Migrate prod periodics/presubmits to slot-manager; add validation postsubmit#81669
Migrate prod periodics/presubmits to slot-manager; add validation postsubmit#81669roivaz wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
approved
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (8)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (7)
WalkthroughARO-HCP production E2E jobs now use ChangesARO-HCP prod-rh CI and credential updates
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/retest |
roivaz
force-pushed
the
aro-hcp-prod-slot-manager-wiring
branch
from
f4ac8a8 to
fcf38a9
Compare
roivaz
changed the title
|
@roivaz: |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: raelga, roivaz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
…tsubmit De-risked prod migration to the Red Hat tenant slot-manager model. Because the pj-rehearse plugin cannot exercise postsubmits (the gating prod-e2e-parallel job is a postsubmit), this PR intentionally leaves the gating postsubmit untouched: * Presubmits (optional prod-e2e-parallel variants) and periodics switch to the prod-rh Vault profile (two customer subscriptions) and the aro-hcp-persistent-e2e workflow; per-job quota/MSI leases removed. * New temporary non-gating postsubmit prod-e2e-parallel-slot-manager exercises the prod-rh + persistent-e2e path; triggered per region via Gangway by the ARO-HCP prow-job-executor for validation. * Cleanup: keep the existing delete-expired-prod-resource-groups (old subscription) alongside new delete-expired-prod-00/01-resource-groups for the two new subscriptions. * Mount cluster-secrets-aro-hcp-prod-rh in the shared e2e and cleanup steps. The gating prod-e2e-parallel postsubmit will be switched to prod-rh and the temporary job removed once every region is validated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
roivaz
force-pushed
the
aro-hcp-prod-slot-manager-wiring
branch
from
fcf38a9 to
4d78ea5
Compare
|
New changes are detected. LGTM label has been removed. |
|
[REHEARSALNOTIFIER]
A total of 29 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-Azure-ARO-HCP-main-prod-e2e-parallel |
|
@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@roivaz: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
De-risked migration of PROD e2e into the Red Hat tenant slot-manager model, mirroring the INT/STG work in #80467 but without touching the gating postsubmit.
Why the reduced scope
The
pj-rehearseplugin can only rehearse presubmits and periodics, not postsubmits — and the gatingprod-e2e-paralleljob is a postsubmit that blocks production code rollouts. To avoid an unvalidated change to a gating job, this PR keeps the gating postsubmit on the old path and validates the new path out-of-band first.What changed
prod-e2e-parallel+-ocp-{stable,fast,nightly}in main config) and periodics switch toVAULT_SECRET_PROFILE: prod-rh+workflow: aro-hcp-persistent-e2e; per-job quota/MSI leases removed (slot-manager selects subscription/identity at runtime).prod-e2e-parallel-slot-managerexercises theprod-rh+persistent-e2epath. It is triggered on demand per region via Gangway by the ARO-HCPprow-job-executorto validate every region.prod-e2e-parallelpostsubmit left unchanged (stillprod+ leases +aro-hcp-e2e).delete-expired-prod-resource-groups(old subscription) kept, plus newdelete-expired-prod-00/01-resource-groupsfor the two new subscriptions.cluster-secrets-aro-hcp-prod-rhmounted in the shared lease-acquire / test-persistent / gather / deprovision steps.Follow-up
Once all regions pass via the temporary postsubmit, a follow-up PR will switch the gating
prod-e2e-parallelpostsubmit toprod-rh, removeprod-e2e-parallel-slot-manager, and drop the old-subscription cleanup job.Dependencies
kv/selfservice/hcm-aro/aro-hcp-prod-rhcluster-profile secret already populated in CI Vault.Part of ARO-25833. Tracked by ARO-28239.
/cc @geoberle
Summary by CodeRabbit
This PR updates the ARO HCP OpenShift CI configuration for PROD to move from the legacy PROD E2E presubmit/periodics setup to the slot-manager model using the
aro-hcp-persistent-e2eworkflow and theprod-rhVault secret profile. As part of this, the PROD parallel E2E jobs (including the-ocp-stable/fast/nightlyvariants) switch fromaro-hcp-e2etoaro-hcp-persistent-e2e, and the previous per-jobleases/quota limiting configuration is removed so slot-manager can select subscriptions and identity containers at runtime.For validation, the PR adds a temporary non-gating postsubmit
prod-e2e-parallel-slot-manager(per-region via Gangway) on the new path, while leaving the existing gatingprod-e2e-parallelpostsubmit on the oldprodpath for now. A follow-up is expected to migrate that gating job after validation.The PROD periodic cleanup is also updated: the single
delete-expired-prod-resource-groupsjob is replaced with two subscription-scoped jobs (delete-expired-prod-00-resource-groupsanddelete-expired-prod-01-resource-groups), both using theprod-rhsecret profile and reporting to the same PROD failures channel/cron behavior.To support the new PROD RH flow, step-registry configurations are extended to mount
cluster-secrets-aro-hcp-prod-rhunder/var/run/aro-hcp-prod-rhacross the relevant lease acquisition, persistent test, and gather/deprovision paths, and the expired-resource-group deprovision credentials are associated with thetest-credentialsnamespace.