CORS-4336: Add CI jobs for AWS European Sovereign Cloud (EUSC) by liweinan · Pull Request #75568 · openshift/release

liweinan · 2026-03-02T18:04:40Z

Implement continuous integration support for AWS EUSC partition (aws-eusc) in eusc-de-east-1 region. Includes cluster profile definition, service endpoints configuration, custom AMI handling, and periodic test jobs.

This enables OpenShift testing on AWS's new European Sovereign Cloud infrastructure, which requires explicit endpoint configuration and custom RHCOS AMIs not available in public regions.

openshift-ci-robot · 2026-03-02T18:04:45Z

@liweinan: This pull request references CORS-4336 which is a valid jira issue.

Details

In response to this:

Implement continuous integration support for AWS EUSC partition (aws-eusc) in eusc-de-east-1 region. Includes cluster profile definition, service endpoints configuration, custom AMI handling, and periodic test jobs.

This enables OpenShift testing on AWS's new European Sovereign Cloud infrastructure, which requires explicit endpoint configuration and custom RHCOS AMIs not available in public regions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-02T18:06:05Z

@liweinan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 2 errors:

 * tests[125]: invalid cluster profile "aws-eusc-qe"
 * tests[126]: invalid cluster profile "aws-eusc-qe"

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

...t/openshift-tests-private/openshift-openshift-tests-private-release-4.22__amd64-nightly.yaml

ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml

...ipi/private/provision/cucushift-installer-rehearse-aws-eusc-ipi-private-provision-chain.yaml

ci-operator/step-registry/ipi/conf/aws/eusc-ami/ipi-conf-aws-eusc-ami-commands.sh

yunjiang29 · 2026-03-05T02:26:01Z

@liweinan as we discussed offline, for the new partition we need three types of cluster:

common IPI cluster
private cluster
disconnected (private) cluster
and based on above basic cluster, we also need to cover STS, custom KMS key, FIPS and minimum permission, you can refer to existing jobs.

...t/openshift-tests-private/openshift-openshift-tests-private-release-4.22__amd64-nightly.yaml

liweinan · 2026-03-05T02:38:24Z

@yunjiang29 Thanks for the review! I'll refactor this PR today.

openshift-ci-robot · 2026-03-05T12:18:26Z

@liweinan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 2 errors:

 * tests[126]: invalid cluster profile "aws-eusc"
 * tests[127]: invalid cluster profile "aws-eusc"

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

liweinan · 2026-03-06T03:16:23Z

@yunjiang29 Thanks for the detailed review! I'll update the PR recordingly.

openshift-ci-robot · 2026-03-06T06:37:31Z

@liweinan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 2 errors:

 * tests[126]: invalid cluster profile "aws-eusc"
 * tests[127]: invalid cluster profile "aws-eusc"

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

Address yunfei's review comments on PR openshift#75568: 1. Job naming convention: - Rename jobs from -f60 to -f7 suffix (non-destructive tests) - Update cron schedule to standard f7 pattern: 7,14,23,30 2. Private cluster configuration: - Add complete private cluster setup with bastion host - Add VPC, security groups, and proxy configuration - Set PUBLISH=Internal for private cluster access - Add minimal IAM permission provisioning - Follow pattern from cucushift-installer-rehearse-aws-ipi-private-provision 3. AMI configuration fix: - Replace deprecated compute.platform.aws.amiID field - Use platform.aws.defaultMachinePlatform.amiID instead

openshift-ci-robot · 2026-03-06T06:40:37Z

@liweinan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 2 errors:

 * tests[126]: invalid cluster profile "aws-eusc"
 * tests[127]: invalid cluster profile "aws-eusc"

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

1. Job naming convention: - Rename jobs from -f60 to -f7 suffix (non-destructive tests) - Update cron schedule to standard f7 pattern: 7,14,23,30 2. Private cluster configuration: - Add complete private cluster setup with bastion host - Add VPC, security groups, and proxy configuration - Set PUBLISH=Internal for private cluster access - Add minimal IAM permission provisioning - Follow pattern from cucushift-installer-rehearse-aws-ipi-private-provision 3. AMI configuration fix: - Replace deprecated compute.platform.aws.amiID field - Use platform.aws.defaultMachinePlatform.amiID instead 4. Generalize step registry components for reusability: - Enhance ipi-conf-aws-custom-endpoints to support multiple AWS partitions * Add AWS_DOMAIN_SUFFIX env var (defaults to amazonaws.com) * Support amazonaws.eu for EUSC, amazonaws.com.cn for China * Allow full URLs for maximum flexibility - Make ipi-conf-aws-eusc-ami more generic * Support AWS_CUSTOM_AMI_ID for general use * Maintain AWS_EUSC_AMI_ID for backward compatibility * Can be used for EUSC, China, GovCloud, or custom AMI scenarios - Use generic steps in EUSC provision chain with partition-specific config - Remove obsolete ipi-conf-aws-eusc-endpoints (replaced by generic version)

openshift-ci-robot · 2026-03-06T07:00:15Z

@liweinan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 2 errors:

 * tests[126]: invalid cluster profile "aws-eusc"
 * tests[127]: invalid cluster profile "aws-eusc"

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

...erator/step-registry/ipi/conf/aws/custom-endpoints/ipi-conf-aws-custom-endpoints-commands.sh

1. Job naming convention: - Rename jobs from -f60 to -f7 suffix (non-destructive tests) - Update cron schedule to standard f7 pattern: 7,14,23,30 2. Private cluster configuration: - Add complete private cluster setup with bastion host - Add VPC, security groups, and proxy configuration - Set PUBLISH=Internal for private cluster access - Add minimal IAM permission provisioning - Follow pattern from cucushift-installer-rehearse-aws-ipi-private-provision 3. Generalize step registry components for maximum reusability: a) Enhance ipi-conf-aws-custom-endpoints for all AWS partitions: - Add AWS_DOMAIN_SUFFIX env var (defaults to amazonaws.com) - Support amazonaws.eu (EUSC), amazonaws.com.cn (China) - Allow full URLs for maximum flexibility - Remove obsolete ipi-conf-aws-eusc-endpoints step b) Extend ipi-conf-aws to support custom AMI configuration: - Add AWS_AMI_ID env var for custom RHCOS AMI - Useful for EUSC, China, GovCloud, or any partition without public AMIs - Fix deprecated amiID field -> defaultMachinePlatform.amiID - Auto-detection still works for C2S/SC2S - Remove obsolete ipi-conf-aws-eusc-ami step c) EUSC provision chain now uses only generic steps with env config This refactoring reduces code duplication (net -59 lines) and makes step components reusable across all AWS partitions.

openshift-ci-robot · 2026-03-06T07:12:44Z

@liweinan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not load configuration from candidate revision of release repo: failed to load ci-operator configuration from release repo: invalid ci-operator config: configuration has 2 errors:

 * tests[126]: invalid cluster profile "aws-eusc"
 * tests[127]: invalid cluster profile "aws-eusc"

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

liweinan · 2026-03-10T13:59:36Z

Relative PRs merged: #75441 / openshift/ci-tools#4973

openshift-ci-robot · 2026-03-30T01:35:53Z

@liweinan: job(s): periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-private-tp-arm-f7, pull-ci-openshift-installer-main-e2e-aws-eusc-techpreview either don't exist or were not found to be affected, and cannot be rehearsed

yunjiang29 · 2026-03-30T02:40:01Z

/lgtm

yunjiang29 · 2026-03-30T02:40:55Z

@liangxia PTAL

liweinan · 2026-03-30T02:44:23Z

/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-private-tp-arm-f7 pull-ci-openshift-installer-main-e2e-aws-eusc-techpreview

openshift-ci-robot · 2026-03-30T02:44:26Z

@liweinan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

yunjiang29 · 2026-03-30T02:59:06Z

Hold this PR until openshift/sippy#3383 merged
/hold

liweinan · 2026-03-30T04:58:39Z

Tests are still using 4.22.0-0.nightly-multi-2026-03-27-045638, let wait for some time for it to run against 4.22.0-0.nightly-2026-03-29-055437.

liweinan · 2026-03-31T02:54:03Z

/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-private-tp-arm-f7

openshift-ci-robot · 2026-03-31T02:54:06Z

@liweinan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

liweinan · 2026-03-31T05:03:56Z

/pj-rehearse pull-ci-openshift-installer-main-e2e-aws-eusc-techpreview

openshift-ci-robot · 2026-03-31T05:03:59Z

@liweinan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

liweinan · 2026-03-31T06:30:02Z

/pj-rehearse pull-ci-openshift-installer-main-e2e-aws-eusc-techpreview

openshift-ci-robot · 2026-03-31T06:30:06Z

@liweinan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

ci-operator/step-registry/aws/deprovision/verification/aws-deprovision-verification-commands.sh

This commit adds comprehensive support for AWS European Sovereign Cloud (EUSC) cluster type across the OpenShift CI infrastructure. Changes include: 1. Cluster profiles and provisioning: - Added aws-eusc cluster profile configuration - Updated bastion host provisioning for EUSC regions - Modified IPI install scripts to handle EUSC region names 2. CI job configurations: - Added e2e-aws-eusc-techpreview job for openshift/installer (main, 4.22, 4.23, 5.0) - Added multi-nightly-eusc jobs for openshift-tests-private (4.22, 4.23, 5.0) - Jobs use aws-eusc cluster profile and eusc-de-east-1 region 3. Test infrastructure: - E2E test script: Added aws-eusc to CLUSTER_TYPE case statement - AWS deprovision verification: Region handling for IAM and Route53 * EUSC partition: explicitly sets eusc-de-east-1 region * Other partitions: rely on AWS SDK defaults to avoid breaking aws-cn, aws-us-gov, aws-iso Technical details: - EUSC regions use pattern: eusc-{location}-{zone} (e.g., eusc-de-east-1) - AMI IDs follow format: ami-{17-char-hex} (longer than standard AWS) - DNS domain: .elb.amazonaws.eu instead of .elb.amazonaws.com This enables testing OpenShift on AWS European Sovereign Cloud infrastructure, which provides EU data residency and sovereignty guarantees.

tthvo · 2026-03-31T15:18:55Z

/pj-rehearse pull-ci-openshift-installer-main-e2e-aws-eusc-techpreview

openshift-ci-robot · 2026-03-31T15:18:58Z

@tthvo: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

tthvo

/lgtm

@yunjiang29 would you like to unhold this PR if it looks good to you? openshift/sippy#3383 is merged now :D

openshift-ci · 2026-03-31T21:02:43Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liangxia, liweinan, patrickdillon, tthvo, yunjiang29

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/installer/OWNERS~~ [liangxia,patrickdillon,tthvo]
~~ci-operator/config/openshift/openshift-tests-private/OWNERS~~ [liangxia]
~~ci-operator/jobs/openshift/installer/OWNERS~~ [liangxia,patrickdillon,tthvo]
~~ci-operator/jobs/openshift/openshift-tests-private/OWNERS~~ [liangxia]
~~ci-operator/step-registry/aws/OWNERS~~ [liangxia,patrickdillon,yunjiang29]
~~ci-operator/step-registry/cluster-profiles/OWNERS~~ [liangxia]
~~ci-operator/step-registry/ipi/OWNERS~~ [liangxia,patrickdillon,yunjiang29]
~~ci-operator/step-registry/openshift/e2e/test/OWNERS~~ [liangxia]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yunjiang29 · 2026-04-01T01:33:16Z

/unhold

yunjiang29 · 2026-04-01T01:33:34Z

/pj-rehearse ack

openshift-ci-robot · 2026-04-01T01:33:36Z

@yunjiang29: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-ci · 2026-04-01T01:51:14Z

@liweinan: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-custom-dns-mini-perm-tp-arm-f7	`6aeed91`	link	unknown	`/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-custom-dns-mini-perm-tp-arm-f7`
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-fips-tp-arm-f7	`6aeed91`	link	unknown	`/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-fips-tp-arm-f7`
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-custom-dns-mini-perm-tp-amd-f28-destructive	`6aeed91`	link	unknown	`/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-custom-dns-mini-perm-tp-amd-f28-destructive`
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-fips-tp-f28-destructive	`6aeed91`	link	unknown	`/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-fips-tp-f28-destructive`
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.23-multi-nightly-aws-eusc-ipi-fips-tp-f28-destructive	`6aeed91`	link	unknown	`/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.23-multi-nightly-aws-eusc-ipi-fips-tp-f28-destructive`
ci/rehearse/openshift/installer/main/e2e-aws-eusc-techpreview	`1f3d76d`	link	unknown	`/pj-rehearse pull-ci-openshift-installer-main-e2e-aws-eusc-techpreview`
ci/rehearse/periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-private-tp-arm-f7	`028a264`	link	unknown	`/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-multi-nightly-aws-eusc-ipi-private-tp-arm-f7`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 2, 2026

openshift-ci bot requested review from neisw and xingxingxia March 2, 2026 18:05