WINC-2016: Add TechPreview variant of WMCO aws-e2e-ote presubmit - #84451
redhat-chai-bot wants to merge 8 commits into
Conversation
|
@redhat-chai-bot: This pull request references WINC-2016 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe master and release-5.0 configurations add an optional AWS end-to-end TechPreview job. The job enables TLS adherence, verifies the cluster settings, and runs the WMCO extension test flow. ChangesAWS TLS adherence CI coverage
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant CIJob
participant Cluster
participant WMCOTests
CIJob->>Cluster: Enable TLSAdherence and configure StrictAllComponents
Cluster-->>CIJob: Report feature-gate and TLS adherence status
CIJob->>Cluster: Wait for cluster stabilization
CIJob->>WMCOTests: Run WMCO setup and extension e2e tests
Suggested reviewers: Merge Risk: 🟡 Moderate · up to The new TLS adherence job can pass without actually exercising the enabled feature gate, so its result may provide false confidence and should be corrected before merge. 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/lgtm |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: redhat-chai-bot, rrasouli The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/test ci-operator-config ci-operator-registry |
|
/retest-required AI-generated. Review for accuracy. |
|
New changes are detected. LGTM label has been removed. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview AI-generated. Review for accuracy. |
|
@redhat-chai-bot: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/test aws-e2e-ote-techpreview |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
@dominikholler: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
@dominikholler: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
@redhat-chai-bot Diagnosed both What actually happened (from both build logs)
Why this is a regression, not a real problemAgainst Suggested fix — verify the real invariant, not the pollDon't gate the step on the featuregate-status jq. The true success criterion is that echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..."
oc patch featuregate cluster --type=merge \
-p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}'
echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..."
ok=false
for i in $(seq 1 60); do
# tolerate the ~4 min API blip that CustomNoUpgrade triggers
if oc patch apiserver cluster --type=merge \
-p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \
&& [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then
ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break
fi
echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15
done
[ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; }
echo "Waiting for cluster to stabilize..."
oc adm wait-for-stable-cluster --timeout=30m
oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade
oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents
echo "TLSAdherence enabled and verified successfully."This keeps your fail-fast intent (it still Once the step is fixed, a fresh rehearsal on both jobs should go green: the |
@redhat-chai-bot
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview |
|
@dominikholler: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
@redhat-chai-bot and the release-5.0 job on the same tip: /pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
@dominikholler: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
878b9a9 to
5597613
Compare
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Add a new presubmit test aws-e2e-ote-techpreview to both master and release-5.0 configs. The test copies the existing aws-e2e-ote test and adds an enable-tls-adherence step that enables TLSAdherence via CustomNoUpgrade post-install, allowing TLS profile adherence tests to run without switching to CAPI (which breaks MAPI-dependent WMCO e2e tests). The enable-tls-adherence step: - Patches featuregate cluster to CustomNoUpgrade with TLSAdherence - Waits for the gate to be observed in featuregate status - Sets apiserver tlsAdherence to StrictAllComponents - Waits for cluster stabilization - Verifies settings before proceeding The test is optional (always_run: false) and only runs when manually triggered with /test aws-e2e-ote-techpreview.
Add TEST_SKIPS: \[Disruptive\] to the aws-e2e-ote-techpreview env in both master and release-5.0 configs. This tells openshift-tests to skip any test spec tagged [Disruptive], avoiding unrelated timeout and node-wedge failures seen in rehearsals.
Add a post-loop check to the enable-tls-adherence step that exits 1 if the TLSAdherence feature gate never became active after 15 minutes of polling. Previously the loop would silently fall through, causing the apiserver patch to silently drop the tlsAdherence field.
Change TEST_SKIPS in aws-e2e-ote-techpreview from \[Disruptive\] to \[node-proxy\]|\[Disruptive\] to match the base aws-e2e-ote job's node-proxy skip while also excluding Disruptive tests.
The featuregate-status jq poll never actually matched TLSAdherence (it ran all 60 iterations even on the successful run). Replace with a retry loop on the apiserver patch itself — the true invariant is whether the apiserver accepts tlsAdherence=StrictAllComponents. The new loop retries the oc patch + read-back through the ~4 min kube-apiserver rollout that follows featuregate change, and exits 1 only if the apiserver never accepts StrictAllComponents.
Remove TEST_SKIPS env var from the techpreview variant in both master and release-5.0 configs to run the full test suite without skipping any tests.
The master aws-e2e-ote base job skips node-proxy tests via TEST_SKIPS: \[node-proxy\]. Add the same skip to the techpreview variant so it stays aligned with its base. The release-5.0 techpreview variant is already aligned (neither it nor its base have TEST_SKIPS), so no change needed there. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Change aws-e2e-ote-techpreview TEST_ARGS from --disable-monitor=pod-network-avalibility,... (deny-list: 4 disabled, ~36 still run) to --monitor=e2e-test-analyzer (allow-list: only e2e-test-analyzer, ~40 suppressed) This aligns release-5.0 with the master config which already uses --monitor=e2e-test-analyzer, suppressing the Monitor test noise that obscures real TLS adherence results. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4f7d2a0 to
346e2c2
Compare
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview |
|
@rrasouli: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
|
@redhat-chai-bot: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Summary
Add a new optional presubmit job
aws-e2e-ote-techpreviewfor the Windows Machine Config Operator (WMCO) that installs a cluster withTechPreviewNoUpgradefeature set enabled.Motivation
The
TLSAdherencefeature gate (merged in openshift/api#2680) is only available when theTechPreviewNoUpgradeorDevPreviewNoUpgradefeature set is enabled. The existingaws-e2e-otejob uses the default feature set, so TLS profile adherence tests (WINC-2016) are always skipped with:Changes
aws-e2e-ote-techpreviewtest entry toopenshift-windows-machine-config-operator-master.yamlaws-e2e-otebut withFEATURE_SET: TechPreviewNoUpgradein envalways_run: false,optional: true— only triggers with/test aws-e2e-ote-techpreviewmake ci-operator-configandmake jobsTesting
After merge, trigger on WMCO PRs with
/test aws-e2e-ote-techpreviewto validate TLS adherence tests run correctly on a TechPreview cluster.AI-generated. Review for accuracy.
@rrasouli requested in Slack thread
Summary by CodeRabbit
Adds an optional
aws-e2e-ote-techpreviewpresubmit job to the Windows Machine Config Operator CI configuration for master and release-5.0.The job enables
TLSAdherencewithCustomNoUpgrade, appliesStrictAllComponents, waits for cluster stabilization, and verifies the configuration before running WMCO AWS e2e tests. This preserves Machine API support.Contributors can trigger the job with
/test aws-e2e-ote-techpreview.