add e2e-kubevirt-mce-baremetalds-disconnected-conformance

add e2e-kubevirt-mce-baremetalds-disconnected-conformance
based on the work for #44946
and #46584

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.14__periodics.yaml

@@ -217,6 +217,23 @@ tests:
       MCE_VERSION: "2.4"
       ODF_OPERATOR_SUB_CHANNEL: stable-4.14
     workflow: hypershift-mce-kubevirt-baremetalds-conformance
+- as: e2e-kubevirt-mce-baremetalds-disconnected-conformance
+  cron: 0 8 * * *
+  steps:
+    cluster_profile: equinix-ocp-metal
+    env:
+      HYPERSHIFT_NODE_COUNT: "2"
+      MCE_VERSION: "2.4"
+      ODF_OPERATOR_SUB_CHANNEL: stable-4.14
+      TEST_SKIPS: Image policy should update OpenShift object image fields when local
+        names are on\|Image policy should update standard Kube object image fields
+        when local names are on\|oc tag should preserve image reference for external
+        images\|Image policy should perform lookup when the Deployment gets the resolve-names
+        annotation later\|Image policy should perform lookup when the object has the
+        resolve-names annotation\|PersistentVolumes NFS when invoking the Recycle
+        reclaim policy should test that a PV becomes Available and is clean after
+        the PVC is deleted.
+    workflow: hypershift-mce-kubevirt-baremetalds-disconnected-conformance
 - as: e2e-mce-power-conformance
   cron: 0 4 * * *
   steps:

ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-4.14-periodics.yaml

@@ -863,6 +863,94 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build03
+  cron: 0 8 * * *
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+  extra_refs:
+  - base_ref: release-4.14
+    org: openshift
+    repo: hypershift
+  labels:
+    ci-operator.openshift.io/cloud: equinix-ocp-metal
+    ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal
+    ci-operator.openshift.io/variant: periodics
+    ci.openshift.io/generator: prowgen
+    job-release: "4.14"
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-kubevirt-mce-baremetalds-disconnected-conformance
+  reporter_config:
+    slack:
+      channel: '#hypershift-kubevirt-platform'
+      job_states_to_report:
+      - failure
+      report_template: ':volcano: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
+        <{{.Status.URL}}|View logs> :volcano:'
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --secret-dir=/usr/local/e2e-kubevirt-mce-baremetalds-disconnected-conformance-cluster-profile
+      - --target=e2e-kubevirt-mce-baremetalds-disconnected-conformance
+      - --variant=periodics
+      command:
+      - ci-operator
+      image: ci-operator:latest
+      imagePullPolicy: Always
+      name: ""
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /usr/local/e2e-kubevirt-mce-baremetalds-disconnected-conformance-cluster-profile
+        name: cluster-profile
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: cluster-profile
+      secret:
+        secretName: cluster-secrets-equinix-ocp-metal
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
 - agent: kubernetes
   cluster: build03
   cron: 0 4 * * *

ci-operator/step-registry/hypershift/conformance/hypershift-conformance-chain.yaml

@@ -4,11 +4,48 @@ chain:
   - as: conformance-tests
     from: tests
     commands: |-
+      set -x
+
+      function patch_image_streams() {
+        # workaround for https://issues.redhat.com/browse/OCPBUGS-31446
+        # imagestreams on the hosted cluster are ignoring
+        # the CA injected at creation/(installation) time.
+        # see: https://issues.redhat.com/browse/RFE-3093
+        # and: https://github.com/openshift/enhancements/pull/416/commits/e46072ecf77b58c79b4bece5e0c6a5a5546a1b8a
+
+        echo "### Patching image streams on the hostedcluster"
+        echo "#### Add trust for the mirroring registry"
+        oc get cm -n openshift-config user-ca-bundle -o json | jq -r '.data["ca-bundle.crt"]' > /tmp/ca-bundle.crt
+        oc create configmap registry-config --from-file=${DS_REGISTRY//:/..}=/tmp/ca-bundle.crt -n openshift-config
+        oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"registry-config"}}}' --type=merge
+        sleep 60
+
+        DEVSCRIPTS_RELEASE_IMAGE_REPO=${DS_REGISTRY}/localimages/local-release-image
+        IMAGESTREAMS=$(oc get imagestreams -n openshift -o=name)
+        for isName in ${IMAGESTREAMS}; do
+          echo "#### Patching ${isName} using insecure registry"
+          FROM=$(oc get -n openshift ${isName} -o=jsonpath={.spec.tags[0].from.name})
+          EXT_REG=${FROM%%@*}
+          INT_PULL_URL=${FROM/$EXT_REG/$DEVSCRIPTS_RELEASE_IMAGE_REPO}
+          oc patch -n openshift ${isName} --type json -p "[{\"op\": \"replace\", \"path\": \"/spec/tags/0/importPolicy/insecure\", \"value\": true}, {\"op\": \"replace\", \"path\": \"/spec/tags/0/from/name\", \"value\": \"${INT_PULL_URL}\"}]"
+        done
+
+        ### tests like "services when running openshift cluster on KubeVirt virtual machines should allow connections to pods from infra cluster pod *"
+        ### requires tools imagestream to be correctly refenced also on the infra cluster
+        isName=imagestream.image.openshift.io/tools
+        echo "#### Patching ${isName} using insecure registry"
+        FROM=$(oc --kubeconfig=${HYPERSHIFT_MANAGEMENT_CLUSTER_KUBECONFIG}  get -n openshift ${isName} -o=jsonpath={.spec.tags[0].from.name})
+        EXT_REG=${FROM%%@*}
+        INT_PULL_URL=${FROM/$EXT_REG/$DEVSCRIPTS_RELEASE_IMAGE_REPO}
+        oc patch --kubeconfig=${HYPERSHIFT_MANAGEMENT_CLUSTER_KUBECONFIG} -n openshift ${isName} --type json -p "[{\"op\": \"replace\", \"path\": \"/spec/tags/0/importPolicy/insecure\", \"value\": true}, {\"op\": \"replace\", \"path\": \"/spec/tags/0/from/name\", \"value\": \"${INT_PULL_URL}\"}]"
+        ###
+      }
+
       function mirror_test_images() {
         echo "### Mirroring test images"
       
         DEVSCRIPTS_TEST_IMAGE_REPO=${DS_REGISTRY}/localimages/local-test-image
-      
+
         openshift-tests images --to-repository ${DEVSCRIPTS_TEST_IMAGE_REPO} > /tmp/mirror
         scp "${SSHOPTS[@]}" /tmp/mirror "root@${IP}:/tmp/mirror"
       
@@ -17,8 +54,11 @@ chain:
       oc image mirror -f /tmp/mirror --registry-config ${DS_WORKING_DIR}/pull_secret.json
       oc image mirror --registry-config ${DS_WORKING_DIR}/pull_secret.json --filter-by-os="linux/${ARCHITECTURE}.*" registry.k8s.io/pause:3.8  $DEVSCRIPTS_TEST_IMAGE_REPO:e2e-28-registry-k8s-io-pause-3-8-aP7uYsw5XCmoDy5W
       oc image mirror --registry-config ${DS_WORKING_DIR}/pull_secret.json --filter-by-os="linux/${ARCHITECTURE}.*" registry.k8s.io/pause:3.9  $DEVSCRIPTS_TEST_IMAGE_REPO:e2e-27-registry-k8s-io-pause-3-9-p9APyPDU5GsW02Rk
+      oc image mirror --registry-config ${DS_WORKING_DIR}/pull_secret.json --filter-by-os="linux/${ARCHITECTURE}.*" registry.k8s.io/pause:3.9  $DEVSCRIPTS_TEST_IMAGE_REPO:e2e-28-registry-k8s-io-pause-3-9-p9APyPDU5GsW02Rk
       EOF
+
         TEST_ARGS+=$(echo " --from-repository ${DEVSCRIPTS_TEST_IMAGE_REPO} ")
+
       }
       
       CLUSTER_NAME="$(echo -n $PROW_JOB_ID|sha256sum|cut -c-20)"
@@ -84,7 +124,14 @@ chain:
           export IC_API_KEY
           ;;
       kubevirt)
-          export TEST_PROVIDER='{"type":"kubevirt"}'
+          if [[ "${DISCONNECTED}" == "true" ]];
+          then
+            mirror_test_images
+            patch_image_streams
+            export TEST_PROVIDER='{"type":"kubevirt","disconnected":true}'
+          else
+            export TEST_PROVIDER='{"type":"kubevirt"}'
+          fi
 
           # This looks counterintuitive. Here's an explanation.
           #
@@ -97,7 +144,7 @@ chain:
           #
           # This might not be the best long term solution, but these older KubeVirt platform
           # tests won't be maintained for long and are not a part of any GA.
-          
+
           PIPE="\|"
           # if $TEST_SKIPS is empty then $PIPE should be empty too
           if [[ -z "$TEST_SKIPS" ]]; then