Skip to content

WINC-2016: Add TechPreview variant of WMCO aws-e2e-ote presubmit #84451

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
redhat-chai-bot wants to merge 8 commits into
base: main
Choose a base branch
from
Open

WINC-2016: Add TechPreview variant of WMCO aws-e2e-ote presubmit #84451

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3d596d0
Add aws-e2e-ote-techpreview CI variant for WMCO
redhat-chai-bot Sep 11, 2026
762fd28
Skip Disruptive tests in aws-e2e-ote-techpreview
redhat-chai-bot Sep 11, 2026
9ab7362
Fail explicitly if TLSAdherence gate never activates
redhat-chai-bot Sep 11, 2026
fbe8cd6
Combine node-proxy and Disruptive skip patterns in master config
redhat-chai-bot Sep 11, 2026
8a8c849
Replace flawed featuregate jq poll with apiserver patch retry
redhat-chai-bot Sep 12, 2026
0876627
Remove TEST_SKIPS from aws-e2e-ote-techpreview
redhat-chai-bot Sep 14, 2026
1b7abe4
Add TEST_SKIPS to master aws-e2e-ote-techpreview to match base job
redhat-chai-bot Sep 15, 2026
346e2c2
Switch release-5.0 techpreview TEST_ARGS from deny-list to allow-list
redhat-chai-bot Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions ...ift/windows-machine-config-operator/openshift-windows-machine-config-operator-master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,72 @@ tests:
- ref: openshift-tests-extension-setup-out-of-payload
- ref: openshift-e2e-test
workflow: ipi-aws-ovn-hybrid
- always_run: false
as: aws-e2e-ote-techpreview

@jrvaldes jrvaldes Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this needed for the 5.0 Smokerun tests?

@redhat-chai-bot redhat-chai-bot Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This entry in the master config targets OCP 5.1 (since master maps to 5.1). It's not directly needed for 5.0 Smokerun tests.

For 5.0, the matching entry is in openshift-windows-machine-config-operator-release-5.0.yaml (also added in this PR) — that's the one relevant for 5.0 PRs and testing.

We kept the master entry so the job is available on both branches — TLS adherence testing is needed on both 5.0 and 5.1 since the feature gate (TLSAdherence) is behind TechPreview on both. But if you'd prefer to scope this PR to release-5.0 only, we can remove the master entry.

@rrasouli — jrvaldes is asking whether we need the master (5.1) entry for the 5.0 Smokerun. Your call on whether to keep both or just release-5.0.

AI-generated. Review for accuracy.

@rrasouli rrasouli Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not keeping them both? currently we are testing 5.0 and in the future this will be part of our build CI

@jrvaldes jrvaldes Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agree

@jrvaldes jrvaldes Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, let's get a rehearsal to pass

optional: true
pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$|^ote/test/e2e/proxy\.go$
steps:
cluster_profile: openshift-org-aws
dependencies:
EXTENSION_IMAGE: windows-machine-config-operator-test
env:
COMPUTE_NODE_REPLICAS: "1"
CONTROL_PLANE_REPLICAS: "1"
EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz
EXTENSION_COMPONENT_NAME: windows-machine-config-operator
TEST_ARGS: --monitor=e2e-test-analyzer
TEST_SKIPS: \[node-proxy\]
TEST_SUITE: windows-machine-config-operator/all
test:
- as: enable-tls-adherence
cli: latest
commands: |
set -euo pipefail
echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..."
oc patch featuregate cluster --type=merge \
-p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}'

echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..."
ok=false
for i in $(seq 1 60); do
if oc patch apiserver cluster --type=merge \
-p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \
&& [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then
ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break
fi
echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15
done
[ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; }

echo "Waiting for cluster to stabilize..."
oc adm wait-for-stable-cluster --timeout=30m

oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade
oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents
echo "TLSAdherence enabled and verified successfully."
from: cli
resources:
requests:
cpu: 100m
memory: 100Mi
- as: wmco-setup-and-test
cli: latest
commands: |
export AWS_SHARED_CREDENTIALS_FILE=${CLUSTER_PROFILE_DIR}/.awscred
export KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey
hack/run-ci-e2e-test.sh -t setup-only -s
dependencies:
- env: OPERATOR_IMAGE
name: windows-machine-config-operator-test
from: windows-machine-config-operator-test
resources:
requests:
cpu: 1000m
memory: 400Mi
timeout: 2h15m0s
- ref: openshift-tests-extension-setup-out-of-payload
- ref: openshift-e2e-test
workflow: ipi-aws-ovn-hybrid
- always_run: false
as: aws-e2e-operator-windows-server-2025
cron: 0 2 * * 1
Expand Down
65 changes: 65 additions & 0 deletions ...indows-machine-config-operator/openshift-windows-machine-config-operator-release-5.0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,71 @@ tests:
- ref: openshift-tests-extension-setup-out-of-payload
- ref: openshift-e2e-test
workflow: ipi-aws-ovn-hybrid
- always_run: false
as: aws-e2e-ote-techpreview
optional: true
pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$
steps:
cluster_profile: openshift-org-aws
dependencies:
EXTENSION_IMAGE: windows-machine-config-operator-test
env:
COMPUTE_NODE_REPLICAS: "1"
CONTROL_PLANE_REPLICAS: "1"
EXTENSION_BINARY_PATH: /usr/bin/wmco-tests-ext.gz
EXTENSION_COMPONENT_NAME: windows-machine-config-operator
TEST_ARGS: --monitor=e2e-test-analyzer
TEST_SUITE: windows-machine-config-operator/all
test:
- as: enable-tls-adherence
cli: latest
commands: |
set -euo pipefail
echo "Enabling TLSAdherence feature gate via CustomNoUpgrade..."
oc patch featuregate cluster --type=merge \
-p '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["TLSAdherence"]}}}'

echo "Setting tlsAdherence=StrictAllComponents (retry through the kube-apiserver rollout)..."
ok=false
for i in $(seq 1 60); do
if oc patch apiserver cluster --type=merge \
-p '{"spec":{"tlsAdherence":"StrictAllComponents"}}' >/dev/null 2>&1 \
&& [ "$(oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' 2>/dev/null)" = "StrictAllComponents" ]; then
ok=true; echo "tlsAdherence=StrictAllComponents accepted (iteration $i)"; break
fi
echo " waiting for apiserver schema/gate (i=$i)..."; sleep 15
done
[ "$ok" = true ] || { echo "ERROR: tlsAdherence never accepted StrictAllComponents"; exit 1; }

echo "Waiting for cluster to stabilize..."
oc adm wait-for-stable-cluster --timeout=30m

oc get featuregate cluster -o jsonpath='{.spec.featureSet}' | grep -q CustomNoUpgrade
oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}' | grep -q StrictAllComponents
echo "TLSAdherence enabled and verified successfully."
from: cli
resources:
requests:
cpu: 100m
memory: 100Mi
- as: wmco-setup-and-test
cli: latest
commands: |
export AWS_SHARED_CREDENTIALS_FILE=${CLUSTER_PROFILE_DIR}/.awscred
export KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey
hack/run-ci-e2e-test.sh -t setup-only -s
dependencies:
- env: OPERATOR_IMAGE
name: windows-machine-config-operator-test
from: windows-machine-config-operator-test
resources:
requests:
cpu: 1000m
memory: 400Mi
timeout: 2h15m0s
- ref: openshift-tests-extension-setup-out-of-payload
- ref: openshift-e2e-test
workflow: ipi-aws-ovn-hybrid
- always_run: false
as: vsphere-disconnected-e2e-operator
optional: true
Expand Down
106 changes: 106 additions & 0 deletions ...-machine-config-operator/openshift-windows-machine-config-operator-master-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,112 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )aws-e2e-ote,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$|^ote/test/e2e/proxy\.go$
branches:
- ^master$
- ^master-
cluster: build03
context: ci/prow/aws-e2e-ote-techpreview
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- build/Dockerfile.ci
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-windows-machine-config-operator-master-aws-e2e-ote-techpreview
optional: true
rerun_command: /test aws-e2e-ote-techpreview
spec:
containers:
- args:
- --enable-secrets-store-csi-driver=true
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --gsm-config=/etc/gsm-config/gsm-config.yaml
- --gsm-credentials-file=/etc/gsm-credentials/key.json
- --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=aws-e2e-ote-techpreview
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /etc/gsm-config
name: gsm-config
readOnly: true
- mountPath: /etc/gsm-credentials
name: gsm-sa-key
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- configMap:
name: gsm-config
name: gsm-config
- csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: ci-operator-sa-key-spc
name: gsm-sa-key
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )aws-e2e-ote-techpreview,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
Expand Down
106 changes: 106 additions & 0 deletions ...ine-config-operator/openshift-windows-machine-config-operator-release-5.0-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,112 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )aws-e2e-ote,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
pipeline_skip_if_only_changed: ^(?:docs|\.github|\.tekton)/|\.md$|^(?:\.gitignore|renovate\.json|OWNERS|PROJECT|LICENSE|Containerfile|Containerfile.bundle)$
branches:
- ^release-5\.0$
- ^release-5\.0-
cluster: build10
context: ci/prow/aws-e2e-ote-techpreview
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- build/Dockerfile.ci
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-windows-machine-config-operator-release-5.0-aws-e2e-ote-techpreview
optional: true
rerun_command: /test aws-e2e-ote-techpreview
spec:
containers:
- args:
- --enable-secrets-store-csi-driver=true
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --gsm-config=/etc/gsm-config/gsm-config.yaml
- --gsm-credentials-file=/etc/gsm-credentials/key.json
- --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=aws-e2e-ote-techpreview
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /etc/gsm-config
name: gsm-config
readOnly: true
- mountPath: /etc/gsm-credentials
name: gsm-sa-key
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- configMap:
name: gsm-config
name: gsm-config
- csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: ci-operator-sa-key-spc
name: gsm-sa-key
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )aws-e2e-ote-techpreview,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
Expand Down