From dc68ace48730ac8460d93e25f608d4ba6a9837c4 Mon Sep 17 00:00:00 2001 From: Jose Castillo Lema Date: Wed, 19 Aug 2026 11:36:50 +0200 Subject: [PATCH 1/3] DPF: Onboard doca4 Signed-off-by: Jose Castillo Lema gitleaks.version: 8.30.0 gitleaks.check-secrets: ENABLED --- .../rh-ecosystem-edge-openshift-dpf-main.yaml | 126 ++++ ...edge-openshift-dpf-main__nightly-4.22.yaml | 24 + ...ystem-edge-openshift-dpf-release-4.22.yaml | 104 +++ ...em-edge-openshift-dpf-main-presubmits.yaml | 705 ++++++++++++++++-- ...openshift-dpf-release-4.22-presubmits.yaml | 400 ++++++++++ 5 files changed, 1308 insertions(+), 51 deletions(-) diff --git a/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main.yaml b/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main.yaml index 233efdbf135d4..3f831af0fa8e3 100644 --- a/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main.yaml +++ b/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main.yaml @@ -44,6 +44,30 @@ tests: test: - ref: dpf-hypervisor-deploy-cluster timeout: 6h0m0s +- always_run: false + as: deploy-cluster-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-deploy-cluster + timeout: 6h0m0s - always_run: false as: sanity capabilities: @@ -69,6 +93,31 @@ tests: - ref: dpf-hypervisor-load-kubeconfig - ref: dpf-hypervisor-sanity-existing timeout: 2h0m0s +- always_run: false + as: sanity-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-load-kubeconfig + - ref: dpf-hypervisor-sanity-existing + timeout: 2h0m0s - always_run: false as: upgrade-management capabilities: @@ -92,6 +141,30 @@ tests: test: - ref: dpf-hypervisor-upgrade-management timeout: 2h0m0s +- always_run: false + as: upgrade-management-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-upgrade-management + timeout: 2h0m0s - always_run: false as: network-tests capabilities: @@ -117,6 +190,31 @@ tests: - ref: dpf-hypervisor-load-kubeconfig - ref: dpf-hypervisor-network-tests timeout: 2h0m0s +- always_run: false + as: network-tests-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-load-kubeconfig + - ref: dpf-hypervisor-network-tests + timeout: 2h0m0s - always_run: false as: conformance capabilities: @@ -145,6 +243,34 @@ tests: - ref: dpf-setup-image-registry - ref: openshift-e2e-test timeout: 7h0m0s +- always_run: false + as: conformance-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + env: + TEST_SKIPS: NetworkSegmentation + test: + - ref: dpf-hypervisor-load-kubeconfig + - ref: dpf-setup-image-registry + - ref: openshift-e2e-test + timeout: 7h0m0s zz_generated_metadata: branch: main org: rh-ecosystem-edge diff --git a/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main__nightly-4.22.yaml b/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main__nightly-4.22.yaml index ff28081cf5124..c29f415ea49b2 100644 --- a/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main__nightly-4.22.yaml +++ b/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main__nightly-4.22.yaml @@ -45,6 +45,30 @@ tests: test: - ref: dpf-hypervisor-deploy-cluster timeout: 6h0m0s +- always_run: false + as: deploy-cluster-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-deploy-cluster + timeout: 6h0m0s zz_generated_metadata: branch: main org: rh-ecosystem-edge diff --git a/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22.yaml b/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22.yaml index 7145ac900a481..00e06fc79012d 100644 --- a/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22.yaml +++ b/ci-operator/config/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22.yaml @@ -46,6 +46,32 @@ tests: test: - ref: dpf-hypervisor-deploy-cluster timeout: 6h0m0s +- always_run: false + as: deploy-cluster-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + env: + OPENSHIFT_DPF_BRANCH: release-4.22 + test: + - ref: dpf-hypervisor-deploy-cluster + timeout: 6h0m0s - always_run: false as: sanity capabilities: @@ -71,6 +97,31 @@ tests: - ref: dpf-hypervisor-load-kubeconfig - ref: dpf-hypervisor-sanity-existing timeout: 2h0m0s +- always_run: false + as: sanity-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-load-kubeconfig + - ref: dpf-hypervisor-sanity-existing + timeout: 2h0m0s - always_run: false as: network-tests capabilities: @@ -96,6 +147,31 @@ tests: - ref: dpf-hypervisor-load-kubeconfig - ref: dpf-hypervisor-network-tests timeout: 2h0m0s +- always_run: false + as: network-tests-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + test: + - ref: dpf-hypervisor-load-kubeconfig + - ref: dpf-hypervisor-network-tests + timeout: 2h0m0s - always_run: false as: conformance capabilities: @@ -124,6 +200,34 @@ tests: - ref: dpf-setup-image-registry - ref: openshift-e2e-test timeout: 7h0m0s +- always_run: false + as: conformance-doca4 + capabilities: + - intranet + reporter_config: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + restrict_network_access: false + steps: + cluster_profile: metal-dpf-doca4 + env: + TEST_SKIPS: NetworkSegmentation + test: + - ref: dpf-hypervisor-load-kubeconfig + - ref: dpf-setup-image-registry + - ref: openshift-e2e-test + timeout: 7h0m0s zz_generated_metadata: branch: release-4.22 org: rh-ecosystem-edge diff --git a/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main-presubmits.yaml b/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main-presubmits.yaml index 64a293da9f046..74ee79d6ef1bd 100644 --- a/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main-presubmits.yaml +++ b/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-main-presubmits.yaml @@ -100,6 +100,106 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(conformance|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/conformance-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 7h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-conformance-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test conformance-doca4 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=conformance-doca4 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(conformance-doca4|remaining-required),?($|\s.*) - agent: kubernetes always_run: false branches: @@ -111,14 +211,370 @@ presubmits: decoration_config: sparse_checkout_files: - Containerfile - timeout: 6h0m0s + timeout: 6h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-deploy-cluster + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test deploy-cluster + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=deploy-cluster + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(deploy-cluster|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/deploy-cluster-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 6h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-deploy-cluster-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test deploy-cluster-doca4 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=deploy-cluster-doca4 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(deploy-cluster-doca4|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build12 + context: ci/prow/images + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-images + rerun_command: /test images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/network-tests + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 2h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-network-tests + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test network-tests + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=network-tests + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(network-tests|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/network-tests-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 2h0m0s labels: capability/intranet: intranet ci-operator.openshift.io/cloud: external - ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-deploy-cluster + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-network-tests-doca4 reporter_config: slack: channel: '#wg-nvidia-dpf-ci' @@ -134,7 +590,7 @@ presubmits: {{- if eq .Status.State "aborted" }} The job was aborted, check for orphaned cloud resources. {{- end }} - rerun_command: /test deploy-cluster + rerun_command: /test network-tests-doca4 spec: containers: - args: @@ -143,7 +599,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=deploy-cluster + - --target=network-tests-doca4 command: - ci-operator env: @@ -199,39 +655,77 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )(deploy-cluster|remaining-required),?($|\s.*) + trigger: (?m)^/test( | .* )(network-tests-doca4|remaining-required),?($|\s.*) - agent: kubernetes - always_run: true + always_run: false branches: - ^main$ - ^main- - cluster: build12 - context: ci/prow/images + cluster: build09 + context: ci/prow/nightly-4.22-deploy-cluster decorate: true decoration_config: sparse_checkout_files: - Containerfile + timeout: 6h0m0s labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 + ci-operator.openshift.io/variant: nightly-4.22 ci.openshift.io/generator: prowgen + job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-images - rerun_command: /test images + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-deploy-cluster + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test nightly-4.22-deploy-cluster spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - - --target=[images] + - --secret-dir=/secrets/ci-pull-credentials + - --target=deploy-cluster + - --variant=nightly-4.22 command: - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" + ports: + - containerPort: 8080 + name: http resources: requests: cpu: 10m volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -246,6 +740,15 @@ presubmits: readOnly: true serviceAccountName: ci-operator volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -255,26 +758,28 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )images,?($|\s.*) + trigger: (?m)^/test( | .* )(nightly-4.22-deploy-cluster|remaining-required),?($|\s.*) - agent: kubernetes always_run: false branches: - ^main$ - ^main- cluster: build09 - context: ci/prow/network-tests + context: ci/prow/nightly-4.22-deploy-cluster-doca4 decorate: true decoration_config: sparse_checkout_files: - Containerfile - timeout: 2h0m0s + timeout: 6h0m0s labels: capability/intranet: intranet ci-operator.openshift.io/cloud: external - ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci-operator.openshift.io/variant: nightly-4.22 ci.openshift.io/generator: prowgen + job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-network-tests + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-deploy-cluster-doca4 reporter_config: slack: channel: '#wg-nvidia-dpf-ci' @@ -290,7 +795,7 @@ presubmits: {{- if eq .Status.State "aborted" }} The job was aborted, check for orphaned cloud resources. {{- end }} - rerun_command: /test network-tests + rerun_command: /test nightly-4.22-deploy-cluster-doca4 spec: containers: - args: @@ -299,7 +804,8 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=network-tests + - --target=deploy-cluster-doca4 + - --variant=nightly-4.22 command: - ci-operator env: @@ -355,28 +861,85 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )(network-tests|remaining-required),?($|\s.*) + trigger: (?m)^/test( | .* )(nightly-4.22-deploy-cluster-doca4|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build12 + context: ci/prow/nightly-4.22-images + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + labels: + ci-operator.openshift.io/variant: nightly-4.22 + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-images + rerun_command: /test nightly-4.22-images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + - --variant=nightly-4.22 + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )nightly-4.22-images,?($|\s.*) - agent: kubernetes always_run: false branches: - ^main$ - ^main- cluster: build09 - context: ci/prow/nightly-4.22-deploy-cluster + context: ci/prow/sanity decorate: true decoration_config: sparse_checkout_files: - Containerfile - timeout: 6h0m0s + timeout: 2h0m0s labels: capability/intranet: intranet ci-operator.openshift.io/cloud: external ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 - ci-operator.openshift.io/variant: nightly-4.22 ci.openshift.io/generator: prowgen - job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-deploy-cluster + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-sanity reporter_config: slack: channel: '#wg-nvidia-dpf-ci' @@ -392,7 +955,7 @@ presubmits: {{- if eq .Status.State "aborted" }} The job was aborted, check for orphaned cloud resources. {{- end }} - rerun_command: /test nightly-4.22-deploy-cluster + rerun_command: /test sanity spec: containers: - args: @@ -401,8 +964,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=deploy-cluster - - --variant=nightly-4.22 + - --target=sanity command: - ci-operator env: @@ -458,42 +1020,74 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )(nightly-4.22-deploy-cluster|remaining-required),?($|\s.*) + trigger: (?m)^/test( | .* )(sanity|remaining-required),?($|\s.*) - agent: kubernetes - always_run: true + always_run: false branches: - ^main$ - ^main- - cluster: build12 - context: ci/prow/nightly-4.22-images + cluster: build09 + context: ci/prow/sanity-doca4 decorate: true decoration_config: sparse_checkout_files: - Containerfile + timeout: 2h0m0s labels: - ci-operator.openshift.io/variant: nightly-4.22 + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 ci.openshift.io/generator: prowgen - job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-nightly-4.22-images - rerun_command: /test nightly-4.22-images + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-sanity-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test sanity-doca4 spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - - --target=[images] - - --variant=nightly-4.22 + - --secret-dir=/secrets/ci-pull-credentials + - --target=sanity-doca4 command: - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" + ports: + - containerPort: 8080 + name: http resources: requests: cpu: 10m volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -508,6 +1102,15 @@ presubmits: readOnly: true serviceAccountName: ci-operator volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -517,14 +1120,14 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )nightly-4.22-images,?($|\s.*) + trigger: (?m)^/test( | .* )(sanity-doca4|remaining-required),?($|\s.*) - agent: kubernetes always_run: false branches: - ^main$ - ^main- cluster: build09 - context: ci/prow/sanity + context: ci/prow/upgrade-management decorate: true decoration_config: sparse_checkout_files: @@ -532,11 +1135,9 @@ presubmits: timeout: 2h0m0s labels: capability/intranet: intranet - ci-operator.openshift.io/cloud: external - ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca8 ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-sanity + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-upgrade-management reporter_config: slack: channel: '#wg-nvidia-dpf-ci' @@ -552,7 +1153,7 @@ presubmits: {{- if eq .Status.State "aborted" }} The job was aborted, check for orphaned cloud resources. {{- end }} - rerun_command: /test sanity + rerun_command: /test upgrade-management spec: containers: - args: @@ -561,7 +1162,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=sanity + - --target=upgrade-management command: - ci-operator env: @@ -617,14 +1218,14 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )(sanity|remaining-required),?($|\s.*) + trigger: (?m)^/test( | .* )(upgrade-management|remaining-required),?($|\s.*) - agent: kubernetes always_run: false branches: - ^main$ - ^main- cluster: build09 - context: ci/prow/upgrade-management + context: ci/prow/upgrade-management-doca4 decorate: true decoration_config: sparse_checkout_files: @@ -632,9 +1233,11 @@ presubmits: timeout: 2h0m0s labels: capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-upgrade-management + name: pull-ci-rh-ecosystem-edge-openshift-dpf-main-upgrade-management-doca4 reporter_config: slack: channel: '#wg-nvidia-dpf-ci' @@ -650,7 +1253,7 @@ presubmits: {{- if eq .Status.State "aborted" }} The job was aborted, check for orphaned cloud resources. {{- end }} - rerun_command: /test upgrade-management + rerun_command: /test upgrade-management-doca4 spec: containers: - args: @@ -659,7 +1262,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=upgrade-management + - --target=upgrade-management-doca4 command: - ci-operator env: @@ -715,4 +1318,4 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )(upgrade-management|remaining-required),?($|\s.*) + trigger: (?m)^/test( | .* )(upgrade-management-doca4|remaining-required),?($|\s.*) diff --git a/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22-presubmits.yaml b/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22-presubmits.yaml index 41ccf782fda1d..f35c2bfe77e3d 100644 --- a/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22-presubmits.yaml +++ b/ci-operator/jobs/rh-ecosystem-edge/openshift-dpf/rh-ecosystem-edge-openshift-dpf-release-4.22-presubmits.yaml @@ -100,6 +100,106 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(conformance|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.22$ + - ^release-4\.22- + cluster: build09 + context: ci/prow/conformance-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 7h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-release-4.22-conformance-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test conformance-doca4 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=conformance-doca4 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(conformance-doca4|remaining-required),?($|\s.*) - agent: kubernetes always_run: false branches: @@ -200,6 +300,106 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(deploy-cluster|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.22$ + - ^release-4\.22- + cluster: build09 + context: ci/prow/deploy-cluster-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 6h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-release-4.22-deploy-cluster-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test deploy-cluster-doca4 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=deploy-cluster-doca4 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(deploy-cluster-doca4|remaining-required),?($|\s.*) - agent: kubernetes always_run: true branches: @@ -356,6 +556,106 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(network-tests|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.22$ + - ^release-4\.22- + cluster: build09 + context: ci/prow/network-tests-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 2h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-release-4.22-network-tests-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test network-tests-doca4 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=network-tests-doca4 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(network-tests-doca4|remaining-required),?($|\s.*) - agent: kubernetes always_run: false branches: @@ -456,3 +756,103 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(sanity|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.22$ + - ^release-4\.22- + cluster: build09 + context: ci/prow/sanity-doca4 + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + timeout: 2h0m0s + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: external + ci-operator.openshift.io/cloud-cluster-profile: metal-dpf-doca4 + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-rh-ecosystem-edge-openshift-dpf-release-4.22-sanity-doca4 + reporter_config: + slack: + channel: '#wg-nvidia-dpf-ci' + job_states_to_report: + - success + - failure + - error + - aborted + report_template: |- + {{- $emoji := ":warning:" }}{{- if eq .Status.State "success" }}{{- $emoji = ":white_check_mark:" }}{{- end }} + {{- $prInfo := "" }}{{- if .Spec.Refs.Pulls }}{{- $pull := index .Spec.Refs.Pulls 0 }}{{- $prInfo = printf " (<%s|PR #%d> by %s)" $pull.Link $pull.Number $pull.Author }}{{- end -}} + {{$emoji}} Job *{{.Spec.Job}}*{{$prInfo}} ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{$emoji}} + {{- if eq .Status.State "aborted" }} + The job was aborted, check for orphaned cloud resources. + {{- end }} + rerun_command: /test sanity-doca4 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=sanity-doca4 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )(sanity-doca4|remaining-required),?($|\s.*) From c7b575b5c5c939b527f2c3945a1eab7b6fdbc421 Mon Sep 17 00:00:00 2001 From: Jose Castillo Lema Date: Wed, 19 Aug 2026 11:52:23 +0200 Subject: [PATCH 2/3] Remove hardcoded secrets Signed-off-by: Jose Castillo Lema gitleaks.version: 8.30.0 gitleaks.check-secrets: ENABLED --- .../dpf-hypervisor-deploy-cluster-commands.sh | 4 ++-- .../dpf-hypervisor-deploy-cluster-ref.yaml | 4 ---- .../hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml | 7 ++++--- .../dpf-hypervisor-load-kubeconfig-commands.sh | 4 ++-- .../dpf-hypervisor-load-kubeconfig-ref.yaml | 4 ---- .../dpf-hypervisor-network-tests-commands.sh | 4 ++-- .../dpf-hypervisor-network-tests-ref.yaml | 4 ---- .../dpf-hypervisor-prepare-environment-commands.sh | 10 +++++----- .../dpf-hypervisor-prepare-environment-ref.yaml | 10 +++------- .../dpf-hypervisor-sanity-existing-commands.sh | 4 ++-- .../dpf-hypervisor-sanity-existing-ref.yaml | 4 ---- .../setup-ssh/dpf-hypervisor-setup-ssh-commands.sh | 2 +- .../setup-ssh/dpf-hypervisor-setup-ssh-ref.yaml | 6 +----- .../dpf-hypervisor-upgrade-management-commands.sh | 4 ++-- .../dpf-hypervisor-upgrade-management-ref.yaml | 4 ---- 15 files changed, 24 insertions(+), 51 deletions(-) diff --git a/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh b/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh index 38d35a854d4a8..11bd56c67a95d 100644 --- a/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-commands.sh @@ -9,14 +9,14 @@ cat ${SHARED_DIR}/testing.txt CLUSTER_NAME=$(cat "${CLUSTER_PROFILE_DIR}/cluster-name") # Configuration -REMOTE_HOST=$(cat /var/run/dpf-ci/remote-host) +REMOTE_HOST=$(cat ${CLUSTER_PROFILE_DIR}/remote-host) echo "Remote host: ${REMOTE_HOST}" echo "Setting up SSH access to DPF hypervisor: ${REMOTE_HOST}" # Prepare SSH key from Vault (add trailing newline if missing) echo "Configuring SSH private key..." -cat /var/run/dpf-ci/private-key | base64 -d > /tmp/id_rsa +cat ${CLUSTER_PROFILE_DIR}/private-key | base64 -d > /tmp/id_rsa echo "" >> /tmp/id_rsa chmod 600 /tmp/id_rsa diff --git a/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-ref.yaml index 730472b15be4a..919676ae6dc93 100644 --- a/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/deploy-cluster/dpf-hypervisor-deploy-cluster-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-deploy-cluster commands: dpf-hypervisor-deploy-cluster-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci documentation: |- Deploy OpenShift cluster with DPF using the automation scripts on the hypervisor. This step executes 'make all' which performs the complete diff --git a/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml b/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml index eadda21a3aadd..bc1ca4dddce51 100644 --- a/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml @@ -24,8 +24,9 @@ workflow: - Testing: 1.5-2 hours - Cleanup: 30-45 minutes - Required secrets in Vault (/var/run/dpf-ci/): + Required secrets in Vault (cluster profile): - private-key: SSH private key for nvd-srv-45 - openshift-pull-secret: OpenShift pull secret - - dpf-pull-secret: NVIDIA DPF pull secret - - env: Base64 encoded .env file \ No newline at end of file + - dpf-pull-secret: NVIDIA DPF pull secret + - env: Base64 encoded .env file + - user-env: Environment override file for cluster configuration \ No newline at end of file diff --git a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh index fc9cad47887dc..71f9fc8a33d74 100755 --- a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh @@ -4,7 +4,7 @@ set -euo pipefail shopt -s inherit_errexit # Configuration -REMOTE_HOST=$(cat /var/run/dpf-ci/remote-host) +REMOTE_HOST=$(cat ${CLUSTER_PROFILE_DIR}/remote-host) CLUSTER_NAME=$(cat "${CLUSTER_PROFILE_DIR}/cluster-name") REMOTE_LAST_OPENSHIFT_DPF_DIR_LOCATION="/root/${CLUSTER_NAME}/ci/last-openshift-dpf-dir.sh" @@ -12,7 +12,7 @@ echo "Setting up SSH access to DPF hypervisor: ${REMOTE_HOST}" # Prepare SSH key from Vault (add trailing newline if missing) echo "Configuring SSH private key..." -cat /var/run/dpf-ci/private-key | base64 -d > /tmp/id_rsa +cat ${CLUSTER_PROFILE_DIR}/private-key | base64 -d > /tmp/id_rsa echo "" >> /tmp/id_rsa chmod 600 /tmp/id_rsa diff --git a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml index c4cc41abb0054..29ca85c32f94a 100644 --- a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-load-kubeconfig commands: dpf-hypervisor-load-kubeconfig-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci documentation: |- SSH into the DPF hypervisor bastion host, locate the kubeconfig from the last openshift-dpf install directory, patch the API server address, and diff --git a/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-commands.sh b/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-commands.sh index 404423cb0ae4f..31d6abb8fe89a 100644 --- a/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-commands.sh @@ -1,12 +1,12 @@ #!/bin/bash set -euo pipefail -REMOTE_HOST=$(cat /var/run/dpf-ci/remote-host) +REMOTE_HOST=$(cat ${CLUSTER_PROFILE_DIR}/remote-host) echo "Setting up SSH access to DPF hypervisor: ${REMOTE_HOST}" # Prepare SSH key from Vault (add trailing newline if missing) -cat /var/run/dpf-ci/private-key | base64 -d > /tmp/id_rsa +cat ${CLUSTER_PROFILE_DIR}/private-key | base64 -d > /tmp/id_rsa echo "" >> /tmp/id_rsa chmod 600 /tmp/id_rsa diff --git a/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-ref.yaml index 8d1a6f99a1db1..10fdc7e35dc31 100644 --- a/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/network-tests/dpf-hypervisor-network-tests-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-network-tests commands: dpf-hypervisor-network-tests-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci documentation: |- Run Kubernetes Network Traffic Flow Tests on an EXISTING DPF cluster. diff --git a/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-commands.sh b/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-commands.sh index 487765ed4c2a4..41e22c7a45368 100644 --- a/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-commands.sh @@ -20,7 +20,7 @@ tar -czf - --exclude='.git' --exclude='logs' --exclude='*.log' . | \ # Prepare .env configuration from Vault echo "Setting up environment configuration..." -cat /var/run/dpf-ci/env | base64 -d > /tmp/dpf-ci.env +cat ${CLUSTER_PROFILE_DIR}/env | base64 -d > /tmp/dpf-ci.env # Generate dynamic cluster name for CI CLUSTER_NAME="dpf-ci-$(date +%Y%m%d-%H%M%S)" @@ -33,8 +33,8 @@ scp /tmp/dpf-ci.env ${REMOTE_HOST}:${REMOTE_WORK_DIR}/.env echo "Setting up pull secrets..." # Process OpenShift pull secret -if [[ -f /var/run/dpf-ci/openshift-pull-secret ]]; then - cat /var/run/dpf-ci/openshift-pull-secret | base64 -d > /tmp/openshift_pull.json +if [[ -f ${CLUSTER_PROFILE_DIR}/openshift-pull-secret ]]; then + cat ${CLUSTER_PROFILE_DIR}/openshift-pull-secret | base64 -d > /tmp/openshift_pull.json scp /tmp/openshift_pull.json ${REMOTE_HOST}:${REMOTE_WORK_DIR}/ else echo "ERROR: OpenShift pull secret not found in Vault" @@ -42,8 +42,8 @@ else fi # Process DPF pull secret -if [[ -f /var/run/dpf-ci/dpf-pull-secret ]]; then - cat /var/run/dpf-ci/dpf-pull-secret | base64 -d > /tmp/pull-secret.txt +if [[ -f ${CLUSTER_PROFILE_DIR}/dpf-pull-secret ]]; then + cat ${CLUSTER_PROFILE_DIR}/dpf-pull-secret | base64 -d > /tmp/pull-secret.txt scp /tmp/pull-secret.txt ${REMOTE_HOST}:${REMOTE_WORK_DIR}/ else echo "ERROR: DPF pull secret not found in Vault" diff --git a/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-ref.yaml index 1b5a91568f6bc..802496acdc7c6 100644 --- a/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/prepare-environment/dpf-hypervisor-prepare-environment-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-prepare-environment commands: dpf-hypervisor-prepare-environment-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci dependencies: - env: SHARED_DIR name: shared-tmp @@ -22,9 +18,9 @@ ref: 6. Validates environment setup Required Vault secrets: - - /var/run/dpf-ci/env: Base64 encoded .env file - - /var/run/dpf-ci/openshift-pull-secret: OpenShift pull secret - - /var/run/dpf-ci/dpf-pull-secret: NVIDIA DPF pull secret + - env: Base64 encoded .env file + - openshift-pull-secret: OpenShift pull secret + - dpf-pull-secret: NVIDIA DPF pull secret from: dpf-ci resources: requests: diff --git a/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-commands.sh b/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-commands.sh index bcb41fa9f786b..da0fd70e7552d 100644 --- a/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-commands.sh @@ -4,13 +4,13 @@ set -euo pipefail CLUSTER_NAME=$(cat "${CLUSTER_PROFILE_DIR}/cluster-name") # Configuration -REMOTE_HOST=$(cat /var/run/dpf-ci/remote-host) +REMOTE_HOST=$(cat ${CLUSTER_PROFILE_DIR}/remote-host) echo "Setting up SSH access to DPF hypervisor: ${REMOTE_HOST}" # Prepare SSH key from Vault (add trailing newline if missing) echo "Configuring SSH private key..." -cat /var/run/dpf-ci/private-key | base64 -d > /tmp/id_rsa +cat ${CLUSTER_PROFILE_DIR}/private-key | base64 -d > /tmp/id_rsa echo "" >> /tmp/id_rsa chmod 600 /tmp/id_rsa diff --git a/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-ref.yaml index 12f14305bf4b7..0f393240ac50d 100644 --- a/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/sanity-existing/dpf-hypervisor-sanity-existing-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-sanity-existing commands: dpf-hypervisor-sanity-existing-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci documentation: |- Run DPF sanity tests on an EXISTING cluster without provisioning. diff --git a/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-commands.sh b/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-commands.sh index 7e81895d47abc..8db229b96e90d 100644 --- a/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-commands.sh @@ -8,7 +8,7 @@ echo "Setting up SSH access to DPF hypervisor: ${REMOTE_HOST}" # Prepare SSH key from Vault (add trailing newline if missing) echo "Configuring SSH private key..." -cat /var/run/dpf-ci/private-key | base64 -d > /tmp/id_rsa +cat ${CLUSTER_PROFILE_DIR}/private-key | base64 -d > /tmp/id_rsa echo "" >> /tmp/id_rsa chmod 600 /tmp/id_rsa diff --git a/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-ref.yaml index fbd99e55dfc70..292ae11dcb918 100644 --- a/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/setup-ssh/dpf-hypervisor-setup-ssh-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-setup-ssh commands: dpf-hypervisor-setup-ssh-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci documentation: |- Set up SSH access to the DPF hypervisor (nvd-srv-45) using private key from Vault and configure SSH client for automated connections. @@ -19,7 +15,7 @@ ref: host key checking disabled for CI environment, and batch mode enabled. Required Vault secrets: - - /var/run/dpf-ci/private-key: SSH private key for root@nvd-srv-45 + - private-key: SSH private key for root@nvd-srv-45 from: dpf-ci resources: requests: diff --git a/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-commands.sh b/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-commands.sh index c3b66be3e6e12..fce402bb6952b 100644 --- a/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-commands.sh @@ -4,13 +4,13 @@ set -euo pipefail # SSH + cluster-locate boilerplate copied from dpf-hypervisor-sanity-existing-commands.sh. # Duplicated because each step ref runs as an independent pod with no shared setup. # Also duplicated in network-tests and deploy-cluster. TODO: extract into a shared script. -REMOTE_HOST=$(cat /var/run/dpf-ci/remote-host) +REMOTE_HOST=$(cat ${CLUSTER_PROFILE_DIR}/remote-host) CLUSTER_NAME=$(cat "${CLUSTER_PROFILE_DIR}/cluster-name") REMOTE_LAST_OPENSHIFT_DPF_DIR_LOCATION="/root/${CLUSTER_NAME}/ci/last-openshift-dpf-dir.sh" echo "Setting up SSH access to DPF hypervisor: ${REMOTE_HOST}" -cat /var/run/dpf-ci/private-key | base64 -d >/tmp/id_rsa +cat ${CLUSTER_PROFILE_DIR}/private-key | base64 -d >/tmp/id_rsa echo "" >>/tmp/id_rsa chmod 600 /tmp/id_rsa diff --git a/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-ref.yaml index c26a50031d28d..5953f8ae4887b 100644 --- a/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/upgrade-management/dpf-hypervisor-upgrade-management-ref.yaml @@ -1,10 +1,6 @@ ref: as: dpf-hypervisor-upgrade-management commands: dpf-hypervisor-upgrade-management-commands.sh - credentials: - - mount_path: /var/run/dpf-ci - name: cluster-secrets-metal-dpf-doca8 - namespace: ci documentation: |- Upgrade the management cluster OCP version on an existing deployment. From d40756b89b1cf68adc9df40927303c0c1503acef Mon Sep 17 00:00:00 2001 From: Jose Castillo Lema Date: Wed, 19 Aug 2026 12:43:01 +0200 Subject: [PATCH 3/3] Remove IP hack from load-kubeconfig Signed-off-by: Jose Castillo Lema gitleaks.version: 8.30.0 gitleaks.check-secrets: ENABLED --- .../e2e/dpf-hypervisor-e2e-workflow.yaml | 7 ++--- ...dpf-hypervisor-load-kubeconfig-commands.sh | 27 ------------------- .../dpf-hypervisor-load-kubeconfig-ref.yaml | 17 ++++-------- 3 files changed, 9 insertions(+), 42 deletions(-) diff --git a/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml b/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml index bc1ca4dddce51..8b99396a33c66 100644 --- a/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/e2e/dpf-hypervisor-e2e-workflow.yaml @@ -25,8 +25,9 @@ workflow: - Cleanup: 30-45 minutes Required secrets in Vault (cluster profile): - - private-key: SSH private key for nvd-srv-45 + - private-key: SSH private key for hypervisor + - remote-host: IP address of the hypervisor bastion host + - cluster-name: Name of the target cluster - openshift-pull-secret: OpenShift pull secret - dpf-pull-secret: NVIDIA DPF pull secret - - env: Base64 encoded .env file - - user-env: Environment override file for cluster configuration \ No newline at end of file + - env: Base64 encoded .env file \ No newline at end of file diff --git a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh index 71f9fc8a33d74..8dedef5847d24 100755 --- a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh +++ b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-commands.sh @@ -47,33 +47,6 @@ fi echo "=== Copying kubeconfig from ${LAST_OPENSHIFT_DPF} on hypervisor ===" scp ${SSH_OPTS} root@${REMOTE_HOST}:${LAST_OPENSHIFT_DPF}/kubeconfig.${CLUSTER_NAME} /tmp/kubeconfig.${CLUSTER_NAME} -# The kubeconfig's API server is addressed by an internal hostname that is -# not resolvable from the CI cluster's network. Resolve it from the -# hypervisor (which can reach internal DNS) and substitute the IP so the -# kubeconfig is usable from the CI pod. -CLUSTER_NAME="$(oc --kubeconfig=/tmp/kubeconfig.${CLUSTER_NAME} config view -o jsonpath='{.clusters[0].name}')" -CLUSTER_API_SERVER_HOSTNAME="$(oc --kubeconfig=/tmp/kubeconfig.${CLUSTER_NAME} config view -o jsonpath='{.clusters[0].cluster.server}' | sed -E 's#https://([^:]+):.*#\1#')" -echo "Resolving cluster API server hostname '${CLUSTER_API_SERVER_HOSTNAME}' from the hypervisor..." -CLUSTER_API_IP="$(ssh ${SSH_OPTS} root@${REMOTE_HOST} "getent hosts ${CLUSTER_API_SERVER_HOSTNAME} | awk '{print \$1}'")" - -if [[ -z "${CLUSTER_API_IP}" ]]; then - echo "ERROR: Failed to resolve '${CLUSTER_API_SERVER_HOSTNAME}' from the hypervisor" - exit 1 -fi - -echo "Resolved '${CLUSTER_API_SERVER_HOSTNAME}' to '${CLUSTER_API_IP}'" - -# The API server's serving certificate is issued for the hypervisor hostname -# (and internal cluster IPs), not the IP substituted above, so TLS hostname -# verification against it would fail. Mark the cluster as insecure and drop -# the CA data (the two are mutually exclusive in a kubeconfig) so consumers -# of this kubeconfig don't need to pass --insecure-skip-tls-verify -# themselves. -oc --kubeconfig=/tmp/kubeconfig.${CLUSTER_NAME} config set-cluster "${CLUSTER_NAME}" \ - --server="https://${CLUSTER_API_IP}:6443" \ - --insecure-skip-tls-verify=true -oc --kubeconfig=/tmp/kubeconfig.${CLUSTER_NAME} config unset "clusters.${CLUSTER_NAME}.certificate-authority-data" - cp /tmp/kubeconfig.${CLUSTER_NAME} "${SHARED_DIR}/kubeconfig" echo "Kubeconfig copied to \${SHARED_DIR}/kubeconfig successfully" diff --git a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml index 29ca85c32f94a..3a1693e293a6a 100644 --- a/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml +++ b/ci-operator/step-registry/dpf/hypervisor/load-kubeconfig/dpf-hypervisor-load-kubeconfig-ref.yaml @@ -3,28 +3,21 @@ ref: commands: dpf-hypervisor-load-kubeconfig-commands.sh documentation: |- SSH into the DPF hypervisor bastion host, locate the kubeconfig from the - last openshift-dpf install directory, patch the API server address, and - copy it to ${SHARED_DIR}/kubeconfig for use by subsequent steps (e.g. + last openshift-dpf install directory, and copy it to + ${SHARED_DIR}/kubeconfig for use by subsequent steps (e.g. openshift-e2e-test). This step: 1. Sets up SSH access to the hypervisor using the Vault private key 2. Reads the last openshift-dpf install dir location from the hypervisor - 3. Copies the cluster kubeconfig from that directory to the local pod - 4. Resolves the cluster API server hostname to an IP from the - hypervisor, since that hostname is not resolvable from the CI - cluster's network, and substitutes it into the kubeconfig - 5. Marks the cluster entry as insecure and drops its CA data, since the - API server's certificate is issued for the hypervisor hostname (and - internal cluster IPs), not the substituted IP, so TLS hostname - verification against it would otherwise fail - 6. Writes the resulting kubeconfig to ${SHARED_DIR}/kubeconfig + 3. Copies the cluster kubeconfig from that directory to ${SHARED_DIR}/kubeconfig + 4. Copies the .env file to ${SHARED_DIR}/.env Required Vault secrets: - private-key: SSH key for hypervisor - remote-host: IP address of the hypervisor bastion host - Use this for quick validation on doca8 or other existing clusters. + Use this for quick validation on existing clusters. Does NOT create or destroy any cluster resources. from: dpf-ci resources: