Add baseline jobs for Confidential Containers

[wainersm]

This will create jobs that run daily to "exercise" the stability of the CI jobs for Confidential Containers.

The following jobs will be generated:

• confidential-containers-operator-main-ubuntu-20.04-x86_64-containerd_kata-clh-baseline
• confidential-containers-operator-main-ubuntu-20.04-x86_64-containerd_kata-qemu-baseline
• confidential-containers-operator-main-ubuntu-20.04_sev-x86_64-containerd_kata-qemu-sev-baseline
• kata-containers-CCv0-ubuntu-20.04-x86_64-CC_CRI_CONTAINERD-baseline
• kata-containers-CCv0-ubuntu-20.04-x86_64-CC_CRI_CONTAINERD_CLOUD_HYPERVISOR-baseline
• kata-containers-CCv0-ubuntu-20.04-x86_64-CC_CRI_CONTAINERD_K8S-baseline
• kata-containers-CCv0-ubuntu-20.04_sev-x86_64-CC_SEV_CRI_CONTAINERD_K8S-baseline

Fixes #542

[wainersm]

I manually published two jobs for the sake of testing and they passed:
http://jenkins.katacontainers.io/job/kata-containers-CCv0-ubuntu-20.04-x86_64-CC_CRI_CONTAINERD-baseline/1/
http://jenkins.katacontainers.io/job/confidential-containers-operator-main-ubuntu-20.04-x86_64-containerd_kata-qemu-baseline/1/

[stevenhorsman]

@wainersm - is there any reason that the TDX and s390x jobs aren't tested in the daily baseline?

[wainersm]

@wainersm - is there any reason that the TDX and s390x jobs aren't tested in the daily baseline?

The TDX jobs run behind the firewall at Intel's infra. If I am not wrong @arronwy has used the jobs builder there too, so probably the daily jobs will be created on their infra.

Regarding s390x, it is currently not managed by the jobs builder so we will need to create it manually. Or, if @BbolroC agrees, we could take that opportunity to onboard s390x.

[stevenhorsman]

@wainersm - is there any reason that the TDX and s390x jobs aren't tested in the daily baseline?

The TDX jobs run behind the firewall at Intel's infra. If I am not wrong @arronwy has used the jobs builder there too, so probably the daily jobs will be created on their infra.

Regarding s390x, it is currently not managed by the jobs builder so we will need to create it manually. Or, if @BbolroC agrees, we could take that opportunity to onboard s390x.

Good point - I guess my question should have been - do you plan to also onboard tdx and s390x to add daily baseline runs so we get data on the reliability of those platforms too? - though I recognise they are not part of this PR :)

[stevenhorsman]

The looks okay to me. Thanks @wainersm!

[fidencio]

lgtm, thanks @wainersm!

@stevenhorsman has a good point on how we'll add s390x and mainly TDX into this view.
For TDX it's running on a different Jenkins instance, and that makes things way more complicated.

I'm fine about this as a starting point, as we may change how we run tests in the near future.

[wainersm]

Thanks @stevenhorsman @fidencio !

I will create the s390x daily job either manually or using the jobs builder. For the last case I'd like an ack (and help) from @BbolroC to onbord it on jobs builder.

[wainersm]

The publish action failed https://github.com/kata-containers/ci/actions/runs/4543721824 because the token used has not permissions to create views on Jenkins:

INFO:jenkins_jobs.builder:Creating jenkins view Daily CCv0 baseline
Traceback (most recent call last):
  File "/home/runner/.local/lib/python3.8/site-packages/jenkins/__init__.py", line 578, in jenkins_request
    return self._response_handler(
  File "/home/runner/.local/lib/python3.8/site-packages/jenkins/__init__.py", line 539, in _response_handler
    response.raise_for_status()
  File "/usr/lib/python3/dist-packages/requests/models.py", line 940, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: http://jenkins.katacontainers.io/createView?name=Daily%20CCv0%20baseline

During handling of the above exception, another exception occurred:

Hi @chavafg , could we have an account (https://github.com/kata-containers/ci/blob/main/.github/workflows/publish_jobs.yml#L26) with permission to create views too?

In meanwhile I will manually create the view on Jenkins.

[BbolroC]

Hi, @wainersm. Thanks for the suggestion. I've already raised an issue to onboard s390x via JJB, but one question: #528 (comment) If you are okay to make separate files (e.g. pr-s390x.yaml and cc-s390x.yaml), I will start onboarding all CI jobs for s390x.