diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index 31610853fe5fd..1f3736bfe65de 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -316,6 +316,17 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-backuprestore + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false as: e2e-aws-minimal optional: true diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml index 8527105789d27..9fd164ff8b14d 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml @@ -303,6 +303,17 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-backuprestore + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false as: e2e-aws-minimal optional: true diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml index cafe054cdc28f..4c1de77a4986c 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml @@ -401,8 +401,19 @@ tests: steps: cluster_profile: hypershift-aws env: + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-aws-e2e-backuprestore +- as: e2e-v2-azure-self-managed-backuprestore + cron: 0 6 * * 0 + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore zz_generated_metadata: branch: release-4.23 org: openshift diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml index a96000818c293..da7c6b1792352 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml @@ -304,6 +304,17 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-backuprestore + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false as: e2e-aws-minimal optional: true diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml index 076a5c789d4f2..1431c452a0e73 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml @@ -432,6 +432,7 @@ tests: steps: cluster_profile: hypershift-aws env: + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-aws-e2e-backuprestore - as: e2e-v2-aws-techpreview-osimagestream @@ -442,6 +443,16 @@ tests: GUEST_FEATURE_SET: TechPreviewNoUpgrade TECH_PREVIEW_NO_UPGRADE: "true" workflow: hypershift-aws-e2e-v2-osimagestream +- as: e2e-v2-azure-self-managed-backuprestore + cron: 0 7 * * 0 + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore zz_generated_metadata: branch: release-5.0 org: openshift diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index e01d7b6bc3e57..4be29887673c5 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -3233,6 +3233,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build01 + context: ci/prow/e2e-v2-azure-self-managed-backuprestore + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-main-e2e-v2-azure-self-managed-backuprestore + optional: true + rerun_command: /test e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-backuprestore,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml index 4f7b51f7a59ec..db10a2120b94b 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml @@ -2573,6 +2573,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 0 6 * * 0 + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.23 + org: openshift + repo: hypershift + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci-operator.openshift.io/variant: periodics + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + - --variant=periodics + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build01 cron: 37 9,21 * * * diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml index 03a538d3fef55..3cebcc652ca3b 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml @@ -3233,6 +3233,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build06 + context: ci/prow/e2e-v2-azure-self-managed-backuprestore + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-release-4.23-e2e-v2-azure-self-managed-backuprestore + optional: true + rerun_command: /test e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-backuprestore,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml index 9e1f59df7fb6d..b44c7964d592c 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml @@ -2922,6 +2922,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 0 7 * * 0 + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-5.0 + org: openshift + repo: hypershift + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci-operator.openshift.io/variant: periodics + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + - --variant=periodics + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build01 cron: 37 9,21 * * * diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml index f511aaf889105..31f5da8fa957d 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml @@ -3233,6 +3233,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build06 + context: ci/prow/e2e-v2-azure-self-managed-backuprestore + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-release-5.0-e2e-v2-azure-self-managed-backuprestore + optional: true + rerun_command: /test e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-backuprestore,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json new file mode 100644 index 0000000000000..b8664c5ef91bf --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json @@ -0,0 +1,19 @@ +{ + "path": "hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml", + "owners": { + "approvers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ], + "reviewers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml new file mode 100644 index 0000000000000..77603ded4f813 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml @@ -0,0 +1,36 @@ +workflow: + as: hypershift-self-managed-azure-e2e-backuprestore + documentation: |- + The HyperShift self-managed-Azure e2e-backuprestore workflow executes backup and + restore tests against a self-managed HyperShift installation on Azure (nested + management cluster) using OADP with Azure Blob Storage. + + It provisions the nested management cluster, installs HyperShift, creates + self-managed Azure guest clusters, installs OLM and the OADP operator with + Azure-specific configuration against the public guest cluster, runs backup/restore + E2E tests, and then runs a minimal conformance suite. + steps: + pre: + - ref: ipi-install-rbac + - chain: hypershift-setup-nested-management-cluster + - ref: hypershift-azure-setup-private-link + - ref: hypershift-install + - ref: hypershift-resolve-nodepool-releases + - chain: hypershift-azure-create-selfmanaged-guests + - ref: operatorhub-subscribe-oadp-operator + - ref: hypershift-self-managed-azure-oadp-setup + test: + - chain: hypershift-e2e-backuprestore + post: + - chain: hypershift-azure-dump-selfmanaged-guests + - ref: hypershift-self-managed-azure-oadp-destroy + - chain: hypershift-azure-destroy-selfmanaged-guests + - chain: hypershift-destroy-nested-management-cluster + env: + CLOUD_PROVIDER: "Azure" + HYPERSHIFT_PLATFORM: "azure" + HYPERSHIFT_NODE_COUNT: "6" + HYPERSHIFT_AZURE_LOCATION: "centralus" + AZURE_SELF_MANAGED: "true" + HYPERSHIFT_EXTERNAL_DNS_DOMAIN: "sm.hcp-sm-azure.azure.devcluster.openshift.com" + HYPERSHIFT_ETCD_STORAGE_CLASS: "managed-csi-premium-v2" diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh new file mode 100755 index 0000000000000..cb370a50f8492 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh @@ -0,0 +1,93 @@ +#!/bin/bash + +set -euo pipefail + +AZURE_AUTH_LOCATION="/etc/hypershift-ci-jobs-self-managed-azure/credentials.json" + +STORAGE_ACCOUNT_MARKER="${SHARED_DIR}/oadp-storage-account-name" +STORAGE_RESOURCEGROUP_MARKER="${SHARED_DIR}/oadp-storage-resourcegroup" +OADP_MI_MARKER="${SHARED_DIR}/oadp-workload-identity-name" +OADP_MI_RG_MARKER="${SHARED_DIR}/oadp-workload-identity-resourcegroup" + +if [[ ! -f "${STORAGE_ACCOUNT_MARKER}" && ! -f "${OADP_MI_MARKER}" ]]; then + echo "No OADP storage account or workload identity marker files found, nothing to clean up" + exit 0 +fi + +echo "Reading Azure credentials..." +AZURE_AUTH_CLIENT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientId)" +AZURE_AUTH_CLIENT_SECRET="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientSecret)" +AZURE_AUTH_TENANT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .tenantId)" +AZURE_AUTH_SUBSCRIPTION_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .subscriptionId)" + +echo "Logging into Azure..." +az login --service-principal -u "${AZURE_AUTH_CLIENT_ID}" -p "${AZURE_AUTH_CLIENT_SECRET}" --tenant "${AZURE_AUTH_TENANT_ID}" --output none +az account set --subscription "${AZURE_AUTH_SUBSCRIPTION_ID}" + +OVERALL_RESULT=0 + +# --- Storage account cleanup (Velero) --- +if [[ -f "${STORAGE_ACCOUNT_MARKER}" ]]; then + STORAGE_ACCOUNT_NAME="$(cat "${STORAGE_ACCOUNT_MARKER}")" + if [[ ! -f "${STORAGE_RESOURCEGROUP_MARKER}" ]]; then + echo "Error: ${STORAGE_RESOURCEGROUP_MARKER} missing, cannot delete storage account ${STORAGE_ACCOUNT_NAME}" + OVERALL_RESULT=1 + else + RESOURCEGROUP="$(cat "${STORAGE_RESOURCEGROUP_MARKER}")" + + echo "Deleting storage account ${STORAGE_ACCOUNT_NAME}..." + RETRIES=3 + STORAGE_DELETED=false + for attempt in $(seq "${RETRIES}"); do + if az storage account delete \ + --name "${STORAGE_ACCOUNT_NAME}" \ + --resource-group "${RESOURCEGROUP}" \ + --yes; then + echo "Storage account deleted successfully" + STORAGE_DELETED=true + break + fi + echo "Attempt ${attempt}/${RETRIES}: Failed to delete storage account. Retrying in 30s..." + sleep 30 + done + if [[ "${STORAGE_DELETED}" != "true" ]]; then + echo "Error: Failed to delete storage account ${STORAGE_ACCOUNT_NAME} after ${RETRIES} attempts" + OVERALL_RESULT=1 + fi + fi +else + echo "No oadp-storage-account-name file found, skipping storage account cleanup" +fi + +# --- OADP workload identity cleanup (Velero + etcd-backup) --- +# Deleting the managed identity also deletes any federated identity +# credentials attached to it; no separate +# `az identity federated-credential delete` call is required. +if [[ -f "${OADP_MI_MARKER}" ]]; then + OADP_MI_NAME="$(cat "${OADP_MI_MARKER}")" + OADP_MI_RESOURCEGROUP="$(cat "${OADP_MI_RG_MARKER}")" + + echo "Deleting managed identity ${OADP_MI_NAME}..." + RETRIES=3 + MI_DELETED=false + for attempt in $(seq "${RETRIES}"); do + if az identity delete \ + --name "${OADP_MI_NAME}" \ + --resource-group "${OADP_MI_RESOURCEGROUP}"; then + echo "Managed identity deleted successfully" + MI_DELETED=true + break + fi + echo "Attempt ${attempt}/${RETRIES}: Failed to delete managed identity. Retrying in 30s..." + sleep 30 + done + if [[ "${MI_DELETED}" != "true" ]]; then + echo "Error: Failed to delete managed identity ${OADP_MI_NAME} after ${RETRIES} attempts" + OVERALL_RESULT=1 + fi +else + echo "No oadp-workload-identity-name file found, skipping OADP workload identity cleanup" +fi + +echo "OADP resource cleanup done" +exit "${OVERALL_RESULT}" diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json new file mode 100644 index 0000000000000..f8f13afb9c51b --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json @@ -0,0 +1,19 @@ +{ + "path": "hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml", + "owners": { + "approvers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ], + "reviewers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml new file mode 100644 index 0000000000000..90213e1681842 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml @@ -0,0 +1,18 @@ +ref: + as: hypershift-self-managed-azure-oadp-destroy + from: upi-installer + cli: latest + commands: hypershift-self-managed-azure-oadp-destroy-commands.sh + best_effort: true + timeout: 5m + resources: + requests: + cpu: 300m + memory: 300Mi + credentials: + - mount_path: /etc/hypershift-ci-jobs-self-managed-azure + name: hypershift-ci-jobs-self-managed-azure + namespace: test-credentials + documentation: |- + Cleans up Azure OADP resources created by hypershift-self-managed-azure-oadp-setup. + Deletes the dynamically created storage account used for OADP backups. diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh new file mode 100755 index 0000000000000..91826ac14d4a0 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh @@ -0,0 +1,310 @@ +#!/bin/bash + +set -euo pipefail + +export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig" + +AZURE_AUTH_LOCATION="/etc/hypershift-ci-jobs-self-managed-azure/credentials.json" +OADP_PLUGIN_IMAGE="${OADP_HYPERSHIFT_PLUGIN_IMAGE:-quay.io/konveyor/hypershift-oadp-plugin:latest}" + +# TODO: This picks the "public" cluster by default. The hypershift-azure-create-selfmanaged-guests +# creates a number of clusters which is baked into the create-guests binary from HyperShift. +# We need to find a way tell the binary to create only a single cluster. +CLUSTER_PREFIX="${CLUSTER_PREFIX:-public}" + +echo "Discovering the public self-managed-Azure guest cluster..." +CLUSTER_NAME="$(oc get hostedcluster -n clusters -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "${CLUSTER_PREFIX}" | head -n1 || true)" +if [[ -z "${CLUSTER_NAME}" ]]; then + echo "!!! Unable to find a public HostedCluster in the 'clusters' namespace" + oc get hostedcluster -n clusters + exit 1 +fi +echo "${CLUSTER_NAME}" > "${SHARED_DIR}/cluster-name" + +RESOURCEGROUP="$(cat "${SHARED_DIR}/azure_pls_resource_group")" +CONTAINER_PREFIX="hypershift-oadp-" +CONTAINER_NAME="${CONTAINER_PREFIX}${CLUSTER_NAME:0:$((63 - ${#CONTAINER_PREFIX}))}" +# Storage account names must be 3-24 chars, lowercase letters and numbers only. +# "oadp" (4) + sanitized cluster stem (up to 12) + job-unique hash (8) = max 24. +CLUSTER_STEM="$(echo "${CLUSTER_NAME}" | tr '[:upper:]' '[:lower:]' | tr -cd '[:lower:][:digit:]')" +JOB_SUFFIX="$(echo -n "${PROW_JOB_ID:-unknown}" | md5sum | cut -c1-8)" +STORAGE_ACCOUNT_NAME="oadp${CLUSTER_STEM:0:12}${JOB_SUFFIX}" + +echo "Setting up OADP prerequisites for backup/restore tests" +echo "Cluster: ${CLUSTER_NAME}, Resource Group: ${RESOURCEGROUP}, Storage Account: ${STORAGE_ACCOUNT_NAME}, Container: ${CONTAINER_NAME}" + +echo "Reading Azure credentials..." +AZURE_AUTH_CLIENT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientId)" +AZURE_AUTH_CLIENT_SECRET="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientSecret)" +AZURE_AUTH_TENANT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .tenantId)" +AZURE_AUTH_SUBSCRIPTION_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .subscriptionId)" + +echo "Logging into Azure..." +az login --service-principal -u "${AZURE_AUTH_CLIENT_ID}" -p "${AZURE_AUTH_CLIENT_SECRET}" --tenant "${AZURE_AUTH_TENANT_ID}" --output none +az account set --subscription "${AZURE_AUTH_SUBSCRIPTION_ID}" + +echo "Creating storage account ${STORAGE_ACCOUNT_NAME} in resource group ${RESOURCEGROUP}..." +az storage account create \ + --name "${STORAGE_ACCOUNT_NAME}" \ + --resource-group "${RESOURCEGROUP}" \ + --sku Standard_LRS \ + --kind StorageV2 \ + --output none + +# Save resource names for cleanup +echo "${STORAGE_ACCOUNT_NAME}" > "${SHARED_DIR}/oadp-storage-account-name" +echo "${RESOURCEGROUP}" > "${SHARED_DIR}/oadp-storage-resourcegroup" + +echo "Creating blob container ${CONTAINER_NAME}..." +az storage container create \ + --name "${CONTAINER_NAME}" \ + --account-name "${STORAGE_ACCOUNT_NAME}" \ + --auth-mode login \ + --output none + +echo "Getting resource ID of storage account ${STORAGE_ACCOUNT_NAME} for role scope..." +STORAGE_ACCOUNT_ID="$(az storage account show --name "${STORAGE_ACCOUNT_NAME}" --resource-group "${RESOURCEGROUP}" --query id -o tsv)" +if [[ -z "${STORAGE_ACCOUNT_ID}" ]]; then + echo "!!! Unable to resolve resource ID for storage account ${STORAGE_ACCOUNT_NAME}" + exit 1 +fi + +# Create the openshift-adp namespace if it doesn't exist +oc get namespace openshift-adp 2>/dev/null || oc create namespace openshift-adp + +echo "Setting up dedicated Azure Workload Identity for OADP (Velero + etcd-backup)..." + +# Subjects hardcoded by the two consumers: +# - HyperShift Operator's HCPEtcdBackup controller (hypershift ns, autodetected via BSL-copied credential) +# - Velero + NodeAgent DaemonSet, which share ServiceAccount "velero" in openshift-adp +ETCD_BACKUP_SA_SUBJECT="system:serviceaccount:hypershift:etcd-backup-job" +VELERO_SA_SUBJECT="system:serviceaccount:openshift-adp:velero" + +OADP_MI_NAME="oadp-workload-identity-${CLUSTER_NAME}" +OADP_MI_RESOURCEGROUP="os4-common" +OADP_MI_LOCATION="${HYPERSHIFT_AZURE_LOCATION:-centralus}" + +echo "Creating managed identity ${OADP_MI_NAME} in resource group ${OADP_MI_RESOURCEGROUP}..." +az identity create \ + --name "${OADP_MI_NAME}" \ + --resource-group "${OADP_MI_RESOURCEGROUP}" \ + --location "${OADP_MI_LOCATION}" \ + --output none + +# Persist identity coordinates immediately so the destroy step can find and +# remove it even if a later step in this block fails. +echo "${OADP_MI_NAME}" > "${SHARED_DIR}/oadp-workload-identity-name" +echo "${OADP_MI_RESOURCEGROUP}" > "${SHARED_DIR}/oadp-workload-identity-resourcegroup" + +echo "Resolving client ID and principal ID of ${OADP_MI_NAME}..." +OADP_MI_CLIENT_ID="" +OADP_MI_PRINCIPAL_ID="" +for attempt in $(seq 1 5); do + OADP_MI_CLIENT_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query clientId -o tsv || true)" + OADP_MI_PRINCIPAL_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query principalId -o tsv || true)" + if [[ -n "${OADP_MI_CLIENT_ID}" && -n "${OADP_MI_PRINCIPAL_ID}" ]]; then + break + fi + echo "Attempt ${attempt}/5: identity not fully propagated yet, retrying in 10s..." + sleep 10 +done +if [[ -z "${OADP_MI_CLIENT_ID}" || -z "${OADP_MI_PRINCIPAL_ID}" ]]; then + echo "!!! Failed to resolve clientId/principalId for managed identity ${OADP_MI_NAME}" + exit 1 +fi + +echo "Resolving management cluster OIDC issuer..." +MGMT_OIDC_ISSUER="$(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}')" +if [[ -z "${MGMT_OIDC_ISSUER}" ]]; then + echo "!!! Unable to resolve serviceAccountIssuer from the management cluster's Authentication config" + exit 1 +fi +echo "Management cluster OIDC issuer: ${MGMT_OIDC_ISSUER}" + +# Creates one federated credential on ${OADP_MI_NAME}, retrying on transient +# failures. Args: +create_federated_credential() { + local fedcred_name="$1" + local subject="$2" + local attempt + for attempt in $(seq 1 5); do + if az identity federated-credential create \ + --name "${fedcred_name}" \ + --identity-name "${OADP_MI_NAME}" \ + --resource-group "${OADP_MI_RESOURCEGROUP}" \ + --issuer "${MGMT_OIDC_ISSUER}" \ + --subject "${subject}" \ + --audiences "api://AzureADTokenExchange" \ + --output none; then + return 0 + fi + echo "Attempt ${attempt}/5: Failed to create federated credential ${fedcred_name}, retrying in 10s..." + sleep 10 + done + return 1 +} + +echo "Creating federated identity credential for etcd-backup..." +if ! create_federated_credential "etcd-backup-fedcred" "${ETCD_BACKUP_SA_SUBJECT}"; then + echo "!!! Failed to create federated identity credential etcd-backup-fedcred after 5 attempts" + exit 1 +fi + +echo "Creating federated identity credential for velero..." +if ! create_federated_credential "velero-fedcred" "${VELERO_SA_SUBJECT}"; then + echo "!!! Failed to create federated identity credential velero-fedcred after 5 attempts" + exit 1 +fi + +echo "Granting Storage Blob Data Contributor on ${STORAGE_ACCOUNT_NAME} to ${OADP_MI_NAME}..." +ROLE_ASSIGNED=false +for attempt in $(seq 1 5); do + if az role assignment create \ + --assignee-object-id "${OADP_MI_PRINCIPAL_ID}" \ + --assignee-principal-type ServicePrincipal \ + --role "Storage Blob Data Contributor" \ + --scope "${STORAGE_ACCOUNT_ID}" \ + --output none; then + ROLE_ASSIGNED=true + break + fi + echo "Attempt ${attempt}/5: Role assignment failed (likely AAD propagation delay), retrying in 15s..." + sleep 15 +done +if [[ "${ROLE_ASSIGNED}" != "true" ]]; then + echo "!!! Failed to grant Storage Blob Data Contributor to ${OADP_MI_NAME} after 5 attempts" + exit 1 +fi + +echo "Creating Azure credentials secret (Workload Identity mode, no client secret)..." +AZURE_CREDS_FILE="$(mktemp)" +cat < "${AZURE_CREDS_FILE}" +AZURE_SUBSCRIPTION_ID=${AZURE_AUTH_SUBSCRIPTION_ID} +AZURE_TENANT_ID=${AZURE_AUTH_TENANT_ID} +AZURE_CLIENT_ID=${OADP_MI_CLIENT_ID} +AZURE_RESOURCE_GROUP=${RESOURCEGROUP} +AZURE_CLOUD_NAME=AzurePublicCloud +EOF + +oc create secret generic cloud-credentials -n openshift-adp --from-file cloud="${AZURE_CREDS_FILE}" +rm -f "${AZURE_CREDS_FILE}" + +echo "Pre-creating/annotating the 'velero' ServiceAccount for Workload Identity (must exist with this annotation before the DPA triggers Velero pod creation)..." +cat </dev/null 2>&1; then + oc rollout restart daemonset/node-agent -n openshift-adp + oc rollout status daemonset/node-agent -n openshift-adp --timeout=300s + fi +fi + +# Create BackupStorageLocation +echo "Creating BackupStorageLocation..." +cat <