metallb tests #83337
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| approvers: | ||
| - natifridman | ||
| - shaior | ||
| - kononovn | ||
| - eifrach | ||
| - timurmp |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| #!/bin/bash | ||
| set -e | ||
| set -o pipefail | ||
|
|
||
| PROJECT_DIR="/tmp" | ||
|
|
||
| echo "Checking if the job should be skipped..." | ||
| if [ -f "${SHARED_DIR}/skip.txt" ]; then | ||
| echo "Detected skip.txt file — skipping the job" | ||
| exit 0 | ||
| fi | ||
|
|
||
| echo "Set CLUSTER_NAME env var" | ||
| if [[ -f "${SHARED_DIR}/cluster_name" ]]; then | ||
| CLUSTER_NAME=$(cat "${SHARED_DIR}/cluster_name") | ||
| fi | ||
| export CLUSTER_NAME=${CLUSTER_NAME} | ||
| echo "CLUSTER_NAME=${CLUSTER_NAME}" | ||
|
|
||
| echo "Set bastion SSH configuration" | ||
| cat /var/group_variables/common/all/ansible_ssh_private_key > "${PROJECT_DIR}/temp_ssh_key" | ||
| chmod 600 "${PROJECT_DIR}/temp_ssh_key" | ||
| BASTION_IP=$(cat /var/host_variables/"${CLUSTER_NAME}"/bastion/ansible_host) | ||
| BASTION_USER=$(cat /var/group_variables/common/all/ansible_user) | ||
|
Comment on lines
+20
to
+24
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Clean up the temporary SSH key on every exit. The key is removed only at Line 48. The existing Proposed fix PROJECT_DIR="/tmp"
+SSH_KEY="$(mktemp "${PROJECT_DIR}/metallb-ssh-key.XXXXXX")"
+trap 'rm -f -- "${SSH_KEY}"' EXIT
-cat /var/group_variables/common/all/ansible_ssh_private_key > "${PROJECT_DIR}/temp_ssh_key"
-chmod 600 "${PROJECT_DIR}/temp_ssh_key"
+cat /var/group_variables/common/all/ansible_ssh_private_key > "${SSH_KEY}"
+chmod 600 "${SSH_KEY}"Update both Also applies to: 48-48 🤖 Prompt for AI Agents |
||
|
|
||
| echo "Run MetalLB deploy playbook" | ||
| cd /eco-ci-cd | ||
| ansible-playbook ./playbooks/cnf/deploy-run-metallb-tests-script.yaml \ | ||
| -i ./inventories/cnf/run-tests.yaml \ | ||
| --extra-vars "kubeconfig=/home/telcov10n/project/generated/${CLUSTER_NAME}/auth/kubeconfig \ | ||
| metallb_repo=${METALLB_REPO} \ | ||
| frr_image=${FRR_IMAGE} \ | ||
| ipv4_service_range=${IPV4_SERVICE_RANGE} \ | ||
| ipv6_service_range=${IPV6_SERVICE_RANGE}" | ||
|
|
||
| echo "Run MetalLB e2e tests via SSH" | ||
| ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=no \ | ||
| "${BASTION_USER}@${BASTION_IP}" -i "${PROJECT_DIR}/temp_ssh_key" \ | ||
| "sudo /tmp/metallb/metallb-tests-run.sh || true" | ||
|
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
file='ci-operator/step-registry/telcov10n/functional/cnf-network/metallb-e2etests/telcov10n-functional-cnf-network-metallb-e2etests-commands.sh'
printf '%s\n' '--- command script ---'
cat -n "$file"
printf '%s\n' '--- references to the step and JUnit report ---'
rg -n -C 3 'telcov10n-functional-cnf-network-metallb-e2etests|junit-report\.xml|metallb-tests-run\.sh' ci-operator .github 2>/dev/null || true
printf '%s\n' '--- related step-registry metadata ---'
find ci-operator/step-registry/telcov10n/functional/cnf-network/metallb-e2etests -maxdepth 1 -type f -print -exec sh -c 'echo "--- $1"; cat -n "$1"' sh {} \;Repository: openshift/release Length of output: 15518 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- complete job test definition ---'
for file in ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-network-phase2-4.20.yaml \
ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-network-phase2-4.22.yaml; do
echo "--- $file"
sed -n '1,80p' "$file"
done
printf '%s\n' '--- artifact and JUnit handling in ci-operator configuration ---'
rg -n -i -C 3 'ARTIFACT_DIR|junit|test.*result|result.*test|failure.*junit|junit.*failure' \
ci-operator docs prow config 2>/dev/null | head -n 500 || true
printf '%s\n' '--- related command scripts that publish JUnit reports ---'
rg -l 'ARTIFACT_DIR.*junit|junit.*ARTIFACT_DIR|junit-report\.xml' ci-operator/step-registry |
while IFS= read -r file; do
echo "--- $file"
cat -n "$file"
doneRepository: openshift/release Length of output: 50374 🏁 Script executed: #!/bin/bash
set -euo pipefail
for file in \
ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-network-phase2-4.20.yaml \
ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-network-phase2-4.22.yaml; do
echo "--- $file"
sed -n '1,75p' "$file"
done
echo '--- targeted JUnit documentation and configuration references ---'
rg -n -i -C 4 \
'junit|test-results|ARTIFACT_DIR|artifact.*result|result.*artifact' \
docs ci-operator/README.md ci-operator/config 2>/dev/null \
-g '*.md' -g '*.yaml' -g '*.yml' -g '*.json' |
grep -vE 'vendor|generated|junit-report\.xml' |
head -n 300 || true
echo '--- target workflow references only ---'
rg -n -C 5 \
'telcov10n-functional-cnf-network-metallb-e2etests|junit_metallb|metallbreport' \
ci-operator/config/openshift-kni/eco-ci-cd \
ci-operator/step-registry/telcov10n/functional/cnf-network \
--glob '!*.metadata.json'Repository: openshift/release Length of output: 46160 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- locate JUnit verification step ---'
find ci-operator/step-registry -type f \
\( -iname '*verify*junit*' -o -iname '*junit*verify*' \) -print
echo '--- inspect references and implementation ---'
rg -n -C 6 'telcov10n-verify-junit-reports|verify-junit-reports|junit.*report|report.*junit' \
ci-operator/step-registry/telcov10n \
ci-operator/config/openshift-kni/eco-ci-cd \
--glob '!*.metadata.json' || trueRepository: openshift/release Length of output: 50374 🏁 Script executed: #!/bin/bash
set -euo pipefail
dir='ci-operator/step-registry/telcov10n/verify-junit-reports'
for file in "$dir"/*; do
case "$file" in
*.sh|*.yaml)
echo "--- $file"
cat -n "$file"
;;
esac
doneRepository: openshift/release Length of output: 1570 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- parser source in this repository ---'
rg -n -l 'fail_if_any_test_failed|KNOWN_FAILURES|job_status\.txt' . \
-g '*.py' -g '*.sh' -g '*.yaml' -g '*.yml' |
head -n 100 || true
echo '--- all references to the MetalLB report path ---'
rg -n -C 5 \
'/tmp/metallbreport|junit-report\.xml|junit_metallb|ARTIFACT_DIR.*junit' \
ci-operator/step-registry/telcov10n ci-operator/config/openshift-kni/eco-ci-cd \
--glob '!*.metadata.json' |
head -n 300 || true
echo '--- all references to the JUnit verification status ---'
rg -n -C 5 \
'job_status\.txt|fail_if_any_test_failed\.py' \
ci-operator/step-registry/telcov10n ci-operator/config/openshift-kni/eco-ci-cd \
--glob '!*.metadata.json' |
head -n 300 || trueRepository: openshift/release Length of output: 50373 🌐 Web query:
💡 Result: The file fail_if_any_test_failed.py is a utility script part of the openshift-kni/eco-ci-cd repository [1][2]. This repository contains a collection of automation tools, Ansible playbooks, and roles designed to streamline Telco Verification CI/CD processes [2]. The script fail_if_any_test_failed.py is specifically used for test result validation and failure reporting within CI/CD pipelines [1][3][4]. Its primary purpose is to inspect test results—typically XML files—to determine if any tests have failed and subsequently report those failures, ensuring the CI/CD pipeline correctly handles and communicates test outcomes [1][3][5]. It should not be confused with the unrelated tool named Eco CI (often associated with the green-coding-solutions/eco-ci-energy-estimation repository), which is a separate third-party tool used to measure energy consumption and carbon emissions in CI/CD pipelines [6][7][8][9]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
base='https://raw.githubusercontent.com/openshift-kni/eco-ci-cd/main'
for path in \
scripts/fail_if_any_test_failed.py \
scripts/metallb-tests-run.sh \
playbooks/cnf/deploy-run-metallb-tests-script.yaml; do
url="${base}/${path}"
echo "--- ${url}"
if ! curl -fsSL "$url" | sed -n '1,260p'; then
echo "unavailable: ${url}"
fi
doneRepository: openshift/release Length of output: 7644 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
command_file = Path(
"ci-operator/step-registry/telcov10n/functional/cnf-network/metallb-e2etests/"
"telcov10n-functional-cnf-network-metallb-e2etests-commands.sh"
)
workflow_file = Path(
"ci-operator/config/openshift-kni/eco-ci-cd/"
"openshift-kni-eco-ci-cd-main__cnf-network-phase2-4.20.yaml"
)
verify_file = Path(
"ci-operator/step-registry/telcov10n/verify-junit-reports/"
"telcov10n-verify-junit-reports-commands.sh"
)
command = command_file.read_text()
workflow = workflow_file.read_text()
verify = verify_file.read_text()
checks = {
"remote test is masked": '"sudo /tmp/metallb/metallb-tests-run.sh || true"' in command,
"report is written under ARTIFACT_DIR": '"${ARTIFACT_DIR}/junit_metallb/junit-report.xml"' in command,
"report is copied to SHARED_DIR": bool(re.search(
r'(?m)^\s*(?:cp|mv|scp)\b.*\$\{SHARED_DIR\}.*junit-report\.xml', command
)),
"workflow invokes JUnit verifier": "ref: telcov10n-verify-junit-reports" in workflow,
"verifier reads SHARED_DIR by default": "python3 fail_if_any_test_failed.py" in verify
and "SHARED_DIR" in verify,
"workflow overrides TESTS_DIR": bool(re.search(r'(?m)^\s*TESTS_DIR\s*:', workflow)),
}
for name, result in checks.items():
print(f"{name}: {result}")
assert checks["remote test is masked"]
assert checks["report is written under ARTIFACT_DIR"]
assert not checks["report is copied to SHARED_DIR"]
assert checks["workflow invokes JUnit verifier"]
assert checks["verifier reads SHARED_DIR by default"]
assert not checks["workflow overrides TESTS_DIR"]
PYRepository: openshift/release Length of output: 381 Propagate the MetalLB test status and report it to the verifier. 🤖 Prompt for AI Agents
Comment on lines
+37
to
+39
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
file='ci-operator/step-registry/telcov10n/functional/cnf-network/metallb-e2etests/telcov10n-functional-cnf-network-metallb-e2etests-commands.sh'
printf '%s\n' '--- target script ---'
cat -n "$file"
printf '%s\n' '--- SSH/scp invocations in the step-registry ---'
rg -n -C 3 '\b(ssh|scp)\b' ci-operator/step-registry --glob '*-commands.sh' | head -n 240
printf '%s\n' '--- timeout-related settings in the target workflow area ---'
rg -n -C 2 'ConnectTimeout|ServerAliveInterval|ServerAliveCountMax|scp|ssh' \
ci-operator/step-registry/telcov10n/functional/cnf-network/metallb-e2etests \
ci-operator/step-registry/telcov10n/functional/cnf-network \
2>/dev/null | head -n 240Repository: openshift/release Length of output: 50373 🌐 Web query:
💡 Result: The scp(1) utility in OpenBSD, as with other OpenSSH implementations, does not have native, standalone flags for ConnectTimeout or ServerAliveInterval [1][2][3]. However, because scp uses ssh(1) under the hood, these options can be passed to the underlying SSH process using the -o configuration option [2][4]. The semantics of these options are defined by ssh_config(5) [5][6]: 1. ConnectTimeout: Specifies the timeout in seconds for establishing the initial connection to the SSH server [5][6]. This replaces the default system TCP timeout and covers both the initial TCP connection and the subsequent SSH protocol handshake and key exchange [5][6]. It is specifically intended for scenarios where the target host is down or unreachable [7]. 2. ServerAliveInterval: Sets a timeout interval in seconds [5][6]. If no data is received from the server within this period, ssh(1) sends an encrypted message to the server to request a response [5][6]. This is primarily used to maintain idle connections (e.g., through NAT firewalls) or to detect when a connection has become unresponsive [8][6]. To use these with scp, you must use the -o syntax, for example: scp -o ConnectTimeout=10 -o ServerAliveInterval=60 source_file user@host:/destination/path These options are applied to the ssh process that scp spawns to handle the transfer [2]. If you have host-specific configurations in your ~/.ssh/config file, these will be applied automatically, but command-line -o options will take precedence if they conflict [9]. Citations:
Bound both bastion connections. The 🤖 Prompt for AI Agents |
||
|
|
||
| echo "Gather JUnit report from bastion" | ||
| mkdir -p "${ARTIFACT_DIR}/junit_metallb" | ||
| scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ | ||
| -i "${PROJECT_DIR}/temp_ssh_key" \ | ||
| "${BASTION_USER}@${BASTION_IP}":/tmp/metallbreport/junit-report.xml \ | ||
|
Comment on lines
+37
to
+45
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -e
file=$(fd -t f 'telcov10n-functional-cnf-network-metallb-e2etests-commands\.sh$' . | head -n 1)
printf '%s\n' "$file"
cat -n "$file" | sed -n '1,100p'
printf '\nRelated bastion and known-host handling:\n'
rg -n -C 3 'BASTION_(IP|USER)|StrictHostKeyChecking|UserKnownHostsFile|known_hosts|temp_ssh_key|metallb-tests-run' ci-operator/step-registry/telcov10n ci-operator/step-registry -g '*-commands.sh' | head -n 240Repository: openshift/release Length of output: 39046 🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' 'Files that define the bastion inventory and provisioning:'
git ls-files | rg '(^|/)(inventor|playbooks|host_vars|group_vars|eco-ci-cd|telcov10n).*(bastion|cnf|metallb)|bastion.*(yaml|yml|sh)$' | head -n 240
printf '\nReferences to the MetalLB step and bastion lifecycle:\n'
rg -n -C 4 'metallb-e2etests|deploy-run-metallb-tests|ansible_ssh_private_key|host_variables/.*/bastion|bastion' ci-operator/step-registry/telcov10n ci-operator/config -g '*.yaml' -g '*.yml' -g '*.sh' -g '*.json' | head -n 320Repository: openshift/release Length of output: 50373 🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' 'MetalLB step references:'
rg -l 'telcov10n-functional-cnf-network-metallb-e2etests|metallb-e2etests' ci-operator/config ci-operator/step-registry -g '*.yaml' -g '*.yml' | head -n 80
printf '\nBastion credential mounts used by the CNF network workflows:\n'
rg -n -C 2 'ansible-kni-qe-(70|71)-bastion|ansible-dev-kpi-0[1-4]-bastion|ansible-group-all|host_variables/.*/bastion' ci-operator/step-registry/telcov10n -g '*.yaml' -g '*.yml' | head -n 220
printf '\nProvision/deprovision wording for the relevant VM bastion:\n'
rg -n -C 3 'VM-based bastion|deploy-vm-bastion|deprovision.*bastion|bastion host' ci-operator/step-registry/telcov10n -g '*.yaml' -g '*.yml' -g '*.sh' | head -n 180Repository: openshift/release Length of output: 50373 Restore SSH host-key verification for both bastion connections. The workflow targets provisioned VM bastions. 🧰 Tools🪛 ast-grep (0.45.1)[warning] 42-45: This (ssh-disable-host-key-check-bash) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| "${ARTIFACT_DIR}/junit_metallb/junit-report.xml" | ||
|
|
||
| rm -f "${PROJECT_DIR}/temp_ssh_key" | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| { | ||
| "path": "telcov10n/functional/cnf-network/metallb-e2etests/telcov10n-functional-cnf-network-metallb-e2etests-ref.yaml", | ||
| "owners": { | ||
| "approvers": [ | ||
| "natifridman", | ||
| "shaior", | ||
| "kononovn", | ||
| "eifrach", | ||
| "timurmp" | ||
| ] | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| ref: | ||
| as: telcov10n-functional-cnf-network-metallb-e2etests | ||
| from: src | ||
| commands: telcov10n-functional-cnf-network-metallb-e2etests-commands.sh | ||
| grace_period: 10s | ||
| timeout: 4h0m0s | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| memory: 200Mi | ||
| env: | ||
| - name: CLUSTER_NAME | ||
| default: "" | ||
| documentation: BM Cluster name | ||
| - name: METALLB_REPO | ||
| default: https://github.com/openshift/metallb.git | ||
| documentation: MetalLB git repository URL | ||
| - name: FRR_IMAGE | ||
| default: quay.io/frrouting/frr:8.5.3 | ||
| documentation: FRR container image used by the MetalLB ginkgo test suite | ||
| - name: IPV4_SERVICE_RANGE | ||
| default: 192.168.10.0/24 | ||
| documentation: IPv4 address range for MetalLB service allocation during tests | ||
| - name: IPV6_SERVICE_RANGE | ||
| default: fc00:f853:0ccd:e799::/124 | ||
| documentation: IPv6 address range for MetalLB service allocation during tests |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Use strict shell mode.
Replace the two commands with
set -euo pipefail. Without-u, an unset CI variable can expand to an empty path and let the script continue with invalid inputs. Keep tracing disabled.Proposed fix
As per coding guidelines: “Step registry command scripts must ... default to
set -euo pipefailwithout-x.”📝 Committable suggestion
🤖 Prompt for AI Agents
Source: Coding guidelines