diff --git a/ci-operator/config/openshift/origin/openshift-origin-main.yaml b/ci-operator/config/openshift/origin/openshift-origin-main.yaml index 513ce0a75fc34..0646f39395d9f 100644 --- a/ci-operator/config/openshift/origin/openshift-origin-main.yaml +++ b/ci-operator/config/openshift/origin/openshift-origin-main.yaml @@ -832,6 +832,17 @@ tests: SRC_FROM_GIT: "true" TEST_SUITE: openshift/conformance/serial workflow: openshift-microshift-e2e-origin-conformance +- always_run: false + as: e2e-aws-tls-observed-config + optional: true + steps: + cluster_profile: openshift-org-aws + env: + TEST_SUITE: openshift/tls-observed-config + observers: + enable: + - observers-resource-watch + workflow: openshift-e2e-aws-serial - always_run: false as: e2e-hypershift-conformance optional: true diff --git a/ci-operator/config/openshift/origin/openshift-origin-release-4.22.yaml b/ci-operator/config/openshift/origin/openshift-origin-release-4.22.yaml index a6d0a4084cd1a..baf81e28ad175 100644 --- a/ci-operator/config/openshift/origin/openshift-origin-release-4.22.yaml +++ b/ci-operator/config/openshift/origin/openshift-origin-release-4.22.yaml @@ -832,6 +832,17 @@ tests: SRC_FROM_GIT: "true" TEST_SUITE: openshift/conformance/serial workflow: openshift-microshift-e2e-origin-conformance +- always_run: false + as: e2e-aws-tls-observed-config + optional: true + steps: + cluster_profile: openshift-org-aws + env: + TEST_SUITE: openshift/tls-observed-config + observers: + enable: + - observers-resource-watch + workflow: openshift-e2e-aws-serial - always_run: false as: e2e-hypershift-conformance optional: true diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml index 19d1c9485d362..03663d7b9eca0 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml @@ -70,16 +70,6 @@ tests: workflow: generic-claim - as: periodic-default-tls interval: 72h - reporter_config: - channel: '#forum-case' - job_states_to_report: - - success - - failure - - error - report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* - ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: - Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> - {{end}}' steps: cluster_profile: openshift-org-aws env: @@ -89,16 +79,6 @@ tests: workflow: ipi-aws - as: periodic-pqc-readiness interval: 72h - reporter_config: - channel: '#forum-case' - job_states_to_report: - - success - - failure - - error - report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* - ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: - Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> - {{end}}' steps: cluster_profile: openshift-org-aws env: @@ -109,16 +89,6 @@ tests: workflow: openshift-e2e-aws-ovn-tls-13 - as: periodic-tls13-adherence interval: 72h - reporter_config: - channel: '#forum-case' - job_states_to_report: - - success - - failure - - error - report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* - ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: - Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> - {{end}}' steps: cluster_profile: openshift-org-aws env: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.22.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.22.yaml index 2dc7d8529ebea..df28acf08d6c6 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.22.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.22.yaml @@ -71,16 +71,6 @@ tests: workflow: openshift-e2e-aws-ovn-tls-13 - as: periodic-default-tls interval: 72h - reporter_config: - channel: '#forum-case' - job_states_to_report: - - success - - failure - - error - report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* - ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: - Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> - {{end}}' steps: cluster_profile: openshift-org-aws env: diff --git a/ci-operator/jobs/openshift/origin/openshift-origin-main-presubmits.yaml b/ci-operator/jobs/openshift/origin/openshift-origin-main-presubmits.yaml index fa6f0c91a3c1f..67bca1468489c 100644 --- a/ci-operator/jobs/openshift/origin/openshift-origin-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/origin/openshift-origin-main-presubmits.yaml @@ -5,7 +5,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-agnostic-ovn-cmd decorate: true decoration_config: @@ -2676,6 +2676,92 @@ presubmits: - ^main$ - ^main- cluster: build09 + context: ci/prow/e2e-aws-tls-observed-config + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/hello-openshift/Dockerfile.rhel + - images/tests/Dockerfile.rhel + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-origin-main-e2e-aws-tls-observed-config + optional: true + rerun_command: /test e2e-aws-tls-observed-config + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-aws-tls-observed-config + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-aws-tls-observed-config,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 context: ci/prow/e2e-azure decorate: true decoration_config: @@ -2761,7 +2847,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-azure-ovn-etcd-scaling decorate: true decoration_config: @@ -2847,7 +2933,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-azure-ovn-upgrade decorate: true decoration_config: @@ -4572,7 +4658,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-hypershift-conformance decorate: true decoration_config: @@ -5879,7 +5965,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-metal-ovn-single-node-live-iso decorate: true decoration_config: @@ -5965,7 +6051,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-metal-ovn-single-node-with-worker-live-iso decorate: true decoration_config: @@ -6318,7 +6404,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/e2e-openstack-dualstack-v6primary decorate: true decoration_config: @@ -6832,7 +6918,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/go-verify-deps decorate: true decoration_config: @@ -6915,7 +7001,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/images decorate: true decoration_config: @@ -6974,7 +7060,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/lint decorate: true decoration_config: @@ -7127,7 +7213,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/okd-scos-images decorate: true decoration_config: @@ -7186,7 +7272,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/unit decorate: true decoration_config: @@ -7253,7 +7339,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/verify decorate: true decoration_config: @@ -7320,7 +7406,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/verify-deps decorate: true decoration_config: @@ -7387,7 +7473,7 @@ presubmits: branches: - ^main$ - ^main- - cluster: build09 + cluster: build10 context: ci/prow/verify-image-manifest-lists decorate: true decoration_config: diff --git a/ci-operator/jobs/openshift/origin/openshift-origin-release-4.22-presubmits.yaml b/ci-operator/jobs/openshift/origin/openshift-origin-release-4.22-presubmits.yaml index 5a23d08f1dd46..ff1b062369793 100644 --- a/ci-operator/jobs/openshift/origin/openshift-origin-release-4.22-presubmits.yaml +++ b/ci-operator/jobs/openshift/origin/openshift-origin-release-4.22-presubmits.yaml @@ -5,7 +5,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-agnostic-ovn-cmd decorate: true decoration_config: @@ -2676,6 +2676,92 @@ presubmits: - ^release-4\.22$ - ^release-4\.22- cluster: build09 + context: ci/prow/e2e-aws-tls-observed-config + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/hello-openshift/Dockerfile.rhel + - images/tests/Dockerfile.rhel + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-origin-release-4.22-e2e-aws-tls-observed-config + optional: true + rerun_command: /test e2e-aws-tls-observed-config + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-aws-tls-observed-config + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-aws-tls-observed-config,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.22$ + - ^release-4\.22- + cluster: build10 context: ci/prow/e2e-azure decorate: true decoration_config: @@ -2761,7 +2847,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-azure-ovn-etcd-scaling decorate: true decoration_config: @@ -2847,7 +2933,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-azure-ovn-upgrade decorate: true decoration_config: @@ -4572,7 +4658,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-hypershift-conformance decorate: true decoration_config: @@ -5879,7 +5965,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-metal-ovn-single-node-live-iso decorate: true decoration_config: @@ -5965,7 +6051,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-metal-ovn-single-node-with-worker-live-iso decorate: true decoration_config: @@ -6318,7 +6404,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/e2e-openstack-dualstack-v6primary decorate: true decoration_config: @@ -6832,7 +6918,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/go-verify-deps decorate: true decoration_config: @@ -6915,7 +7001,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/images decorate: true decoration_config: @@ -6974,7 +7060,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/lint decorate: true decoration_config: @@ -7041,7 +7127,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/unit decorate: true decoration_config: @@ -7108,7 +7194,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/verify decorate: true decoration_config: @@ -7175,7 +7261,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/verify-deps decorate: true decoration_config: @@ -7242,7 +7328,7 @@ presubmits: branches: - ^release-4\.22$ - ^release-4\.22- - cluster: build09 + cluster: build10 context: ci/prow/verify-image-manifest-lists decorate: true decoration_config: diff --git a/ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-commands.sh b/ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-commands.sh index 805f04e0e3d14..dedf8431e04d8 100644 --- a/ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-commands.sh +++ b/ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-commands.sh @@ -7,6 +7,7 @@ echo "=========================================" echo "Vault Configuration for KMS" echo "=========================================" echo "Namespace: ${VAULT_NAMESPACE}" +echo "Release Name: ${VAULT_RELEASE_NAME}" echo "" export KUBECONFIG="${SHARED_DIR}/kubeconfig" @@ -19,22 +20,22 @@ echo "" # Enable transit secret engine echo "Enabling transit secret engine..." -oc exec vault-0 -n "${VAULT_NAMESPACE}" -- \ +oc exec ${VAULT_RELEASE_NAME}-0 -n "${VAULT_NAMESPACE}" -- \ env VAULT_TOKEN="${ROOT_TOKEN}" vault secrets enable -path=transit transit # Create encryption key echo "Creating transit encryption key..." -oc exec vault-0 -n "${VAULT_NAMESPACE}" -- \ +oc exec ${VAULT_RELEASE_NAME}-0 -n "${VAULT_NAMESPACE}" -- \ env VAULT_TOKEN="${ROOT_TOKEN}" vault write -f transit/keys/${VAULT_KMS_KEY_NAME} # Enable AppRole auth echo "Enabling AppRole authentication..." -oc exec vault-0 -n "${VAULT_NAMESPACE}" -- \ +oc exec ${VAULT_RELEASE_NAME}-0 -n "${VAULT_NAMESPACE}" -- \ env VAULT_TOKEN="${ROOT_TOKEN}" vault auth enable approle # Create KMS policy echo "Creating KMS policy..." -oc exec vault-0 -n "${VAULT_NAMESPACE}" -- \ +oc exec ${VAULT_RELEASE_NAME}-0 -n "${VAULT_NAMESPACE}" -- \ sh -c "VAULT_TOKEN=${ROOT_TOKEN} vault policy write kms-policy - <