From 450b191e76a2cb46e3b8609ad553b183bcd2311a Mon Sep 17 00:00:00 2001 From: Martin Gencur Date: Mon, 3 Aug 2026 11:49:04 +0200 Subject: [PATCH 1/7] ci(hypershift): add self-managed Azure OADP backup/restore E2E test Add hypershift-self-managed-azure-oadp-setup and -oadp-destroy steps that discover the public self-managed-Azure guest cluster and create/ tear down an Azure Storage Account and Blob container for OADP, along with a DataProtectionApplication, BackupStorageLocation, and VolumeSnapshotLocation, mirroring the existing AWS OADP setup. Wire these into a new hypershift-self-managed-azure-e2e-backuprestore workflow (reusing e2e-v2-azure-self-managed's pre-steps) and a new e2e-v2-azure-self-managed-backuprestore test running the minimal conformance suite after backup/restore. --- .../hypershift/openshift-hypershift-main.yaml | 10 ++ .../openshift-hypershift-main-presubmits.yaml | 87 ++++++++++ .../hypershift/self-managed-azure/OWNERS | 1 + .../e2e-backuprestore/OWNERS | 1 + ...e-e2e-backuprestore-workflow.metadata.json | 19 +++ ...aged-azure-e2e-backuprestore-workflow.yaml | 36 ++++ .../self-managed-azure/oadp-destroy/OWNERS | 1 + ...elf-managed-azure-oadp-destroy-commands.sh | 43 +++++ ...naged-azure-oadp-destroy-ref.metadata.json | 19 +++ ...t-self-managed-azure-oadp-destroy-ref.yaml | 18 ++ .../self-managed-azure/oadp-setup/OWNERS | 1 + ...-self-managed-azure-oadp-setup-commands.sh | 155 ++++++++++++++++++ ...managed-azure-oadp-setup-ref.metadata.json | 19 +++ ...ift-self-managed-azure-oadp-setup-ref.yaml | 29 ++++ 14 files changed, 439 insertions(+) create mode 120000 ci-operator/step-registry/hypershift/self-managed-azure/OWNERS create mode 120000 ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS create mode 100644 ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json create mode 100644 ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml create mode 120000 ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS create mode 100755 ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh create mode 100644 ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json create mode 100644 ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml create mode 120000 ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS create mode 100755 ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh create mode 100644 ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-ref.metadata.json create mode 100644 ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-ref.yaml diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index 31610853fe5fd..e4b8114c8e7c7 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -316,6 +316,16 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-backuprestore + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false as: e2e-aws-minimal optional: true diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index e01d7b6bc3e57..4be29887673c5 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -3233,6 +3233,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build01 + context: ci/prow/e2e-v2-azure-self-managed-backuprestore + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-main-e2e-v2-azure-self-managed-backuprestore + optional: true + rerun_command: /test e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-backuprestore,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json new file mode 100644 index 0000000000000..b8664c5ef91bf --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.metadata.json @@ -0,0 +1,19 @@ +{ + "path": "hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml", + "owners": { + "approvers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ], + "reviewers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml new file mode 100644 index 0000000000000..77603ded4f813 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/e2e-backuprestore/hypershift-self-managed-azure-e2e-backuprestore-workflow.yaml @@ -0,0 +1,36 @@ +workflow: + as: hypershift-self-managed-azure-e2e-backuprestore + documentation: |- + The HyperShift self-managed-Azure e2e-backuprestore workflow executes backup and + restore tests against a self-managed HyperShift installation on Azure (nested + management cluster) using OADP with Azure Blob Storage. + + It provisions the nested management cluster, installs HyperShift, creates + self-managed Azure guest clusters, installs OLM and the OADP operator with + Azure-specific configuration against the public guest cluster, runs backup/restore + E2E tests, and then runs a minimal conformance suite. + steps: + pre: + - ref: ipi-install-rbac + - chain: hypershift-setup-nested-management-cluster + - ref: hypershift-azure-setup-private-link + - ref: hypershift-install + - ref: hypershift-resolve-nodepool-releases + - chain: hypershift-azure-create-selfmanaged-guests + - ref: operatorhub-subscribe-oadp-operator + - ref: hypershift-self-managed-azure-oadp-setup + test: + - chain: hypershift-e2e-backuprestore + post: + - chain: hypershift-azure-dump-selfmanaged-guests + - ref: hypershift-self-managed-azure-oadp-destroy + - chain: hypershift-azure-destroy-selfmanaged-guests + - chain: hypershift-destroy-nested-management-cluster + env: + CLOUD_PROVIDER: "Azure" + HYPERSHIFT_PLATFORM: "azure" + HYPERSHIFT_NODE_COUNT: "6" + HYPERSHIFT_AZURE_LOCATION: "centralus" + AZURE_SELF_MANAGED: "true" + HYPERSHIFT_EXTERNAL_DNS_DOMAIN: "sm.hcp-sm-azure.azure.devcluster.openshift.com" + HYPERSHIFT_ETCD_STORAGE_CLASS: "managed-csi-premium-v2" diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh new file mode 100755 index 0000000000000..a2ba476fa74ff --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh @@ -0,0 +1,43 @@ +#!/bin/bash + +set -euo pipefail + +AZURE_AUTH_LOCATION="/etc/hypershift-ci-jobs-self-managed-azure/credentials.json" + +if [ ! -f "${SHARED_DIR}/oadp-storage-account-name" ]; then + echo "No oadp-storage-account-name file found, skipping storage account cleanup" + exit 0 +fi + +STORAGE_ACCOUNT_NAME="$(cat "${SHARED_DIR}/oadp-storage-account-name")" +RESOURCEGROUP="$(cat "${SHARED_DIR}/oadp-storage-resourcegroup")" + +echo "Reading Azure credentials..." +AZURE_AUTH_CLIENT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientId)" +AZURE_AUTH_CLIENT_SECRET="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientSecret)" +AZURE_AUTH_TENANT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .tenantId)" +AZURE_AUTH_SUBSCRIPTION_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .subscriptionId)" + +echo "Logging into Azure..." +az login --service-principal -u "${AZURE_AUTH_CLIENT_ID}" -p "${AZURE_AUTH_CLIENT_SECRET}" --tenant "${AZURE_AUTH_TENANT_ID}" --output none +az account set --subscription "${AZURE_AUTH_SUBSCRIPTION_ID}" + +echo "Deleting storage account ${STORAGE_ACCOUNT_NAME}..." +RETRIES=3 +for attempt in $(seq "${RETRIES}"); do + if az storage account delete \ + --name "${STORAGE_ACCOUNT_NAME}" \ + --resource-group "${RESOURCEGROUP}" \ + --yes; then + echo "Storage account deleted successfully" + break + fi + echo "Attempt ${attempt}/${RETRIES}: Failed to delete storage account. Retrying in 30s..." + sleep 30 + if [[ "${attempt}" -eq "${RETRIES}" ]]; then + echo "Error: Failed to delete storage account after ${RETRIES} attempts" + exit 1 + fi +done + +echo "Storage account cleanup done" diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json new file mode 100644 index 0000000000000..f8f13afb9c51b --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.metadata.json @@ -0,0 +1,19 @@ +{ + "path": "hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml", + "owners": { + "approvers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ], + "reviewers": [ + "csrwng", + "enxebre", + "mgencur", + "bryan-cox", + "jparrill" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml new file mode 100644 index 0000000000000..90213e1681842 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-ref.yaml @@ -0,0 +1,18 @@ +ref: + as: hypershift-self-managed-azure-oadp-destroy + from: upi-installer + cli: latest + commands: hypershift-self-managed-azure-oadp-destroy-commands.sh + best_effort: true + timeout: 5m + resources: + requests: + cpu: 300m + memory: 300Mi + credentials: + - mount_path: /etc/hypershift-ci-jobs-self-managed-azure + name: hypershift-ci-jobs-self-managed-azure + namespace: test-credentials + documentation: |- + Cleans up Azure OADP resources created by hypershift-self-managed-azure-oadp-setup. + Deletes the dynamically created storage account used for OADP backups. diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh new file mode 100755 index 0000000000000..ec1d9959d1ff0 --- /dev/null +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh @@ -0,0 +1,155 @@ +#!/bin/bash + +set -euo pipefail + +export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig" + +AZURE_AUTH_LOCATION="/etc/hypershift-ci-jobs-self-managed-azure/credentials.json" +OADP_PLUGIN_IMAGE="${OADP_HYPERSHIFT_PLUGIN_IMAGE:-quay.io/konveyor/hypershift-oadp-plugin:latest}" + +echo "Discovering the public self-managed-Azure guest cluster..." +CLUSTER_NAME="$(oc get hostedcluster -n clusters -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "public" | head -n1)" +if [[ -z "${CLUSTER_NAME}" ]]; then + echo "!!! Unable to find a public HostedCluster in the 'clusters' namespace" + oc get hostedcluster -n clusters + exit 1 +fi +echo "${CLUSTER_NAME}" > "${SHARED_DIR}/cluster-name" + +RESOURCEGROUP="$(cat "${SHARED_DIR}/azure_pls_resource_group")" +CONTAINER_NAME="${OADP_AZURE_CONTAINER_NAME:-hypershift-oadp-${CLUSTER_NAME}}" +# Storage account names must be 3-24 chars, lowercase letters and numbers only. +STORAGE_ACCOUNT_NAME="oadp${CLUSTER_NAME:0:20}" +STORAGE_ACCOUNT_NAME="$(echo "${STORAGE_ACCOUNT_NAME}" | tr -cd '[:lower:][:digit:]' | cut -c1-24)" + +echo "Setting up OADP prerequisites for backup/restore tests" +echo "Cluster: ${CLUSTER_NAME}, Resource Group: ${RESOURCEGROUP}, Storage Account: ${STORAGE_ACCOUNT_NAME}, Container: ${CONTAINER_NAME}" + +echo "Reading Azure credentials..." +AZURE_AUTH_CLIENT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientId)" +AZURE_AUTH_CLIENT_SECRET="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientSecret)" +AZURE_AUTH_TENANT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .tenantId)" +AZURE_AUTH_SUBSCRIPTION_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .subscriptionId)" + +echo "Logging into Azure..." +az login --service-principal -u "${AZURE_AUTH_CLIENT_ID}" -p "${AZURE_AUTH_CLIENT_SECRET}" --tenant "${AZURE_AUTH_TENANT_ID}" --output none +az account set --subscription "${AZURE_AUTH_SUBSCRIPTION_ID}" + +echo "Creating storage account ${STORAGE_ACCOUNT_NAME} in resource group ${RESOURCEGROUP}..." +az storage account create \ + --name "${STORAGE_ACCOUNT_NAME}" \ + --resource-group "${RESOURCEGROUP}" \ + --sku Standard_LRS \ + --kind StorageV2 \ + --output none + +# Save resource names for cleanup +echo "${STORAGE_ACCOUNT_NAME}" > "${SHARED_DIR}/oadp-storage-account-name" +echo "${RESOURCEGROUP}" > "${SHARED_DIR}/oadp-storage-resourcegroup" + +echo "Creating blob container ${CONTAINER_NAME}..." +az storage container create \ + --name "${CONTAINER_NAME}" \ + --account-name "${STORAGE_ACCOUNT_NAME}" \ + --auth-mode login \ + --output none + +echo "Getting storage account key..." +STORAGE_ACCOUNT_KEY="$(az storage account keys list --account-name "${STORAGE_ACCOUNT_NAME}" --resource-group "${RESOURCEGROUP}" --query '[0].value' -o tsv)" + +# Create the openshift-adp namespace if it doesn't exist +oc get namespace openshift-adp 2>/dev/null || oc create namespace openshift-adp + +echo "Creating Azure credentials secret..." +# Disable tracing due to credential handling +[[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false +set +x + +AZURE_CREDS_FILE="$(mktemp)" +cat < "${AZURE_CREDS_FILE}" +[default] +AZURE_SUBSCRIPTION_ID=${AZURE_AUTH_SUBSCRIPTION_ID} +AZURE_TENANT_ID=${AZURE_AUTH_TENANT_ID} +AZURE_CLIENT_ID=${AZURE_AUTH_CLIENT_ID} +AZURE_CLIENT_SECRET=${AZURE_AUTH_CLIENT_SECRET} +AZURE_RESOURCE_GROUP=${RESOURCEGROUP} +AZURE_CLOUD_NAME=AzurePublicCloud +AZURE_STORAGE_ACCOUNT_ACCESS_KEY=${STORAGE_ACCOUNT_KEY} +EOF + +oc create secret generic cloud-credentials -n openshift-adp --from-file cloud="${AZURE_CREDS_FILE}" +rm -f "${AZURE_CREDS_FILE}" + +$WAS_TRACING && set -x + +# Create DataProtectionApplication +echo "Creating DataProtectionApplication..." +cat < Date: Mon, 3 Aug 2026 12:05:03 +0200 Subject: [PATCH 2/7] ci(hypershift): add azure-self-managed-backuprestore to 4.23/5.0 Branch the e2e-v2-azure-self-managed-backuprestore presubmit to release-4.23 and release-5.0, and add a weekly periodic version of it to both release branches' __periodics.yaml files. --- .../openshift-hypershift-release-4.23.yaml | 10 +++ ...ft-hypershift-release-4.23__periodics.yaml | 8 ++ .../openshift-hypershift-release-5.0.yaml | 10 +++ ...ift-hypershift-release-5.0__periodics.yaml | 8 ++ ...ift-hypershift-release-4.23-periodics.yaml | 83 ++++++++++++++++++ ...ft-hypershift-release-4.23-presubmits.yaml | 87 +++++++++++++++++++ ...hift-hypershift-release-5.0-periodics.yaml | 83 ++++++++++++++++++ ...ift-hypershift-release-5.0-presubmits.yaml | 87 +++++++++++++++++++ 8 files changed, 376 insertions(+) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml index 8527105789d27..a4a3fb8eb3181 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml @@ -303,6 +303,16 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-backuprestore + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false as: e2e-aws-minimal optional: true diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml index cafe054cdc28f..0b83c286089ed 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml @@ -403,6 +403,14 @@ tests: env: TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-aws-e2e-backuprestore +- as: e2e-v2-azure-self-managed-backuprestore + cron: 0 6 * * 0 + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore zz_generated_metadata: branch: release-4.23 org: openshift diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml index a96000818c293..9539b6f5bb62d 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml @@ -304,6 +304,16 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-backuprestore + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false as: e2e-aws-minimal optional: true diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml index 076a5c789d4f2..6e1e1b3d1ff8c 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml @@ -442,6 +442,14 @@ tests: GUEST_FEATURE_SET: TechPreviewNoUpgrade TECH_PREVIEW_NO_UPGRADE: "true" workflow: hypershift-aws-e2e-v2-osimagestream +- as: e2e-v2-azure-self-managed-backuprestore + cron: 0 7 * * 0 + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + TEST_SUITE: openshift/conformance/parallel/minimal + workflow: hypershift-self-managed-azure-e2e-backuprestore zz_generated_metadata: branch: release-5.0 org: openshift diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml index 4f7b51f7a59ec..db10a2120b94b 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-periodics.yaml @@ -2573,6 +2573,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 0 6 * * 0 + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.23 + org: openshift + repo: hypershift + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci-operator.openshift.io/variant: periodics + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + - --variant=periodics + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build01 cron: 37 9,21 * * * diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml index 03a538d3fef55..3cebcc652ca3b 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.23-presubmits.yaml @@ -3233,6 +3233,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build06 + context: ci/prow/e2e-v2-azure-self-managed-backuprestore + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-release-4.23-e2e-v2-azure-self-managed-backuprestore + optional: true + rerun_command: /test e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-backuprestore,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml index 9e1f59df7fb6d..b44c7964d592c 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-periodics.yaml @@ -2922,6 +2922,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 0 7 * * 0 + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-5.0 + org: openshift + repo: hypershift + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci-operator.openshift.io/variant: periodics + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + - --variant=periodics + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build01 cron: 37 9,21 * * * diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml index f511aaf889105..31f5da8fa957d 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.0-presubmits.yaml @@ -3233,6 +3233,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build06 + context: ci/prow/e2e-v2-azure-self-managed-backuprestore + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-release-5.0-e2e-v2-azure-self-managed-backuprestore + optional: true + rerun_command: /test e2e-v2-azure-self-managed-backuprestore + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-backuprestore + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-backuprestore,?($|\s.*) - agent: kubernetes always_run: false annotations: From b3e25beffc215ac8c5130706ac5e56d301c8afb5 Mon Sep 17 00:00:00 2001 From: Martin Gencur Date: Mon, 3 Aug 2026 13:41:51 +0200 Subject: [PATCH 3/7] fix(hypershift): parameterize cluster prefix and fix creds file in oadp-setup Make the target guest cluster name filter configurable via CLUSTER_PREFIX (default "public") and remove the stray [default] header from the Azure credentials file. --- .../hypershift-self-managed-azure-oadp-setup-commands.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh index ec1d9959d1ff0..fa7d65726d298 100755 --- a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh @@ -7,8 +7,13 @@ export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig" AZURE_AUTH_LOCATION="/etc/hypershift-ci-jobs-self-managed-azure/credentials.json" OADP_PLUGIN_IMAGE="${OADP_HYPERSHIFT_PLUGIN_IMAGE:-quay.io/konveyor/hypershift-oadp-plugin:latest}" +# TODO: This picks the "public" cluster by default. The hypershift-azure-create-selfmanaged-guests +# creates a number of clusters which is baked into the create-guests binary from HyperShift. +# We need to find a way tell the binary to create only a single cluster. +CLUSTER_PREFIX="${CLUSTER_PREFIX:-public}" + echo "Discovering the public self-managed-Azure guest cluster..." -CLUSTER_NAME="$(oc get hostedcluster -n clusters -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "public" | head -n1)" +CLUSTER_NAME="$(oc get hostedcluster -n clusters -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "${CLUSTER_PREFIX}" | head -n1)" if [[ -z "${CLUSTER_NAME}" ]]; then echo "!!! Unable to find a public HostedCluster in the 'clusters' namespace" oc get hostedcluster -n clusters @@ -67,7 +72,6 @@ set +x AZURE_CREDS_FILE="$(mktemp)" cat < "${AZURE_CREDS_FILE}" -[default] AZURE_SUBSCRIPTION_ID=${AZURE_AUTH_SUBSCRIPTION_ID} AZURE_TENANT_ID=${AZURE_AUTH_TENANT_ID} AZURE_CLIENT_ID=${AZURE_AUTH_CLIENT_ID} From b7de1b5845002940181488f4e257a159dab70e08 Mon Sep 17 00:00:00 2001 From: Martin Gencur Date: Tue, 4 Aug 2026 11:31:37 +0200 Subject: [PATCH 4/7] feat(hypershift): run AWS backuprestore periodics with TechPreviewNoUpgrade Add TECH_PREVIEW_NO_UPGRADE: "true" to the e2e-v2-aws-backuprestore periodic in the release-4.23 and release-5.0 configs. --- .../hypershift/openshift-hypershift-release-4.23__periodics.yaml | 1 + .../hypershift/openshift-hypershift-release-5.0__periodics.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml index 0b83c286089ed..81efde6e90dbb 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml @@ -401,6 +401,7 @@ tests: steps: cluster_profile: hypershift-aws env: + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-aws-e2e-backuprestore - as: e2e-v2-azure-self-managed-backuprestore diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml index 6e1e1b3d1ff8c..1117653d2c1de 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml @@ -432,6 +432,7 @@ tests: steps: cluster_profile: hypershift-aws env: + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-aws-e2e-backuprestore - as: e2e-v2-aws-techpreview-osimagestream From 2917d75697ca1b32eda716ef87dd08fb93c1416c Mon Sep 17 00:00:00 2001 From: Martin Gencur Date: Tue, 4 Aug 2026 11:42:08 +0200 Subject: [PATCH 5/7] feat(hypershift): run self-managed Azure backuprestore with TechPreviewNoUpgrade Add TECH_PREVIEW_NO_UPGRADE: "true" to hypershift-self-managed-azure-e2e-backuprestore in main, release-4.23, and release-5.0 configs. --- .../config/openshift/hypershift/openshift-hypershift-main.yaml | 1 + .../hypershift/openshift-hypershift-release-4.23__periodics.yaml | 1 + .../hypershift/openshift-hypershift-release-5.0__periodics.yaml | 1 + 3 files changed, 3 insertions(+) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index e4b8114c8e7c7..1f3736bfe65de 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -324,6 +324,7 @@ tests: env: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml index 81efde6e90dbb..695776b8a3156 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml @@ -410,6 +410,7 @@ tests: cluster_profile: hypershift-azure env: HYPERSHIFT_AZURE_LOCATION: centralus + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore zz_generated_metadata: diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml index 1117653d2c1de..56b79970e961e 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml @@ -449,6 +449,7 @@ tests: cluster_profile: hypershift-azure env: HYPERSHIFT_AZURE_LOCATION: centralus + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore zz_generated_metadata: From cdd2795feda29ebf7c086b3241e2bf536468692d Mon Sep 17 00:00:00 2001 From: Martin Gencur Date: Wed, 5 Aug 2026 13:25:47 +0200 Subject: [PATCH 6/7] fix(hypershift): use a shared dedicated workload identity for OADP Velero and etcd-backup on self-managed Azure oadp-setup now provisions one managed identity federated to both the velero and etcd-backup-job ServiceAccounts, so both Velero's object-store plugin and the HCPEtcdBackup controller authenticate via Workload Identity instead of the shared root Service Principal, which had no federated credential and caused AADSTS70025 failures. Adds the Workload-Identity pod labels/SA annotation OADP needs, sets useAAD on the BSL, and drops the now-dead standalone etcd-backup credential secret. oadp-destroy cleans up the renamed identity marker files. --- ...elf-managed-azure-oadp-destroy-commands.sh | 89 +++++++--- ...-self-managed-azure-oadp-setup-commands.sh | 168 ++++++++++++++++-- ...ift-self-managed-azure-oadp-setup-ref.yaml | 18 +- 3 files changed, 240 insertions(+), 35 deletions(-) diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh index a2ba476fa74ff..24fa2d57a0d5d 100755 --- a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh @@ -4,13 +4,15 @@ set -euo pipefail AZURE_AUTH_LOCATION="/etc/hypershift-ci-jobs-self-managed-azure/credentials.json" -if [ ! -f "${SHARED_DIR}/oadp-storage-account-name" ]; then - echo "No oadp-storage-account-name file found, skipping storage account cleanup" - exit 0 -fi +STORAGE_ACCOUNT_MARKER="${SHARED_DIR}/oadp-storage-account-name" +STORAGE_RESOURCEGROUP_MARKER="${SHARED_DIR}/oadp-storage-resourcegroup" +OADP_MI_MARKER="${SHARED_DIR}/oadp-workload-identity-name" +OADP_MI_RG_MARKER="${SHARED_DIR}/oadp-workload-identity-resourcegroup" -STORAGE_ACCOUNT_NAME="$(cat "${SHARED_DIR}/oadp-storage-account-name")" -RESOURCEGROUP="$(cat "${SHARED_DIR}/oadp-storage-resourcegroup")" +if [[ ! -f "${STORAGE_ACCOUNT_MARKER}" && ! -f "${OADP_MI_MARKER}" ]]; then + echo "No OADP storage account or workload identity marker files found, nothing to clean up" + exit 0 +fi echo "Reading Azure credentials..." AZURE_AUTH_CLIENT_ID="$(<"${AZURE_AUTH_LOCATION}" jq -r .clientId)" @@ -22,22 +24,65 @@ echo "Logging into Azure..." az login --service-principal -u "${AZURE_AUTH_CLIENT_ID}" -p "${AZURE_AUTH_CLIENT_SECRET}" --tenant "${AZURE_AUTH_TENANT_ID}" --output none az account set --subscription "${AZURE_AUTH_SUBSCRIPTION_ID}" -echo "Deleting storage account ${STORAGE_ACCOUNT_NAME}..." -RETRIES=3 -for attempt in $(seq "${RETRIES}"); do - if az storage account delete \ - --name "${STORAGE_ACCOUNT_NAME}" \ - --resource-group "${RESOURCEGROUP}" \ - --yes; then - echo "Storage account deleted successfully" - break +OVERALL_RESULT=0 + +# --- Storage account cleanup (Velero) --- +if [[ -f "${STORAGE_ACCOUNT_MARKER}" ]]; then + STORAGE_ACCOUNT_NAME="$(cat "${STORAGE_ACCOUNT_MARKER}")" + RESOURCEGROUP="$(cat "${STORAGE_RESOURCEGROUP_MARKER}")" + + echo "Deleting storage account ${STORAGE_ACCOUNT_NAME}..." + RETRIES=3 + STORAGE_DELETED=false + for attempt in $(seq "${RETRIES}"); do + if az storage account delete \ + --name "${STORAGE_ACCOUNT_NAME}" \ + --resource-group "${RESOURCEGROUP}" \ + --yes; then + echo "Storage account deleted successfully" + STORAGE_DELETED=true + break + fi + echo "Attempt ${attempt}/${RETRIES}: Failed to delete storage account. Retrying in 30s..." + sleep 30 + done + if [[ "${STORAGE_DELETED}" != "true" ]]; then + echo "Error: Failed to delete storage account ${STORAGE_ACCOUNT_NAME} after ${RETRIES} attempts" + OVERALL_RESULT=1 fi - echo "Attempt ${attempt}/${RETRIES}: Failed to delete storage account. Retrying in 30s..." - sleep 30 - if [[ "${attempt}" -eq "${RETRIES}" ]]; then - echo "Error: Failed to delete storage account after ${RETRIES} attempts" - exit 1 +else + echo "No oadp-storage-account-name file found, skipping storage account cleanup" +fi + +# --- OADP workload identity cleanup (Velero + etcd-backup) --- +# Deleting the managed identity also deletes any federated identity +# credentials attached to it; no separate +# `az identity federated-credential delete` call is required. +if [[ -f "${OADP_MI_MARKER}" ]]; then + OADP_MI_NAME="$(cat "${OADP_MI_MARKER}")" + OADP_MI_RESOURCEGROUP="$(cat "${OADP_MI_RG_MARKER}")" + + echo "Deleting managed identity ${OADP_MI_NAME}..." + RETRIES=3 + MI_DELETED=false + for attempt in $(seq "${RETRIES}"); do + if az identity delete \ + --name "${OADP_MI_NAME}" \ + --resource-group "${OADP_MI_RESOURCEGROUP}"; then + echo "Managed identity deleted successfully" + MI_DELETED=true + break + fi + echo "Attempt ${attempt}/${RETRIES}: Failed to delete managed identity. Retrying in 30s..." + sleep 30 + done + if [[ "${MI_DELETED}" != "true" ]]; then + echo "Error: Failed to delete managed identity ${OADP_MI_NAME} after ${RETRIES} attempts" + OVERALL_RESULT=1 fi -done +else + echo "No oadp-workload-identity-name file found, skipping OADP workload identity cleanup" +fi -echo "Storage account cleanup done" +echo "OADP resource cleanup done" +exit "${OVERALL_RESULT}" diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh index fa7d65726d298..7b3777d19dd89 100755 --- a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh @@ -59,32 +59,145 @@ az storage container create \ --auth-mode login \ --output none -echo "Getting storage account key..." -STORAGE_ACCOUNT_KEY="$(az storage account keys list --account-name "${STORAGE_ACCOUNT_NAME}" --resource-group "${RESOURCEGROUP}" --query '[0].value' -o tsv)" +echo "Getting resource ID of storage account ${STORAGE_ACCOUNT_NAME} for role scope..." +STORAGE_ACCOUNT_ID="$(az storage account show --name "${STORAGE_ACCOUNT_NAME}" --resource-group "${RESOURCEGROUP}" --query id -o tsv)" +if [[ -z "${STORAGE_ACCOUNT_ID}" ]]; then + echo "!!! Unable to resolve resource ID for storage account ${STORAGE_ACCOUNT_NAME}" + exit 1 +fi # Create the openshift-adp namespace if it doesn't exist oc get namespace openshift-adp 2>/dev/null || oc create namespace openshift-adp -echo "Creating Azure credentials secret..." -# Disable tracing due to credential handling -[[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false -set +x +echo "Setting up dedicated Azure Workload Identity for OADP (Velero + etcd-backup)..." + +# Subjects hardcoded by the two consumers: +# - HyperShift Operator's HCPEtcdBackup controller (hypershift ns, autodetected via BSL-copied credential) +# - Velero + NodeAgent DaemonSet, which share ServiceAccount "velero" in openshift-adp +ETCD_BACKUP_SA_SUBJECT="system:serviceaccount:hypershift:etcd-backup-job" +VELERO_SA_SUBJECT="system:serviceaccount:openshift-adp:velero" + +OADP_MI_NAME="oadp-workload-identity-${CLUSTER_NAME}" +OADP_MI_RESOURCEGROUP="os4-common" +OADP_MI_LOCATION="${HYPERSHIFT_AZURE_LOCATION:-centralus}" + +echo "Creating managed identity ${OADP_MI_NAME} in resource group ${OADP_MI_RESOURCEGROUP}..." +az identity create \ + --name "${OADP_MI_NAME}" \ + --resource-group "${OADP_MI_RESOURCEGROUP}" \ + --location "${OADP_MI_LOCATION}" \ + --output none + +# Persist identity coordinates immediately so the destroy step can find and +# remove it even if a later step in this block fails. +echo "${OADP_MI_NAME}" > "${SHARED_DIR}/oadp-workload-identity-name" +echo "${OADP_MI_RESOURCEGROUP}" > "${SHARED_DIR}/oadp-workload-identity-resourcegroup" + +echo "Resolving client ID and principal ID of ${OADP_MI_NAME}..." +OADP_MI_CLIENT_ID="" +OADP_MI_PRINCIPAL_ID="" +for attempt in $(seq 1 5); do + OADP_MI_CLIENT_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query clientId -o tsv)" + OADP_MI_PRINCIPAL_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query principalId -o tsv)" + if [[ -n "${OADP_MI_CLIENT_ID}" && -n "${OADP_MI_PRINCIPAL_ID}" ]]; then + break + fi + echo "Attempt ${attempt}/5: identity not fully propagated yet, retrying in 10s..." + sleep 10 +done +if [[ -z "${OADP_MI_CLIENT_ID}" || -z "${OADP_MI_PRINCIPAL_ID}" ]]; then + echo "!!! Failed to resolve clientId/principalId for managed identity ${OADP_MI_NAME}" + exit 1 +fi + +echo "Resolving management cluster OIDC issuer..." +MGMT_OIDC_ISSUER="$(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}')" +if [[ -z "${MGMT_OIDC_ISSUER}" ]]; then + echo "!!! Unable to resolve serviceAccountIssuer from the management cluster's Authentication config" + exit 1 +fi +echo "Management cluster OIDC issuer: ${MGMT_OIDC_ISSUER}" + +# Creates one federated credential on ${OADP_MI_NAME}, retrying on transient +# failures. Args: +create_federated_credential() { + local fedcred_name="$1" + local subject="$2" + local attempt + for attempt in $(seq 1 5); do + if az identity federated-credential create \ + --name "${fedcred_name}" \ + --identity-name "${OADP_MI_NAME}" \ + --resource-group "${OADP_MI_RESOURCEGROUP}" \ + --issuer "${MGMT_OIDC_ISSUER}" \ + --subject "${subject}" \ + --audiences "api://AzureADTokenExchange" \ + --output none; then + return 0 + fi + echo "Attempt ${attempt}/5: Failed to create federated credential ${fedcred_name}, retrying in 10s..." + sleep 10 + done + return 1 +} + +echo "Creating federated identity credential for etcd-backup..." +if ! create_federated_credential "etcd-backup-fedcred" "${ETCD_BACKUP_SA_SUBJECT}"; then + echo "!!! Failed to create federated identity credential etcd-backup-fedcred after 5 attempts" + exit 1 +fi + +echo "Creating federated identity credential for velero..." +if ! create_federated_credential "velero-fedcred" "${VELERO_SA_SUBJECT}"; then + echo "!!! Failed to create federated identity credential velero-fedcred after 5 attempts" + exit 1 +fi + +echo "Granting Storage Blob Data Contributor on ${STORAGE_ACCOUNT_NAME} to ${OADP_MI_NAME}..." +ROLE_ASSIGNED=false +for attempt in $(seq 1 5); do + if az role assignment create \ + --assignee-object-id "${OADP_MI_PRINCIPAL_ID}" \ + --assignee-principal-type ServicePrincipal \ + --role "Storage Blob Data Contributor" \ + --scope "${STORAGE_ACCOUNT_ID}" \ + --output none; then + ROLE_ASSIGNED=true + break + fi + echo "Attempt ${attempt}/5: Role assignment failed (likely AAD propagation delay), retrying in 15s..." + sleep 15 +done +if [[ "${ROLE_ASSIGNED}" != "true" ]]; then + echo "!!! Failed to grant Storage Blob Data Contributor to ${OADP_MI_NAME} after 5 attempts" + exit 1 +fi +echo "Creating Azure credentials secret (Workload Identity mode, no client secret)..." AZURE_CREDS_FILE="$(mktemp)" cat < "${AZURE_CREDS_FILE}" AZURE_SUBSCRIPTION_ID=${AZURE_AUTH_SUBSCRIPTION_ID} AZURE_TENANT_ID=${AZURE_AUTH_TENANT_ID} -AZURE_CLIENT_ID=${AZURE_AUTH_CLIENT_ID} -AZURE_CLIENT_SECRET=${AZURE_AUTH_CLIENT_SECRET} +AZURE_CLIENT_ID=${OADP_MI_CLIENT_ID} AZURE_RESOURCE_GROUP=${RESOURCEGROUP} AZURE_CLOUD_NAME=AzurePublicCloud -AZURE_STORAGE_ACCOUNT_ACCESS_KEY=${STORAGE_ACCOUNT_KEY} EOF oc create secret generic cloud-credentials -n openshift-adp --from-file cloud="${AZURE_CREDS_FILE}" rm -f "${AZURE_CREDS_FILE}" -$WAS_TRACING && set -x +echo "Pre-creating/annotating the 'velero' ServiceAccount for Workload Identity (must exist with this annotation before the DPA triggers Velero pod creation)..." +cat </dev/null 2>&1; then + oc rollout restart daemonset/node-agent -n openshift-adp + oc rollout status daemonset/node-agent -n openshift-adp --timeout=300s + fi +fi + # Create BackupStorageLocation echo "Creating BackupStorageLocation..." cat < Date: Thu, 6 Aug 2026 08:26:13 +0200 Subject: [PATCH 7/7] fix(hypershift): unique OADP storage names and strict Velero readiness check Use PROW_JOB_ID-derived suffix for Azure storage account uniqueness, remove || true from Velero wait, and align backuprestore CI configs. Co-Authored-By: Claude Opus 4.6 --- .../openshift-hypershift-release-4.23.yaml | 1 + ...ft-hypershift-release-4.23__periodics.yaml | 1 + .../openshift-hypershift-release-5.0.yaml | 1 + ...ift-hypershift-release-5.0__periodics.yaml | 1 + ...elf-managed-azure-oadp-destroy-commands.sh | 41 +++++++++++-------- ...-self-managed-azure-oadp-setup-commands.sh | 17 ++++---- ...ift-self-managed-azure-oadp-setup-ref.yaml | 5 --- 7 files changed, 37 insertions(+), 30 deletions(-) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml index a4a3fb8eb3181..9fd164ff8b14d 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23.yaml @@ -311,6 +311,7 @@ tests: env: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml index 695776b8a3156..4c1de77a4986c 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.23__periodics.yaml @@ -410,6 +410,7 @@ tests: cluster_profile: hypershift-azure env: HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml index 9539b6f5bb62d..da7c6b1792352 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0.yaml @@ -312,6 +312,7 @@ tests: env: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "4.22" + TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore - always_run: false diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml index 56b79970e961e..1431c452a0e73 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml @@ -449,6 +449,7 @@ tests: cluster_profile: hypershift-azure env: HYPERSHIFT_AZURE_LOCATION: centralus + NODEPOOL_N1_VERSION: "4.22" TECH_PREVIEW_NO_UPGRADE: "true" TEST_SUITE: openshift/conformance/parallel/minimal workflow: hypershift-self-managed-azure-e2e-backuprestore diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh index 24fa2d57a0d5d..cb370a50f8492 100755 --- a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-destroy/hypershift-self-managed-azure-oadp-destroy-commands.sh @@ -29,26 +29,31 @@ OVERALL_RESULT=0 # --- Storage account cleanup (Velero) --- if [[ -f "${STORAGE_ACCOUNT_MARKER}" ]]; then STORAGE_ACCOUNT_NAME="$(cat "${STORAGE_ACCOUNT_MARKER}")" - RESOURCEGROUP="$(cat "${STORAGE_RESOURCEGROUP_MARKER}")" + if [[ ! -f "${STORAGE_RESOURCEGROUP_MARKER}" ]]; then + echo "Error: ${STORAGE_RESOURCEGROUP_MARKER} missing, cannot delete storage account ${STORAGE_ACCOUNT_NAME}" + OVERALL_RESULT=1 + else + RESOURCEGROUP="$(cat "${STORAGE_RESOURCEGROUP_MARKER}")" - echo "Deleting storage account ${STORAGE_ACCOUNT_NAME}..." - RETRIES=3 - STORAGE_DELETED=false - for attempt in $(seq "${RETRIES}"); do - if az storage account delete \ - --name "${STORAGE_ACCOUNT_NAME}" \ - --resource-group "${RESOURCEGROUP}" \ - --yes; then - echo "Storage account deleted successfully" - STORAGE_DELETED=true - break + echo "Deleting storage account ${STORAGE_ACCOUNT_NAME}..." + RETRIES=3 + STORAGE_DELETED=false + for attempt in $(seq "${RETRIES}"); do + if az storage account delete \ + --name "${STORAGE_ACCOUNT_NAME}" \ + --resource-group "${RESOURCEGROUP}" \ + --yes; then + echo "Storage account deleted successfully" + STORAGE_DELETED=true + break + fi + echo "Attempt ${attempt}/${RETRIES}: Failed to delete storage account. Retrying in 30s..." + sleep 30 + done + if [[ "${STORAGE_DELETED}" != "true" ]]; then + echo "Error: Failed to delete storage account ${STORAGE_ACCOUNT_NAME} after ${RETRIES} attempts" + OVERALL_RESULT=1 fi - echo "Attempt ${attempt}/${RETRIES}: Failed to delete storage account. Retrying in 30s..." - sleep 30 - done - if [[ "${STORAGE_DELETED}" != "true" ]]; then - echo "Error: Failed to delete storage account ${STORAGE_ACCOUNT_NAME} after ${RETRIES} attempts" - OVERALL_RESULT=1 fi else echo "No oadp-storage-account-name file found, skipping storage account cleanup" diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh index 7b3777d19dd89..91826ac14d4a0 100755 --- a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-commands.sh @@ -13,7 +13,7 @@ OADP_PLUGIN_IMAGE="${OADP_HYPERSHIFT_PLUGIN_IMAGE:-quay.io/konveyor/hypershift-o CLUSTER_PREFIX="${CLUSTER_PREFIX:-public}" echo "Discovering the public self-managed-Azure guest cluster..." -CLUSTER_NAME="$(oc get hostedcluster -n clusters -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "${CLUSTER_PREFIX}" | head -n1)" +CLUSTER_NAME="$(oc get hostedcluster -n clusters -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "${CLUSTER_PREFIX}" | head -n1 || true)" if [[ -z "${CLUSTER_NAME}" ]]; then echo "!!! Unable to find a public HostedCluster in the 'clusters' namespace" oc get hostedcluster -n clusters @@ -22,10 +22,13 @@ fi echo "${CLUSTER_NAME}" > "${SHARED_DIR}/cluster-name" RESOURCEGROUP="$(cat "${SHARED_DIR}/azure_pls_resource_group")" -CONTAINER_NAME="${OADP_AZURE_CONTAINER_NAME:-hypershift-oadp-${CLUSTER_NAME}}" +CONTAINER_PREFIX="hypershift-oadp-" +CONTAINER_NAME="${CONTAINER_PREFIX}${CLUSTER_NAME:0:$((63 - ${#CONTAINER_PREFIX}))}" # Storage account names must be 3-24 chars, lowercase letters and numbers only. -STORAGE_ACCOUNT_NAME="oadp${CLUSTER_NAME:0:20}" -STORAGE_ACCOUNT_NAME="$(echo "${STORAGE_ACCOUNT_NAME}" | tr -cd '[:lower:][:digit:]' | cut -c1-24)" +# "oadp" (4) + sanitized cluster stem (up to 12) + job-unique hash (8) = max 24. +CLUSTER_STEM="$(echo "${CLUSTER_NAME}" | tr '[:upper:]' '[:lower:]' | tr -cd '[:lower:][:digit:]')" +JOB_SUFFIX="$(echo -n "${PROW_JOB_ID:-unknown}" | md5sum | cut -c1-8)" +STORAGE_ACCOUNT_NAME="oadp${CLUSTER_STEM:0:12}${JOB_SUFFIX}" echo "Setting up OADP prerequisites for backup/restore tests" echo "Cluster: ${CLUSTER_NAME}, Resource Group: ${RESOURCEGROUP}, Storage Account: ${STORAGE_ACCOUNT_NAME}, Container: ${CONTAINER_NAME}" @@ -97,8 +100,8 @@ echo "Resolving client ID and principal ID of ${OADP_MI_NAME}..." OADP_MI_CLIENT_ID="" OADP_MI_PRINCIPAL_ID="" for attempt in $(seq 1 5); do - OADP_MI_CLIENT_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query clientId -o tsv)" - OADP_MI_PRINCIPAL_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query principalId -o tsv)" + OADP_MI_CLIENT_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query clientId -o tsv || true)" + OADP_MI_PRINCIPAL_ID="$(az identity show --name "${OADP_MI_NAME}" --resource-group "${OADP_MI_RESOURCEGROUP}" --query principalId -o tsv || true)" if [[ -n "${OADP_MI_CLIENT_ID}" && -n "${OADP_MI_PRINCIPAL_ID}" ]]; then break fi @@ -235,7 +238,7 @@ EOF # Wait for Velero pod to be ready echo "Waiting for Velero pod to be ready..." -oc wait --for=condition=Available deployment/velero -n openshift-adp --timeout=300s || true +oc wait --for=condition=Available deployment/velero -n openshift-adp --timeout=300s # Safety net: the OADP operator's own ServiceAccount reconcile could in # principle recreate/strip the annotation we pre-set above, or the very first diff --git a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-ref.yaml b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-ref.yaml index be180035446fd..00d650a9d2f89 100644 --- a/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-ref.yaml +++ b/ci-operator/step-registry/hypershift/self-managed-azure/oadp-setup/hypershift-self-managed-azure-oadp-setup-ref.yaml @@ -12,11 +12,6 @@ ref: name: hypershift-ci-jobs-self-managed-azure namespace: test-credentials env: - - name: OADP_AZURE_CONTAINER_NAME - documentation: |- - The Azure Blob Storage container (bucket) name used for OADP backups. - If empty, a container will be created using the target cluster name. - default: "" - name: OADP_HYPERSHIFT_PLUGIN_IMAGE documentation: |- The image to use for the hypershift OADP plugin in the DataProtectionApplication.