From 5d6919bf9f066f4fa56343228c4504000264d951 Mon Sep 17 00:00:00 2001 From: Mat Kowalski Date: Mon, 27 Jul 2026 21:09:33 +0200 Subject: [PATCH] kube-vip: build the image and promote to ocp/5.0 The kube-vip onboarding was test-only: no images stanza and no promotion, so CI never builds the container, the private-org sync and the release branching automation ignore the repo, and no release-5.0 branch is ever created. This blocks the ART payload onboarding (ART-21663, OPNET-779): MCO's image-references will reference the kube-vip payload tag (OPNET-782). Add the image build (Dockerfile.openshift) and promotion to ocp/5.0 on main, plus the release-5.0 config with promotion disabled per the pre-branch-cut convention (modeled on baremetal-runtimecfg). Signed-off-by: Mat Kowalski --- .../kube-vip/openshift-kube-vip-main.yaml | 19 +- .../openshift-kube-vip-release-5.0.yaml | 44 +++++ .../openshift-kube-vip-main-postsubmits.yaml | 63 ++++++ .../openshift-kube-vip-main-presubmits.yaml | 63 +++++- ...hift-kube-vip-release-5.0-postsubmits.yaml | 63 ++++++ ...shift-kube-vip-release-5.0-presubmits.yaml | 186 ++++++++++++++++++ 6 files changed, 435 insertions(+), 3 deletions(-) create mode 100644 ci-operator/config/openshift/kube-vip/openshift-kube-vip-release-5.0.yaml create mode 100644 ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-postsubmits.yaml create mode 100644 ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-postsubmits.yaml create mode 100644 ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-presubmits.yaml diff --git a/ci-operator/config/openshift/kube-vip/openshift-kube-vip-main.yaml b/ci-operator/config/openshift/kube-vip/openshift-kube-vip-main.yaml index 58437d0ab9b8d..ed3dc2dfc4bfb 100644 --- a/ci-operator/config/openshift/kube-vip/openshift-kube-vip-main.yaml +++ b/ci-operator/config/openshift/kube-vip/openshift-kube-vip-main.yaml @@ -3,6 +3,24 @@ build_root: name: release namespace: openshift tag: rhel-9-release-golang-1.26-openshift-5.0 +images: + items: + - dockerfile_path: Dockerfile.openshift + to: kube-vip +promotion: + to: + - name: "5.0" + namespace: ocp +releases: + initial: + integration: + name: "5.0" + namespace: ocp + latest: + integration: + include_built_images: true + name: "5.0" + namespace: ocp resources: '*': limits: @@ -10,7 +28,6 @@ resources: requests: cpu: 100m memory: 200Mi -test_binary_build_commands: go test -race ./... tests: - as: unit-tests commands: make unit-tests diff --git a/ci-operator/config/openshift/kube-vip/openshift-kube-vip-release-5.0.yaml b/ci-operator/config/openshift/kube-vip/openshift-kube-vip-release-5.0.yaml new file mode 100644 index 0000000000000..7f2315a253d47 --- /dev/null +++ b/ci-operator/config/openshift/kube-vip/openshift-kube-vip-release-5.0.yaml @@ -0,0 +1,44 @@ +build_root: + image_stream_tag: + name: release + namespace: openshift + tag: rhel-9-release-golang-1.26-openshift-5.0 +images: + items: + - dockerfile_path: Dockerfile.openshift + to: kube-vip +promotion: + to: + - disabled: true + name: "5.0" + namespace: ocp +releases: + initial: + integration: + name: "5.0" + namespace: ocp + latest: + integration: + include_built_images: true + name: "5.0" + namespace: ocp +resources: + '*': + limits: + memory: 4Gi + requests: + cpu: 100m + memory: 200Mi +tests: +- as: unit-tests + commands: make unit-tests + container: + from: src +- as: integration-tests + commands: make integration-tests + container: + from: src +zz_generated_metadata: + branch: release-5.0 + org: openshift + repo: kube-vip diff --git a/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-postsubmits.yaml b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-postsubmits.yaml new file mode 100644 index 0000000000000..3fa9f63afc5b7 --- /dev/null +++ b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-postsubmits.yaml @@ -0,0 +1,63 @@ +postsubmits: + openshift/kube-vip: + - agent: kubernetes + always_run: true + branches: + - ^main$ + cluster: build01 + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile.openshift + labels: + ci-operator.openshift.io/is-promotion: "true" + ci.openshift.io/generator: prowgen + max_concurrency: 1 + name: branch-ci-openshift-kube-vip-main-images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --image-mirror-push-secret=/etc/push-secret/.dockerconfigjson + - --promote + - --report-credentials-file=/etc/report/credentials + - --target=[images] + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/push-secret + name: push-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: push-secret + secret: + secretName: registry-push-credentials-ci-central + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-presubmits.yaml b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-presubmits.yaml index c8b3b8747e992..8967cab3daaf9 100644 --- a/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-main-presubmits.yaml @@ -1,5 +1,62 @@ presubmits: openshift/kube-vip: + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build08 + context: ci/prow/images + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile.openshift + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-kube-vip-main-images + rerun_command: /test images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + - --target=[release:latest] + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )images,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -9,7 +66,8 @@ presubmits: context: ci/prow/integration-tests decorate: true decoration_config: - skip_cloning: true + sparse_checkout_files: + - Dockerfile.openshift labels: ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" @@ -72,7 +130,8 @@ presubmits: context: ci/prow/unit-tests decorate: true decoration_config: - skip_cloning: true + sparse_checkout_files: + - Dockerfile.openshift labels: ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" diff --git a/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-postsubmits.yaml b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-postsubmits.yaml new file mode 100644 index 0000000000000..45330d4ee951a --- /dev/null +++ b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-postsubmits.yaml @@ -0,0 +1,63 @@ +postsubmits: + openshift/kube-vip: + - agent: kubernetes + always_run: true + branches: + - ^release-5\.0$ + cluster: build01 + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile.openshift + labels: + ci-operator.openshift.io/is-promotion: "true" + ci.openshift.io/generator: prowgen + max_concurrency: 1 + name: branch-ci-openshift-kube-vip-release-5.0-images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --image-mirror-push-secret=/etc/push-secret/.dockerconfigjson + - --promote + - --report-credentials-file=/etc/report/credentials + - --target=[images] + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/push-secret + name: push-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: push-secret + secret: + secretName: registry-push-credentials-ci-central + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-presubmits.yaml new file mode 100644 index 0000000000000..420cfb0856e8d --- /dev/null +++ b/ci-operator/jobs/openshift/kube-vip/openshift-kube-vip-release-5.0-presubmits.yaml @@ -0,0 +1,186 @@ +presubmits: + openshift/kube-vip: + - agent: kubernetes + always_run: true + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build01 + context: ci/prow/images + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile.openshift + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-kube-vip-release-5.0-images + rerun_command: /test images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build01 + context: ci/prow/integration-tests + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile.openshift + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-kube-vip-release-5.0-integration-tests + rerun_command: /test integration-tests + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=integration-tests + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )integration-tests,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build01 + context: ci/prow/unit-tests + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile.openshift + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-kube-vip-release-5.0-unit-tests + rerun_command: /test unit-tests + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=unit-tests + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )unit-tests,?($|\s.*)