diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index 4477b0e9b535e..c454bf29b35b0 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -138,6 +138,72 @@ tests: - ref: openshift-tests-extension-setup-out-of-payload - ref: openshift-e2e-test workflow: ipi-aws-ovn-hybrid +- always_run: false + as: aws-e2e-ote-techpreview + optional: true + pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$|^ote/test/e2e/proxy\.go$ + steps: + cluster_profile: openshift-org-aws + dependencies: + EXTENSION_IMAGE: windows-machine-config-operator-test + env: + COMPUTE_NODE_REPLICAS: "1" + CONTROL_PLANE_REPLICAS: "1" + EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz + EXTENSION_COMPONENT_NAME: windows-machine-config-operator + TEST_ARGS: --monitor=e2e-test-analyzer + TEST_SKIPS: \[node-proxy\] + TEST_SUITE: windows-machine-config-operator/all + test: + - as: enable-tls-adherence + cli: latest + commands: | + set -euo pipefail + echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..." + oc patch featuregate cluster --type=merge \ + -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' + + echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..." + ok=false + for i in $(seq 1 60); do + if oc patch apiserver cluster --type=merge \ + -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \ + && [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then + ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break + fi + echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15 + done + [ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; } + + echo "Waiting for cluster to stabilize..." + oc adm wait-for-stable-cluster --timeout=30m + + oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade + oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents + echo "TLSAdherence enabled and verified successfully." + from: cli + resources: + requests: + cpu: 100m + memory: 100Mi + - as: wmco-setup-and-test + cli: latest + commands: | + export AWS_SHARED_CREDENTIALS_FILE=${CLUSTER_PROFILE_DIR}/.awscred + export KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey + hack/run-ci-e2e-test.sh -t setup-only -s + dependencies: + - env: OPERATOR_IMAGE + name: windows-machine-config-operator-test + from: windows-machine-config-operator-test + resources: + requests: + cpu: 1000m + memory: 400Mi + timeout: 2h15m0s + - ref: openshift-tests-extension-setup-out-of-payload + - ref: openshift-e2e-test + workflow: ipi-aws-ovn-hybrid - always_run: false as: aws-e2e-operator-windows-server-2025 cron: 0 2 * * 1 diff --git a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml index 917d15bec3896..18ca15f3043f8 100644 --- a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml @@ -211,6 +211,112 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )aws-e2e-ote,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$|^ote/test/e2e/proxy\.go$ + branches: + - ^master$ + - ^master- + cluster: build03 + context: ci/prow/aws-e2e-ote-techpreview + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - build/Dockerfile.ci + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview + optional: true + rerun_command: /test aws-e2e-ote-techpreview + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=aws-e2e-ote-techpreview + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )aws-e2e-ote-techpreview,?($|\s.*) - agent: kubernetes always_run: false annotations: