From 3d596d07af9eb0c4c988eb8ee8959d321db7178d Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Fri, 11 Sep 2026 15:37:19 +0000 Subject: [PATCH 1/9] Add aws-e2e-ote-techpreview CI variant for WMCO Add a new presubmit test aws-e2e-ote-techpreview to both master and release-5.0 configs. The test copies the existing aws-e2e-ote test and adds an enable-tls-adherence step that enables TLSAdherence via CustomNoUpgrade post-install, allowing TLS profile adherence tests to run without switching to CAPI (which breaks MAPI-dependent WMCO e2e tests). The enable-tls-adherence step: - Patches featuregate cluster to CustomNoUpgrade with TLSAdherence - Waits for the gate to be observed in featuregate status - Sets apiserver tlsAdherence to StrictAllComponents - Waits for cluster stabilization - Verifies settings before proceeding The test is optional (always_run: false) and only runs when manually triggered with /test aws-e2e-ote-techpreview. --- ...indows-machine-config-operator-master.yaml | 63 +++++++++++ ...s-machine-config-operator-release-5.0.yaml | 62 ++++++++++ ...ine-config-operator-master-presubmits.yaml | 106 ++++++++++++++++++ ...onfig-operator-release-5.0-presubmits.yaml | 106 ++++++++++++++++++ 4 files changed, 337 insertions(+) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index 4477b0e9b535e..ad07f376cea5f 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -138,6 +138,69 @@ tests: - ref: openshift-tests-extension-setup-out-of-payload - ref: openshift-e2e-test workflow: ipi-aws-ovn-hybrid +- always_run: false + as: aws-e2e-ote-techpreview + optional: true + pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$|^ote/test/e2e/proxy\.go$ + steps: + cluster_profile: openshift-org-aws + dependencies: + EXTENSION_IMAGE: windows-machine-config-operator-test + env: + COMPUTE_NODE_REPLICAS: "1" + CONTROL_PLANE_REPLICAS: "1" + EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz + EXTENSION_COMPONENT_NAME: windows-machine-config-operator + TEST_ARGS: --monitor=e2e-test-analyzer + TEST_SKIPS: \[node-proxy\] + TEST_SUITE: windows-machine-config-operator/all + test: + - as: enable-tls-adherence + cli: latest + commands: | + echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..." + oc patch featuregate cluster --type=merge -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' + echo "Waiting for TLSAdherence to be observed in featuregate status..." + version=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') + for i in $(seq 1 60); do + if oc get featuregate cluster -o json | jq -e --arg v "$version" '.status.featureGates[]? | select(.version==$v) | .enabled[]?.name | select(.=="TLSAdherence")' >/dev/null 2>&1; then + echo "TLSAdherence gate active for version $version" + break + fi + echo " waiting for TLSAdherence gate ($i/60)..." + sleep 15 + done + echo "Setting tlsAdherence to StrictAllComponents..." + oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' + echo "Waiting for cluster to stabilize..." + oc adm wait-for-stable-cluster --timeout=30m + echo "Verifying TLSAdherence is enabled..." + oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade + oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents + echo "TLSAdherence enabled and verified successfully." + from: cli + resources: + requests: + cpu: 100m + memory: 100Mi + - as: wmco-setup-and-test + cli: latest + commands: | + export AWS_SHARED_CREDENTIALS_FILE=${CLUSTER_PROFILE_DIR}/.awscred + export KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey + hack/run-ci-e2e-test.sh -t setup-only -s + dependencies: + - env: OPERATOR_IMAGE + name: windows-machine-config-operator-test + from: windows-machine-config-operator-test + resources: + requests: + cpu: 1000m + memory: 400Mi + timeout: 2h15m0s + - ref: openshift-tests-extension-setup-out-of-payload + - ref: openshift-e2e-test + workflow: ipi-aws-ovn-hybrid - always_run: false as: aws-e2e-operator-windows-server-2025 cron: 0 2 * * 1 diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index 498312ec0e8b7..0a382b60c95f0 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -133,6 +133,68 @@ tests: - ref: openshift-tests-extension-setup-out-of-payload - ref: openshift-e2e-test workflow: ipi-aws-ovn-hybrid +- always_run: false + as: aws-e2e-ote-techpreview + optional: true + pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$ + steps: + cluster_profile: openshift-org-aws + dependencies: + EXTENSION_IMAGE: windows-machine-config-operator-test + env: + COMPUTE_NODE_REPLICAS: "1" + CONTROL_PLANE_REPLICAS: "1" + EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz + EXTENSION_COMPONENT_NAME: windows-machine-config-operator + TEST_ARGS: --disable-monitor=pod-network-avalibility,required-scc-annotation-checker,termination-message-policy,kubelet-log-collector + TEST_SUITE: windows-machine-config-operator/all + test: + - as: enable-tls-adherence + cli: latest + commands: | + echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..." + oc patch featuregate cluster --type=merge -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' + echo "Waiting for TLSAdherence to be observed in featuregate status..." + version=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') + for i in $(seq 1 60); do + if oc get featuregate cluster -o json | jq -e --arg v "$version" '.status.featureGates[]? | select(.version==$v) | .enabled[]?.name | select(.=="TLSAdherence")' >/dev/null 2>&1; then + echo "TLSAdherence gate active for version $version" + break + fi + echo " waiting for TLSAdherence gate ($i/60)..." + sleep 15 + done + echo "Setting tlsAdherence to StrictAllComponents..." + oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' + echo "Waiting for cluster to stabilize..." + oc adm wait-for-stable-cluster --timeout=30m + echo "Verifying TLSAdherence is enabled..." + oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade + oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents + echo "TLSAdherence enabled and verified successfully." + from: cli + resources: + requests: + cpu: 100m + memory: 100Mi + - as: wmco-setup-and-test + cli: latest + commands: | + export AWS_SHARED_CREDENTIALS_FILE=${CLUSTER_PROFILE_DIR}/.awscred + export KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey + hack/run-ci-e2e-test.sh -t setup-only -s + dependencies: + - env: OPERATOR_IMAGE + name: windows-machine-config-operator-test + from: windows-machine-config-operator-test + resources: + requests: + cpu: 1000m + memory: 400Mi + timeout: 2h15m0s + - ref: openshift-tests-extension-setup-out-of-payload + - ref: openshift-e2e-test + workflow: ipi-aws-ovn-hybrid - always_run: false as: vsphere-disconnected-e2e-operator optional: true diff --git a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml index 917d15bec3896..18ca15f3043f8 100644 --- a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml @@ -211,6 +211,112 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )aws-e2e-ote,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$|^ote/test/e2e/proxy\.go$ + branches: + - ^master$ + - ^master- + cluster: build03 + context: ci/prow/aws-e2e-ote-techpreview + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - build/Dockerfile.ci + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview + optional: true + rerun_command: /test aws-e2e-ote-techpreview + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=aws-e2e-ote-techpreview + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )aws-e2e-ote-techpreview,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml index e87d512a59324..c5ba6ad5bfeaf 100644 --- a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml @@ -211,6 +211,112 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )aws-e2e-ote,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$ + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build10 + context: ci/prow/aws-e2e-ote-techpreview + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - build/Dockerfile.ci + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview + optional: true + rerun_command: /test aws-e2e-ote-techpreview + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=aws-e2e-ote-techpreview + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )aws-e2e-ote-techpreview,?($|\s.*) - agent: kubernetes always_run: false annotations: From 762fd28a0fabb513c24e85c9fe6363267390ee60 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Fri, 11 Sep 2026 22:27:03 +0000 Subject: [PATCH 2/9] Skip Disruptive tests in aws-e2e-ote-techpreview Add TEST_SKIPS: \[Disruptive\] to the aws-e2e-ote-techpreview env in both master and release-5.0 configs. This tells openshift-tests to skip any test spec tagged [Disruptive], avoiding unrelated timeout and node-wedge failures seen in rehearsals. --- .../openshift-windows-machine-config-operator-master.yaml | 2 +- .../openshift-windows-machine-config-operator-release-5.0.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index ad07f376cea5f..40ff842b39227 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -152,7 +152,7 @@ tests: EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator TEST_ARGS: --monitor=e2e-test-analyzer - TEST_SKIPS: \[node-proxy\] + TEST_SKIPS: \[Disruptive\] TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index 0a382b60c95f0..245d70cd38421 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -147,6 +147,7 @@ tests: EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator TEST_ARGS: --disable-monitor=pod-network-avalibility,required-scc-annotation-checker,termination-message-policy,kubelet-log-collector + TEST_SKIPS: \[Disruptive\] TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence From 9ab736207be9f527d0e3c7a8f5a30f6e455eae3d Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Fri, 11 Sep 2026 22:36:02 +0000 Subject: [PATCH 3/9] Fail explicitly if TLSAdherence gate never activates Add a post-loop check to the enable-tls-adherence step that exits 1 if the TLSAdherence feature gate never became active after 15 minutes of polling. Previously the loop would silently fall through, causing the apiserver patch to silently drop the tlsAdherence field. --- .../openshift-windows-machine-config-operator-master.yaml | 6 ++++++ ...enshift-windows-machine-config-operator-release-5.0.yaml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index 40ff842b39227..ae9c5fc138d87 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -162,14 +162,20 @@ tests: oc patch featuregate cluster --type=merge -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' echo "Waiting for TLSAdherence to be observed in featuregate status..." version=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') + tls_adherence_active=false for i in $(seq 1 60); do if oc get featuregate cluster -o json | jq -e --arg v "$version" '.status.featureGates[]? | select(.version==$v) | .enabled[]?.name | select(.=="TLSAdherence")' >/dev/null 2>&1; then echo "TLSAdherence gate active for version $version" + tls_adherence_active=true break fi echo " waiting for TLSAdherence gate ($i/60)..." sleep 15 done + if [ "$tls_adherence_active" != "true" ]; then + echo "ERROR: TLSAdherence gate did not become active after 15 minutes" + exit 1 + fi echo "Setting tlsAdherence to StrictAllComponents..." oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' echo "Waiting for cluster to stabilize..." diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index 245d70cd38421..72b991d644614 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -157,14 +157,20 @@ tests: oc patch featuregate cluster --type=merge -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' echo "Waiting for TLSAdherence to be observed in featuregate status..." version=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') + tls_adherence_active=false for i in $(seq 1 60); do if oc get featuregate cluster -o json | jq -e --arg v "$version" '.status.featureGates[]? | select(.version==$v) | .enabled[]?.name | select(.=="TLSAdherence")' >/dev/null 2>&1; then echo "TLSAdherence gate active for version $version" + tls_adherence_active=true break fi echo " waiting for TLSAdherence gate ($i/60)..." sleep 15 done + if [ "$tls_adherence_active" != "true" ]; then + echo "ERROR: TLSAdherence gate did not become active after 15 minutes" + exit 1 + fi echo "Setting tlsAdherence to StrictAllComponents..." oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' echo "Waiting for cluster to stabilize..." From fbe8cd6acb9e8d77b2a9fa243dc97db7934ba946 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Fri, 11 Sep 2026 22:52:23 +0000 Subject: [PATCH 4/9] Combine node-proxy and Disruptive skip patterns in master config Change TEST_SKIPS in aws-e2e-ote-techpreview from \[Disruptive\] to \[node-proxy\]|\[Disruptive\] to match the base aws-e2e-ote job's node-proxy skip while also excluding Disruptive tests. --- .../openshift-windows-machine-config-operator-master.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index ae9c5fc138d87..f2ee687623731 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -152,7 +152,7 @@ tests: EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator TEST_ARGS: --monitor=e2e-test-analyzer - TEST_SKIPS: \[Disruptive\] + TEST_SKIPS: \[node-proxy\]|\[Disruptive\] TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence From 8a8c8490948bad238b026080b903eb918bf44c18 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Sat, 12 Sep 2026 07:11:33 +0000 Subject: [PATCH 5/9] Replace flawed featuregate jq poll with apiserver patch retry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The featuregate-status jq poll never actually matched TLSAdherence (it ran all 60 iterations even on the successful run). Replace with a retry loop on the apiserver patch itself — the true invariant is whether the apiserver accepts tlsAdherence=StrictAllComponents. The new loop retries the oc patch + read-back through the ~4 min kube-apiserver rollout that follows featuregate change, and exits 1 only if the apiserver never accepts StrictAllComponents. --- ...indows-machine-config-operator-master.yaml | 31 +++++++++---------- ...s-machine-config-operator-release-5.0.yaml | 31 +++++++++---------- 2 files changed, 28 insertions(+), 34 deletions(-) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index f2ee687623731..800f8971a33b7 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -158,29 +158,26 @@ tests: - as: enable-tls-adherence cli: latest commands: | + set -euo pipefail echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..." - oc patch featuregate cluster --type=merge -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' - echo "Waiting for TLSAdherence to be observed in featuregate status..." - version=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') - tls_adherence_active=false + oc patch featuregate cluster --type=merge \ + -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' + + echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..." + ok=false for i in $(seq 1 60); do - if oc get featuregate cluster -o json | jq -e --arg v "$version" '.status.featureGates[]? | select(.version==$v) | .enabled[]?.name | select(.=="TLSAdherence")' >/dev/null 2>&1; then - echo "TLSAdherence gate active for version $version" - tls_adherence_active=true - break + if oc patch apiserver cluster --type=merge \ + -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \ + && [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then + ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break fi - echo " waiting for TLSAdherence gate ($i/60)..." - sleep 15 + echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15 done - if [ "$tls_adherence_active" != "true" ]; then - echo "ERROR: TLSAdherence gate did not become active after 15 minutes" - exit 1 - fi - echo "Setting tlsAdherence to StrictAllComponents..." - oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' + [ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; } + echo "Waiting for cluster to stabilize..." oc adm wait-for-stable-cluster --timeout=30m - echo "Verifying TLSAdherence is enabled..." + oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents echo "TLSAdherence enabled and verified successfully." diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index 72b991d644614..4e13a9fe33fb8 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -153,29 +153,26 @@ tests: - as: enable-tls-adherence cli: latest commands: | + set -euo pipefail echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..." - oc patch featuregate cluster --type=merge -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' - echo "Waiting for TLSAdherence to be observed in featuregate status..." - version=$(oc get clusterversion version -o jsonpath='{.status.desired.version}') - tls_adherence_active=false + oc patch featuregate cluster --type=merge \ + -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' + + echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..." + ok=false for i in $(seq 1 60); do - if oc get featuregate cluster -o json | jq -e --arg v "$version" '.status.featureGates[]? | select(.version==$v) | .enabled[]?.name | select(.=="TLSAdherence")' >/dev/null 2>&1; then - echo "TLSAdherence gate active for version $version" - tls_adherence_active=true - break + if oc patch apiserver cluster --type=merge \ + -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \ + && [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then + ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break fi - echo " waiting for TLSAdherence gate ($i/60)..." - sleep 15 + echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15 done - if [ "$tls_adherence_active" != "true" ]; then - echo "ERROR: TLSAdherence gate did not become active after 15 minutes" - exit 1 - fi - echo "Setting tlsAdherence to StrictAllComponents..." - oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' + [ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; } + echo "Waiting for cluster to stabilize..." oc adm wait-for-stable-cluster --timeout=30m - echo "Verifying TLSAdherence is enabled..." + oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents echo "TLSAdherence enabled and verified successfully." From 0876627e9776c1e20e6433417357556d39f206f0 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Mon, 14 Sep 2026 08:37:42 +0000 Subject: [PATCH 6/9] Remove TEST_SKIPS from aws-e2e-ote-techpreview Remove TEST_SKIPS env var from the techpreview variant in both master and release-5.0 configs to run the full test suite without skipping any tests. --- .../openshift-windows-machine-config-operator-master.yaml | 1 - .../openshift-windows-machine-config-operator-release-5.0.yaml | 1 - 2 files changed, 2 deletions(-) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index 800f8971a33b7..5bf919c647a60 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -152,7 +152,6 @@ tests: EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator TEST_ARGS: --monitor=e2e-test-analyzer - TEST_SKIPS: \[node-proxy\]|\[Disruptive\] TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index 4e13a9fe33fb8..c449da51b4a47 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -147,7 +147,6 @@ tests: EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator TEST_ARGS: --disable-monitor=pod-network-avalibility,required-scc-annotation-checker,termination-message-policy,kubelet-log-collector - TEST_SKIPS: \[Disruptive\] TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence From 1b7abe4e6886970a5e3224e5f95f1b113101853d Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Tue, 15 Sep 2026 05:48:37 +0000 Subject: [PATCH 7/9] Add TEST_SKIPS to master aws-e2e-ote-techpreview to match base job The master aws-e2e-ote base job skips node-proxy tests via TEST_SKIPS: \[node-proxy\]. Add the same skip to the techpreview variant so it stays aligned with its base. The release-5.0 techpreview variant is already aligned (neither it nor its base have TEST_SKIPS), so no change needed there. Co-Authored-By: Claude Opus 4.6 --- .../openshift-windows-machine-config-operator-master.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml index 5bf919c647a60..c454bf29b35b0 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml @@ -152,6 +152,7 @@ tests: EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator TEST_ARGS: --monitor=e2e-test-analyzer + TEST_SKIPS: \[node-proxy\] TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence From 346e2c2c0b5b2b03b4ce1cc2307732892108af56 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Tue, 15 Sep 2026 06:50:22 +0000 Subject: [PATCH 8/9] Switch release-5.0 techpreview TEST_ARGS from deny-list to allow-list Change aws-e2e-ote-techpreview TEST_ARGS from --disable-monitor=pod-network-avalibility,... (deny-list: 4 disabled, ~36 still run) to --monitor=e2e-test-analyzer (allow-list: only e2e-test-analyzer, ~40 suppressed) This aligns release-5.0 with the master config which already uses --monitor=e2e-test-analyzer, suppressing the Monitor test noise that obscures real TLS adherence results. Co-Authored-By: Claude Opus 4.6 --- .../openshift-windows-machine-config-operator-release-5.0.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index c449da51b4a47..b36e1d762a078 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -146,7 +146,7 @@ tests: CONTROL_PLANE_REPLICAS: "1" EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz EXTENSION_COMPONENT_NAME: windows-machine-config-operator - TEST_ARGS: --disable-monitor=pod-network-avalibility,required-scc-annotation-checker,termination-message-policy,kubelet-log-collector + TEST_ARGS: --monitor=e2e-test-analyzer TEST_SUITE: windows-machine-config-operator/all test: - as: enable-tls-adherence From 78462c6bed6ddb26de50dc7d7e297a5ad61b37c1 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Wed, 16 Sep 2026 13:32:49 +0000 Subject: [PATCH 9/9] Remove release-5.0 aws-e2e-ote-techpreview --- ...s-machine-config-operator-release-5.0.yaml | 65 ----------- ...onfig-operator-release-5.0-presubmits.yaml | 106 ------------------ 2 files changed, 171 deletions(-) diff --git a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml index b36e1d762a078..498312ec0e8b7 100644 --- a/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml @@ -133,71 +133,6 @@ tests: - ref: openshift-tests-extension-setup-out-of-payload - ref: openshift-e2e-test workflow: ipi-aws-ovn-hybrid -- always_run: false - as: aws-e2e-ote-techpreview - optional: true - pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$ - steps: - cluster_profile: openshift-org-aws - dependencies: - EXTENSION_IMAGE: windows-machine-config-operator-test - env: - COMPUTE_NODE_REPLICAS: "1" - CONTROL_PLANE_REPLICAS: "1" - EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz - EXTENSION_COMPONENT_NAME: windows-machine-config-operator - TEST_ARGS: --monitor=e2e-test-analyzer - TEST_SUITE: windows-machine-config-operator/all - test: - - as: enable-tls-adherence - cli: latest - commands: | - set -euo pipefail - echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..." - oc patch featuregate cluster --type=merge \ - -p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}' - - echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..." - ok=false - for i in $(seq 1 60); do - if oc patch apiserver cluster --type=merge \ - -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \ - && [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then - ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break - fi - echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15 - done - [ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; } - - echo "Waiting for cluster to stabilize..." - oc adm wait-for-stable-cluster --timeout=30m - - oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade - oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents - echo "TLSAdherence enabled and verified successfully." - from: cli - resources: - requests: - cpu: 100m - memory: 100Mi - - as: wmco-setup-and-test - cli: latest - commands: | - export AWS_SHARED_CREDENTIALS_FILE=${CLUSTER_PROFILE_DIR}/.awscred - export KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey - hack/run-ci-e2e-test.sh -t setup-only -s - dependencies: - - env: OPERATOR_IMAGE - name: windows-machine-config-operator-test - from: windows-machine-config-operator-test - resources: - requests: - cpu: 1000m - memory: 400Mi - timeout: 2h15m0s - - ref: openshift-tests-extension-setup-out-of-payload - - ref: openshift-e2e-test - workflow: ipi-aws-ovn-hybrid - always_run: false as: vsphere-disconnected-e2e-operator optional: true diff --git a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml index c5ba6ad5bfeaf..e87d512a59324 100644 --- a/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/windows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml @@ -211,112 +211,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )aws-e2e-ote,?($|\s.*) - - agent: kubernetes - always_run: false - annotations: - pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$ - branches: - - ^release-5\.0$ - - ^release-5\.0- - cluster: build10 - context: ci/prow/aws-e2e-ote-techpreview - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - build/Dockerfile.ci - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws - ci.openshift.io/generator: prowgen - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview - optional: true - rerun_command: /test aws-e2e-ote-techpreview - spec: - containers: - - args: - - --enable-secrets-store-csi-driver=true - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --gsm-config=/etc/gsm-config/gsm-config.yaml - - --gsm-credentials-file=/etc/gsm-credentials/key.json - - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=aws-e2e-ote-techpreview - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /etc/gsm-config - name: gsm-config - readOnly: true - - mountPath: /etc/gsm-credentials - name: gsm-sa-key - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - configMap: - name: gsm-config - name: gsm-config - - csi: - driver: secrets-store.csi.k8s.io - readOnly: true - volumeAttributes: - secretProviderClass: ci-operator-sa-key-spc - name: gsm-sa-key - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )aws-e2e-ote-techpreview,?($|\s.*) - agent: kubernetes always_run: false annotations: