -3,7 +3,10 @@ chain: steps: - chain: cucushift-installer-rehearse-aws-ipi-ovn-provision - chain: cucushift-hypershift-extended-install-private + - ref: cucushift-hypershift-extended-enable-additional-trust-bundle - chain: hypershift-aws-create + - ref: cucushift-hypershift-extended-enable-custom-image-registry + - ref: cucushift-hypershift-extended-global-pull-secret env: - name: BASE_DOMAIN default: "qe.devcluster.openshift.com" diff --git a/ci-operator/step-registry/hypershift/aws/create/hypershift-aws-create-chain.yaml b/ci-operator/step-registry/hypershift/aws/create/hypershift-aws-create-chain.yaml index 4633bdf911e2c..817372a420f17 100644 --- a/ci-operator/step-registry/hypershift/aws/create/hypershift-aws-create-chain.yaml +++ b/ci-operator/step-registry/hypershift/aws/create/hypershift-aws-create-chain.yaml @@ -83,6 +83,9 @@ chain: - name: HC_DISABLED_CAPS default: "" documentation: "Disabling Capabilities in Hosted Cluster,format: 'Console,ImageRegistry...' detail see https://issues.redhat.com/browse/MGMT-20628" + - name: ADDITIONAL_CA_BUNDLE_FILE + default: "" + documentation: "The additional ca bundle file name in the shared directory" commands: |- set -exuo pipefail AWS_GUEST_INFRA_CREDENTIALS_FILE="/etc/hypershift-ci-jobs-awscreds/credentials" @@ -164,6 +167,10 @@ chain: COMMAND+=(--kas-dns-name="${HYPERSHIFT_DYNAMIC_DNS}") fi + if [[ -n "${ADDITIONAL_CA_BUNDLE_FILE}" ]]; then + COMMAND+=(--additional-trust-bundle "${SHARED_DIR}/${ADDITIONAL_CA_BUNDLE_FILE}") + fi + if [[ $HYPERSHIFT_CREATE_CLUSTER_RENDER == "true" ]]; then "${COMMAND[@]}" --render > "${SHARED_DIR}/hypershift_create_cluster_render.yaml" exit 0 From 1eff67a5548f7394c9441eae426e28e9e5da54eb Mon Sep 17 00:00:00 2001 From: Lin Gao Date: Thu, 18 Sep 2025 15:23:46 +0800 Subject: [PATCH 2/2] Enable 4.21 --- ...s-private-release-4.21__amd64-nightly.yaml | 16 ++++ ...-tests-private-release-4.19-periodics.yaml | 2 +- ...-tests-private-release-4.20-periodics.yaml | 2 +- ...-tests-private-release-4.21-periodics.yaml | 82 +++++++++++++++++++ 4 files changed, 100 insertions(+), 2 deletions(-) diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml index e078309b7eecf..505de5f3b1be1 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml @@ -808,6 +808,22 @@ tests: test: - chain: openshift-e2e-test-hypershift-qe-mgmt workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift +- as: aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + cron: 45 23 7,14,21,28 * * + steps: + cluster_profile: aws-qe + env: + ADDITIONAL_CA_BUNDLE_FILE: additional-ca.crt + BASE_DOMAIN: qe.devcluster.openshift.com + DYNAMIC_ADDITIONAL_TRUST_BUNDLE_ENABLED: "true" + DYNAMIC_GLOBAL_PULL_SECRET_ENABLED: "true" + DYNAMIC_IMAGE_REGISTRY_ENABLED: "true" + HYPERSHIFT_FEATURE_SET: TechPreviewNoUpgrade + PUBLIC_ONLY: "true" + TEST_IMPORTANCE: Critical + test: + - chain: openshift-e2e-test-hypershift-qe-mgmt + workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift - as: aws-ipi-ovn-hypershift-mgmt-f7 cron: 12 18 7,14,23,30 * * steps: diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml index d7afcb073d41b..23b61a9e2df5d 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml @@ -19811,7 +19811,7 @@ periodics: - --variant=amd64-nightly command: - ci-operator - image: ci-operator:latest + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" resources: diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml index 685787255cfbc..607e3ab30e30a 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml @@ -21064,7 +21064,7 @@ periodics: - --variant=amd64-nightly command: - ci-operator - image: ci-operator:latest + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" resources: diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml index 962aaa222cafa..ed9e56e182a98 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml @@ -4056,6 +4056,88 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 45 23 7,14,21,28 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.21 + org: openshift + repo: openshift-tests-private + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: aws-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.21" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=aws-ipi-ovn-hypershift-mgmt-global-ps-f7 + - --variant=amd64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 56 12 2,9,16,23 * *