Remove epoxy and support s2i containers

.zuul.yaml

@@ -1,17 +1,4 @@
 ---
-- project:
-    name: openstack-k8s-operators/watcher-operator
-    default-branch: main
-    merge-mode: rebase
-    templates:
-      - opendev-master-watcher-operator-pipeline
-      - opendev-epoxy-watcher-operator-pipeline
-    github-check:
-      jobs:
-        - noop
-        - watcher-operator-doc-preview
-        - watcher-operator-kuttl
-
 - job:
     name: watcher-operator-base
     nodeset: centos-9-medium-2x-centos-9-crc-cloud-ocp-4-20-1-3xl
@@ -135,77 +122,6 @@
       asciidoc_available: true
       doc_available: false
 
-##########################################################
-#                                                        #
-#               Epoxy Zuul Jobs                          #
-#                                                        #
-##########################################################
-- job:
-    name: openstack-meta-content-provider-epoxy
-    description: |
-      A zuul job building content from OpenDev epoxy release.
-    parent: openstack-meta-content-provider
-    vars:
-      cifmw_install_yamls_sdk_version: v1.41.1
-      cifmw_bop_openstack_release: epoxy
-      cifmw_bop_dlrn_baseurl: "https://trunk.rdoproject.org/centos9-epoxy"
-      cifmw_repo_setup_branch: epoxy
-      cifmw_build_containers_registry_namespace: podified-epoxy-centos9
-      zuul_project_container_path: "{{ ansible_user_dir }}/src/github.com/openstack-k8s-operators/watcher-operator/ci/files/containers.yaml"
-      cifmw_build_containers_config_file: "{{ ansible_user_dir }}/containers.yaml"
-      cifmw_repo_setup_promotion: podified-ci-testing
-      cifmw_build_containers_force: true
-      cifmw_build_containers_image_tag: watcher_latest
-- job:
-    name: watcher-operator-validation-epoxy
-    parent: watcher-operator-validation-base
-    dependencies: ["openstack-meta-content-provider-epoxy"]
-    description: |
-      A zuul job to validate the watcher operator and its service deployment.
-      It will deploy podified and EDPM using current-podified antelope content.
-      During watcher deployment, It will fetch epoxy current hash and pull
-      openstack watcher services containers from meta content provider.
-      It will test current-podified control plane EDPM deployment with openstack watcher
-      master content. It deploys watcher using TLSe, and creates the certificates to use.
-      No dedicated RabbitMQ notifications broker is enabled on this job.
-    extra-vars:
-      # Override zuul meta content provider provided content_provider_dlrn_md5_hash
-      # var. As returned dlrn md5 hash comes from master release but job is using
-      # antelope content.
-      content_provider_dlrn_md5_hash: ''
-    vars:
-      # Donot use openstack services containers from meta content provider master
-      # job.
-      cifmw_update_containers_openstack: false
-      cifmw_update_containers_watcher: true
-      cifmw_update_containers_registry: "{{ content_provider_os_registry_url | split('/') | first }}"
-      cifmw_update_containers_tag: watcher_latest
-      cifmw_update_containers_org: podified-epoxy-centos9
-      # current dlrn hash changes frequently. In meta content provider, containers
-      # are tagged with watcher_latest, let's use the same here.
-      fetch_dlrn_hash: false
-      watcher_services_tag: watcher_latest
-      # tempest vars
-      cifmw_test_operator_tempest_registry: "{{ content_provider_os_registry_url | split('/') | first }}"
-      cifmw_test_operator_tempest_namespace: "{{ content_provider_os_registry_url | split('/') | last }}"
-      cifmw_test_operator_tempest_image_tag: watcher_latest
-      # Max api microversion for epoxy release
-      watcher_tempest_max_microversion: "1.4"
-      # Use watcher-tempest-plugin from known-compatible commit to current status of epoxy branch
-      cifmw_test_operator_tempest_external_plugin:
-        - repository: "https://opendev.org/openstack/watcher-tempest-plugin.git"
-          changeRepository: "https://review.opendev.org/openstack/watcher-tempest-plugin"
-          changeRefspec: "380572db57798530b64dcac14c6b01b0382c5d8e"
-      watcher_scenario: "edpm-no-notifications"
-
-- job:
-    name: watcher-operator-validation-epoxy-ocp4-18
-    parent: watcher-operator-validation-epoxy
-    description: |
-      watcher-operator-validation qualification with OCP 4.18.
-      No dedicated RabbitMQ notifications broker is enabled on this job.
-    nodeset: centos-9-medium-2x-centos-9-crc-cloud-ocp-4-18-1-3xl
-
 ##########################################################
 #                                                        #
 #               Master Zuul Jobs                         #
@@ -261,7 +177,10 @@
       cifmw_update_containers_watcher: true
       watcher_services_tag: watcher_latest
       watcher_registry_url: "{{ content_provider_os_registry_url }}"
-      cifmw_test_operator_tempest_image_tag: watcher_latest
+      cifmw_test_operator_tempest_registry: quay.io
+      cifmw_test_operator_tempest_namespace: openstack-k8s-operators
+      cifmw_test_operator_tempest_image_tag: master-latest
+      cifmw_test_operator_tempest_container: openstack-tempest
       cifmw_extras:
         - "@{{ ansible_user_dir }}/{{ zuul.projects['github.com/openstack-k8s-operators/ci-framework'].
            src_dir }}/scenarios/centos-9/multinode-ci.yml"
@@ -273,6 +192,8 @@
            src_dir }}/ci/tests/watcher-tempest-nfs.yml"
         - "@{{ ansible_user_dir }}/{{ zuul.projects['github.com/openstack-k8s-operators/watcher-operator'].
            src_dir }}/ci/scenarios/nfs.yml"
+        - "@{{ ansible_user_dir }}/{{ zuul.projects['github.com/openstack-k8s-operators/watcher-operator'].
+           src_dir }}/ci/scenarios/use_s2i_containers.yml"
 
     extra-vars:
       # Override zuul meta content provider provided content_provider_dlrn_md5_hash
@@ -308,14 +229,6 @@
         - openstack-meta-content-provider-master
         - watcher-operator-validation-master
 
-- project-template:
-    name: opendev-epoxy-watcher-operator-pipeline
-    github-check:
-      jobs:
-        - openstack-meta-content-provider-epoxy
-        - watcher-operator-validation-epoxy
-        - watcher-operator-validation-epoxy-ocp4-18
-
 - project-template:
     name: opendev-watcher-edpm-pipeline
     openstack-check:
@@ -354,3 +267,15 @@
             irrelevant-files: *irrelevant_files_watcher
             required-projects:
               - github.com/openstack-k8s-operators/watcher-operator
+
+- project:
+    name: openstack-k8s-operators/watcher-operator
+    default-branch: main
+    merge-mode: rebase
+    templates:
+      - opendev-master-watcher-operator-pipeline
+    github-check:
+      jobs:
+        - noop
+        - watcher-operator-doc-preview
+        - watcher-operator-kuttl

Makefile

@@ -382,13 +382,15 @@ CATALOG_IMAGE ?= quay.io/openstack-k8s-operators/watcher-operator-index:latest
 WATCHER_API_CI_IMAGE ?= quay.io/podified-master-centos9/openstack-watcher-api:current-podified
 WATCHER_DECISION_ENGINE_CI_IMAGE ?= quay.io/podified-master-centos9/openstack-watcher-decision-engine:current-podified
 WATCHER_APPLIER_CI_IMAGE ?= quay.io/podified-master-centos9/openstack-watcher-applier:current-podified
+WATCHER_BASE_CI_IMAGE ?= ""
 
 WATCHER_SAMPLE_CR_PATH ?= config/samples/watcher_v1beta1_watcher.yaml
 
 .PHONY: watcher
 watcher: export WATCHER_API_IMAGE=${WATCHER_API_CI_IMAGE}
 watcher: export WATCHER_DECISION_ENGINE_IMAGE=${WATCHER_DECISION_ENGINE_CI_IMAGE}
 watcher: export WATCHER_APPLIER_IMAGE=${WATCHER_APPLIER_CI_IMAGE}
+watcher: export WATCHER_BASE_IMAGE=${WATCHER_BASE_CI_IMAGE}
 watcher: export CATALOG_IMG=${CATALOG_IMAGE}
 watcher: ## Install watcher operator via olm
 	# explicitly to delete any running watcher-operator deployments from openstack-operator here as
@@ -495,6 +497,7 @@ run-with-webhook: export WEBHOOK_PORT?=9443
 run-with-webhook: export RELATED_IMAGE_WATCHER_API_IMAGE_URL_DEFAULT=${WATCHER_API_CI_IMAGE}
 run-with-webhook: export RELATED_IMAGE_WATCHER_DECISION_ENGINE_IMAGE_URL_DEFAULT=${WATCHER_DECISION_ENGINE_CI_IMAGE}
 run-with-webhook: export RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT=${WATCHER_APPLIER_CI_IMAGE}
+run-with-webhook: export RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT=${WATCHER_BASE_IMAGE}
 run-with-webhook: manifests generate fmt vet ## Run a controller from your host.
 	/bin/bash hack/clean_local_webhook.sh
 	/bin/bash hack/run_with_local_webhook.sh

api/v1beta1/common_types.go

@@ -242,10 +242,20 @@ func (r *WatcherImages) Default(defaults WatcherDefaults) {
 // SetupDefaults initializes any CRD field defaults based on environment variables (the defaulting mechanism itself is implemented via webhooks)
 func SetupDefaults() {
 	// Acquire environmental defaults and initialize Watcher defaults with them
-	watcherDefaults := WatcherDefaults{
-		APIContainerImageURL:            util.GetEnvVar("RELATED_IMAGE_WATCHER_API_IMAGE_URL_DEFAULT", WatcherAPIContainerImage),
-		ApplierContainerImageURL:        util.GetEnvVar("RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT", WatcherApplierContainerImage),
-		DecisionEngineContainerImageURL: util.GetEnvVar("RELATED_IMAGE_WATCHER_DECISION_ENGINE_IMAGE_URL_DEFAULT", WatcherDecisionEngineContainerImage),
+	baseImage := util.GetEnvVar("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT", "")
+	var watcherDefaults WatcherDefaults
+	if baseImage != "" {
+		watcherDefaults = WatcherDefaults{
+			APIContainerImageURL:            baseImage,
+			ApplierContainerImageURL:        baseImage,
+			DecisionEngineContainerImageURL: baseImage,
+		}
+	} else {
+		watcherDefaults = WatcherDefaults{
+			APIContainerImageURL:            util.GetEnvVar("RELATED_IMAGE_WATCHER_API_IMAGE_URL_DEFAULT", WatcherAPIContainerImage),
+			ApplierContainerImageURL:        util.GetEnvVar("RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT", WatcherApplierContainerImage),
+			DecisionEngineContainerImageURL: util.GetEnvVar("RELATED_IMAGE_WATCHER_DECISION_ENGINE_IMAGE_URL_DEFAULT", WatcherDecisionEngineContainerImage),
+		}
 	}
 	SetupWatcherDefaults(watcherDefaults)
 }

ci/olm.sh

@@ -53,4 +53,6 @@ spec:
       value: ${WATCHER_DECISION_ENGINE_IMAGE}
     - name: RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT
       value: ${WATCHER_APPLIER_IMAGE}
+    - name: RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT
+      value: ${WATCHER_BASE_IMAGE}
 EOF_CAT

ci/playbooks/deploy_watcher_operator.yaml

@@ -32,6 +32,4 @@
         script: make watcher
         extra_args:
           CATALOG_IMAGE: "{{ watcher_catalog_image | default('quay.io/openstack-k8s-operators/watcher-operator-index:latest') }}"
-          WATCHER_API_CI_IMAGE: "{{ _registry_url }}/openstack-watcher-api:{{ _tag }}"
-          WATCHER_DECISION_ENGINE_CI_IMAGE: "{{ _registry_url }}/openstack-watcher-decision-engine:{{ _tag }}"
-          WATCHER_APPLIER_CI_IMAGE: "{{ _registry_url }}/openstack-watcher-applier:{{ _tag }}"
+          WATCHER_BASE_CI_IMAGE: "quay.io/openstack-k8s-operators/openstack-watcher-base:master-latest"

ci/playbooks/patch-openstack-versions.yaml.j2

@@ -1,5 +1,5 @@
 spec:
   customContainerImages:
-    watcherAPIImage: {{ _registry_url }}/openstack-watcher-api:{{ _tag }}
-    watcherApplierImage: {{ _registry_url }}/openstack-watcher-applier:{{ _tag }}
-    watcherDecisionEngineImage: {{ _registry_url }}/openstack-watcher-decision-engine:{{ _tag }}
+    watcherAPIImage: quay.io/openstack-k8s-operators/openstack-watcher-base:master-latest
+    watcherApplierImage: quay.io/openstack-k8s-operators/openstack-watcher-base:master-latest
+    watcherDecisionEngineImage: quay.io/openstack-k8s-operators/openstack-watcher-base:master-latest

ci/playbooks/use-s2i-containers.yaml

@@ -0,0 +1,29 @@
+- name: Deploy s2i containers
+  hosts:  "{{ cifmw_target_hook_host | default('localhost')  }}"
+  gather_facts: true
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  tasks:
+    - name: Make sure logs directory exists
+      ansible.builtin.file:
+        path: "{{ logs_dir | default(cifmw_path) }}"
+        state: directory
+        recurse: true
+    - name: Generate container update template file
+      ansible.builtin.template:
+        src: "patch-openstack-versions.yaml.j2"
+        dest: "{{ logs_dir | default(cifmw_path) }}/s2i-patch-containers.yaml"
+    - name: Patch the openstackversions to use the master s2i containers
+      ansible.builtin.shell:
+        cmd: |
+          oc patch openstackversions controlplane --type merge --patch-file {{ logs_dir | default(cifmw_path) }}/s2i-patch-containers.yaml
+    - name: Wait for OpenStack controlplane to reconcile with S2I containers
+      ansible.builtin.command:
+        cmd: >-
+          oc wait OpenStackControlPlane controlplane
+          --namespace=openstack
+          --for=condition=Ready
+          --timeout=600s
+      retries: 3
+      delay: 10

ci/scenarios/use_s2i_containers.yml

@@ -0,0 +1,4 @@
+---
+post_deploy_99_patch_s2i_containers:
+  source: "{{ ansible_user_dir }}/{{ zuul.projects['github.com/openstack-k8s-operators/watcher-operator'].src_dir }}/ci/playbooks/use-s2i-containers.yaml"
+  type: playbook

config/default/manager_default_images.yaml

@@ -17,3 +17,5 @@ spec:
           value: quay.io/podified-master-centos9/openstack-watcher-decision-engine:current-podified
         - name: RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT
           value: quay.io/podified-master-centos9/openstack-watcher-applier:current-podified
+        - name: RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT
+          value: ''

test/functional/watcher_controller_test.go

@@ -709,6 +709,69 @@ var _ = Describe("Watcher controller", func() {
 		})
 	})
 
+	When("Watcher is created with RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT set and no container images in CR", func() {
+		BeforeEach(func() {
+			_ = os.Setenv("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT", "watcher-base-custom-image")
+			watcherv1beta1.SetupDefaults()
+			DeferCleanup(func() {
+				_ = os.Unsetenv("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT")
+				watcherv1beta1.SetupDefaults()
+			})
+			DeferCleanup(th.DeleteInstance, CreateWatcher(watcherTest.Instance, MinimalWatcherSpec))
+		})
+
+		It("should use the base image for all three services", func() {
+			Watcher := GetWatcher(watcherTest.Instance)
+			Expect(Watcher.Spec.APIContainerImageURL).To(Equal("watcher-base-custom-image"))
+			Expect(Watcher.Spec.DecisionEngineContainerImageURL).To(Equal("watcher-base-custom-image"))
+			Expect(Watcher.Spec.ApplierContainerImageURL).To(Equal("watcher-base-custom-image"))
+		})
+	})
+
+	When("Watcher is created with RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT and per-service env vars set", func() {
+		BeforeEach(func() {
+			_ = os.Setenv("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT", "watcher-base-custom-image")
+			_ = os.Setenv("RELATED_IMAGE_WATCHER_API_IMAGE_URL_DEFAULT", "watcher-api-custom-image-env")
+			_ = os.Setenv("RELATED_IMAGE_WATCHER_DECISION_ENGINE_IMAGE_URL_DEFAULT", "watcher-decision-engine-custom-image-env")
+			_ = os.Setenv("RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT", "watcher-applier-custom-image-env")
+			watcherv1beta1.SetupDefaults()
+			DeferCleanup(func() {
+				_ = os.Unsetenv("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT")
+				_ = os.Unsetenv("RELATED_IMAGE_WATCHER_API_IMAGE_URL_DEFAULT")
+				_ = os.Unsetenv("RELATED_IMAGE_WATCHER_DECISION_ENGINE_IMAGE_URL_DEFAULT")
+				_ = os.Unsetenv("RELATED_IMAGE_WATCHER_APPLIER_IMAGE_URL_DEFAULT")
+				watcherv1beta1.SetupDefaults()
+			})
+			DeferCleanup(th.DeleteInstance, CreateWatcher(watcherTest.Instance, MinimalWatcherSpec))
+		})
+
+		It("should use the base image, ignoring per-service env vars", func() {
+			Watcher := GetWatcher(watcherTest.Instance)
+			Expect(Watcher.Spec.APIContainerImageURL).To(Equal("watcher-base-custom-image"))
+			Expect(Watcher.Spec.DecisionEngineContainerImageURL).To(Equal("watcher-base-custom-image"))
+			Expect(Watcher.Spec.ApplierContainerImageURL).To(Equal("watcher-base-custom-image"))
+		})
+	})
+
+	When("Watcher is created with RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT and container images in CR", func() {
+		BeforeEach(func() {
+			_ = os.Setenv("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT", "watcher-base-custom-image")
+			watcherv1beta1.SetupDefaults()
+			DeferCleanup(func() {
+				_ = os.Unsetenv("RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT")
+				watcherv1beta1.SetupDefaults()
+			})
+			DeferCleanup(th.DeleteInstance, CreateWatcher(watcherTest.Instance, MinimalWatcherContainerSpec))
+		})
+
+		It("should use the images from the CR spec", func() {
+			Watcher := GetWatcher(watcherTest.Instance)
+			Expect(Watcher.Spec.APIContainerImageURL).To(Equal("watcher-api-custom-image"))
+			Expect(Watcher.Spec.DecisionEngineContainerImageURL).To(Equal("watcher-decision-engine-custom-image"))
+			Expect(Watcher.Spec.ApplierContainerImageURL).To(Equal("watcher-applier-custom-image"))
+		})
+	})
+
 	When("Watcher rejects when empty databaseinstance is used", func() {
 		It("should raise an error for empty databaseInstance", func() {
 			spec := GetDefaultWatcherAPISpec()