diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__multi-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__multi-nightly.yaml index 5aeb508ab4a41..18217717ca026 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__multi-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__multi-nightly.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: aws-efs-csi-operator-create-efs + cbo-tests: + name: "5.0" + namespace: ocp + tag: cluster-baremetal-operator cli: name: "5.0" namespace: ocp @@ -2963,6 +2967,63 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-ipi-virtual-media +- as: metal-ipi-ovn-ipv4-vmedia-rhcos9-worker-arm-f28 + capabilities: + - intranet + cron: 55 20 14 * * + reporter_config: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + DISCONNECTED: "false" + RESERVE_BOOTSTRAP: "false" + TEST_SUITE: cluster-baremetal-operator/non-disruptive + VENDOR: hpe + WORKER_COREOS_STREAM: rhel-9 + architecture: arm64 + masters: "3" + workers: "2" + test: + - ref: baremetal-lab-test-cbo-extension + workflow: baremetal-lab-ipi-virtual-media +- as: metal-ipi-ovn-ipv4-rhcos9-worker-amd-f28 + capabilities: + - intranet + cron: 52 17 24 * * + reporter_config: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + DISCONNECTED: "false" + RESERVE_BOOTSTRAP: "false" + TEST_SUITE: cluster-baremetal-operator/non-disruptive + WORKER_COREOS_STREAM: rhel-9 + architecture: amd64 + masters: "3" + workers: "2" + test: + - ref: baremetal-lab-test-cbo-extension + workflow: baremetal-lab-ipi - as: aws-eusc-ipi-fips-tp-arm-f7 cron: 0 0 31 2 * steps: diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1__multi-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1__multi-nightly.yaml index 96b7062699540..3b7453366c92c 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1__multi-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1__multi-nightly.yaml @@ -3,6 +3,10 @@ base_images: name: "5.1" namespace: ocp tag: aws-efs-csi-operator-create-efs + cbo-tests: + name: "5.0" + namespace: ocp + tag: cluster-baremetal-operator cli: name: "5.1" namespace: ocp @@ -2946,6 +2950,63 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-ipi-virtual-media +- as: metal-ipi-ovn-ipv4-vmedia-rhcos9-worker-arm-f28 + capabilities: + - intranet + cron: 6 17 23 * * + reporter_config: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + DISCONNECTED: "false" + RESERVE_BOOTSTRAP: "false" + TEST_SUITE: cluster-baremetal-operator/non-disruptive + VENDOR: hpe + WORKER_COREOS_STREAM: rhel-9 + architecture: arm64 + masters: "3" + workers: "2" + test: + - ref: baremetal-lab-test-cbo-extension + workflow: baremetal-lab-ipi-virtual-media +- as: metal-ipi-ovn-ipv4-rhcos9-worker-amd-f28 + capabilities: + - intranet + cron: 23 4 9 * * + reporter_config: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + DISCONNECTED: "false" + RESERVE_BOOTSTRAP: "false" + TEST_SUITE: cluster-baremetal-operator/non-disruptive + WORKER_COREOS_STREAM: rhel-9 + architecture: amd64 + masters: "3" + workers: "2" + test: + - ref: baremetal-lab-test-cbo-extension + workflow: baremetal-lab-ipi - as: aws-eusc-ipi-fips-tp-arm-f7 cron: 0 0 31 2 * steps: diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0-periodics.yaml index b1b985352880f..ec906d803334e 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0-periodics.yaml @@ -91408,6 +91408,127 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 52 17 24 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-5.0 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: multi-nightly + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-5.0-multi-nightly-metal-ipi-ovn-ipv4-rhcos9-worker-amd-f28 + reporter_config: + slack: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=metal-ipi-ovn-ipv4-rhcos9-worker-amd-f28 + - --variant=multi-nightly + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 0 0 31 2 * @@ -91848,6 +91969,127 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 55 20 14 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-5.0 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: multi-nightly + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-5.0-multi-nightly-metal-ipi-ovn-ipv4-vmedia-rhcos9-worker-arm-f28 + reporter_config: + slack: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=metal-ipi-ovn-ipv4-vmedia-rhcos9-worker-arm-f28 + - --variant=multi-nightly + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 0 0 31 2 * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1-periodics.yaml index 09b5ee1937646..00b0ba692cd28 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.1-periodics.yaml @@ -60681,6 +60681,127 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 23 4 9 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-5.1 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: multi-nightly + ci.openshift.io/generator: prowgen + job-release: "5.1" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-5.1-multi-nightly-metal-ipi-ovn-ipv4-rhcos9-worker-amd-f28 + reporter_config: + slack: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=metal-ipi-ovn-ipv4-rhcos9-worker-amd-f28 + - --variant=multi-nightly + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 0 0 31 2 * @@ -61121,6 +61242,127 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 6 17 23 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-5.1 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: multi-nightly + ci.openshift.io/generator: prowgen + job-release: "5.1" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-5.1-multi-nightly-metal-ipi-ovn-ipv4-vmedia-rhcos9-worker-arm-f28 + reporter_config: + slack: + channel: '#metal-qe-ci' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=metal-ipi-ovn-ipv4-vmedia-rhcos9-worker-arm-f28 + - --variant=multi-nightly + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build09 cron: 0 0 31 2 * diff --git a/ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh b/ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh index 01b6637890478..aefc7fed6bb8f 100644 --- a/ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh +++ b/ci-operator/step-registry/baremetal/lab/ipi/install/baremetal-lab-ipi-install-commands.sh @@ -257,6 +257,51 @@ if [[ "$ENABLE_CAPI" == "true" ]]; then sed -i 's/watchAllNamespaces: false/watchAllNamespaces: true/' "${INSTALL_DIR}/openshift/99_baremetal-provisioning-config.yaml" fi +# Patch worker BMH manifests to use the specified CoreOS stream. +# This controls which IPA (kernel/initrd/rootfs) version is used +# during PXE boot for worker nodes. +if [[ -n "${WORKER_COREOS_STREAM:-}" ]]; then + if [[ ! "${WORKER_COREOS_STREAM}" =~ ^[a-zA-Z0-9._-]+$ ]]; then + echo "[ERROR] Invalid WORKER_COREOS_STREAM: ${WORKER_COREOS_STREAM}" + exit 1 + fi + esc_stream="$(printf '%s' "${WORKER_COREOS_STREAM}" | sed 's/[\/&]/\\&/g')" + for bmh_file in "${INSTALL_DIR}"/openshift/99_openshift-cluster-api_hosts-*.yaml; do + if ! grep -q 'installer.openshift.io/role: control-plane' "${bmh_file}"; then + echo "cat ${bmh_file}" + cat "${bmh_file}" + sed -i "s/coreos.openshift.io\/stream: .*/coreos.openshift.io\/stream: ${esc_stream}/" "${bmh_file}" + grep "${esc_stream}" "${bmh_file}" + fi + done + # Patch worker MachineSet hostSelector to match the new stream + for ms_file in "${INSTALL_DIR}"/openshift/99_openshift-cluster-api_worker-machineset-*.yaml; do + sed -i 's/- rhel-9/- rhel-10/' "${ms_file}" + ls "${ms_file}" + echo -e "\n${ms_file}\n---------------------\n$(cat "${ms_file}")\n----------------------\n" + done + # Set the worker MachineConfigPool to use the specified stream for + # the on-disk OS. Requires the OSStreams feature gate (TechPreviewNoUpgrade). + cat > "${INSTALL_DIR}/openshift/99_worker-osimagestream.yaml" <&- + eth1 eth2 201>&- else echo "No active IPv4 lease record found to release." fi - if [ "${DISCONNECTED}" != "true" ] && [ "${ipv6_enabled}" == "true" ]; then - echo "Flush the SLAAC IPv6 addresses manually from eth1 (since SLAAC has no release packet)" - nsenter -n -t "$pid" ip -6 addr flush dev eth1 + if [[ " ${devices[*]} " == *" eth2.br-int "* ]]; then + echo "Evaluating IPv6 DHCP lease status for eth2 in $container_name..." + if [ -s "/var/builds/$CLUSTER_NAME/haproxy/dhclient.eth2.v6.lease" ] && \ + grep -q "lease6 {" "/var/builds/$CLUSTER_NAME/haproxy/dhclient.eth2.v6.lease"; then + echo "Releasing isolated IPv6 DHCP lease for eth2..." + nsenter -m -u -n -i -p -t "$pid" \ + /sbin/dhclient -6 -r \ + -pf "/etc/haproxy/dhclient.eth2.v6.pid" \ + -lf "/etc/haproxy/dhclient.eth2.v6.lease" \ + eth2 201>&- + else + echo "No active IPv6 lease record found to release." + fi fi for dev in "${devices[@]}"; do diff --git a/ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh b/ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh index 3afd11222a0ae..d9662bf7476cf 100644 --- a/ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh +++ b/ci-operator/step-registry/baremetal/lab/pre/load-balancer/run/baremetal-lab-pre-load-balancer-run-commands.sh @@ -21,6 +21,11 @@ interface "eth1" { also request routers, domain-name, domain-name-servers, domain-search, dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers; } + +interface "eth2" { + also request routers, domain-name, domain-name-servers, domain-search, + dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers; +} ' echo "Pushing the configuration and starting the load balancer in the auxiliary host..." @@ -120,114 +125,55 @@ for dev in "${devices[@]}"; do fi done -echo "Injecting static IP assignments to eth2 (Internal interface)..." -if [ "${ipv4_enabled}" == "true" ]; then - if { [ "${LOAD_BALANCER_TYPE:-cluster-managed}" == "user-managed" ] || [ "${AGENT_PLATFORM_TYPE:-}" == "none" ]; }; then - if [ "${DISCONNECTED}" == "true" ]; then - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "$INTERNAL_API_IPV4"/22 dev eth2 - echo "Disconnected environment: Adding Ingress IP address to eth2 as alias..." - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "$INTERNAL_INGRESS_IPV4"/22 dev eth2 - else - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "$INTERNAL_INGRESS_IPV4"/22 dev eth2 - fi - else - # Required for internal communication, uses a separate IP to avoid conflicts with VIPs or node IPs. - LAST_OCTET="${INTERNAL_API_IPV4##*.}" - if [ "$LAST_OCTET" -lt 155 ]; then - # Nodes 1 to 154 -> Containers get 80.101 to 80.254 - HAPROXY_IPv4="${INTERNAL_API_IPV4%.*.*}.80.$((LAST_OCTET+100))"/22 - else - # Fallback for Nodes 155 to 248 -> Containers get 83.161 to 83.254 - HAPROXY_IPv4="${INTERNAL_API_IPV4%.*.*}.83.$((LAST_OCTET+6))"/22 - fi - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "${HAPROXY_IPv4}" dev eth2 - echo "Skipping assignment of IPv4 VIPs to eth2 because the load balancer is cluster-managed." - fi -fi -if [ "${ipv6_enabled}" == "true" ]; then - if { [ "${LOAD_BALANCER_TYPE:-cluster-managed}" == "user-managed" ] || [ "${AGENT_PLATFORM_TYPE:-}" == "none" ]; }; then - if [ "${DISCONNECTED}" == "true" ]; then - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "$INTERNAL_API_IPV6"/64 dev eth2 - echo "Disconnected environment: Adding Ingress IPv6 address to eth2 as alias..." - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "$INTERNAL_INGRESS_IPV6"/64 dev eth2 - else - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "$INTERNAL_INGRESS_IPV6"/64 dev eth2 - fi - else - # Required for internal communication, uses a separate IP to avoid conflicts with VIPs or node IPs. - nsenter -t "$CONTAINER_PID" -n /sbin/ip addr add "${INTERNAL_API_IPV6/::1/::4}"/64 dev eth2 - echo "Skipping assignment of IPv6 VIPs to eth2 because the load balancer is cluster-managed." - fi -fi -nsenter -t "$CONTAINER_PID" -n /sbin/ip link set eth2 up - -# --- EXTERNAL IPv4 DHCP SERVICE --- -if [ "${ipv4_enabled}" == "true" ]; then - if [ "${ipv6_enabled}" != "true" ]; then - nsenter -t "$CONTAINER_PID" -n /sbin/sysctl -w net.ipv6.conf.eth1.disable_ipv6=1 - fi - if [ "${DISCONNECTED}" != "true" ]; then - echo "Launching isolated IPv4 DHCP client exclusively for eth1..." - nsenter -m -u -n -i -p -t "$CONTAINER_PID" /sbin/dhclient -nw -v \ - -pf "/etc/haproxy/dhclient.v4.pid" \ - -lf "/etc/haproxy/dhclient.v4.lease" eth1 201>&- - - echo "Waiting for interfaces to obtain IPv4 addresses inside the container namespace..." - for i in {1..60}; do - if nsenter -t "$CONTAINER_PID" -n /sbin/ip -o -4 a list "${api_ip_interface}" | grep -q 'inet '; then - echo "IPv4 network layer state successfully verified." +if [ "${ipv4_enabled:-false}" == "true" ]; then + echo "Launching global IPv4 DHCP client..." + nsenter -m -u -n -i -p -t "$CONTAINER_PID" \ + /sbin/dhclient -nw -v \ + -pf "/etc/haproxy/dhclient.v4.pid" \ + -lf "/etc/haproxy/dhclient.v4.lease" eth1 eth2 201>&- + + echo "Waiting for interfaces to obtain IPv4 addresses inside the container namespace..." + for i in {1..60}; do + if nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -4 a list "${api_ip_interface}" | grep -q 'inet '; then + if [ "${DISCONNECTED}" == "true" ] || nsenter -m -u -n -i -p -t "$CONTAINER_PID" /sbin/ip -o -4 a list eth2 | grep -q 'inet '; then + echo "IPv4 addresses successfully assigned." break fi + fi - if [ "$i" -eq 60 ]; then - echo "Timed out waiting for DHCP IPv4 assignment on eth1. Exiting." - exit 1 - fi - sleep 0.5 - done - else - echo "Disconnected environment active. Skipping external IPv4 DHCP." - fi + if [ "$i" -eq 60 ]; then + echo "Timed out waiting for DHCP IPv4 assignment inside container. Exiting." + exit 1 + fi + sleep 0.5 + done else echo "IPv4 is disabled. Skipping IPv4 lease request." fi -# --- EXTERNAL IPv6 DHCP SERVICE --- -if [ "${ipv6_enabled}" == "true" ]; then - if [ "${DISCONNECTED}" != "true" ]; then - echo "Waiting for eth1 IPv6 Link-Local address to stabilize..." - for j in {1..20}; do - if nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth1 | grep -q 'inet6 fe80:' && \ - ! nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth1 | grep -q 'tentative'; then - echo "eth1 IPv6 Link-Local interface is ready." - break - fi - if [ "$j" -eq 20 ]; then - echo "Timed out waiting for eth1 IPv6 Link-Local initialization. Exiting." - exit 1 - fi - sleep 0.5 - done - - echo "Waiting for SLAAC to automatically assign global IPv6 addresses inside the container namespace..." - for i in {1..60}; do - if nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list "${api_ip_interface}" | grep global | grep -q 'inet6 '; then - echo "IPv6 global network layer state successfully verified." - break - fi +if [ "${ipv6_enabled:-false}" == "true" ] && [[ " ${devices[*]} " == *" eth2.br-int "* ]]; then - if [ "$i" -eq 60 ]; then - echo "Timed out waiting for SLAAC auto-configuration on eth1. Exiting." - exit 1 - fi - sleep 0.5 - done - else - echo "Disconnected environment active. Disabling IPv6 tracking profiles." - nsenter -t "$CONTAINER_PID" -n /sbin/sysctl -w net.ipv6.conf.eth1.disable_ipv6=1 - fi + echo "Waiting for eth2 IPv6 Link-Local address to be ready..." + for j in {1..20}; do + # Using only -n namespace argument to guarantee stability + if nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth2 | grep -q 'inet6 fe80:' && \ + ! nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth2 | grep -q 'tentative'; then + echo "eth2 IPv6 link-local interface is ready and available." + break + fi + [ "$j" -eq 20 ] && { echo "Timed out waiting for eth2 link-local interface state. Exiting."; exit 1; } + sleep 0.5 + done + + echo "Launching IPv6 DHCP client for eth2..." + nsenter -m -u -n -i -p -t "$CONTAINER_PID" \ + /sbin/dhclient -6 -v \ + -cf /dev/null \ + -pf "/etc/haproxy/dhclient.eth2.v6.pid" \ + -lf "/etc/haproxy/dhclient.eth2.v6.lease" eth2 201>&- + sleep 2 else - echo "IPv6 is disabled. Skipping SLAAC address allocation." + echo "IPv6 is disabled or br-int is absent. Skipping IPv6 lease request." fi cleanup @@ -236,58 +182,71 @@ trap - EXIT INT TERM echo "Sending HUP to HAProxy to trigger the configuration reload..." podman kill --signal HUP "$CONTAINER_NAME" -# --- MERGED VARIABLE GATHERING BLOCK --- -echo "Gathering the IP Addresses for downstream tasks..." +echo "Gather the IP Address for the new interface" api_ip="" -api_int_ip="" -api_ip_v6="" -api_int_ip_v6="" -ingress_vip="" -ingress_vip_v6="" - if [ "${ipv4_enabled:-false}" == "true" ]; then - if [ "${DISCONNECTED}" == "true" ]; then - api_ip="$INTERNAL_API_IPV4" - else - api_ip=$(nsenter -t "$CONTAINER_PID" -n /sbin/ip -o -4 a list ${api_ip_interface} | sed 's/.*inet \(.*\)\/[0-9]* brd.*$/\1/') - fi - api_int_ip="$api_ip" - if [ "${DISCONNECTED}" != "true" ] && \ - { [ "${LOAD_BALANCER_TYPE}" == "user-managed" ] || [ "${AGENT_PLATFORM_TYPE}" == "none" ]; }; then - # Connected user-managed LBs use the reserved ingress VIP on eth2 for - # both API and ingress listeners. Keep node-to-API traffic on that network. - api_int_ip="$INTERNAL_INGRESS_IPV4" - fi - ingress_vip="$INTERNAL_INGRESS_IPV4" - + api_ip=$(nsenter -m -u -n -i -p -t "$CONTAINER_PID" -n \ + /sbin/ip -o -4 a list ${api_ip_interface} | sed 's/.*inet \(.*\)\/[0-9]* brd.*$/\1/') if [ "${#api_ip}" -eq 0 ]; then - echo "No IPv4 Address has been mapped for the API VIP, failing." + echo "No IPv4 Address has been set for the external API VIP, failing" exit 1 fi fi +api_ip_v6="" if [ "${ipv6_enabled:-false}" == "true" ]; then - if [ "${DISCONNECTED}" == "true" ]; then - api_ip_v6="$INTERNAL_API_IPV6" - else - api_ip_v6=$(nsenter -t "$CONTAINER_PID" -n /sbin/ip -o -6 a list ${api_ip_interface} | grep global | sed 's/.*inet6 \(.*\)\/[0-9]* scope global.*/\1/') - fi - api_int_ip_v6="$api_ip_v6" - if [ "${DISCONNECTED}" != "true" ] && \ - { [ "${LOAD_BALANCER_TYPE}" == "user-managed" ] || [ "${AGENT_PLATFORM_TYPE}" == "none" ]; }; then - # Using eth1 here makes internal IPv6 clients traverse AUX on the way out, - # while HAProxy replies directly over eth2, bypassing AUX's connection tracking. - api_int_ip_v6="$INTERNAL_INGRESS_IPV6" + echo "Waiting for ${api_ip_interface} global IPv6 address to be ready..." + for i in {1..60}; do + if nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list ${api_ip_interface} | grep global | grep -q 'inet6' && \ + ! nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list ${api_ip_interface} | grep global | grep -q 'tentative'; then + api_ip_v6=$(nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list ${api_ip_interface} | grep global | sed -n 's/.*inet6 \([^ ]*\)\/.*/\1/p' | head -n1) + if [ -n "$api_ip_v6" ]; then + echo "Global IPv6 address ready: $api_ip_v6" + break + fi + fi + if [ "$i" -eq 60 ]; then + echo "No global IPv6 Address has been set for the external API VIP, failing" + exit 1 + fi + sleep 0.5 + done +fi + +api_int_ip="$api_ip" +api_int_ip_v6="$api_ip_v6" + +if [ x"${DISCONNECTED}" != x"true" ]; then + if [ "${ipv4_enabled:-false}" == "true" ]; then + api_int_ip=$(nsenter -m -u -n -i -p -t "$CONTAINER_PID" \ + /sbin/ip -o -4 a list eth2 | sed 's/.*inet \(.*\)\/[0-9]* brd.*$/\1/') + if [ "${#api_int_ip}" -eq 0 ]; then + echo "No IPv4 Address has been set for internal api-int, failing" + exit 1 + fi fi - ingress_vip_v6="$INTERNAL_INGRESS_IPV6" - if [ "${#api_ip_v6}" -eq 0 ]; then - echo "No global IPv6 Address has been mapped for the API VIP, failing." - exit 1 + if [ "${ipv6_enabled:-false}" == "true" ]; then + echo "Waiting for eth2 global IPv6 address to be ready..." + for i in {1..60}; do + if nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth2 | grep global | grep -q 'inet6' && \ + ! nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth2 | grep global | grep -q 'tentative'; then + api_int_ip_v6=$(nsenter -n -t "$CONTAINER_PID" /sbin/ip -o -6 a list eth2 | grep global | sed -n 's/.*inet6 \([^ ]*\)\/.*/\1/p' | head -n1) + if [ -n "$api_int_ip_v6" ]; then + echo "Global IPv6 address ready on eth2: $api_int_ip_v6" + break + fi + fi + if [ "$i" -eq 60 ]; then + echo "No global IPv6 Address has been set for internal IPv6 api-int, failing" + exit 1 + fi + sleep 0.5 + done fi fi -printf "ingress_vip: %s\napi_vip: %s\ningress_vip_v6: %s\napi_vip_v6: %s\napi_int: %s\napi_int_v6: %s" "$ingress_vip" "$api_ip" "$ingress_vip_v6" "$api_ip_v6" "$api_int_ip" "$api_int_ip_v6" > "$BUILD_DIR/external_vips.yaml" +printf "ingress_vip: %s\napi_vip: %s\ningress_vip_v6: %s\napi_vip_v6: %s\napi_int: %s\napi_int_v6: %s" "$api_ip" "$api_ip" "$api_ip_v6" "$api_ip_v6" "$api_int_ip" "$api_int_ip_v6" > "$BUILD_DIR/external_vips.yaml" EOF echo "Syncing back the external_vips.yaml file" diff --git a/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-commands.sh b/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-commands.sh index 4f9796eb638b2..90a01906daf68 100644 --- a/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-commands.sh +++ b/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-commands.sh @@ -11,7 +11,7 @@ mkdir -p "${ARTIFACT_DIR}/junit" # Decompress and prepare the CBO test extension binary echo "Preparing cluster-baremetal-operator test extension binary..." BINARY=/tmp/cluster-baremetal-operator-tests-ext -gunzip -c /usr/bin/cluster-baremetal-operator-tests-ext.gz > "${BINARY}" +gunzip -c /cbo-tests/usr/bin/cluster-baremetal-operator-tests-ext.gz > "${BINARY}" chmod +x "${BINARY}" # Verify binary diff --git a/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-ref.yaml b/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-ref.yaml index f17f69a9a73c9..0ab6e7f289e58 100644 --- a/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-ref.yaml +++ b/ci-operator/step-registry/baremetal/lab/test/cbo-extension/baremetal-lab-test-cbo-extension-ref.yaml @@ -1,10 +1,15 @@ ref: as: baremetal-lab-test-cbo-extension - from: cbo-tests - grace_period: 10m + from_image: + namespace: ci + name: "baremetal-qe-base" + tag: latest commands: baremetal-lab-test-cbo-extension-commands.sh - cli: latest timeout: 4h0m0s + grace_period: 10m + dependencies: + - name: cbo-tests + env: CBO_TESTS_IMAGE env: - name: TEST_SUITE default: ""