From 003ec2ad403cef5a6d2ea9f41ecd071ec95331c9 Mon Sep 17 00:00:00 2001 From: Andrea Panattoni Date: Sun, 23 Aug 2026 19:02:29 +0200 Subject: [PATCH 1/2] Allow disabling OPENSHIFT_INSTALL_GATHER_BOOTSTRAP When setting `EXTRA_NETWORK_NAMES` variables, the secondary IP address are tried for SSH during the install gather phase. If the addresses are not reachable, it takes minutes before the SSH session fails. Multiplied for each IP address and node, it becomes ~1h20m. Allow disabling `OPENSHIFT_INSTALL_GATHER_BOOTSTRAP` on `baremetalds-devscripts-setup` workflow. Signed-off-by: Andrea Panattoni --- .../devscripts/setup/baremetalds-devscripts-setup-commands.sh | 2 +- .../devscripts/setup/baremetalds-devscripts-setup-ref.yaml | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-commands.sh b/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-commands.sh index 393b9cc25c289..ec0c9ae458146 100644 --- a/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-commands.sh +++ b/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-commands.sh @@ -187,7 +187,7 @@ fi # We always want to collect an installer log bundle for bootstrap, # even on success cat - <> "${SHARED_DIR}/dev-scripts-additional-config" -export OPENSHIFT_INSTALL_GATHER_BOOTSTRAP=true +export OPENSHIFT_INSTALL_GATHER_BOOTSTRAP=${OPENSHIFT_INSTALL_GATHER_BOOTSTRAP:-true} export OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY=${OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY:-} EOF diff --git a/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-ref.yaml b/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-ref.yaml index 0577a9b8195af..8201839305fdf 100644 --- a/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-ref.yaml +++ b/ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-ref.yaml @@ -30,6 +30,9 @@ ref: - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY default: "true" documentation: "Set to true to disable the Sigstore image signature policy to allow the installation of an unsigned release image. This is for internal CI testing only" + - name: OPENSHIFT_INSTALL_GATHER_BOOTSTRAP + default: "true" + documentation: "Set to false to disable the bootstrap gather." dependencies: - name: "release:latest" env: OPENSHIFT_INSTALL_RELEASE_IMAGE From 2b481d19a053c776d5353fca41ff9e8d5a91c040 Mon Sep 17 00:00:00 2001 From: Ori Braunshtein Date: Mon, 10 Aug 2026 09:06:16 +0300 Subject: [PATCH 2/2] feat: add OpenPERouter baremetal E2E deploy lane Baseline for the openperouter-e2e-metal test. Currently deploys the operator via OLM bundle on a baremetal OCP cluster and verifies all components (operator, webhook, controller, router) come up healthy. The full E2E lane will extend this with containerlab fabric setup and test execution. The bundle image is now built using bundle.Dockerfile rather than bundle.Dockerfile.openshift (like the other telco-5g projects using konflux here). Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Ori Braunshtein --- .../openshift-kni-openperouter-main.yaml | 42 +++++++++- ...hift-kni-openperouter-main-presubmits.yaml | 83 +++++++++++++++++++ .../step-registry/openperouter/e2e/OWNERS | 11 +++ .../e2e/openperouter-e2e-commands.sh | 67 +++++++++++++++ .../e2e/openperouter-e2e-ref.metadata.json | 17 ++++ .../e2e/openperouter-e2e-ref.yaml | 14 ++++ 6 files changed, 231 insertions(+), 3 deletions(-) create mode 100644 ci-operator/step-registry/openperouter/e2e/OWNERS create mode 100644 ci-operator/step-registry/openperouter/e2e/openperouter-e2e-commands.sh create mode 100644 ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.metadata.json create mode 100644 ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.yaml diff --git a/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml b/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml index 529b5cd31f10c..b5f79da118569 100644 --- a/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml +++ b/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml @@ -1,3 +1,12 @@ +base_images: + cli-operator-sdk: + name: cli-operator-sdk + namespace: ocp + tag: v1.39.2 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts binary_build_commands: make build build_root: image_stream_tag: @@ -9,7 +18,8 @@ images: items: - dockerfile_path: Dockerfile.openshift to: openperouter-operator - - dockerfile_path: operator/bundle.Dockerfile.openshift + - context_dir: operator + dockerfile_path: bundle.Dockerfile to: openperouter-operator-bundle - build_args: - name: BASE_IMAGE @@ -19,10 +29,11 @@ images: operator: bundles: - as: operator-bundle - dockerfile_path: operator/bundle.Dockerfile.openshift + context_dir: operator + dockerfile_path: bundle.Dockerfile skip_building_index: true substitutions: - - pullspec: quay.io/redhat-user-workloads/telco-5g-tenant/openperouter-operator-[\d].* + - pullspec: quay.io/openperouter/router:main with: pipeline:openperouter-operator promotion: to: @@ -47,6 +58,31 @@ resources: requests: cpu: 100m memory: 200Mi +tests: +- as: openperouter-e2e-metal + cluster: build05 + steps: + cluster_profile: equinix-ocp-metal + dependencies: + OO_BUNDLE: operator-bundle + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4v6 + NETWORK_TYPE=OVNKubernetes + EXTRA_NETWORK_NAMES="toswitch1 toswitch2" + TOSWITCH1_NETWORK_SUBNET_V4='192.168.11.0/24' + TOSWITCH1_NETWORK_SUBNET_V6='2001:db8:11::/64' + TOSWITCH2_NETWORK_SUBNET_V4='192.168.12.0/24' + TOSWITCH2_NETWORK_SUBNET_V6='2001:db8:12::/64' + NUM_WORKERS=2 + ENABLE_LOCAL_REGISTRY=true + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: openshift-openperouter-system + OPENSHIFT_INSTALL_GATHER_BOOTSTRAP: "false" + test: + - ref: optional-operators-operator-sdk + - ref: openperouter-e2e + workflow: baremetalds-e2e zz_generated_metadata: branch: main org: openshift-kni diff --git a/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml b/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml index e7cd5b88239fb..c3f5699420109 100644 --- a/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml +++ b/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml @@ -111,3 +111,86 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/openperouter-e2e-metal + decorate: true + decoration_config: {} + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci-operator.openshift.io/cluster: build05 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-kni-openperouter-main-openperouter-e2e-metal + path_alias: github.com/openperouter/openperouter + rerun_command: /test openperouter-e2e-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=openperouter-e2e-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )openperouter-e2e-metal,?($|\s.*) diff --git a/ci-operator/step-registry/openperouter/e2e/OWNERS b/ci-operator/step-registry/openperouter/e2e/OWNERS new file mode 100644 index 0000000000000..9827a2117fb39 --- /dev/null +++ b/ci-operator/step-registry/openperouter/e2e/OWNERS @@ -0,0 +1,11 @@ +approvers: +- fedepaol +- maiqueb +- oribon +- zeeke +reviewers: +- fedepaol +- maiqueb +- oribon +- zeeke + diff --git a/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-commands.sh b/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-commands.sh new file mode 100644 index 0000000000000..e1e3edce4083c --- /dev/null +++ b/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-commands.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +set -o nounset +set -o errexit +set -o pipefail + +echo "************ openperouter deploy-verify test ************" + +# shellcheck source=/dev/null +source "${SHARED_DIR}/packet-conf.sh" + +echo "### Copying openperouter PR source to remote host" +OPENPEROUTER_SRC="/go/src/github.com/openperouter/openperouter" +ssh "${SSHOPTS[@]}" "root@${IP}" "mkdir -p /root/openperouter" +scp "${SSHOPTS[@]}" "${OPENPEROUTER_SRC}/Makefile" "root@${IP}:/root/openperouter/" +scp "${SSHOPTS[@]}" -r "${OPENPEROUTER_SRC}/e2etests" "root@${IP}:/root/openperouter/" + +echo "### Create OpenPERouter CR and verify deployment" +ssh "${SSHOPTS[@]}" "root@${IP}" bash -s << 'EOFDEPLOY' +set -euo pipefail +export KUBECONFIG=/root/dev-scripts/ocp/ostest/auth/kubeconfig + +# Ensure namespace is privileged (router pods need host networking + nsenter) +oc label --overwrite ns openshift-openperouter-system \ + pod-security.kubernetes.io/enforce=privileged \ + pod-security.kubernetes.io/audit=privileged \ + pod-security.kubernetes.io/warn=privileged + +# Create OpenPERouter CR +cat <<'EOF' | oc apply -f - +apiVersion: network.openperouter.io/v1alpha1 +kind: OpenPERouter +metadata: + name: openperouter + namespace: openshift-openperouter-system +spec: + logLevel: debug +EOF + +# Wait for controller and router daemonsets to be created and rolled out +for ds in controller router; do + echo "Waiting for daemonset $ds to be created..." + deadline=$((SECONDS + 300)) + until oc get daemonset "$ds" -n openshift-openperouter-system &>/dev/null; do + if (( SECONDS >= deadline )); then + echo "ERROR: Timed out waiting for daemonset $ds" + exit 1 + fi + sleep 5 + done + oc rollout status daemonset/"$ds" -n openshift-openperouter-system --timeout=300s +done + +echo "=== Deploy verification ===" +oc get pods -n openshift-openperouter-system -o wide +oc get daemonset -n openshift-openperouter-system + +# Verify all pods are Running and Ready +NOT_READY=$(oc get pods -n openshift-openperouter-system --no-headers | grep -v "Completed" | grep -v "1/1\|2/2\|3/3\|4/4\|5/5" || true) +if [ -n "$NOT_READY" ]; then + echo "ERROR: Some pods are not fully ready:" + echo "$NOT_READY" + exit 1 +fi + +echo "All openperouter pods are running and ready" +EOFDEPLOY diff --git a/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.metadata.json b/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.metadata.json new file mode 100644 index 0000000000000..19a59ac69df32 --- /dev/null +++ b/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.metadata.json @@ -0,0 +1,17 @@ +{ + "path": "openperouter/e2e/openperouter-e2e-ref.yaml", + "owners": { + "approvers": [ + "fedepaol", + "maiqueb", + "oribon", + "zeeke" + ], + "reviewers": [ + "fedepaol", + "maiqueb", + "oribon", + "zeeke" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.yaml b/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.yaml new file mode 100644 index 0000000000000..73d89f138049a --- /dev/null +++ b/ci-operator/step-registry/openperouter/e2e/openperouter-e2e-ref.yaml @@ -0,0 +1,14 @@ +ref: + as: openperouter-e2e + from: src + grace_period: 10m + commands: openperouter-e2e-commands.sh + timeout: 3600s + resources: + requests: + cpu: 100m + memory: 200Mi + documentation: |- + Create OpenPERouter CR and verify that operator, controller, and router + daemonsets come up healthy. OLM bundle deploy is handled by the + optional-operators-operator-sdk step.