diff --git a/ci-operator/config/openshift/installer/openshift-installer-main.yaml b/ci-operator/config/openshift/installer/openshift-installer-main.yaml index 193fc94588535..8507b676f33a4 100644 --- a/ci-operator/config/openshift/installer/openshift-installer-main.yaml +++ b/ci-operator/config/openshift/installer/openshift-installer-main.yaml @@ -554,6 +554,24 @@ tests: FEATURE_SET: TechPreviewNoUpgrade PUBLISH: Internal workflow: openshift-e2e-gcd +- always_run: false + as: e2e-gcd-ovn-private-manual-oidc-techpreview + optional: true + steps: + cluster_profile: gcd + env: + BASE_DOMAIN: ci.gcd.devcluster.openshift.com + BASTION_IMAGE_NAME: fedora-coreos-41-20241122-3-0-gcp-x86-64 + BASTION_IMAGE_PROJECT: eu0:openshift + BASTION_MACHINE_TYPE: c3-standard-4 + COMPUTE_NODE_REPLICAS: "2" + COMPUTE_NODE_TYPE: c3-standard-4 + CONTROL_PLANE_DISK_TYPE: hyperdisk-balanced + CONTROL_PLANE_NODE_TYPE: c3-standard-8 + DEFAULT_MACHINE_OSIMAGE: projects/eu0:openshift/images/rhcos10 + FEATURE_SET: TechPreviewNoUpgrade + PUBLISH: Internal + workflow: openshift-e2e-gcd-manual-oidc-workload-identity - always_run: false as: e2e-gcp-ovn pipeline_run_if_changed: (gcp|google) diff --git a/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml b/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml index 509852fd2ec50..cd6d11e7143d1 100644 --- a/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml @@ -5648,6 +5648,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-external-aws-ccm,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build02 + context: ci/prow/e2e-gcd-ovn-private-manual-oidc-techpreview + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/baremetal/Dockerfile.ci + - images/installer/Dockerfile.ci + - images/installer/Dockerfile.upi.ci + - images/libvirt/Dockerfile.ci + - images/openstack/Dockerfile.ci + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: gcd + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview + optional: true + rerun_command: /test e2e-gcd-ovn-private-manual-oidc-techpreview + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-gcd-ovn-private-manual-oidc-techpreview + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-gcd-ovn-private-manual-oidc-techpreview,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS new file mode 100644 index 0000000000000..d93971ab2936d --- /dev/null +++ b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS @@ -0,0 +1,5 @@ +approvers: +- barbacbd +- patrickdillon +- rochacbruno +- tthvo diff --git a/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json new file mode 100644 index 0000000000000..87c68a1c39aff --- /dev/null +++ b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json @@ -0,0 +1,11 @@ +{ + "path": "ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml", + "owners": { + "approvers": [ + "barbacbd", + "patrickdillon", + "rochacbruno", + "tthvo" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml new file mode 100644 index 0000000000000..2ab3fa96b90eb --- /dev/null +++ b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml @@ -0,0 +1,15 @@ +chain: + as: ipi-gcd-pre-manual-oidc-workload-identity + steps: + - ref: gcp-provision-vpc + - ref: ignition-bastionhost + - ref: gcp-provision-bastionhost + - ref: proxy-config-generate + - chain: ipi-conf-gcd + - ref: ipi-conf-manual-creds + - ref: ipi-conf-gcp-oidc-creds-provision + - chain: ipi-install + documentation: |- + The IPI GCD setup chain provisions a VPC, bastion host, and proxy, + then installs a private OpenShift cluster on Google Cloud Dedicated + with manual OIDC workload identity credentials provisioned by ccoctl. diff --git a/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS new file mode 100644 index 0000000000000..d93971ab2936d --- /dev/null +++ b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS @@ -0,0 +1,5 @@ +approvers: +- barbacbd +- patrickdillon +- rochacbruno +- tthvo diff --git a/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json new file mode 100644 index 0000000000000..047399664d558 --- /dev/null +++ b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json @@ -0,0 +1,11 @@ +{ + "path": "openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml", + "owners": { + "approvers": [ + "barbacbd", + "patrickdillon", + "rochacbruno", + "tthvo" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml new file mode 100644 index 0000000000000..a8af9c305eecf --- /dev/null +++ b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml @@ -0,0 +1,21 @@ +workflow: + as: openshift-e2e-gcd-manual-oidc-workload-identity + steps: + allow_best_effort_post_steps: true + env: + TEST_SKIPS: >- + CSRs from machines that are not recognized by the cloud provider are not approved + pre: + - chain: ipi-gcd-pre-manual-oidc-workload-identity + test: + - ref: openshift-e2e-test + post: + - chain: gather-core-dump + - chain: ipi-gcp-post + - ref: ipi-conf-gcp-oidc-creds-deprovision + - ref: gcp-deprovision-bastionhost + - ref: gcp-deprovision-vpc + documentation: |- + The OpenShift E2E GCD manual OIDC workflow executes the common + end-to-end test suite on a private cluster on Google Cloud Dedicated + with manual OIDC workload identity credentials provisioned by ccoctl.