Add openshift-e2e-aws-disconnected workflow#77922
Add openshift-e2e-aws-disconnected workflow#77922mdbooth wants to merge 1 commit intoopenshift:mainfrom
Conversation
Add a new disconnected AWS workflow for component-level CI testing. The workflow creates an isolated VPC with private subnets and VPC endpoints, a bastion host providing mirror registry, egress proxy, and SSH jump host, then installs OpenShift using mirrored images and manual CCO credentials. Also adds an optional e2e-aws-capi-disconnected-techpreview job to cluster-capi-operator. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WalkthroughThis PR adds comprehensive CI/CD infrastructure for disconnected AWS E2E testing of OpenShift cluster-capi-operator. Changes include a new test configuration, presubmit job, and step-registry definitions for AWS provisioning, E2E execution, and deprovisioning in fully isolated network environments. Changes
Sequence Diagram(s)sequenceDiagram
participant Test as Test Runner
participant Pre as Pre-Provision Chain
participant Cluster as AWS Cluster
participant Bastion as Bastion Host
participant Mirror as Mirror Registry
participant E2E as E2E Tests
participant Post as Post-Deprovision Chain
Test->>Pre: Trigger disconnected provisioning
Pre->>Cluster: Create isolated VPC & subnets
Pre->>Bastion: Provision bastion host
Pre->>Mirror: Mirror images to bastion
Pre->>Cluster: Configure IAM users & bot RBAC
Pre->>Cluster: Deploy cluster via IPI
Pre-->>Test: Ready for testing
Test->>E2E: Run openshift-e2e-aws-disconnected workflow
E2E->>Bastion: Access via bastion jump host
E2E->>Cluster: Execute E2E test suite
E2E-->>Test: Tests complete
Test->>Post: Trigger disconnected deprovisioning
Post->>Cluster: Gather console artifacts & logs
Post->>Bastion: Collect mirror registry content
Post->>Cluster: Remove security groups & IAM policies
Post->>Cluster: Delete CloudFormation stacks
Post-->>Test: Cleanup complete
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mdbooth The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@ci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.yaml`:
- Around line 27-30: Remove the -x (xtrace) flag before sourcing the proxy
config to prevent secrets from being printed: modify the script where it
currently sets "set -exuo pipefail" so that xtrace is disabled (e.g., use "set
-euo pipefail" or temporarily turn off xtrace) prior to the conditional that
sources "${SHARED_DIR}/proxy-conf.sh", then re-enable xtrace afterwards if
needed; update the lines referencing set -exuo pipefail and the source
"${SHARED_DIR}/proxy-conf.sh" accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: cbfb056e-a337-401a-8a80-ae55f676bf2f
📒 Files selected for processing (11)
ci-operator/config/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main.yamlci-operator/jobs/openshift/cluster-capi-operator/openshift-cluster-capi-operator-main-presubmits.yamlci-operator/step-registry/ipi/aws/post/disconnected/OWNERSci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.metadata.jsonci-operator/step-registry/ipi/aws/post/disconnected/ipi-aws-post-disconnected-chain.yamlci-operator/step-registry/ipi/aws/pre/disconnected/OWNERSci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.metadata.jsonci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.yamlci-operator/step-registry/openshift/e2e/aws/disconnected/OWNERSci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.metadata.jsonci-operator/step-registry/openshift/e2e/aws/disconnected/openshift-e2e-aws-disconnected-workflow.yaml
| set -exuo pipefail | ||
| if test -f "${SHARED_DIR}/proxy-conf.sh"; then | ||
| source "${SHARED_DIR}/proxy-conf.sh" | ||
| fi |
There was a problem hiding this comment.
Remove xtrace before sourcing proxy config to avoid secret leakage.
Line 27 enables -x, and Line 29 sources proxy-conf.sh; this can print sensitive proxy values into job logs.
🔒 Proposed fix
- set -exuo pipefail
+ set -euo pipefail
if test -f "${SHARED_DIR}/proxy-conf.sh"; then
source "${SHARED_DIR}/proxy-conf.sh"
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| set -exuo pipefail | |
| if test -f "${SHARED_DIR}/proxy-conf.sh"; then | |
| source "${SHARED_DIR}/proxy-conf.sh" | |
| fi | |
| set -euo pipefail | |
| if test -f "${SHARED_DIR}/proxy-conf.sh"; then | |
| source "${SHARED_DIR}/proxy-conf.sh" | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@ci-operator/step-registry/ipi/aws/pre/disconnected/ipi-aws-pre-disconnected-chain.yaml`
around lines 27 - 30, Remove the -x (xtrace) flag before sourcing the proxy
config to prevent secrets from being printed: modify the script where it
currently sets "set -exuo pipefail" so that xtrace is disabled (e.g., use "set
-euo pipefail" or temporarily turn off xtrace) prior to the conditional that
sources "${SHARED_DIR}/proxy-conf.sh", then re-enable xtrace afterwards if
needed; update the lines referencing set -exuo pipefail and the source
"${SHARED_DIR}/proxy-conf.sh" accordingly.
openshift-ci
bot
added
the
do-not-merge/invalid-owners-file
|
The OWNERS file contains untrusted users, which makes it INVALID. The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the openshift org. You can then trigger verification by writing
|
|
@mdbooth: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Despite reporting failure the pj-rehearse seems to have been a success. The failure is an actual bug in capi-operator: it needs to import the additional trust bundle in order to trust the mirror registry. The environment came up. I verified manually (by logging in to it during the run) that it was disconnected. It seems to have successfully collected artifacts. |
1 participant
Add a new disconnected AWS workflow for component-level CI testing.
The workflow creates an isolated VPC with private subnets and VPC
endpoints, a bastion host providing mirror registry, egress proxy,
and SSH jump host, then installs OpenShift using mirrored images
and manual CCO credentials.
Also adds an optional e2e-aws-capi-disconnected-techpreview job
to cluster-capi-operator.
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
Summary by CodeRabbit
New Features
Tests
Chores