From fddbee8d4a0de7814e3811dfce61c8abc7de85cf Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 11:14:09 -0400 Subject: [PATCH 01/19] Add unit-test presubmit for kdm-controller/kdm-plugin oadp-dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit migtools/kubevirt-datamover-controller and migtools/kubevirt-datamover-plugin (oadp-dev branch) had zero CI test coverage — only image builds. Both ship a self-contained `make test` (envtest for the controller, plain go test for the plugin), so wire that up as a standard unit-test presubmit. disable_sparse_checkout is required: without it prowgen defaults these repos to a Dockerfile-only sparse checkout (fine for the image-build job, but it starves `make test` of the Makefile/go source it needs). Partial step toward openshift/oadp-operator#1832 (Group A2: controllers reconciled by the operator, gated on a DPA feature flag). The harder half — installing oadp-operator via OLM against the PR-built kdm image and running its e2e suite — is blocked on there being no reusable oadp-dev catalog/index image (oadp-operator's ci-index is built ephemeral, per-PR, and never promoted), so that part isn't in this PR. Signed-off-by: Tiger Kaovilai --- ...ubevirt-datamover-controller-oadp-dev.yaml | 13 ++++ ...ls-kubevirt-datamover-plugin-oadp-dev.yaml | 13 ++++ ...mover-controller-oadp-dev-postsubmits.yaml | 4 +- ...amover-controller-oadp-dev-presubmits.yaml | 76 ++++++++++++++++++- ...datamover-plugin-oadp-dev-postsubmits.yaml | 4 +- ...-datamover-plugin-oadp-dev-presubmits.yaml | 76 ++++++++++++++++++- 6 files changed, 174 insertions(+), 12 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 6cd5562fe088b..dab925e5feef8 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -13,6 +13,8 @@ promotion: to: - namespace: konveyor tag: oadp-dev +prowgen: + disable_sparse_checkout: true resources: '*': limits: @@ -20,6 +22,17 @@ resources: requests: cpu: 100m memory: 200Mi +tests: +- as: unit-test + steps: + test: + - as: unit + commands: make test + from: src + resources: + requests: + cpu: 100m + memory: 200Mi zz_generated_metadata: branch: oadp-dev org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index 3fb476682384d..b84e25be559f7 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -13,6 +13,8 @@ promotion: to: - namespace: konveyor tag: oadp-dev +prowgen: + disable_sparse_checkout: true resources: '*': limits: @@ -20,6 +22,17 @@ resources: requests: cpu: 100m memory: 200Mi +tests: +- as: unit-test + steps: + test: + - as: unit + commands: make test + from: src + resources: + requests: + cpu: 100m + memory: 200Mi zz_generated_metadata: branch: oadp-dev org: migtools diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml index a01715b010015..90120dd5a6651 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml @@ -6,9 +6,7 @@ postsubmits: - ^oadp-dev$ cluster: build03 decorate: true - decoration_config: - sparse_checkout_files: - - Dockerfile + decoration_config: {} labels: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml index 24990c860ac38..b2400b3f768d6 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml @@ -8,9 +8,7 @@ presubmits: cluster: build01 context: ci/prow/images decorate: true - decoration_config: - sparse_checkout_files: - - Dockerfile + decoration_config: {} labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen @@ -57,3 +55,75 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^oadp-dev$ + - ^oadp-dev- + cluster: build13 + context: ci/prow/unit-test + decorate: true + decoration_config: {} + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-unit-test + rerun_command: /test unit-test + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --target=unit-test + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )unit-test,?($|\s.*) diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml index 80bcdb3fa8b48..7275581c7d2fe 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml @@ -6,9 +6,7 @@ postsubmits: - ^oadp-dev$ cluster: build10 decorate: true - decoration_config: - sparse_checkout_files: - - Dockerfile + decoration_config: {} labels: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml index eb598fe505c7a..9b2eba7860eb2 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml @@ -8,9 +8,7 @@ presubmits: cluster: build09 context: ci/prow/images decorate: true - decoration_config: - sparse_checkout_files: - - Dockerfile + decoration_config: {} labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen @@ -57,3 +55,75 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^oadp-dev$ + - ^oadp-dev- + cluster: build13 + context: ci/prow/unit-test + decorate: true + decoration_config: {} + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-unit-test + rerun_command: /test unit-test + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --target=unit-test + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )unit-test,?($|\s.*) From 39dbbb0976918abcecf1e11bab9c580817f8c81a Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 14:33:20 -0400 Subject: [PATCH 02/19] Replace unit-test with real oadp-operator e2e for kdm-controller/plugin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The unit-test presubmit added in the previous commit was redundant with kubevirt-datamover-controller's existing GitHub Actions test.yml, and missed the actual goal: gating these repos' PRs on oadp-operator's real e2e suite (openshift/oadp-operator#1832, Group A2), not local unit tests. Adds the real integration: - oadp-operator's own oadp-dev config now builds an operator bundle/index (operator.bundles) and the ci-Dockerfile e2e test binary, promoting both (as oadp-operator-index / oadp-operator-e2e-tests) on every merge. This is what kdm-controller/plugin need to install oadp-operator via OLM and run its e2e suite — previously only the operator binary was promoted; the bundle/index/test-binary were built ephemeral, per-PR, and only inside oadp-operator's own job. - kdm-controller/plugin presubmits: install oadp-operator via optional-operators-ci-aws from that promoted index, patch the running operator deployment's RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER / RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN env to the PR-built image (oc set env, not the subscribe ref's OO_CONFIG_ENVVARS -- that can only override dependencies a step already declares, not inject a new one), then run `make TEST_VIRT=true test-e2e` from the promoted test binary. TEST_VIRT=true makes the suite install community KubeVirt/HCO itself and run the kubevirt-datamover-labeled specs (incl. VM backup/restore), so no separate CNV step-registry chain is needed. Signed-off-by: Tiger Kaovilai --- ...ubevirt-datamover-controller-oadp-dev.yaml | 54 +++++++++++-- ...ls-kubevirt-datamover-plugin-oadp-dev.yaml | 54 +++++++++++-- .../openshift-oadp-operator-oadp-dev.yaml | 10 +-- ...mover-controller-oadp-dev-postsubmits.yaml | 1 + ...amover-controller-oadp-dev-presubmits.yaml | 76 +++++++++++-------- ...datamover-plugin-oadp-dev-postsubmits.yaml | 1 + ...-datamover-plugin-oadp-dev-presubmits.yaml | 76 +++++++++++-------- ...ft-oadp-operator-oadp-dev-postsubmits.yaml | 4 +- ...ift-oadp-operator-oadp-dev-presubmits.yaml | 4 +- 9 files changed, 195 insertions(+), 85 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index dab925e5feef8..6ab2d22fa68ed 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -1,3 +1,12 @@ +base_images: + oadp-operator-index: + name: oadp-operator-index + namespace: konveyor + tag: latest + test-oadp-operator: + name: oadp-operator-e2e-tests + namespace: konveyor + tag: latest build_root: image_stream_tag: name: builder @@ -15,6 +24,12 @@ promotion: tag: oadp-dev prowgen: disable_sparse_checkout: true +releases: + latest: + candidate: + product: ocp + stream: nightly + version: "4.22" resources: '*': limits: @@ -23,16 +38,45 @@ resources: cpu: 100m memory: 200Mi tests: -- as: unit-test +- always_run: false + as: e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: oadp-operator-index + env: + OO_CHANNEL: dev + OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' test: - - as: unit - commands: make test - from: src + - as: set-related-image + cli: latest + commands: | + oc set env deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER="${KDM_CONTROLLER_IMAGE}" + oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s + dependencies: + - env: KDM_CONTROLLER_IMAGE + name: kubevirt-datamover-controller + from: cli resources: requests: cpu: 100m - memory: 200Mi + memory: 100Mi + - as: e2e + cli: latest + commands: make TEST_VIRT=true test-e2e + credentials: + - mount_path: /var/run/oadp-credentials + name: oadp-credentials + namespace: test-credentials + from: test-oadp-operator + resources: + requests: + cpu: 1000m + memory: 512Mi + workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-dev org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index b84e25be559f7..a123320363965 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -1,3 +1,12 @@ +base_images: + oadp-operator-index: + name: oadp-operator-index + namespace: konveyor + tag: latest + test-oadp-operator: + name: oadp-operator-e2e-tests + namespace: konveyor + tag: latest build_root: image_stream_tag: name: builder @@ -15,6 +24,12 @@ promotion: tag: oadp-dev prowgen: disable_sparse_checkout: true +releases: + latest: + candidate: + product: ocp + stream: nightly + version: "4.22" resources: '*': limits: @@ -23,16 +38,45 @@ resources: cpu: 100m memory: 200Mi tests: -- as: unit-test +- always_run: false + as: e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: oadp-operator-index + env: + OO_CHANNEL: dev + OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' test: - - as: unit - commands: make test - from: src + - as: set-related-image + cli: latest + commands: | + oc set env deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN="${KDM_PLUGIN_IMAGE}" + oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s + dependencies: + - env: KDM_PLUGIN_IMAGE + name: kubevirt-datamover-plugin + from: cli resources: requests: cpu: 100m - memory: 200Mi + memory: 100Mi + - as: e2e + cli: latest + commands: make TEST_VIRT=true test-e2e + credentials: + - mount_path: /var/run/oadp-credentials + name: oadp-credentials + namespace: test-credentials + from: test-oadp-operator + resources: + requests: + cpu: 1000m + memory: 512Mi + workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-dev org: migtools diff --git a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml index 6b3863b6fe8b4..3130af1129817 100644 --- a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml +++ b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml @@ -16,15 +16,11 @@ operator: - dockerfile_path: build/Dockerfile.bundle promotion: to: - - excluded_images: - - test-oadp-operator - name: oadp-operator - namespace: konveyor - additional_images: - oadp-operator-e2e-tests: test-oadp-operator - oadp-operator-index: ci-index + ci-index: oadp-operator-index + test-oadp-operator: oadp-operator-e2e-tests + name: oadp-operator namespace: konveyor - tag: oadp-dev resources: '*': limits: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml index 90120dd5a6651..cd0c887ef0e22 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml @@ -11,6 +11,7 @@ postsubmits: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" ci.openshift.io/generator: prowgen + job-release: "4.22" max_concurrency: 1 name: branch-ci-migtools-kubevirt-datamover-controller-oadp-dev-images spec: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml index b2400b3f768d6..ccab99a602b6f 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml @@ -1,36 +1,55 @@ presubmits: migtools/kubevirt-datamover-controller: - agent: kubernetes - always_run: true + always_run: false branches: - ^oadp-dev$ - ^oadp-dev- - cluster: build01 - context: ci/prow/images + cluster: build11 + context: ci/prow/e2e-test-aws decorate: true decoration_config: {} labels: - capability/arm64: arm64 + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen + job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-images - rerun_command: /test images + name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-e2e-test-aws + rerun_command: /test e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - - --target=[images] + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-test-aws command: - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" + ports: + - containerPort: 8080 + name: http resources: requests: cpu: 10m volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -45,6 +64,15 @@ presubmits: readOnly: true serviceAccountName: ci-operator volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -54,49 +82,39 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )images,?($|\s.*) + trigger: (?m)^/test( | .* )e2e-test-aws,?($|\s.*) - agent: kubernetes always_run: true branches: - ^oadp-dev$ - ^oadp-dev- - cluster: build13 - context: ci/prow/unit-test + cluster: build01 + context: ci/prow/images decorate: true decoration_config: {} labels: + capability/arm64: arm64 ci.openshift.io/generator: prowgen + job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-unit-test - rerun_command: /test unit-test + name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-images + rerun_command: /test images spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - - --target=unit-test + - --target=[images] command: - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" - ports: - - containerPort: 8080 - name: http resources: requests: cpu: 10m volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -111,12 +129,6 @@ presubmits: readOnly: true serviceAccountName: ci-operator volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -126,4 +138,4 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )unit-test,?($|\s.*) + trigger: (?m)^/test( | .* )images,?($|\s.*) diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml index 7275581c7d2fe..3a87b9fc02d3e 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml @@ -11,6 +11,7 @@ postsubmits: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" ci.openshift.io/generator: prowgen + job-release: "4.22" max_concurrency: 1 name: branch-ci-migtools-kubevirt-datamover-plugin-oadp-dev-images spec: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml index 9b2eba7860eb2..8a541cd409f12 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml @@ -1,36 +1,55 @@ presubmits: migtools/kubevirt-datamover-plugin: - agent: kubernetes - always_run: true + always_run: false branches: - ^oadp-dev$ - ^oadp-dev- - cluster: build09 - context: ci/prow/images + cluster: build06 + context: ci/prow/e2e-test-aws decorate: true decoration_config: {} labels: - capability/arm64: arm64 + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen + job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-images - rerun_command: /test images + name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-e2e-test-aws + rerun_command: /test e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - - --target=[images] + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-test-aws command: - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" + ports: + - containerPort: 8080 + name: http resources: requests: cpu: 10m volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -45,6 +64,15 @@ presubmits: readOnly: true serviceAccountName: ci-operator volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -54,49 +82,39 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )images,?($|\s.*) + trigger: (?m)^/test( | .* )e2e-test-aws,?($|\s.*) - agent: kubernetes always_run: true branches: - ^oadp-dev$ - ^oadp-dev- - cluster: build13 - context: ci/prow/unit-test + cluster: build09 + context: ci/prow/images decorate: true decoration_config: {} labels: + capability/arm64: arm64 ci.openshift.io/generator: prowgen + job-release: "4.22" pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-unit-test - rerun_command: /test unit-test + name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-images + rerun_command: /test images spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - - --target=unit-test + - --target=[images] command: - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest imagePullPolicy: Always name: "" - ports: - - containerPort: 8080 - name: http resources: requests: cpu: 10m volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -111,12 +129,6 @@ presubmits: readOnly: true serviceAccountName: ci-operator volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -126,4 +138,4 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )unit-test,?($|\s.*) + trigger: (?m)^/test( | .* )images,?($|\s.*) diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml index 1e20a7fdb62b1..c67783a916702 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml @@ -25,8 +25,8 @@ postsubmits: - --promote - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=ci-index - - --target=test-oadp-operator + - --target=oadp-operator-e2e-tests + - --target=oadp-operator-index command: - ci-operator image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml index 3b9e724bb7536..b4e915bc01d27 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml @@ -1445,8 +1445,8 @@ presubmits: - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=ci-index - - --target=test-oadp-operator + - --target=oadp-operator-e2e-tests + - --target=oadp-operator-index command: - ci-operator image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest From cfd976323c6959c18300052136a3a20a37238d4d Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 15:39:53 -0400 Subject: [PATCH 03/19] Use Subscription.spec.config.env for RELATED_IMAGE override; target 5.0 Patching the Deployment directly (oc set env deployment/...) doesn't survive OLM's own reconciliation: CSV.spec is what OLM continuously reconciles the Deployment from, so a direct Deployment edit would very plausibly get reverted mid-test. Subscription.spec.config.env is OLM's documented, supported override mechanism instead -- it wins over a same-named CSV env var and is designed to persist across reconciliation and upgrades. Patch that instead of hand-editing the CSV's deployment array. Also point releases.latest at the 5.0 nightly candidate instead of 4.22, matching the actual current oadp-dev target. (Resource sizing for the e2e step was cross-checked against oadp-operator's own existing e2e-test-kubevirt-aws-periodic job -- already an exact match, no change needed there.) Signed-off-by: Tiger Kaovilai --- .../migtools-kubevirt-datamover-controller-oadp-dev.yaml | 9 +++++++-- .../migtools-kubevirt-datamover-plugin-oadp-dev.yaml | 9 +++++++-- ...bevirt-datamover-controller-oadp-dev-postsubmits.yaml | 2 +- ...ubevirt-datamover-controller-oadp-dev-presubmits.yaml | 4 ++-- ...s-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml | 2 +- ...ls-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml | 4 ++-- 6 files changed, 20 insertions(+), 10 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 6ab2d22fa68ed..71bd1ea8c8fc4 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -29,7 +29,7 @@ releases: candidate: product: ocp stream: nightly - version: "4.22" + version: "5.0" resources: '*': limits: @@ -54,7 +54,12 @@ tests: - as: set-related-image cli: latest commands: | - oc set env deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER="${KDM_CONTROLLER_IMAGE}" + SUB=$(cat "${SHARED_DIR}/oo-subscription") + # Subscription.spec.config.env is OLM's supported override mechanism: + # it wins over same-named CSV env vars and survives reconciliation, + # unlike patching the Deployment directly (OLM reconciles that from + # the CSV and would revert it). + oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_CONTROLLER_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER",value:$img}]}}}')" oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s dependencies: - env: KDM_CONTROLLER_IMAGE diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index a123320363965..8b3fb5f05f822 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -29,7 +29,7 @@ releases: candidate: product: ocp stream: nightly - version: "4.22" + version: "5.0" resources: '*': limits: @@ -54,7 +54,12 @@ tests: - as: set-related-image cli: latest commands: | - oc set env deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN="${KDM_PLUGIN_IMAGE}" + SUB=$(cat "${SHARED_DIR}/oo-subscription") + # Subscription.spec.config.env is OLM's supported override mechanism: + # it wins over same-named CSV env vars and survives reconciliation, + # unlike patching the Deployment directly (OLM reconciles that from + # the CSV and would revert it). + oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_PLUGIN_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN",value:$img}]}}}')" oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s dependencies: - env: KDM_PLUGIN_IMAGE diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml index cd0c887ef0e22..30ae0983f4895 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml @@ -11,7 +11,7 @@ postsubmits: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" ci.openshift.io/generator: prowgen - job-release: "4.22" + job-release: "5.0" max_concurrency: 1 name: branch-ci-migtools-kubevirt-datamover-controller-oadp-dev-images spec: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml index ccab99a602b6f..125d7370b0111 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml @@ -13,7 +13,7 @@ presubmits: ci-operator.openshift.io/cloud: aws ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen - job-release: "4.22" + job-release: "5.0" pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-e2e-test-aws rerun_command: /test e2e-test-aws @@ -95,7 +95,7 @@ presubmits: labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen - job-release: "4.22" + job-release: "5.0" pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-migtools-kubevirt-datamover-controller-oadp-dev-images rerun_command: /test images diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml index 3a87b9fc02d3e..f607cf372e34d 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml @@ -11,7 +11,7 @@ postsubmits: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" ci.openshift.io/generator: prowgen - job-release: "4.22" + job-release: "5.0" max_concurrency: 1 name: branch-ci-migtools-kubevirt-datamover-plugin-oadp-dev-images spec: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml index 8a541cd409f12..7df65c6b809b9 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml @@ -13,7 +13,7 @@ presubmits: ci-operator.openshift.io/cloud: aws ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen - job-release: "4.22" + job-release: "5.0" pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-e2e-test-aws rerun_command: /test e2e-test-aws @@ -95,7 +95,7 @@ presubmits: labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen - job-release: "4.22" + job-release: "5.0" pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-dev-images rerun_command: /test images From 4e74f778b83665442d8c0905bc2d224256945457 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 16:24:38 -0400 Subject: [PATCH 04/19] Fix set-related-image race; drop unneeded disable_sparse_checkout oc patch subscription ... followed immediately by oc rollout status was racy: rollout status can report the existing rollout as already-complete before OLM has even noticed the Subscription change and pushed a new Deployment generation, letting the e2e suite start against the original promoted image instead of the PR's. Poll the Deployment's own env value until it reflects the override before checking rollout status. Also drop prowgen.disable_sparse_checkout: true -- it was only needed for the unit-test job's `from: src` step, which no longer exists (the e2e steps run from `cli` and `test-oadp-operator`, not `src`). Removing it reverts the images/postsubmit jobs to their original Dockerfile-only sparse checkout, avoiding unrelated churn and CI runtime. Signed-off-by: Tiger Kaovilai --- ...tools-kubevirt-datamover-controller-oadp-dev.yaml | 12 ++++++++++-- .../migtools-kubevirt-datamover-plugin-oadp-dev.yaml | 12 ++++++++++-- ...rt-datamover-controller-oadp-dev-postsubmits.yaml | 4 +++- ...irt-datamover-controller-oadp-dev-presubmits.yaml | 8 ++++++-- ...bevirt-datamover-plugin-oadp-dev-postsubmits.yaml | 4 +++- ...ubevirt-datamover-plugin-oadp-dev-presubmits.yaml | 8 ++++++-- 6 files changed, 38 insertions(+), 10 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 71bd1ea8c8fc4..41c384a7d68b8 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -22,8 +22,6 @@ promotion: to: - namespace: konveyor tag: oadp-dev -prowgen: - disable_sparse_checkout: true releases: latest: candidate: @@ -60,6 +58,16 @@ tests: # unlike patching the Deployment directly (OLM reconciles that from # the CSV and would revert it). oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_CONTROLLER_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER",value:$img}]}}}')" + echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER=${KDM_CONTROLLER_IMAGE}" + for i in $(seq 1 60); do + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER')].value}" 2>/dev/null || true) + [ "${CURRENT}" = "${KDM_CONTROLLER_IMAGE}" ] && break + sleep 5 + done + if [ "${CURRENT}" != "${KDM_CONTROLLER_IMAGE}" ]; then + echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + exit 1 + fi oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s dependencies: - env: KDM_CONTROLLER_IMAGE diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index 8b3fb5f05f822..c6c01fb95b413 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -22,8 +22,6 @@ promotion: to: - namespace: konveyor tag: oadp-dev -prowgen: - disable_sparse_checkout: true releases: latest: candidate: @@ -60,6 +58,16 @@ tests: # unlike patching the Deployment directly (OLM reconciles that from # the CSV and would revert it). oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_PLUGIN_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN",value:$img}]}}}')" + echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN=${KDM_PLUGIN_IMAGE}" + for i in $(seq 1 60); do + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN')].value}" 2>/dev/null || true) + [ "${CURRENT}" = "${KDM_PLUGIN_IMAGE}" ] && break + sleep 5 + done + if [ "${CURRENT}" != "${KDM_PLUGIN_IMAGE}" ]; then + echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + exit 1 + fi oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s dependencies: - env: KDM_PLUGIN_IMAGE diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml index 30ae0983f4895..5b5e4ce363dec 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-postsubmits.yaml @@ -6,7 +6,9 @@ postsubmits: - ^oadp-dev$ cluster: build03 decorate: true - decoration_config: {} + decoration_config: + sparse_checkout_files: + - Dockerfile labels: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml index 125d7370b0111..6f4e7c8cfad00 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev-presubmits.yaml @@ -8,7 +8,9 @@ presubmits: cluster: build11 context: ci/prow/e2e-test-aws decorate: true - decoration_config: {} + decoration_config: + sparse_checkout_files: + - Dockerfile labels: ci-operator.openshift.io/cloud: aws ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws @@ -91,7 +93,9 @@ presubmits: cluster: build01 context: ci/prow/images decorate: true - decoration_config: {} + decoration_config: + sparse_checkout_files: + - Dockerfile labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml index f607cf372e34d..3eac88bdb87c0 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-postsubmits.yaml @@ -6,7 +6,9 @@ postsubmits: - ^oadp-dev$ cluster: build10 decorate: true - decoration_config: {} + decoration_config: + sparse_checkout_files: + - Dockerfile labels: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml index 7df65c6b809b9..653dceea47163 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev-presubmits.yaml @@ -8,7 +8,9 @@ presubmits: cluster: build06 context: ci/prow/e2e-test-aws decorate: true - decoration_config: {} + decoration_config: + sparse_checkout_files: + - Dockerfile labels: ci-operator.openshift.io/cloud: aws ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws @@ -91,7 +93,9 @@ presubmits: cluster: build09 context: ci/prow/images decorate: true - decoration_config: {} + decoration_config: + sparse_checkout_files: + - Dockerfile labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen From 091a76987608a84d2251f7f7fc78a0e7e7cd932a Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 16:36:43 -0400 Subject: [PATCH 05/19] Fix additional_images key/value direction (was backwards) additional_images maps {destination-name: pipeline-source-tag} -- I had it backwards (ci-index: oadp-operator-index instead of oadp-operator-index: ci-index), and had it on the wrong promotion.to[] entry. Confirmed via ci-tools source (ImageTargets() inserts the *value* as a required build target) and two working examples elsewhere in this repo (quay-operator, vertical-pod-autoscaler-operator): the value must be a real pipeline tag. With the original ordering, the postsubmit's generated promote targets were `oadp-operator-e2e-tests`/ `oadp-operator-index` -- neither is a real pipeline image in this config, so the actual postsubmit run would have failed outright once merged. Also: the original single promotion.to[] entry has an explicit `name` (shared-imagestream mode), where each promoted image becomes a *tag* under that one name rather than its own imagestream -- fine for the existing lone "oadp-operator" image, but wrong for what I actually want (oadp-operator-index and oadp-operator-e2e-tests as their own separate imagestreams, matching the kdm repos' base_images references). Moved additional_images to a second to[] entry with no `name` and an explicit `tag: latest`, which is the tag-mode that produces per-key imagestreams instead. Added excluded_images to the original entry so it doesn't also try to sweep the newly-added test-oadp-operator image into the shared "oadp-operator" stream. Verified: generated postsubmit promote targets are now `ci-index` and `test-oadp-operator` -- real pipeline tags -- instead of the bogus names. Signed-off-by: Tiger Kaovilai --- .../openshift-oadp-operator-oadp-dev.yaml | 10 +++++++--- .../openshift-oadp-operator-oadp-dev-postsubmits.yaml | 4 ++-- .../openshift-oadp-operator-oadp-dev-presubmits.yaml | 4 ++-- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml index 3130af1129817..88378c4a7c316 100644 --- a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml +++ b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml @@ -16,11 +16,15 @@ operator: - dockerfile_path: build/Dockerfile.bundle promotion: to: - - additional_images: - ci-index: oadp-operator-index - test-oadp-operator: oadp-operator-e2e-tests + - excluded_images: + - test-oadp-operator name: oadp-operator namespace: konveyor + - additional_images: + oadp-operator-e2e-tests: test-oadp-operator + oadp-operator-index: ci-index + namespace: konveyor + tag: latest resources: '*': limits: diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml index c67783a916702..1e20a7fdb62b1 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml @@ -25,8 +25,8 @@ postsubmits: - --promote - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=oadp-operator-e2e-tests - - --target=oadp-operator-index + - --target=ci-index + - --target=test-oadp-operator command: - ci-operator image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml index b4e915bc01d27..3b9e724bb7536 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml @@ -1445,8 +1445,8 @@ presubmits: - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=oadp-operator-e2e-tests - - --target=oadp-operator-index + - --target=ci-index + - --target=test-oadp-operator command: - ci-operator image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest From 7a435f76f82ea978d3ba65e22d42f9eb07d77ddc Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 16:42:03 -0400 Subject: [PATCH 06/19] Fix oadp-dev/oadp-1.6 tag collision; add oadp-1.6 e2e wiring oadp-dev and oadp-1.6 both promoting oadp-operator-index/ oadp-operator-e2e-tests to the same konveyor namespace under tag "latest" would collide -- whichever branch's postsubmit ran last would clobber the other's promoted image. Give oadp-dev's entry an explicit tag: oadp-dev instead, matching the branch-specific-tag/shared-name convention the kdm repos' own promotion already uses. Updated their base_images tag references to match. Replicates the same real oadp-operator e2e wiring (see prior commits on this branch) for the oadp-1.6 branch: - oadp-operator's oadp-1.6 base config: same two-entry promotion split (existing name-mode entry + excluded_images, new tag-mode entry for oadp-operator-index/oadp-operator-e2e-tests tagged oadp-1.6). - kdm-controller/kdm-plugin oadp-1.6 configs: same e2e-test-aws presubmit, adjusted for this branch: OO_CHANNEL: stable (matching oadp-operator's own oadp-1.6 e2e jobs, vs "dev" for oadp-dev), and dependency names pointing at this branch's own local build names (kubevirt-datamover-controller-oadp-1.6 / -plugin-oadp-1.6). Signed-off-by: Tiger Kaovilai --- ...ubevirt-datamover-controller-oadp-1.6.yaml | 70 +++++++++++++++ ...ubevirt-datamover-controller-oadp-dev.yaml | 4 +- ...ls-kubevirt-datamover-plugin-oadp-1.6.yaml | 70 +++++++++++++++ ...ls-kubevirt-datamover-plugin-oadp-dev.yaml | 4 +- .../openshift-oadp-operator-oadp-dev.yaml | 2 +- ...mover-controller-oadp-1.6-postsubmits.yaml | 1 + ...amover-controller-oadp-1.6-presubmits.yaml | 86 +++++++++++++++++++ ...datamover-plugin-oadp-1.6-postsubmits.yaml | 1 + ...-datamover-plugin-oadp-1.6-presubmits.yaml | 86 +++++++++++++++++++ 9 files changed, 319 insertions(+), 5 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml index 0841369a62368..fe7c594867371 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml @@ -1,3 +1,12 @@ +base_images: + oadp-operator-index: + name: oadp-operator-index + namespace: konveyor + tag: oadp-1.6 + test-oadp-operator: + name: oadp-operator-e2e-tests + namespace: konveyor + tag: oadp-1.6 build_root: image_stream_tag: name: builder @@ -13,6 +22,12 @@ promotion: to: - name: kubevirt-datamover-controller namespace: konveyor +releases: + latest: + candidate: + product: ocp + stream: nightly + version: "5.0" resources: '*': limits: @@ -20,6 +35,61 @@ resources: requests: cpu: 100m memory: 200Mi +tests: +- always_run: false + as: e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: oadp-operator-index + env: + OO_CHANNEL: stable + OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' + test: + - as: set-related-image + cli: latest + commands: | + SUB=$(cat "${SHARED_DIR}/oo-subscription") + # Subscription.spec.config.env is OLM's supported override mechanism: + # it wins over same-named CSV env vars and survives reconciliation, + # unlike patching the Deployment directly (OLM reconciles that from + # the CSV and would revert it). + oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_CONTROLLER_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER",value:$img}]}}}')" + echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER=${KDM_CONTROLLER_IMAGE}" + for i in $(seq 1 60); do + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER')].value}" 2>/dev/null || true) + [ "${CURRENT}" = "${KDM_CONTROLLER_IMAGE}" ] && break + sleep 5 + done + if [ "${CURRENT}" != "${KDM_CONTROLLER_IMAGE}" ]; then + echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + exit 1 + fi + oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s + dependencies: + - env: KDM_CONTROLLER_IMAGE + name: kubevirt-datamover-controller-oadp-1.6 + from: cli + resources: + requests: + cpu: 100m + memory: 100Mi + - as: e2e + cli: latest + commands: make TEST_VIRT=true test-e2e + credentials: + - mount_path: /var/run/oadp-credentials + name: oadp-credentials + namespace: test-credentials + from: test-oadp-operator + resources: + requests: + cpu: 1000m + memory: 512Mi + workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-1.6 org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 41c384a7d68b8..64d2c7d40a731 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -2,11 +2,11 @@ base_images: oadp-operator-index: name: oadp-operator-index namespace: konveyor - tag: latest + tag: oadp-dev test-oadp-operator: name: oadp-operator-e2e-tests namespace: konveyor - tag: latest + tag: oadp-dev build_root: image_stream_tag: name: builder diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml index 74ebd47549d07..f33cf32181951 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml @@ -1,3 +1,12 @@ +base_images: + oadp-operator-index: + name: oadp-operator-index + namespace: konveyor + tag: oadp-1.6 + test-oadp-operator: + name: oadp-operator-e2e-tests + namespace: konveyor + tag: oadp-1.6 build_root: image_stream_tag: name: builder @@ -13,6 +22,12 @@ promotion: to: - name: kubevirt-datamover-plugin namespace: konveyor +releases: + latest: + candidate: + product: ocp + stream: nightly + version: "5.0" resources: '*': limits: @@ -20,6 +35,61 @@ resources: requests: cpu: 100m memory: 200Mi +tests: +- always_run: false + as: e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: oadp-operator-index + env: + OO_CHANNEL: stable + OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' + test: + - as: set-related-image + cli: latest + commands: | + SUB=$(cat "${SHARED_DIR}/oo-subscription") + # Subscription.spec.config.env is OLM's supported override mechanism: + # it wins over same-named CSV env vars and survives reconciliation, + # unlike patching the Deployment directly (OLM reconciles that from + # the CSV and would revert it). + oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_PLUGIN_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN",value:$img}]}}}')" + echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN=${KDM_PLUGIN_IMAGE}" + for i in $(seq 1 60); do + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN')].value}" 2>/dev/null || true) + [ "${CURRENT}" = "${KDM_PLUGIN_IMAGE}" ] && break + sleep 5 + done + if [ "${CURRENT}" != "${KDM_PLUGIN_IMAGE}" ]; then + echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + exit 1 + fi + oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s + dependencies: + - env: KDM_PLUGIN_IMAGE + name: kubevirt-datamover-plugin-oadp-1.6 + from: cli + resources: + requests: + cpu: 100m + memory: 100Mi + - as: e2e + cli: latest + commands: make TEST_VIRT=true test-e2e + credentials: + - mount_path: /var/run/oadp-credentials + name: oadp-credentials + namespace: test-credentials + from: test-oadp-operator + resources: + requests: + cpu: 1000m + memory: 512Mi + workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-1.6 org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index c6c01fb95b413..54a6e1b1d4c93 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -2,11 +2,11 @@ base_images: oadp-operator-index: name: oadp-operator-index namespace: konveyor - tag: latest + tag: oadp-dev test-oadp-operator: name: oadp-operator-e2e-tests namespace: konveyor - tag: latest + tag: oadp-dev build_root: image_stream_tag: name: builder diff --git a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml index 88378c4a7c316..6b3863b6fe8b4 100644 --- a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml +++ b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml @@ -24,7 +24,7 @@ promotion: oadp-operator-e2e-tests: test-oadp-operator oadp-operator-index: ci-index namespace: konveyor - tag: latest + tag: oadp-dev resources: '*': limits: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-postsubmits.yaml index 6e6a435045bc0..15a55b786d20b 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-postsubmits.yaml @@ -13,6 +13,7 @@ postsubmits: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" ci.openshift.io/generator: prowgen + job-release: "5.0" max_concurrency: 1 name: branch-ci-migtools-kubevirt-datamover-controller-oadp-1.6-images spec: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-presubmits.yaml index e2a48e2137d1e..939656a640fab 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6-presubmits.yaml @@ -1,5 +1,90 @@ presubmits: migtools/kubevirt-datamover-controller: + - agent: kubernetes + always_run: false + branches: + - ^oadp-1\.6$ + - ^oadp-1\.6- + cluster: build11 + context: ci/prow/e2e-test-aws + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-migtools-kubevirt-datamover-controller-oadp-1.6-e2e-test-aws + rerun_command: /test e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-test-aws + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-test-aws,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -14,6 +99,7 @@ presubmits: labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen + job-release: "5.0" pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-migtools-kubevirt-datamover-controller-oadp-1.6-images rerun_command: /test images diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-postsubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-postsubmits.yaml index 1fde5040ef48e..4e545be58496a 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-postsubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-postsubmits.yaml @@ -13,6 +13,7 @@ postsubmits: capability/arm64: arm64 ci-operator.openshift.io/is-promotion: "true" ci.openshift.io/generator: prowgen + job-release: "5.0" max_concurrency: 1 name: branch-ci-migtools-kubevirt-datamover-plugin-oadp-1.6-images spec: diff --git a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-presubmits.yaml b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-presubmits.yaml index e50593dde217e..f419440bb065c 100644 --- a/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-presubmits.yaml +++ b/ci-operator/jobs/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6-presubmits.yaml @@ -1,5 +1,90 @@ presubmits: migtools/kubevirt-datamover-plugin: + - agent: kubernetes + always_run: false + branches: + - ^oadp-1\.6$ + - ^oadp-1\.6- + cluster: build06 + context: ci/prow/e2e-test-aws + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-1.6-e2e-test-aws + rerun_command: /test e2e-test-aws + run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-test-aws + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-test-aws,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -14,6 +99,7 @@ presubmits: labels: capability/arm64: arm64 ci.openshift.io/generator: prowgen + job-release: "5.0" pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-migtools-kubevirt-datamover-plugin-oadp-1.6-images rerun_command: /test images From 7c8d09fe64b800ead46e48bf65901328278bf87d Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 6 Aug 2026 17:35:13 -0400 Subject: [PATCH 07/19] Use double-quoted JSONPath string literals in set-related-image steps CodeRabbit flagged the single-quoted @.name=='manager' style filter comparisons as risky. Kubernetes' JSONPath implementation documents double-quoted string literals in filter expressions; switch to that form (escaped, since the outer jsonpath argument is itself double-quoted) to remove any doubt about whether the polling loop's match would silently fail to parse. Signed-off-by: Tiger Kaovilai --- .../migtools-kubevirt-datamover-controller-oadp-1.6.yaml | 2 +- .../migtools-kubevirt-datamover-controller-oadp-dev.yaml | 2 +- .../migtools-kubevirt-datamover-plugin-oadp-1.6.yaml | 2 +- .../migtools-kubevirt-datamover-plugin-oadp-dev.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml index fe7c594867371..57aa6d21d7a75 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml @@ -60,7 +60,7 @@ tests: oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_CONTROLLER_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER",value:$img}]}}}')" echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER=${KDM_CONTROLLER_IMAGE}" for i in $(seq 1 60); do - CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER')].value}" 2>/dev/null || true) + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name==\"manager\")].env[?(@.name==\"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER\")].value}" 2>/dev/null || true) [ "${CURRENT}" = "${KDM_CONTROLLER_IMAGE}" ] && break sleep 5 done diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 64d2c7d40a731..8b4039404fa1a 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -60,7 +60,7 @@ tests: oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_CONTROLLER_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER",value:$img}]}}}')" echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER=${KDM_CONTROLLER_IMAGE}" for i in $(seq 1 60); do - CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER')].value}" 2>/dev/null || true) + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name==\"manager\")].env[?(@.name==\"RELATED_IMAGE_KUBEVIRT_DATAMOVER_CONTROLLER\")].value}" 2>/dev/null || true) [ "${CURRENT}" = "${KDM_CONTROLLER_IMAGE}" ] && break sleep 5 done diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml index f33cf32181951..357b0e4b3b5bb 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml @@ -60,7 +60,7 @@ tests: oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_PLUGIN_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN",value:$img}]}}}')" echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN=${KDM_PLUGIN_IMAGE}" for i in $(seq 1 60); do - CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN')].value}" 2>/dev/null || true) + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name==\"manager\")].env[?(@.name==\"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN\")].value}" 2>/dev/null || true) [ "${CURRENT}" = "${KDM_PLUGIN_IMAGE}" ] && break sleep 5 done diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index 54a6e1b1d4c93..14aedb7acae21 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -60,7 +60,7 @@ tests: oc patch subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" --type merge -p "$(jq -n --arg img "${KDM_PLUGIN_IMAGE}" '{spec:{config:{env:[{name:"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN",value:$img}]}}}')" echo "Waiting for Deployment to observe RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN=${KDM_PLUGIN_IMAGE}" for i in $(seq 1 60); do - CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name=='manager')].env[?(@.name=='RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN')].value}" 2>/dev/null || true) + CURRENT=$(oc get deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" -o jsonpath="{.spec.template.spec.containers[?(@.name==\"manager\")].env[?(@.name==\"RELATED_IMAGE_KUBEVIRT_DATAMOVER_PLUGIN\")].value}" 2>/dev/null || true) [ "${CURRENT}" = "${KDM_PLUGIN_IMAGE}" ] && break sleep 5 done From 33ab914a9fb2ec9f86965e65e2f1c992e3595df9 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Tue, 11 Aug 2026 10:51:52 -0400 Subject: [PATCH 08/19] Promote oadp-operator bundle directly; install via operator-sdk run bundle The promoted oadp-operator-index bakes in a reference to the bundle image from its own building job's ephemeral namespace, which becomes unreachable once that namespace is torn down - BundleUnpackFailed on rehearsal confirmed this. Promote the bundle itself instead (skip_building_index) and install it directly via operator-sdk run bundle, which needs no index/catalog at all. Also fixes a self-referential OO_INSTALL_MODE bug in the shared optional-operators-operator-sdk-non-ci-bundle-image step that silently dropped the install-mode flag for every consumer. Signed-off-by: Tiger Kaovilai --- ...ubevirt-datamover-controller-oadp-1.6.yaml | 24 ++++++++++--------- ...ubevirt-datamover-controller-oadp-dev.yaml | 24 ++++++++++--------- ...ls-kubevirt-datamover-plugin-oadp-1.6.yaml | 24 ++++++++++--------- ...ls-kubevirt-datamover-plugin-oadp-dev.yaml | 24 ++++++++++--------- .../openshift-oadp-operator-oadp-1.6.yaml | 6 +++-- .../openshift-oadp-operator-oadp-dev.yaml | 6 +++-- ...ft-oadp-operator-oadp-1.6-postsubmits.yaml | 2 +- ...ift-oadp-operator-oadp-1.6-presubmits.yaml | 12 +++++----- ...ft-oadp-operator-oadp-dev-postsubmits.yaml | 2 +- ...ift-oadp-operator-oadp-dev-presubmits.yaml | 12 +++++----- ...erator-sdk-non-ci-bundle-image-commands.sh | 2 +- 11 files changed, 75 insertions(+), 63 deletions(-) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml index 57aa6d21d7a75..47c7f2a01dbee 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml @@ -1,8 +1,4 @@ base_images: - oadp-operator-index: - name: oadp-operator-index - namespace: konveyor - tag: oadp-1.6 test-oadp-operator: name: oadp-operator-e2e-tests namespace: konveyor @@ -41,18 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws - dependencies: - OO_INDEX: oadp-operator-index env: - OO_CHANNEL: stable + OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-1.6 + OO_INSTALL_MODE: OwnNamespace OO_INSTALL_NAMESPACE: openshift-adp - OO_PACKAGE: oadp-operator - OO_TARGET_NAMESPACES: '!install' + post: + - chain: ipi-aws-post + pre: + - chain: ipi-aws-pre + - ref: optional-operators-operator-sdk-non-ci-bundle-image test: - as: set-related-image cli: latest commands: | - SUB=$(cat "${SHARED_DIR}/oo-subscription") + SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') + if [ -z "${SUB}" ]; then + echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 + exit 1 + fi + echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, # unlike patching the Deployment directly (OLM reconciles that from @@ -89,7 +92,6 @@ tests: requests: cpu: 1000m memory: 512Mi - workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-1.6 org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 8b4039404fa1a..072af29afb7c3 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -1,8 +1,4 @@ base_images: - oadp-operator-index: - name: oadp-operator-index - namespace: konveyor - tag: oadp-dev test-oadp-operator: name: oadp-operator-e2e-tests namespace: konveyor @@ -41,18 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws - dependencies: - OO_INDEX: oadp-operator-index env: - OO_CHANNEL: dev + OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-dev + OO_INSTALL_MODE: OwnNamespace OO_INSTALL_NAMESPACE: openshift-adp - OO_PACKAGE: oadp-operator - OO_TARGET_NAMESPACES: '!install' + post: + - chain: ipi-aws-post + pre: + - chain: ipi-aws-pre + - ref: optional-operators-operator-sdk-non-ci-bundle-image test: - as: set-related-image cli: latest commands: | - SUB=$(cat "${SHARED_DIR}/oo-subscription") + SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') + if [ -z "${SUB}" ]; then + echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 + exit 1 + fi + echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, # unlike patching the Deployment directly (OLM reconciles that from @@ -89,7 +92,6 @@ tests: requests: cpu: 1000m memory: 512Mi - workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-dev org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml index 357b0e4b3b5bb..f7cc955673864 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml @@ -1,8 +1,4 @@ base_images: - oadp-operator-index: - name: oadp-operator-index - namespace: konveyor - tag: oadp-1.6 test-oadp-operator: name: oadp-operator-e2e-tests namespace: konveyor @@ -41,18 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws - dependencies: - OO_INDEX: oadp-operator-index env: - OO_CHANNEL: stable + OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-1.6 + OO_INSTALL_MODE: OwnNamespace OO_INSTALL_NAMESPACE: openshift-adp - OO_PACKAGE: oadp-operator - OO_TARGET_NAMESPACES: '!install' + post: + - chain: ipi-aws-post + pre: + - chain: ipi-aws-pre + - ref: optional-operators-operator-sdk-non-ci-bundle-image test: - as: set-related-image cli: latest commands: | - SUB=$(cat "${SHARED_DIR}/oo-subscription") + SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') + if [ -z "${SUB}" ]; then + echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 + exit 1 + fi + echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, # unlike patching the Deployment directly (OLM reconciles that from @@ -89,7 +92,6 @@ tests: requests: cpu: 1000m memory: 512Mi - workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-1.6 org: migtools diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index 14aedb7acae21..a7b63599c2c93 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -1,8 +1,4 @@ base_images: - oadp-operator-index: - name: oadp-operator-index - namespace: konveyor - tag: oadp-dev test-oadp-operator: name: oadp-operator-e2e-tests namespace: konveyor @@ -41,18 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws - dependencies: - OO_INDEX: oadp-operator-index env: - OO_CHANNEL: dev + OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-dev + OO_INSTALL_MODE: OwnNamespace OO_INSTALL_NAMESPACE: openshift-adp - OO_PACKAGE: oadp-operator - OO_TARGET_NAMESPACES: '!install' + post: + - chain: ipi-aws-post + pre: + - chain: ipi-aws-pre + - ref: optional-operators-operator-sdk-non-ci-bundle-image test: - as: set-related-image cli: latest commands: | - SUB=$(cat "${SHARED_DIR}/oo-subscription") + SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') + if [ -z "${SUB}" ]; then + echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 + exit 1 + fi + echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, # unlike patching the Deployment directly (OLM reconciles that from @@ -89,7 +92,6 @@ tests: requests: cpu: 1000m memory: 512Mi - workflow: optional-operators-ci-aws zz_generated_metadata: branch: oadp-dev org: migtools diff --git a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml index be749c95d0374..30e36950eba5c 100644 --- a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml +++ b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6.yaml @@ -13,7 +13,9 @@ images: to: test-oadp-operator operator: bundles: - - dockerfile_path: build/Dockerfile.bundle + - as: oadp-operator-bundle + dockerfile_path: build/Dockerfile.bundle + skip_building_index: true promotion: to: - excluded_images: @@ -21,8 +23,8 @@ promotion: name: oadp-operator namespace: konveyor - additional_images: + oadp-operator-bundle: oadp-operator-bundle oadp-operator-e2e-tests: test-oadp-operator - oadp-operator-index: ci-index namespace: konveyor tag: oadp-1.6 resources: diff --git a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml index 6b3863b6fe8b4..b9be0fa4f907c 100644 --- a/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml +++ b/ci-operator/config/openshift/oadp-operator/openshift-oadp-operator-oadp-dev.yaml @@ -13,7 +13,9 @@ images: to: test-oadp-operator operator: bundles: - - dockerfile_path: build/Dockerfile.bundle + - as: oadp-operator-bundle + dockerfile_path: build/Dockerfile.bundle + skip_building_index: true promotion: to: - excluded_images: @@ -21,8 +23,8 @@ promotion: name: oadp-operator namespace: konveyor - additional_images: + oadp-operator-bundle: oadp-operator-bundle oadp-operator-e2e-tests: test-oadp-operator - oadp-operator-index: ci-index namespace: konveyor tag: oadp-dev resources: diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-postsubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-postsubmits.yaml index 0890fd1aa182d..a4ffc5f7b86e6 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-postsubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-postsubmits.yaml @@ -25,7 +25,7 @@ postsubmits: - --promote - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=ci-index + - --target=oadp-operator-bundle - --target=test-oadp-operator command: - ci-operator diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-presubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-presubmits.yaml index 8d0800ecf3ad3..456f72e5b6a0c 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-presubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-1.6-presubmits.yaml @@ -1894,7 +1894,7 @@ presubmits: - ^oadp-1\.6$ - ^oadp-1\.6- cluster: build01 - context: ci/prow/ci-index + context: ci/prow/ci-bundle-oadp-operator-bundle decorate: true decoration_config: sparse_checkout_files: @@ -1903,15 +1903,15 @@ presubmits: labels: ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-oadp-operator-oadp-1.6-ci-index - rerun_command: /test ci-index + name: pull-ci-openshift-oadp-operator-oadp-1.6-ci-bundle-oadp-operator-bundle + rerun_command: /test ci-bundle-oadp-operator-bundle spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --report-credentials-file=/etc/report/credentials - - --target=ci-index + - --target=oadp-operator-bundle command: - ci-operator image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest @@ -1944,7 +1944,7 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )ci-index,?($|\s.*) + trigger: (?m)^/test( | .* )ci-bundle-oadp-operator-bundle,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1970,7 +1970,7 @@ presubmits: - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=ci-index + - --target=oadp-operator-bundle - --target=test-oadp-operator command: - ci-operator diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml index 1e20a7fdb62b1..4aed8eb33a8e7 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-postsubmits.yaml @@ -25,7 +25,7 @@ postsubmits: - --promote - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=ci-index + - --target=oadp-operator-bundle - --target=test-oadp-operator command: - ci-operator diff --git a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml index 3b9e724bb7536..49c938f9f7380 100644 --- a/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml +++ b/ci-operator/jobs/openshift/oadp-operator/openshift-oadp-operator-oadp-dev-presubmits.yaml @@ -1369,7 +1369,7 @@ presubmits: - ^oadp-dev$ - ^oadp-dev- cluster: build05 - context: ci/prow/ci-index + context: ci/prow/ci-bundle-oadp-operator-bundle decorate: true decoration_config: sparse_checkout_files: @@ -1378,15 +1378,15 @@ presubmits: labels: ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-oadp-operator-oadp-dev-ci-index - rerun_command: /test ci-index + name: pull-ci-openshift-oadp-operator-oadp-dev-ci-bundle-oadp-operator-bundle + rerun_command: /test ci-bundle-oadp-operator-bundle spec: containers: - args: - --gcs-upload-secret=/secrets/gcs/service-account.json - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --report-credentials-file=/etc/report/credentials - - --target=ci-index + - --target=oadp-operator-bundle command: - ci-operator image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest @@ -1419,7 +1419,7 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )ci-index,?($|\s.*) + trigger: (?m)^/test( | .* )ci-bundle-oadp-operator-bundle,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1445,7 +1445,7 @@ presubmits: - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --report-credentials-file=/etc/report/credentials - --target=[images] - - --target=ci-index + - --target=oadp-operator-bundle - --target=test-oadp-operator command: - ci-operator diff --git a/ci-operator/step-registry/optional-operators/operator-sdk/non-ci-bundle-image/optional-operators-operator-sdk-non-ci-bundle-image-commands.sh b/ci-operator/step-registry/optional-operators/operator-sdk/non-ci-bundle-image/optional-operators-operator-sdk-non-ci-bundle-image-commands.sh index 88cb5d7c467fe..70b8e2a6274ec 100755 --- a/ci-operator/step-registry/optional-operators/operator-sdk/non-ci-bundle-image/optional-operators-operator-sdk-non-ci-bundle-image-commands.sh +++ b/ci-operator/step-registry/optional-operators/operator-sdk/non-ci-bundle-image/optional-operators-operator-sdk-non-ci-bundle-image-commands.sh @@ -63,7 +63,7 @@ fi INSTALL_MODE_ARG="" if [[ -n ${OO_INSTALL_MODE} ]]; then - INSTALL_MODE_ARG=--install-mode="${INSTALL_MODE_ARG}" + INSTALL_MODE_ARG=--install-mode="${OO_INSTALL_MODE}" fi ( cd /tmp From 1ef79291b9065b911871a9988667fe13644c41a7 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Tue, 11 Aug 2026 11:30:23 -0400 Subject: [PATCH 09/19] Dump Subscription/CSV on set-related-image timeout for diagnosis If the Deployment env poll times out, we can't yet tell whether OLM failed to propagate Subscription.spec.config.env to an already-Succeeded CSV (the likely cause) versus the Subscription patch having gone to the wrong object. Capture both objects as artifacts so a re-run isn't needed to distinguish them. Signed-off-by: Tiger Kaovilai --- .../migtools-kubevirt-datamover-controller-oadp-1.6.yaml | 2 ++ .../migtools-kubevirt-datamover-controller-oadp-dev.yaml | 2 ++ .../migtools-kubevirt-datamover-plugin-oadp-1.6.yaml | 2 ++ .../migtools-kubevirt-datamover-plugin-oadp-dev.yaml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml index 47c7f2a01dbee..19541bdc52687 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml @@ -69,6 +69,8 @@ tests: done if [ "${CURRENT}" != "${KDM_CONTROLLER_IMAGE}" ]; then echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + oc get subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/subscription-${SUB}.yaml" || true + oc get csv -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/csvs.yaml" || true exit 1 fi oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index 072af29afb7c3..d57361ac25c3b 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -69,6 +69,8 @@ tests: done if [ "${CURRENT}" != "${KDM_CONTROLLER_IMAGE}" ]; then echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + oc get subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/subscription-${SUB}.yaml" || true + oc get csv -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/csvs.yaml" || true exit 1 fi oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml index f7cc955673864..0fc39b7a8652c 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml @@ -69,6 +69,8 @@ tests: done if [ "${CURRENT}" != "${KDM_PLUGIN_IMAGE}" ]; then echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + oc get subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/subscription-${SUB}.yaml" || true + oc get csv -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/csvs.yaml" || true exit 1 fi oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index a7b63599c2c93..01232b1c71bcf 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -69,6 +69,8 @@ tests: done if [ "${CURRENT}" != "${KDM_PLUGIN_IMAGE}" ]; then echo "Timed out waiting for Deployment spec to reflect the Subscription.spec.config.env override" >&2 + oc get subscription "${SUB}" -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/subscription-${SUB}.yaml" || true + oc get csv -n "${OO_INSTALL_NAMESPACE}" -o yaml > "${ARTIFACT_DIR}/csvs.yaml" || true exit 1 fi oc rollout status deployment/openshift-adp-controller-manager -n "${OO_INSTALL_NAMESPACE}" --timeout=180s From 2aeb6004949d2f5bad139f311b8dace4abe1b25d Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 00:39:12 -0400 Subject: [PATCH 10/19] Migrate KDM e2e install off operator-sdk run bundle (PSA-restricted risk) operator-sdk run bundle spins up its own registry/grpc pod to serve the bundle to OLM, and that pod's containers don't reliably get a PodSecurity "restricted"-compliant securityContext on all containers even with --security-context-config=restricted passed (operator-framework/operator-sdk#7040, open upstream). oadp-operator's own team hit this deterministically on OCP 4.21 and abandoned operator-sdk run bundle entirely in their own deploy-olm Makefile target (openshift/oadp-operator#2078), switching to a real opm catalog + CatalogSource (with grpcPodConfig.securityContextConfig: restricted) + OperatorGroup + Subscription instead -- exactly what this repo's optional-operators-subscribe step already implements correctly. Add a new step-registry step, optional-operators-opm-index-from-bundle, that builds a fresh opm sqlite index from an already-promoted bundle image (OO_BUNDLE) using opm index add + rootless umoci/skopeo assembly (no podman/buildah, no daemon), pushes it to this job's own namespace on the CI registry (reachable externally for the job's lifetime, same profile OO_BUNDLE itself already proves works), and writes the resulting pullspec to ${SHARED_DIR}/oo-index-pullspec. Patch optional-operators-subscribe-commands.sh to read that file as an OO_INDEX override, mirroring its existing SHARED_DIR override pattern for OO_INSTALL_NAMESPACE -- fully backward compatible for every other current consumer of this step. Switch the 4 KDM (kubevirt-datamover-controller/plugin x oadp-dev/1.6) consuming configs from optional-operators-operator-sdk-non-ci-bundle-image back to optional-operators-subscribe, restoring OO_PACKAGE/OO_CHANNEL/ OO_TARGET_NAMESPACES from the original pre-operator-sdk-pivot config. Revert set-related-image's Subscription discovery to read ${SHARED_DIR}/oo-subscription directly, since optional-operators-subscribe (unlike operator-sdk run bundle) already writes it. A placeholder `dependencies: {OO_INDEX: src}` is needed in each config purely to satisfy ci-operator's static validation of optional-operators-subscribe-ref.yaml's own declared `ci-index` dependency -- the actual value is overwritten by the SHARED_DIR read above before use. Signed-off-by: Tiger Kaovilai --- ...ubevirt-datamover-controller-oadp-1.6.yaml | 15 +++-- ...ubevirt-datamover-controller-oadp-dev.yaml | 15 +++-- ...ls-kubevirt-datamover-plugin-oadp-1.6.yaml | 15 +++-- ...ls-kubevirt-datamover-plugin-oadp-dev.yaml | 15 +++-- .../opm-index-from-bundle/OWNERS | 28 ++++++++ ...perators-opm-index-from-bundle-commands.sh | 67 +++++++++++++++++++ ...rs-opm-index-from-bundle-ref.metadata.json | 35 ++++++++++ ...l-operators-opm-index-from-bundle-ref.yaml | 34 ++++++++++ .../optional-operators-subscribe-commands.sh | 4 ++ 9 files changed, 200 insertions(+), 28 deletions(-) create mode 100644 ci-operator/step-registry/optional-operators/opm-index-from-bundle/OWNERS create mode 100644 ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh create mode 100644 ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.metadata.json create mode 100644 ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.yaml diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml index 19541bdc52687..34a8965fb3fb8 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-1.6.yaml @@ -37,24 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: src env: OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-1.6 - OO_INSTALL_MODE: OwnNamespace + OO_CHANNEL: stable OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' post: - chain: ipi-aws-post pre: - chain: ipi-aws-pre - - ref: optional-operators-operator-sdk-non-ci-bundle-image + - ref: optional-operators-opm-index-from-bundle + - ref: optional-operators-subscribe test: - as: set-related-image cli: latest commands: | - SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') - if [ -z "${SUB}" ]; then - echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 - exit 1 - fi + SUB=$(cat "${SHARED_DIR}/oo-subscription") echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, diff --git a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml index d57361ac25c3b..8c196afc30f6b 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-controller/migtools-kubevirt-datamover-controller-oadp-dev.yaml @@ -37,24 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: src env: OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-dev - OO_INSTALL_MODE: OwnNamespace + OO_CHANNEL: dev OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' post: - chain: ipi-aws-post pre: - chain: ipi-aws-pre - - ref: optional-operators-operator-sdk-non-ci-bundle-image + - ref: optional-operators-opm-index-from-bundle + - ref: optional-operators-subscribe test: - as: set-related-image cli: latest commands: | - SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') - if [ -z "${SUB}" ]; then - echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 - exit 1 - fi + SUB=$(cat "${SHARED_DIR}/oo-subscription") echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml index 0fc39b7a8652c..41dbb9303350c 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-1.6.yaml @@ -37,24 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: src env: OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-1.6 - OO_INSTALL_MODE: OwnNamespace + OO_CHANNEL: stable OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' post: - chain: ipi-aws-post pre: - chain: ipi-aws-pre - - ref: optional-operators-operator-sdk-non-ci-bundle-image + - ref: optional-operators-opm-index-from-bundle + - ref: optional-operators-subscribe test: - as: set-related-image cli: latest commands: | - SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') - if [ -z "${SUB}" ]; then - echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 - exit 1 - fi + SUB=$(cat "${SHARED_DIR}/oo-subscription") echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, diff --git a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml index 01232b1c71bcf..54867d34edcc7 100644 --- a/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml +++ b/ci-operator/config/migtools/kubevirt-datamover-plugin/migtools-kubevirt-datamover-plugin-oadp-dev.yaml @@ -37,24 +37,25 @@ tests: run_if_changed: .+\.go|go\.(\bmod\b|\bsum\b)|Makefile|Dockerfile|.dockerignore|.*\.ya{0,1}ml|.sh steps: cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: src env: OO_BUNDLE: registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-dev - OO_INSTALL_MODE: OwnNamespace + OO_CHANNEL: dev OO_INSTALL_NAMESPACE: openshift-adp + OO_PACKAGE: oadp-operator + OO_TARGET_NAMESPACES: '!install' post: - chain: ipi-aws-post pre: - chain: ipi-aws-pre - - ref: optional-operators-operator-sdk-non-ci-bundle-image + - ref: optional-operators-opm-index-from-bundle + - ref: optional-operators-subscribe test: - as: set-related-image cli: latest commands: | - SUB=$(oc get subscription -n "${OO_INSTALL_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}') - if [ -z "${SUB}" ]; then - echo "No Subscription found in namespace ${OO_INSTALL_NAMESPACE}" >&2 - exit 1 - fi + SUB=$(cat "${SHARED_DIR}/oo-subscription") echo "Discovered Subscription: ${SUB}" # Subscription.spec.config.env is OLM's supported override mechanism: # it wins over same-named CSV env vars and survives reconciliation, diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/OWNERS b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/OWNERS new file mode 100644 index 0000000000000..a75d770dc3db3 --- /dev/null +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/OWNERS @@ -0,0 +1,28 @@ +approvers: +- dirgim +- jsztuka +- 14rcole +- maneeshmehra +- yashvardhannanavati +- nmars +- sonam1412 +- asergienk +reviewers: +- anik120 +- awgreene +- benluddy +- Bowenislandsong +- dinhxuanvu +- ecordell +- exdx +- gallettilance +- kevinrizza +- njhale +- dirgim +- jsztuka +- 14rcole +- nmars +- maneeshmehra +- yashvardhannanavati +- sonam1412 +- asergienk diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh new file mode 100644 index 0000000000000..05c029ef25787 --- /dev/null +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +set -o nounset +set -o errexit +set -o pipefail + +# For disconnected or otherwise unreachable environments, we want to +# have steps use an HTTP(S) proxy to reach the API server. This proxy +# configuration file should export HTTP_PROXY, HTTPS_PROXY, and NO_PROXY +# environment variables, as well as their lowercase equivalents (note +# that libcurl doesn't recognize the uppercase variables). +if test -f "${SHARED_DIR}/proxy-conf.sh" +then + # shellcheck disable=SC1090 + source "${SHARED_DIR}/proxy-conf.sh" +fi + +echo "[$(date --utc +%FT%T.%3NZ)] == Parameters:" +echo "[$(date --utc +%FT%T.%3NZ)] OO_BUNDLE: $OO_BUNDLE" +echo "[$(date --utc +%FT%T.%3NZ)] OPM_BASE_IMAGE: $OPM_BASE_IMAGE" + +TOOLS_DIR=/tmp/bin +mkdir -p "${TOOLS_DIR}" +export PATH="${TOOLS_DIR}:${PATH}" + +echo "[$(date --utc +%FT%T.%3NZ)] Installing opm" +curl -sL --retry 5 https://github.com/operator-framework/operator-registry/releases/download/v1.26.2/linux-amd64-opm -o "${TOOLS_DIR}/opm" && chmod +x "${TOOLS_DIR}/opm" + +echo "[$(date --utc +%FT%T.%3NZ)] Installing umoci" +curl -sL --retry 5 https://github.com/opencontainers/umoci/releases/download/v0.4.7/umoci.amd64 -o "${TOOLS_DIR}/umoci" && chmod +x "${TOOLS_DIR}/umoci" + +echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" +dnf install -y skopeo + +echo "[$(date --utc +%FT%T.%3NZ)] Logging in to the internal registry" +KUBECONFIG="" oc registry login + +INDEX_DESTINATION="registry.ci.openshift.org/${NAMESPACE}/oadp-operator-index:latest" + +tmp=$(mktemp -d) +cd "${tmp}" + +echo "[$(date --utc +%FT%T.%3NZ)] Generating index database from bundle ${OO_BUNDLE}" +opm index add \ + --bundles "${OO_BUNDLE}" \ + --out-dockerfile index.Dockerfile \ + --generate + +echo "[$(date --utc +%FT%T.%3NZ)] Assembling index image from ${OPM_BASE_IMAGE}" +skopeo copy "docker://${OPM_BASE_IMAGE}" oci:opm:latest +umoci unpack --rootless --image opm:latest bundle +mv database bundle/rootfs/ +umoci repack --image opm:index bundle +umoci config --config.label 'operators.operatorframework.io.index.database.v1=/database/index.db' --image opm:index +umoci config --config.exposedports "50051" --image opm:index +umoci config --config.entrypoint "/bin/opm" --image opm:index +umoci config --config.cmd "registry" \ + --config.cmd "serve" \ + --config.cmd "--database" \ + --config.cmd "/database/index.db" \ + --image opm:index + +echo "[$(date --utc +%FT%T.%3NZ)] Publishing index to ${INDEX_DESTINATION}" +skopeo copy oci:opm:index "docker://${INDEX_DESTINATION}" + +echo "${INDEX_DESTINATION}" > "${SHARED_DIR}/oo-index-pullspec" +echo "[$(date --utc +%FT%T.%3NZ)] Wrote index pullspec to \${SHARED_DIR}/oo-index-pullspec: ${INDEX_DESTINATION}" diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.metadata.json b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.metadata.json new file mode 100644 index 0000000000000..a6526a1ca6e4d --- /dev/null +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.metadata.json @@ -0,0 +1,35 @@ +{ + "path": "optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.yaml", + "owners": { + "approvers": [ + "dirgim", + "jsztuka", + "14rcole", + "maneeshmehra", + "yashvardhannanavati", + "nmars", + "sonam1412", + "asergienk" + ], + "reviewers": [ + "anik120", + "awgreene", + "benluddy", + "Bowenislandsong", + "dinhxuanvu", + "ecordell", + "exdx", + "gallettilance", + "kevinrizza", + "njhale", + "dirgim", + "jsztuka", + "14rcole", + "nmars", + "maneeshmehra", + "yashvardhannanavati", + "sonam1412", + "asergienk" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.yaml b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.yaml new file mode 100644 index 0000000000000..e4f222433931b --- /dev/null +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-ref.yaml @@ -0,0 +1,34 @@ +ref: + as: optional-operators-opm-index-from-bundle + from: cli + commands: optional-operators-opm-index-from-bundle-commands.sh + resources: + requests: + cpu: 300m + memory: 300Mi + env: + - name: OO_BUNDLE + documentation: |- + Pullspec of an already-existing (e.g. cross-repo promoted) operator + bundle image to build a fresh index from. Required. + - name: OPM_BASE_IMAGE + documentation: |- + The base opm image to assemble the generated index database into. + default: "quay.io/operator-framework/opm:latest" + documentation: |- + Builds a fresh opm sqlite index image from an already-existing bundle + image (`OO_BUNDLE`) using `opm index add` plus rootless `umoci`/`skopeo` + image assembly (no podman/buildah, no daemon), pushes it to this job's + own namespace on the CI registry (reachable externally for the + lifetime of the job), and writes the resulting pullspec to + `${SHARED_DIR}/oo-index-pullspec` for `optional-operators-subscribe` + to consume as `OO_INDEX`. + + Use this instead of `operator-sdk run bundle` when installing from a + bundle that isn't paired with a promoted index: `operator-sdk run + bundle`'s own internal registry pod does not reliably get a + PodSecurity "restricted"-compliant securityContext on all its + containers (operator-framework/operator-sdk#7040, open upstream), + which can be rejected by namespaces enforcing PSA "restricted". + `optional-operators-subscribe`'s CatalogSource does not have this + problem (it sets `grpcPodConfig.securityContextConfig: restricted`). diff --git a/ci-operator/step-registry/optional-operators/subscribe/optional-operators-subscribe-commands.sh b/ci-operator/step-registry/optional-operators/subscribe/optional-operators-subscribe-commands.sh index d4be44e48d2b9..5570a076be6e1 100755 --- a/ci-operator/step-registry/optional-operators/subscribe/optional-operators-subscribe-commands.sh +++ b/ci-operator/step-registry/optional-operators/subscribe/optional-operators-subscribe-commands.sh @@ -166,6 +166,10 @@ if [ -n "${INITIAL_CHANNEL}" ]; then OO_CHANNEL="${INITIAL_CHANNEL}" fi +if [[ -f "${SHARED_DIR}/oo-index-pullspec" ]]; then + OO_INDEX=$(cat "${SHARED_DIR}/oo-index-pullspec") +fi + if [[ $JOB_NAME != rehearse-* ]]; then if [[ -z ${OO_INDEX:-} ]] || [[ -z ${OO_PACKAGE:-} ]] || [[ -z ${OO_CHANNEL:-} ]]; then echo "[$(date --utc +%FT%T.%3NZ)] At least of required variables OO_INDEX=${OO_INDEX:-} OO_PACKAGE=${OO_PACKAGE:-} OO_CHANNEL=${OO_CHANNEL:-} is unset" From 6140dcbf93c9c9c96dc1cde336014c67b6211bf1 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 02:11:01 -0400 Subject: [PATCH 11/19] opm-index-from-bundle: use oc image extract for skopeo, not dnf dnf install -y skopeo fails in the step pod's non-root user: error: Failed to create: /var/cache/yum/metadata Confirmed on an actual rehearsal run (kubevirt-datamover-plugin oadp-dev e2e-test-aws). Extract a pre-built skopeo binary directly from the public quay.io/skopeo/stable image instead, via oc image extract -- the same established pattern already used by hypershift-install-commands.sh, aws-load-balancer-pre-install-rosa-commands.sh, and the cucushift upgrade steps for pulling a single binary (ccoctl, hypershift) out of an image without needing package management or root. Signed-off-by: Tiger Kaovilai --- .../optional-operators-opm-index-from-bundle-commands.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 05c029ef25787..892c3cd470421 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -30,7 +30,8 @@ echo "[$(date --utc +%FT%T.%3NZ)] Installing umoci" curl -sL --retry 5 https://github.com/opencontainers/umoci/releases/download/v0.4.7/umoci.amd64 -o "${TOOLS_DIR}/umoci" && chmod +x "${TOOLS_DIR}/umoci" echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" -dnf install -y skopeo +oc image extract quay.io/skopeo/stable:latest --path /usr/bin/skopeo:"${TOOLS_DIR}" --filter-by-os="linux/amd64" --confirm +chmod +x "${TOOLS_DIR}/skopeo" echo "[$(date --utc +%FT%T.%3NZ)] Logging in to the internal registry" KUBECONFIG="" oc registry login From d933570867d80328a4ccdbc81306b9e3d8d79bb1 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 03:34:35 -0400 Subject: [PATCH 12/19] opm-index-from-bundle: use writable auth file for registry login oc registry login's default write location (/run/containers/...) isn't writable by the step pod's non-root user: error: mkdir /run/containers: permission denied Confirmed on an actual rehearsal run (kubevirt-datamover-plugin oadp-dev e2e-test-aws) -- opm/umoci/skopeo installation all succeeded this time, this was the next blocker. Pass an explicit writable --to= path and reuse it via skopeo's --authfile flag for both copy invocations, matching the existing --to="${auth_file}" pattern already used elsewhere in this repo (quay-omr-v3-install-commands.sh and others). Signed-off-by: Tiger Kaovilai --- .../optional-operators-opm-index-from-bundle-commands.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 892c3cd470421..46aba94500ace 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -34,7 +34,8 @@ oc image extract quay.io/skopeo/stable:latest --path /usr/bin/skopeo:"${TOOLS_DI chmod +x "${TOOLS_DIR}/skopeo" echo "[$(date --utc +%FT%T.%3NZ)] Logging in to the internal registry" -KUBECONFIG="" oc registry login +AUTH_FILE=/tmp/oo-index-auth.json +KUBECONFIG="" oc registry login --to="${AUTH_FILE}" INDEX_DESTINATION="registry.ci.openshift.org/${NAMESPACE}/oadp-operator-index:latest" @@ -48,7 +49,7 @@ opm index add \ --generate echo "[$(date --utc +%FT%T.%3NZ)] Assembling index image from ${OPM_BASE_IMAGE}" -skopeo copy "docker://${OPM_BASE_IMAGE}" oci:opm:latest +skopeo copy --authfile="${AUTH_FILE}" "docker://${OPM_BASE_IMAGE}" oci:opm:latest umoci unpack --rootless --image opm:latest bundle mv database bundle/rootfs/ umoci repack --image opm:index bundle @@ -62,7 +63,7 @@ umoci config --config.cmd "registry" \ --image opm:index echo "[$(date --utc +%FT%T.%3NZ)] Publishing index to ${INDEX_DESTINATION}" -skopeo copy oci:opm:index "docker://${INDEX_DESTINATION}" +skopeo copy --authfile="${AUTH_FILE}" oci:opm:index "docker://${INDEX_DESTINATION}" echo "${INDEX_DESTINATION}" > "${SHARED_DIR}/oo-index-pullspec" echo "[$(date --utc +%FT%T.%3NZ)] Wrote index pullspec to \${SHARED_DIR}/oo-index-pullspec: ${INDEX_DESTINATION}" From 211796de4688e8e7e43f06ca6d1befc151c10a47 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 05:06:13 -0400 Subject: [PATCH 13/19] opm-index-from-bundle: fix registry hostname mismatch and OO_BUNDLE auth Confirmed on an actual rehearsal run (kubevirt-datamover-controller oadp-dev e2e-test-aws): opm index add failed to resolve OO_BUNDLE (registry.ci.openshift.org/konveyor/oadp-operator-bundle:oadp-dev) with "not found" -- oc registry login only authenticates against whatever THIS build-farm cluster's own registry route is (registry.build11.ci.openshift.org in that run), which is unrelated to registry.ci.openshift.org, the separate cross-cluster/cross-repo registry hosting the promoted bundle. Two separate fixes: 1. Extract the TEST cluster's own global pull secret (secret/pull-secret in openshift-config, via the default KUBECONFIG at this point in the pre chain, which already points at the test cluster) and export it as REGISTRY_AUTH_FILE, the standard env var opm's underlying containers/image library respects. This is the same pull secret operator-sdk run bundle already successfully used to pull this exact OO_BUNDLE pullspec in the prior design. 2. Read the actual authenticated hostname back out of oc registry login's own auth file (jq '.auths | keys[0]') instead of hardcoding registry.ci.openshift.org for INDEX_DESTINATION -- the two are not interchangeable, and the hardcoded value would have broken the later publish step too even once the pull was fixed. Signed-off-by: Tiger Kaovilai --- .../optional-operators-opm-index-from-bundle-commands.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 46aba94500ace..14a99293f4413 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -33,11 +33,16 @@ echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" oc image extract quay.io/skopeo/stable:latest --path /usr/bin/skopeo:"${TOOLS_DIR}" --filter-by-os="linux/amd64" --confirm chmod +x "${TOOLS_DIR}/skopeo" -echo "[$(date --utc +%FT%T.%3NZ)] Logging in to the internal registry" +echo "[$(date --utc +%FT%T.%3NZ)] Extracting the test cluster's own global pull secret (needed to pull OO_BUNDLE from registry.ci.openshift.org)" +oc extract secret/pull-secret -n openshift-config --confirm --to /tmp +export REGISTRY_AUTH_FILE=/tmp/.dockerconfigjson + +echo "[$(date --utc +%FT%T.%3NZ)] Logging in to this job's own build-farm registry namespace" AUTH_FILE=/tmp/oo-index-auth.json KUBECONFIG="" oc registry login --to="${AUTH_FILE}" +REGISTRY_HOST=$(jq -r '.auths | keys[0]' "${AUTH_FILE}") -INDEX_DESTINATION="registry.ci.openshift.org/${NAMESPACE}/oadp-operator-index:latest" +INDEX_DESTINATION="${REGISTRY_HOST}/${NAMESPACE}/oadp-operator-index:latest" tmp=$(mktemp -d) cd "${tmp}" From d602949780a0d1862a238e3fa459df6eeff730ce Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 06:31:40 -0400 Subject: [PATCH 14/19] opm-index-from-bundle: install jq (missing from cli base image) Confirmed on an actual rehearsal run (kubevirt-datamover-plugin oadp-dev e2e-test-aws): oc extract + oc registry login both succeeded this time, but the subsequent jq call to read the registry hostname back out of the auth file failed with "jq: command not found" -- the cli base image doesn't ship jq. Install it the same way as opm/umoci in this same script (and the same way gather-extra-commands.sh already does elsewhere in this repo): a static jq-1.6 binary via curl into TOOLS_DIR. Signed-off-by: Tiger Kaovilai --- .../optional-operators-opm-index-from-bundle-commands.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 14a99293f4413..47e4597e49045 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -33,6 +33,9 @@ echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" oc image extract quay.io/skopeo/stable:latest --path /usr/bin/skopeo:"${TOOLS_DIR}" --filter-by-os="linux/amd64" --confirm chmod +x "${TOOLS_DIR}/skopeo" +echo "[$(date --utc +%FT%T.%3NZ)] Installing jq" +curl -sL --retry 5 https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -o "${TOOLS_DIR}/jq" && chmod +x "${TOOLS_DIR}/jq" + echo "[$(date --utc +%FT%T.%3NZ)] Extracting the test cluster's own global pull secret (needed to pull OO_BUNDLE from registry.ci.openshift.org)" oc extract secret/pull-secret -n openshift-config --confirm --to /tmp export REGISTRY_AUTH_FILE=/tmp/.dockerconfigjson From 176b54d7106c5cdc0d7d45da23dcd1fcf32f4b58 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 08:00:28 -0400 Subject: [PATCH 15/19] opm-index-from-bundle: mirror bundle into own namespace before opm pull Confirmed on an actual rehearsal run (kubevirt-datamover-controller oadp-1.6 e2e-test-aws): opm index add still failed to resolve OO_BUNDLE from registry.ci.openshift.org/konveyor/... even after exporting REGISTRY_AUTH_FILE to the extracted cluster-wide pull secret -- operator-registry issue #935 notes opm's in-process containerd-based registry client has had auth-handling quirks distinct from podman/skopeo, particularly with complex multi-entry auth files (the cluster-wide pull-secret merges many registries' credentials). Sidestep this entirely: skopeo (already proven working, with explicit --src-authfile/--dest-authfile) mirrors OO_BUNDLE into this job's own, single-entry-auth build-farm namespace first, then opm index add pulls from that simpler, already-authenticated destination instead of touching registry.ci.openshift.org directly. Signed-off-by: Tiger Kaovilai --- ...ional-operators-opm-index-from-bundle-commands.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 47e4597e49045..294743ef5b9c1 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -38,7 +38,7 @@ curl -sL --retry 5 https://github.com/stedolan/jq/releases/download/jq-1.6/jq-li echo "[$(date --utc +%FT%T.%3NZ)] Extracting the test cluster's own global pull secret (needed to pull OO_BUNDLE from registry.ci.openshift.org)" oc extract secret/pull-secret -n openshift-config --confirm --to /tmp -export REGISTRY_AUTH_FILE=/tmp/.dockerconfigjson +BUNDLE_AUTH_FILE=/tmp/.dockerconfigjson echo "[$(date --utc +%FT%T.%3NZ)] Logging in to this job's own build-farm registry namespace" AUTH_FILE=/tmp/oo-index-auth.json @@ -46,13 +46,19 @@ KUBECONFIG="" oc registry login --to="${AUTH_FILE}" REGISTRY_HOST=$(jq -r '.auths | keys[0]' "${AUTH_FILE}") INDEX_DESTINATION="${REGISTRY_HOST}/${NAMESPACE}/oadp-operator-index:latest" +BUNDLE_MIRROR="${REGISTRY_HOST}/${NAMESPACE}/oadp-operator-bundle-mirror:latest" tmp=$(mktemp -d) cd "${tmp}" -echo "[$(date --utc +%FT%T.%3NZ)] Generating index database from bundle ${OO_BUNDLE}" +echo "[$(date --utc +%FT%T.%3NZ)] Mirroring ${OO_BUNDLE} to ${BUNDLE_MIRROR}" +echo "[$(date --utc +%FT%T.%3NZ)] opm's own pull mechanism does not reliably authenticate against registry.ci.openshift.org, so mirror the bundle into this job's own (already-authenticated) build-farm namespace first, and have opm pull from there instead" +skopeo copy --src-authfile="${BUNDLE_AUTH_FILE}" --dest-authfile="${AUTH_FILE}" "docker://${OO_BUNDLE}" "docker://${BUNDLE_MIRROR}" + +echo "[$(date --utc +%FT%T.%3NZ)] Generating index database from bundle ${BUNDLE_MIRROR}" +export REGISTRY_AUTH_FILE="${AUTH_FILE}" opm index add \ - --bundles "${OO_BUNDLE}" \ + --bundles "${BUNDLE_MIRROR}" \ --out-dockerfile index.Dockerfile \ --generate From f15372ada8cfdcf4544a483afd3ea973dd37de62 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 09:33:15 -0400 Subject: [PATCH 16/19] opm-index-from-bundle: install skopeo via dnf, not extracted binary Confirmed on an actual rehearsal run (kubevirt-datamover-controller oadp-dev e2e-test-aws): the skopeo binary extracted via oc image extract from quay.io/skopeo/stable is dynamically linked and fails immediately at its first invocation: skopeo: error while loading shared libraries: libsubid.so.5: cannot open shared object file: No such file or directory Extracting just the binary (not its shared-library dependencies) from a foreign image doesn't work for a dynamically-linked binary. dnf install -y skopeo pulls in the correct dependency chain automatically, but plain dnf install failed earlier in this same script's iteration with "Failed to create: /var/cache/yum/metadata" (the non-root step-pod user can't write there). Redirect only dnf's own cache directory to /tmp via --setopt=cachedir, leaving the actual package install at its normal system paths (/usr/bin, /usr/lib64, etc, which appear to be writable, unlike /var/cache specifically). Signed-off-by: Tiger Kaovilai --- .../optional-operators-opm-index-from-bundle-commands.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 294743ef5b9c1..8177199f5c096 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -30,8 +30,7 @@ echo "[$(date --utc +%FT%T.%3NZ)] Installing umoci" curl -sL --retry 5 https://github.com/opencontainers/umoci/releases/download/v0.4.7/umoci.amd64 -o "${TOOLS_DIR}/umoci" && chmod +x "${TOOLS_DIR}/umoci" echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" -oc image extract quay.io/skopeo/stable:latest --path /usr/bin/skopeo:"${TOOLS_DIR}" --filter-by-os="linux/amd64" --confirm -chmod +x "${TOOLS_DIR}/skopeo" +dnf install -y --setopt=cachedir=/tmp/dnf-cache skopeo echo "[$(date --utc +%FT%T.%3NZ)] Installing jq" curl -sL --retry 5 https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -o "${TOOLS_DIR}/jq" && chmod +x "${TOOLS_DIR}/jq" From 144adae7f3be9ee1607b2ff6d6e5b11fcc1a878a Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 10:59:11 -0400 Subject: [PATCH 17/19] opm-index-from-bundle: extract whole skopeo image, fix LD_LIBRARY_PATH Confirmed on an actual rehearsal run (kubevirt-datamover-plugin oadp-1.6 e2e-test-aws): dnf install -y --setopt=cachedir=/tmp/dnf-cache skopeo still failed identically to plain dnf install ("Failed to create: /var/cache/yum/metadata") -- the cachedir override wasn't honored (this dnf/yum appears to hardcode that path via config, unaffected by the CLI setopt). Rather than keep chasing dnf/yum permission quirks, or extracting just the binary again (which failed at runtime on a missing shared library, libsubid.so.5, not present in this image), extract the ENTIRE quay.io/skopeo/stable filesystem via oc image extract --path /:..., and wrap the binary with a small script that points LD_LIBRARY_PATH at that same extracted tree's own lib directories. This guarantees every runtime dependency comes from one single, official, already-trusted source, instead of chasing missing .so files one at a time or depending on an unofficial third-party static build. Signed-off-by: Tiger Kaovilai --- ...tional-operators-opm-index-from-bundle-commands.sh | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 8177199f5c096..19449434324ec 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -30,7 +30,16 @@ echo "[$(date --utc +%FT%T.%3NZ)] Installing umoci" curl -sL --retry 5 https://github.com/opencontainers/umoci/releases/download/v0.4.7/umoci.amd64 -o "${TOOLS_DIR}/umoci" && chmod +x "${TOOLS_DIR}/umoci" echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" -dnf install -y --setopt=cachedir=/tmp/dnf-cache skopeo +echo "[$(date --utc +%FT%T.%3NZ)] dnf/yum install fails in this step pod (non-root user can't write /var/cache/yum, even with --setopt=cachedir overridden), and extracting just the binary fails at runtime on a missing shared library (libsubid.so.5) not present in this image -- extract the whole skopeo image filesystem instead and point LD_LIBRARY_PATH at its own lib directories, so every runtime dependency comes from the same, single trusted source" +mkdir -p /tmp/skopeo-root +oc image extract quay.io/skopeo/stable:latest --path /:/tmp/skopeo-root --filter-by-os="linux/amd64" --confirm +chmod +x /tmp/skopeo-root/usr/bin/skopeo +cat > "${TOOLS_DIR}/skopeo" <<'WRAPPER' +#!/bin/bash +export LD_LIBRARY_PATH="/tmp/skopeo-root/usr/lib64:/tmp/skopeo-root/lib64:${LD_LIBRARY_PATH:-}" +exec /tmp/skopeo-root/usr/bin/skopeo "$@" +WRAPPER +chmod +x "${TOOLS_DIR}/skopeo" echo "[$(date --utc +%FT%T.%3NZ)] Installing jq" curl -sL --retry 5 https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -o "${TOOLS_DIR}/jq" && chmod +x "${TOOLS_DIR}/jq" From b54e34dc44dca793cb09aeecc1286e52ee5f6a3a Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 12:29:52 -0400 Subject: [PATCH 18/19] opm-index-from-bundle: replace skopeo+umoci with native oc image commands Confirmed on an actual rehearsal run (kubevirt-datamover-plugin oadp-dev e2e-test-aws): the "extract whole skopeo image + set LD_LIBRARY_PATH" approach also failed -- symbol lookup error: /tmp/skopeo-root/usr/lib64/libc.so.6: undefined symbol: __tunable_is_initialized, version GLIBC_PRIVATE LD_LIBRARY_PATH only controls where shared libraries are searched; the dynamic loader (ELF interpreter) that actually starts the process is still the host's own, and mixing a different glibc build in via LD_LIBRARY_PATH is fundamentally unsafe -- confirms this whole "extract a foreign dynamically-linked binary and patch its library path" strategy doesn't work reliably across different base images. Rather than keep chasing skopeo's installation (dnf permission issues, missing shared libraries, glibc mismatches -- five failed attempts), drop skopeo and umoci entirely and use native `oc image` subcommands instead, which are already proven reliable throughout this whole step (no extraction, no foreign binaries, no dynamic- linking risk at all): - `oc image mirror` replaces the skopeo bundle-mirroring copy (using a merged auth file covering both the test cluster's pull secret and this job's own build-farm credentials, since oc image mirror takes one --registry-config, not separate src/dest authfiles). - `oc image append` replaces the whole umoci unpack/repack dance and the two skopeo copies around it -- it can add a layer (our database/index.db, from `opm index add --generate`) and patch the image's Entrypoint/Cmd/Labels/ExposedPorts directly against a remote base image and push the result, without any local container build tool. This also removes the now-unnecessary umoci/skopeo curl-download and oc-image-extract installation steps entirely. Signed-off-by: Tiger Kaovilai --- ...perators-opm-index-from-bundle-commands.sh | 50 ++++++------------- 1 file changed, 15 insertions(+), 35 deletions(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 19449434324ec..6a58ec86e97f3 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -26,21 +26,6 @@ export PATH="${TOOLS_DIR}:${PATH}" echo "[$(date --utc +%FT%T.%3NZ)] Installing opm" curl -sL --retry 5 https://github.com/operator-framework/operator-registry/releases/download/v1.26.2/linux-amd64-opm -o "${TOOLS_DIR}/opm" && chmod +x "${TOOLS_DIR}/opm" -echo "[$(date --utc +%FT%T.%3NZ)] Installing umoci" -curl -sL --retry 5 https://github.com/opencontainers/umoci/releases/download/v0.4.7/umoci.amd64 -o "${TOOLS_DIR}/umoci" && chmod +x "${TOOLS_DIR}/umoci" - -echo "[$(date --utc +%FT%T.%3NZ)] Installing skopeo" -echo "[$(date --utc +%FT%T.%3NZ)] dnf/yum install fails in this step pod (non-root user can't write /var/cache/yum, even with --setopt=cachedir overridden), and extracting just the binary fails at runtime on a missing shared library (libsubid.so.5) not present in this image -- extract the whole skopeo image filesystem instead and point LD_LIBRARY_PATH at its own lib directories, so every runtime dependency comes from the same, single trusted source" -mkdir -p /tmp/skopeo-root -oc image extract quay.io/skopeo/stable:latest --path /:/tmp/skopeo-root --filter-by-os="linux/amd64" --confirm -chmod +x /tmp/skopeo-root/usr/bin/skopeo -cat > "${TOOLS_DIR}/skopeo" <<'WRAPPER' -#!/bin/bash -export LD_LIBRARY_PATH="/tmp/skopeo-root/usr/lib64:/tmp/skopeo-root/lib64:${LD_LIBRARY_PATH:-}" -exec /tmp/skopeo-root/usr/bin/skopeo "$@" -WRAPPER -chmod +x "${TOOLS_DIR}/skopeo" - echo "[$(date --utc +%FT%T.%3NZ)] Installing jq" curl -sL --retry 5 https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -o "${TOOLS_DIR}/jq" && chmod +x "${TOOLS_DIR}/jq" @@ -56,12 +41,14 @@ REGISTRY_HOST=$(jq -r '.auths | keys[0]' "${AUTH_FILE}") INDEX_DESTINATION="${REGISTRY_HOST}/${NAMESPACE}/oadp-operator-index:latest" BUNDLE_MIRROR="${REGISTRY_HOST}/${NAMESPACE}/oadp-operator-bundle-mirror:latest" -tmp=$(mktemp -d) -cd "${tmp}" - echo "[$(date --utc +%FT%T.%3NZ)] Mirroring ${OO_BUNDLE} to ${BUNDLE_MIRROR}" echo "[$(date --utc +%FT%T.%3NZ)] opm's own pull mechanism does not reliably authenticate against registry.ci.openshift.org, so mirror the bundle into this job's own (already-authenticated) build-farm namespace first, and have opm pull from there instead" -skopeo copy --src-authfile="${BUNDLE_AUTH_FILE}" --dest-authfile="${AUTH_FILE}" "docker://${OO_BUNDLE}" "docker://${BUNDLE_MIRROR}" +MERGED_AUTH_FILE=/tmp/merged-auth.json +jq -s '{auths: (.[0].auths + .[1].auths)}' "${BUNDLE_AUTH_FILE}" "${AUTH_FILE}" > "${MERGED_AUTH_FILE}" +oc image mirror --registry-config="${MERGED_AUTH_FILE}" "${OO_BUNDLE}=${BUNDLE_MIRROR}" + +tmp=$(mktemp -d) +cd "${tmp}" echo "[$(date --utc +%FT%T.%3NZ)] Generating index database from bundle ${BUNDLE_MIRROR}" export REGISTRY_AUTH_FILE="${AUTH_FILE}" @@ -70,22 +57,15 @@ opm index add \ --out-dockerfile index.Dockerfile \ --generate -echo "[$(date --utc +%FT%T.%3NZ)] Assembling index image from ${OPM_BASE_IMAGE}" -skopeo copy --authfile="${AUTH_FILE}" "docker://${OPM_BASE_IMAGE}" oci:opm:latest -umoci unpack --rootless --image opm:latest bundle -mv database bundle/rootfs/ -umoci repack --image opm:index bundle -umoci config --config.label 'operators.operatorframework.io.index.database.v1=/database/index.db' --image opm:index -umoci config --config.exposedports "50051" --image opm:index -umoci config --config.entrypoint "/bin/opm" --image opm:index -umoci config --config.cmd "registry" \ - --config.cmd "serve" \ - --config.cmd "--database" \ - --config.cmd "/database/index.db" \ - --image opm:index - -echo "[$(date --utc +%FT%T.%3NZ)] Publishing index to ${INDEX_DESTINATION}" -skopeo copy --authfile="${AUTH_FILE}" oci:opm:index "docker://${INDEX_DESTINATION}" +echo "[$(date --utc +%FT%T.%3NZ)] Assembling and publishing index image from ${OPM_BASE_IMAGE} to ${INDEX_DESTINATION}" +echo "[$(date --utc +%FT%T.%3NZ)] Using oc image append (native, no extracted/foreign binaries involved) instead of umoci+skopeo -- it can add a layer and patch image config directly against a remote base image, without a local container build tool" +tar czf index-layer.tar.gz database +oc image append --registry-config="${AUTH_FILE}" \ + --from "${OPM_BASE_IMAGE}" \ + --to "${INDEX_DESTINATION}" \ + --image '{"Entrypoint":["/bin/opm"],"Cmd":["registry","serve","--database","/database/index.db"],"Labels":{"operators.operatorframework.io.index.database.v1":"/database/index.db"},"ExposedPorts":{"50051/tcp":{}}}' \ + index-layer.tar.gz echo "${INDEX_DESTINATION}" > "${SHARED_DIR}/oo-index-pullspec" echo "[$(date --utc +%FT%T.%3NZ)] Wrote index pullspec to \${SHARED_DIR}/oo-index-pullspec: ${INDEX_DESTINATION}" + From 26967439e02f8975044a92cf053ffae21618aabd Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Wed, 12 Aug 2026 13:46:32 -0400 Subject: [PATCH 19/19] opm-index-from-bundle: add diagnostics, filter-by-os for bundle mirror Confirmed on an actual rehearsal run (kubevirt-datamover-plugin oadp-dev e2e-test-aws): oc image mirror still fails to resolve OO_BUNDLE from registry.ci.openshift.org/konveyor/... with "name unknown" -- the same class of error both opm's own pull mechanism and an unauthenticated local skopeo inspect hit earlier, despite the merged auth file now including the test cluster's own extracted global pull secret. Two additions to narrow this down without more blind guessing: 1. Log which registries are actually present in the extracted cluster pull secret, and run `oc image info` against OO_BUNDLE as a dedicated diagnostic (non-fatal) before the mirror attempt, so the next rehearsal's log shows definitively whether the credential even covers this registry. 2. Add --filter-by-os=linux/amd64 to the mirror call: the bundle promotes multiple architectures (arm64 too, per this repo's own oadp-operator image config), and oc image mirror may need an explicit platform filter for manifest-list sources the same way oc image extract does, rather than silently failing resolution. Signed-off-by: Tiger Kaovilai --- .../optional-operators-opm-index-from-bundle-commands.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh index 6a58ec86e97f3..85fa8d0a6579a 100644 --- a/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh +++ b/ci-operator/step-registry/optional-operators/opm-index-from-bundle/optional-operators-opm-index-from-bundle-commands.sh @@ -32,6 +32,7 @@ curl -sL --retry 5 https://github.com/stedolan/jq/releases/download/jq-1.6/jq-li echo "[$(date --utc +%FT%T.%3NZ)] Extracting the test cluster's own global pull secret (needed to pull OO_BUNDLE from registry.ci.openshift.org)" oc extract secret/pull-secret -n openshift-config --confirm --to /tmp BUNDLE_AUTH_FILE=/tmp/.dockerconfigjson +echo "[$(date --utc +%FT%T.%3NZ)] Registries present in the extracted cluster pull secret: $(jq -r '.auths | keys | join(", ")' "${BUNDLE_AUTH_FILE}")" echo "[$(date --utc +%FT%T.%3NZ)] Logging in to this job's own build-farm registry namespace" AUTH_FILE=/tmp/oo-index-auth.json @@ -45,7 +46,9 @@ echo "[$(date --utc +%FT%T.%3NZ)] Mirroring ${OO_BUNDLE} to ${BUNDLE_MIRROR}" echo "[$(date --utc +%FT%T.%3NZ)] opm's own pull mechanism does not reliably authenticate against registry.ci.openshift.org, so mirror the bundle into this job's own (already-authenticated) build-farm namespace first, and have opm pull from there instead" MERGED_AUTH_FILE=/tmp/merged-auth.json jq -s '{auths: (.[0].auths + .[1].auths)}' "${BUNDLE_AUTH_FILE}" "${AUTH_FILE}" > "${MERGED_AUTH_FILE}" -oc image mirror --registry-config="${MERGED_AUTH_FILE}" "${OO_BUNDLE}=${BUNDLE_MIRROR}" +echo "[$(date --utc +%FT%T.%3NZ)] Diagnostic: oc image info for ${OO_BUNDLE}" +oc image info "${OO_BUNDLE}" --registry-config="${MERGED_AUTH_FILE}" || true +oc image mirror --registry-config="${MERGED_AUTH_FILE}" --filter-by-os="linux/amd64" "${OO_BUNDLE}=${BUNDLE_MIRROR}" tmp=$(mktemp -d) cd "${tmp}"