Skip to content

openshift/install e2e-aws add run smoke tests - #1317

Merged
openshift-merge-robot merged 1 commit into
openshift:masterfrom
sallyom:openshift-installer-add-smoke
Sep 10, 2018
Merged

openshift/install e2e-aws add run smoke tests#1317
openshift-merge-robot merged 1 commit into
openshift:masterfrom
sallyom:openshift-installer-add-smoke

Conversation

@sallyom

@sallyom sallyom commented Aug 29, 2018

Copy link
Copy Markdown
Contributor

This PR depends on openshift/installer#223 for Dockerfiles

@bbguimaraes @stevekuznetsov
EDITED:
Ran this from local system, from openshift/ci-operator dir:
and I've placed 3 files in a local installer/secret dir: license, pull-secret, and .aws/credentials
Running this cmd:

./ci-operator -template /path/to/modified-for-local-dev/cluster-launch-installer-e2e.yaml \
 -config /path/to/release/ci-operator/config/openshift/installer/master.json \
 -secret-dir=/path/to/local/openshfit.yaml \
 -secret-dir=/local/path/installer/secret  \
 -git-ref=sallyom/installer@mybranch \
 -namespace=myns

And then, creating like so (noting here so I have record/don't forget):
1.oc create secret generic dev-cluster-profile --from-file=/local/path/to/aws/openshift.yaml -n myns
2.oc create secret -n myns generic cluster-secrets-aws --from-file=/path/to/secret/pull-secret --from-file=/path/to/secret/license --from-file=/path/to/secret/credentials -o yaml --dry-run | oc apply -n myns -f -
3. oc create -f release/cluster/ci/config/installer-origin-release-bazel.yaml -n openshift (tested in my ns)

I have tested this several times locally, all looks good, hoping it works same way w/in the presubmit job

@openshift-ci-robot openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 29, 2018
@openshift-bot openshift-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 29, 2018
@openshift-ci-robot openshift-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Aug 29, 2018
@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from 790c36f to aafe668 Compare August 29, 2018 14:06
@openshift-bot openshift-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 29, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you should be able to just bazel run

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh good

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why does this vary per job?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nope, it should not

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems wrong

@sallyom sallyom Aug 30, 2018

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WIP lol It was wrong.. I've updated (since I was kind of able to test locally) I've made the change to the correct template now

@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from aafe668 to 63e0e75 Compare August 30, 2018 11:51
@openshift-ci-robot openshift-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 30, 2018

@sallyom sallyom Aug 30, 2018

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stevekuznetsov This is only to get the bazel binary available, to run bazel build smoke_tests . If we can add that to the base image, we won't need this.

@sallyom sallyom Aug 30, 2018

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stevekuznetsov I need to run above 2 lines from directory where openshift/installer source code is.. is this where it is?? I haven't gotten that far in my testing to find out...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You want a cluster-launch-installer-src template, look at cluster-launch-src for examples

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks

@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from 63e0e75 to 64d5368 Compare August 30, 2018 13:41
Comment thread cluster/test-deploy/aws/openshift.yaml Outdated

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stevekuznetsov This is for local testing using rh-dev account.. will change it back or put in an if_local_dev block or something

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's remove the local dev bits

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup done

@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from a7afe39 to 806c4c7 Compare August 30, 2018 19:55
@openshift openshift deleted a comment from stevekuznetsov Aug 30, 2018
@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch 4 times, most recently from afec203 to f0ebf51 Compare September 3, 2018 12:10
@sallyom sallyom changed the title [WIP] openshift/install e2e-aws add run smoke tests openshift/install e2e-aws add run smoke tests Sep 3, 2018
@openshift-ci-robot openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 3, 2018
@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from f0ebf51 to 169fc45 Compare September 3, 2018 12:27

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can remove "(if post remove etcd)", since both this repo and the installer repo are past that point.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, there was talk that the bootstrap instance would eventually not be included in the overall node count though? if it's terminated after the bootstrap is complete? we'll have to keep an eye on that number, it definitely shouldn't be hardcoded the way it is

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

...there was talk that the bootstrap instance would eventually not be included in the overall node count though?

I'm hoping that when that happens, we'll have terminated the bootstrap node by tge time the installer exits. We may need parallel release/installer PRs for that, but the etcd comment is stale ;).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, got it

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's this about? Are you suggesting calculating this from inputs.yaml?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yea, or keeping it in a variable rather than hardcoded there

@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from 169fc45 to b675583 Compare September 4, 2018 15:39

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we should be able to drop this. cp can create the target directory on its own:

$ mkdir -p a/b
$ cd a
$ cp -vR . /tmp/installer-src
‘.’ -> ‘/tmp/installer-src’
‘./b’ -> ‘/tmp/installer-src/b’

Once we drop the mkdir, the only thing left is the cp call. So we should be able to drop the shell entirely, and go straight to cp:

command:
- cp
- -R
- .
- /tmp/installer-src

or something like that.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, will do

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's previous discussion of source access here. But using parallel containers for the copy and Bazel tests seems pretty complicated. I'm fine with this approach to get this PR landed, but it would be nice if there was an easier way...

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it would be nice! took me quite awhile to figure that out lol

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's this which doing? Can we drop it?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yea, it was also debugging, fixing..

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the cache need to be mounted into the container? We don't mount it here, and the tarball build seems to work. After a successful build, you're already copying the smoke-test binary out of its symlinked location into /tmp/smoke. I expect all other Bazel files could die with the container.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, I can def delete the other files, meant to do that.. I was stumped with the .cache stuff, I'm not sure what's going on there, yea, our other job does not require that, I know! I kept getting Permission Denied, can't create .cache/bazel-something so creating a writable path for that solved the issue.. anyways, I'll clean up the other files we don't need...

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cleaned up bazel-bin

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kept getting Permission Denied, can't create .cache/bazel-something so creating a writable path for that solved the issue...

Ah, probably because of the random UID Prow uses and the lack of $HOME. More on this issue in #1178 and #1185. Try something like this (and if you also go that route for USER, you can drop your internal export from the script).

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we drop the "${@}"? This script isn't going to be called with arguments, is it?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup, fixing

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two lines feel like debugging information that we can drop, now that you have the wait loop set up.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yea, right. fixing..

@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from e515cac to 04fdedc Compare September 4, 2018 17:19
@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from 3776f5c to a1e585d Compare September 10, 2018 15:30
@openshift-bot openshift-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 10, 2018
@sallyom
sallyom force-pushed the openshift-installer-add-smoke branch from a1e585d to 199f2e0 Compare September 10, 2018 15:53
@openshift-bot openshift-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 10, 2018
@smarterclayton

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 10, 2018
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sallyom, smarterclayton

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 10, 2018
@openshift-merge-robot
openshift-merge-robot merged commit 710cff0 into openshift:master Sep 10, 2018
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@sallyom: Updated the following 2 configmaps:

  • job-config configmap using the following files:
    • key openshift-installer-presubmits.yaml using file ci-operator/jobs/openshift/installer/openshift-installer-presubmits.yaml
  • ci-operator-openshift-installer configmap using the following files:
    • key master.yaml using file ci-operator/config/openshift/installer/master.yaml
Details

In response to this:

This PR depends on openshift/installer#223 for Dockerfiles

@bbguimaraes @stevekuznetsov
EDITED:
Ran this from local system, from openshift/ci-operator dir:
and I've placed 3 files in a local installer/secret dir: license, pull-secret, and .aws/credentials
Running this cmd:

./ci-operator -template /path/to/modified-for-local-dev/cluster-launch-installer-e2e.yaml \
-config /path/to/release/ci-operator/config/openshift/installer/master.json \
-secret-dir=/path/to/local/openshfit.yaml \
-secret-dir=/local/path/installer/secret  \
-git-ref=sallyom/installer@mybranch \
-namespace=myns

And then, creating like so (noting here so I have record/don't forget):
1.oc create secret generic dev-cluster-profile --from-file=/local/path/to/aws/openshift.yaml -n myns
2.oc create secret -n myns generic cluster-secrets-aws --from-file=/path/to/secret/pull-secret --from-file=/path/to/secret/license --from-file=/path/to/secret/credentials -o yaml --dry-run | oc apply -n myns -f -
3. oc create -f release/cluster/ci/config/installer-origin-release-bazel.yaml -n openshift (tested in my ns)

I have tested this several times locally, all looks good, hoping it works same way w/in the presubmit job

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@sallyom: The following updates succeeded:

  • /usr/bin/make applyTemplate WHAT=projects/origin-release/pipeline.yaml
    
    $ /usr/bin/make applyTemplate WHAT=projects/origin-release/pipeline.yaml
    oc process -f projects/origin-release/pipeline.yaml | oc apply -f -
    imagestream "origin-release" configured
    buildconfig "origin-release-golang-1.8" configured
    buildconfig "origin-release-golang-1.9" configured
    buildconfig "origin-release-golang-1.10" configured
    buildconfig "origin-release-golang-1.11" configured
    buildconfig "origin-release-bazel" created
    buildconfig "origin-release-nodejs-8" configured
    buildconfig "origin-release-nodejs-8-browser-tests" configured
    

Details

In response to this:

This PR depends on openshift/installer#223 for Dockerfiles

@bbguimaraes @stevekuznetsov
EDITED:
Ran this from local system, from openshift/ci-operator dir:
and I've placed 3 files in a local installer/secret dir: license, pull-secret, and .aws/credentials
Running this cmd:

./ci-operator -template /path/to/modified-for-local-dev/cluster-launch-installer-e2e.yaml \
-config /path/to/release/ci-operator/config/openshift/installer/master.json \
-secret-dir=/path/to/local/openshfit.yaml \
-secret-dir=/local/path/installer/secret  \
-git-ref=sallyom/installer@mybranch \
-namespace=myns

And then, creating like so (noting here so I have record/don't forget):
1.oc create secret generic dev-cluster-profile --from-file=/local/path/to/aws/openshift.yaml -n myns
2.oc create secret -n myns generic cluster-secrets-aws --from-file=/path/to/secret/pull-secret --from-file=/path/to/secret/license --from-file=/path/to/secret/credentials -o yaml --dry-run | oc apply -n myns -f -
3. oc create -f release/cluster/ci/config/installer-origin-release-bazel.yaml -n openshift (tested in my ns)

I have tested this several times locally, all looks good, hoping it works same way w/in the presubmit job

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@wking

wking commented Sep 10, 2018

Copy link
Copy Markdown
Member

This is giving us errors like:

error: could not resolve inputs: could not determine inputs for step [input:base-smoke]: could not resolve base image: imagestreamtags.image.openshift.io "origin-release" not found

This is possibly because the origin-release image is not pushed to Quay?

@wking

wking commented Sep 10, 2018

Copy link
Copy Markdown
Member
imagestreamtags.image.openshift.io "origin-release" not found

@sallyom has filed #1428 working on this.

@wking

wking commented Sep 10, 2018

Copy link
Copy Markdown
Member

And also #1431.

@wking

wking commented Sep 10, 2018

Copy link
Copy Markdown
Member

And also #1433.

@wking

wking commented Sep 10, 2018

Copy link
Copy Markdown
Member

And also #1434.

wking added a commit to wking/openshift-release that referenced this pull request Sep 10, 2018
Like 81a9e69 (openshift-installer-presubmits: Normalize job names,
2018-09-04, openshift#1354), but for the new smoke-test job from 199f2e0
(openshift/install e2e-aws add run smoke tests, 2018-08-28, openshift#1317).
wking added a commit to wking/openshift-installer that referenced this pull request Sep 10, 2018
Since 199f2e07 (openshift/install e2e-aws add run smoke tests,
2018-08-28, openshift/release#1317) we've been running the smoke tests
on AWS via Prow, so we can drop our Jenkins bindings.  This commit
also drops Dockerfiles for some images which have been supplanted in
Prow by 5e94276 (add Dockerfiles for ci, 2018-09-06, openshift#223).
wking added a commit to wking/openshift-release that referenced this pull request Sep 11, 2018
…onfig

Catching up with 56600df (add configmap for e2e-aws-smoke,
2018-09-10, openshift#1434) and ultimately with 199f2e0 (openshift/install
e2e-aws add run smoke tests, 2018-08-28, openshift#1317).
derekhiggins pushed a commit to derekhiggins/release that referenced this pull request Oct 24, 2023
This is only needed in rhcos.sh for old versions which lack the
openshift-install coreos-print-stream-json option, and the
file moved in openshift/installer#5252
so we should only copy if the "old" location is detected
jimdaga added a commit to jimdaga/release that referenced this pull request Aug 18, 2026
openshift-merge-bot Bot pushed a commit that referenced this pull request Aug 24, 2026
…83501)

* feat(gcp-hcp): implement ArgoCD sync validation with Ginkgo v2 tests

Implements GCP-557: Replace placeholder ArgoCD validation step with real Ginkgo v2 tests

Changes:
- ci-operator config: Add gcp-hcp-e2e-tests image build from Dockerfile.e2e
- verify-argocd-sync commands.sh: Replace placeholder with full implementation
  - Authenticate with WIF credential from hypershift-gcp-wif-auth step
  - Generate region and MC cluster kubeconfigs via gcloud CLI
  - Run Ginkgo v2 test binary with JUnit output
  - Export REGION_KUBECONFIG and MC_KUBECONFIG to test environment
- verify-argocd-sync ref.yaml: Update step configuration
  - Use gcp-hcp-e2e-tests image (from gcp-hcp-infra repo)
  - Increase resources: 500m CPU, 1Gi memory (for Go client libraries)
  - Increase timeout: 60min (accommodates 30min sync + retries + setup)
  - Update documentation with dependencies and environment variables

Architecture:
- Bash wrapper: WIF auth + kubeconfig generation via gcloud CLI
- Ginkgo test binary: Pure Go validation using controller-runtime/client-go
- No gcloud SDK in test image (only in wrapper script)
- JUnit XML output to ARTIFACT_DIR for Prow test grid

Test flow:
1. Wait for ArgoCD namespace (20min timeout)
2. Wait for ArgoCD server deployment ready (20min timeout)
3. Poll Applications for Synced status (30min timeout, configurable)
4. Auto-retry stuck apps every 2 minutes
5. Optional MC cluster validation (skips if MC_KUBECONFIG not set)

Related: openshift-online/gcp-hcp-infra commit 29b7ce7f

* fix(ci-operator): correct images section format to use items key

The images section requires an 'items' key for the list of images.
This matches the format used in other ci-operator configs like openshift/hypershift.

* fix(ci): regenerate Prow jobs for gcp-hcp-e2e-tests image

Running make jobs with increased Docker memory (8GB) to regenerate Prow job
configurations after adding gcp-hcp-e2e-tests image to ci-operator config.

Changes:
- Update decoration_config to use sparse checkout for Dockerfile.e2e
- Move github-credentials from volumes to oauth_token_secret in decoration
- Remove redundant github-credentials volume definitions

Resolves generated-config CI check failure.

* fix(ci): remove github-credentials volumeMounts after moving to oauth_token_secret

The previous commit moved github-credentials to decoration_config oauth_token_secret
but left the volumeMount references, causing:
'volumeMount named "github-credentials-openshift-ci-robot-private-git-cloner" is undefined'

Removed all volumeMount entries for github-credentials since oauth_token_secret
in decoration_config provides credentials without explicit volume mounts.

* fix(security): remove MC_CLUSTER_ENDPOINT from log output

Cluster endpoints can expose internal hostnames/IPs. Remove from
diagnostic logging per CodeRabbit security finding.

* fix: use distinct region cluster name and make MC kubeconfig conditional

- Export region.value.cluster_name as region-cluster-name in provision step
- Use REGION_CLUSTER_NAME for region kubeconfig (not MC_CLUSTER_NAME)
- Make MC kubeconfig generation conditional (don't fail if MC unavailable)
- Tests will skip MC validation if MC_KUBECONFIG not set

Addresses CodeRabbit findings:
- 3793583558: Use region cluster name for region kubeconfig
- 3793583560: Keep region validation available when MC unavailable

* fix: address remaining CodeRabbit findings

- Update workflow doc to describe real ArgoCD validation (not placeholder)
- Add curl timeouts (--connect-timeout 10 --max-time 60) to tfc_api_call
- Fix errexit control flow in terraform apply/destroy retry loops
  (capture command in if statement to prevent set -e exit before retry)

Addresses CodeRabbit findings:
- 3793583549: Update test phase documentation
- 3793583551: Set timeout for TFC API requests
- 3793583554: Fix errexit control flow in terraform retry loops

* feat(ci): add image promotion for gcp-hcp-e2e-tests

Following HyperShift pattern, add promotion config to push the
gcp-hcp-e2e-tests image to ci namespace on merge. This replaces
the deprecated BuildConfig pattern with modern ci-operator image
building and promotion.

Without promotion, the image is rebuilt from scratch for every
e2e job run. With promotion, the image is pushed to registry on
merge and reused by subsequent jobs.

Pattern matches openshift/hypershift config:
- Build image during CI from Dockerfile.e2e
- Promote to ci namespace with latest tag on postsubmit
- Step-registry references via 'from: gcp-hcp-e2e-tests'

Context: Builds on app.ci are deprecated (per DPTP). The modern
pattern is ci-operator images + promotion config instead of
BuildConfigs in clusters/app.ci/supplemental-ci-images/.

* chore(ci): regenerate Prow jobs for image promotion

Regenerated after adding promotion config. Creates new postsubmit
job 'branch-ci-openshift-online-gcp-hcp-infra-main-images' that
pushes gcp-hcp-e2e-tests to ci namespace on merge.

* fix(e2e): split kubeconfig generation into separate step to avoid gcloud dependency in test image

The verify-argocd-sync step was trying to run gcloud commands inside the
gcp-hcp-e2e-tests image, which only contains the compiled Go test binary.
This caused failures with 'gcloud: command not found'.

Solution: Create new gcp-hcp-generate-kubeconfigs step that:
- Runs in upi-installer image (has gcloud)
- Generates static kubeconfigs with embedded access tokens
- Saves kubeconfigs to SHARED_DIR for downstream steps

The verify-argocd-sync step now:
- Runs in gcp-hcp-e2e-tests image (test binary only)
- Reads pre-generated kubeconfigs from SHARED_DIR
- Executes Ginkgo v2 tests using native Kubernetes client-go

This follows the same pattern as HyperShift E2E tests and avoids mixing
infrastructure tooling (gcloud) with test execution (Go binary).

* Use DNS/public endpoint for GKE kubeconfig generation

Private GKE clusters with enable_private_endpoint=true return the
internal endpoint when queried with --format='value(endpoint)'.
Test pods cannot reach the private endpoint from the Prow cluster.

This change prioritizes DNS-based endpoints (dnsConfig.clusterDns)
which are publicly accessible when dns_allow_external_traffic=true,
and falls back to the public IP endpoint (privateClusterConfig.publicEndpoint)
if DNS endpoints are not configured.

This ensures kubectl can access the clusters without requiring gcloud
credential helpers or VPN connectivity.

* Trigger rehearsal after gcp-hcp-infra PR #1317 merge

* Add missing github-credentials volume to e2e-platform job

The volumeMount was present but the corresponding volume definition
was missing, causing pj-rehearse configuration validation to fail.

This volume is needed for ci-operator's --oauth-token-path argument
which provides GitHub authentication for private repo access during
the test workflow.

* Revert: Remove manually-added github-credentials volume

The volume 'github-credentials-openshift-ci-robot-private-git-cloner' is
reserved for Prow's decoration system and is automatically added based
on the --oauth-token-path argument. Adding it manually causes a conflict:
'volume github-credentials-openshift-ci-robot-private-git-cloner is a
reserved for decoration'

Prow's decorator handles this volume automatically - no manual definition needed.

* Update Dockerfile path for e2e test relocation

Updates ci-operator config to use test/Dockerfile.e2e after the e2e
test files were moved from repo root to test/ directory.

Changes:
- dockerfile_path: Dockerfile.e2e → test/Dockerfile.e2e
- sparse_checkout_files: Dockerfile.e2e → test/Dockerfile.e2e (6 jobs)

This change must be applied atomically with openshift-online/gcp-hcp-infra#1326.

Related: GCP-557

* Disable Ginkgo color output for cleaner CI logs

Adds --ginkgo.no-color flag to test execution. Color codes don't render
well in CI log viewers and make output harder to read.

Related: GCP-557

* Fix build context for relocated test files

Sets context_dir: test so Dockerfile.e2e can find go.mod/go.sum in the
correct location. The dockerfile_path is relative to context_dir.

Without this, the build fails with:
  error: copier: stat: "/go.mod": no such file or directory

Changes:
- context_dir: test (new)
- dockerfile_path: test/Dockerfile.e2e → Dockerfile.e2e (relative to context_dir)

Related: GCP-557

* Fix sparse checkout by using inputs.src.paths for complete test/ directory

The previous approach only checked out test/Dockerfile.e2e via
sparse_checkout_files, but the build needs:
- test/go.mod
- test/go.sum
- test/e2e/

Using inputs.src.paths copies the entire test/ directory into the build
context, ensuring all required files are available.

This replaces sparse checkout with explicit source path mapping:
  source: /go/src/github.com/openshift-online/gcp-hcp-infra/test
  dest: . (build context root)

Related: GCP-557

* Fix sparse checkout to include entire test/ directory

Prowgen auto-generates sparse_checkout_files based on dockerfile_path,
but only includes the Dockerfile itself. This causes build failures
because go.mod, go.sum, and e2e/ directory are not checked out.

Manual fix: Change sparse_checkout_files from 'test/Dockerfile.e2e' to
'test/' to check out the entire test directory.

This is the CORRECT and FINAL fix. All required files will now be
available:
- test/go.mod
- test/go.sum
- test/e2e/
- test/Dockerfile.e2e

Related: GCP-557

* Use private endpoint for cluster connectivity from Prow

GKE private clusters are not reachable via public IP from Prow pods.
The test was failing with:
  dial tcp 34.41.118.126:443: i/o timeout

This was because we were using publicEndpoint as the fallback when DNS
endpoint was unavailable.

Fix: Use privateEndpoint instead of publicEndpoint for cluster-to-cluster
connectivity. Prow pods run in the same GCP network and can reach private
endpoints.

Endpoint priority:
1. DNS endpoint (dnsConfig.clusterDns) - preferred
2. Private endpoint (privateClusterConfig.privateEndpoint) - fallback

Related: GCP-557

* Revert incorrect private endpoint change - need to research actual network topology

* Use gcloud get-credentials with --dns-endpoint for kubeconfig generation

Instead of manually constructing kubeconfigs, use gcloud's built-in
get-credentials command with the --dns-endpoint flag. This matches the
working manual connection method.

Benefits:
- Uses the same method that works for manual access
- Automatically handles authentication and endpoint selection
- Simpler and more maintainable code
- gcloud handles DNS endpoint resolution correctly

The --dns-endpoint flag tells gcloud to use the DNS-based cluster endpoint
(e.g., clustername.p.googleapis.com) instead of IP addresses.

Related: GCP-557

* Revert "Use gcloud get-credentials with --dns-endpoint for kubeconfig generation"

This reverts commit 962f370.

* Use Connect Gateway for cluster access instead of public endpoint

Connect Gateway allows secure access to GKE clusters without requiring
public master endpoints. This works with private clusters and uses
fleet membership (which is already configured).

Endpoint format:
  https://{region}-connectgateway.googleapis.com/v1/projects/{projectNumber}/locations/{region}/gkeMemberships/{clusterName}

Benefits:
- Works with private master endpoints (no need for enable_private_endpoint=false)
- Uses existing fleet enrollment
- Same embedded access token pattern (valid for 1 hour)
- More secure than public endpoints

The kubeconfig uses an embedded access token from WIF which is valid
for 1 hour - sufficient for CI jobs that run 30-60 minutes max.

Related: GCP-557

* Fix Connect Gateway TLS: remove cluster CA from kubeconfig

Connect Gateway (connectgateway.googleapis.com) uses Google's public
TLS certificates signed by Google Trust Services, not the cluster's
self-signed CA. Including certificate-authority-data caused x509
validation failure:

  tls: failed to verify certificate: x509: certificate signed by
  unknown authority

Fix: omit certificate-authority-data entirely and let the system CA
bundle validate Google's public certs.

Also removed the now-unnecessary gcloud container clusters describe
calls that were only used to fetch the CA certificate.

Related: GCP-557

* Workaround Firestore provider bug: import orphaned databases on 409

hashicorp/terraform-provider-google#22533: on freshly created projects,
google_firestore_database has a read-after-write consistency bug. The
provider creates the database successfully, but the immediate GET returns
404 (~80ms after creation), so the resource is dropped from state. The
next apply attempt fails with 409 'Database already exists' because the
database exists in GCP but not in state.

Fix: detect the 409 pattern in apply output, extract the MC project ID
from terraform state/outputs, and terraform import the orphaned database
resources before retrying. This restores state consistency so the retry
succeeds.

Affects ~60% of freshly created projects per upstream bug report.

Related: GCP-557

* Fix MC Connect Gateway: use region project for fleet membership

MC clusters are registered in the region project's fleet, not their
own project's fleet. The Connect Gateway URL must reference the project
that owns the fleet membership.

Before: projects/{MC_PROJECT_NUMBER}/locations/.../gkeMemberships/...
After:  projects/{REGION_PROJECT_NUMBER}/locations/.../gkeMemberships/...

This fixes the 403 Forbidden error when accessing MC clusters via
Connect Gateway. The region project number is already available from
the region kubeconfig generation earlier in the script.

Related: GCP-557

* Increase ArgoCD sync validation timeouts

- Step timeout: 60m -> 90m
- Ginkgo suite timeout: add --ginkgo.timeout=85m (5m grace before step kill)

Initial conservative timeouts to establish a baseline for how long
ArgoCD app sync takes in e2e. Can be scaled back once we know what
stable looks like. Individual per-app sync timeouts (45m) are
configured in gcp-hcp-infra test code via env vars.

Related: GCP-557

* Add pre-destroy-cleanup step to remove resources blocking terraform destroy

ArgoCD-deployed applications create GCP resources that terraform does
not manage and cannot delete:

- Gateway API resources (HTTPRoute, Gateway) trigger GKE to create
  Network Endpoint Groups (NEGs) that hold VPC references
- external-dns creates DNS records in regional zones
- These block terraform destroy with 'network in use' and 'zone not
  empty' errors

The pre-destroy-cleanup step runs before tf-deprovision and:
1. Stops ArgoCD (scale down, delete all Applications/ApplicationSets)
2. Deletes Gateway API resources to trigger GKE NEG cleanup
3. Deletes DNS records from regional managed zones
4. Force-deletes remaining NEGs via gcloud

Uses best_effort: true so cleanup failures don't block the job.
Uses Connect Gateway with fresh WIF token (original may have expired).

Does NOT delete resources terraform handles (IAM, KCC resources,
Spanner — these cascade with project deletion).

Related: GCP-557

* Fix pre-destroy-cleanup: bash arithmetic bug and connectivity checks

1. Fix 'syntax error in expression' from wc -l whitespace in arithmetic.
   Added safe_count() helper to strip whitespace before evaluation.

2. Add connectivity verification before attempting kubectl operations.
   Clusters may be unreachable if the access token expired or the
   cluster is already being torn down. Skip kubectl phases gracefully.

3. Improve 'Unable to list' error messages to indicate the project
   may be in deletion state.

Related: GCP-557

* Fix CI checks: add metadata.json, disable sparse checkout, add cluster assignments

- Add missing gcp-hcp-pre-destroy-cleanup-ref.metadata.json
- Add disable_sparse_checkout: true to ci-operator config (the Dockerfile
  needs the full test/ directory, not just test/Dockerfile.e2e)
- Remove prowgen-generated sparse_checkout_files from job configs
- Add cluster assignments (build04 postsubmit, build06 presubmit images)

Related: GCP-557

* Fix CI: move disable_sparse_checkout under prowgen, fix metadata trailing newline

* Fix pre-destroy-cleanup: exit gracefully when provision didn't complete

If tf-provision was interrupted or never ran, the SHARED_DIR won't
have region-project-id. Exit cleanly instead of failing with
'No such file or directory'.

Also fixes: disable_sparse_checkout under prowgen (not top-level),
metadata.json trailing newline.

* Add missing metadata.json for generate-kubeconfigs step

* Replace terraform destroy with force project deletion for reliable cleanup

terraform destroy fails unreliably when orphaned NEGs or other resources
block VPC deletion. This change replaces the pre-destroy-cleanup +
tf-deprovision approach with a single cleanup-infrastructure step that:

1. Stops ArgoCD (prevents resource recreation)
2. Deletes Gateway API resources + removes finalizers
3. Force-deletes remaining NEGs (zonal and regional)
4. Deletes DNS records from regional zones
5. **Force-deletes GCP projects** (bypasses terraform destroy)
6. Clears TFC workspace state via API

This approach is modeled after the Tekton cleanup-infrastructure task
but adapted for Prow/TFC workflow. Project deletion cascades to all
resources (NEGs, VPCs, DNS, GKE, etc.) regardless of terraform state,
making cleanup reliable for ephemeral e2e environments.

Projects enter PENDING_DELETE state (30-day soft delete). The e2e-render
script already generates unique project IDs per run to avoid collisions.

Removes:
- gcp-hcp-pre-destroy-cleanup (partial cleanup, didn't solve the NEG issue)
- gcp-hcp-tf-deprovision (fails when resources block terraform destroy)

Adds:
- gcp-hcp-cleanup-infrastructure (comprehensive cleanup via project deletion)

* Fix critical bugs in cleanup-infrastructure script

Issues fixed:

1. **CRITICAL: Fixed project deletion exit code check**
   - Was checking exit code of 'tee', not 'gcloud projects delete'
   - Now captures output and exit code separately
   - Actually returns non-zero on failure

2. **Added dependency validation**
   - Validates jq, kubectl, gcloud exist at startup
   - Prevents silent failures from missing tools

3. **Fixed TFC workspace deletion exit code**
   - Same pattern as project deletion fix
   - Captures curl exit code correctly

4. **Added curl timeouts**
   - 30s max-time, 10s connect-timeout on TFC API calls
   - Prevents hanging if TFC is slow/down

5. **Better error handling for Gateway finalizer removal**
   - Captures kubectl output before piping to jq
   - Handles missing Gateway CRD gracefully

6. **Made TFC org configurable**
   - Uses TFC_ORGANIZATION env var with fallback
   - Hard-coded value now default, not mandatory

7. **Added comment about 120s wait**
   - Documents that it's a conservative estimate
   - Explains tuning rationale

* Fix cleanup-infrastructure image reference

Use 'from: gcp-hcp-e2e-tests' instead of 'from_image' with ci namespace.
The gcp-hcp-e2e-tests image is built during the job, not imported from
a registry, so we need to reference it as a pipeline image.

This fixes the rehearsal failure:
  failed to import tag ci-gcp-hcp-e2e-tests-latest
  image not found in quay.io/openshift/ci

* Fix cleanup-infrastructure credentials: use correct secret names

- WIF credential comes from SHARED_DIR/wif-cred.json (no mount needed)
- TFC token: use tfcloud-ci-secret in ci namespace (matches tf-provision/tf-deprovision)
- Remove non-existent gcp-hcp-ci-workload-identity and terraform-cloud-token refs
- Add GCP_REGION env var (matches other steps)

* Add best_effort and grace_period to cleanup-infrastructure step

Without best_effort: true, cleanup failures would fail the entire job.
Post-phase cleanup steps should not determine pass/fail — only the
test phase should.

Matches the pattern from tf-deprovision and pre-destroy-cleanup.

* Fix Firestore 409 import detection for TFC remote output

TFC formats error output with │ prefix characters and splits the error
across multiple lines:

  │ Error: Error creating Database: googleapi: Error 409: Database already exists.
  │   with module.management_cluster.google_firestore_database.status

The previous grep pattern 'google_firestore_database.*Database already exists'
requires both strings on the same line, which never matches TFC output.

Fix: use two separate greps to check for each string independently.

* Fix cleanup-infrastructure: use upi-installer image (has jq/gcloud/kubectl)

The gcp-hcp-e2e-tests image is a Go binary for Ginkgo tests — it doesn't
include jq, gcloud, or kubectl. Use ocp/4.22:upi-installer instead, which
is the same image used by pre-destroy-cleanup and generate-kubeconfigs.

* TEMPORARY: Add image check step + use oc instead of kubectl

1. Add check-cleanup-image step as first pre step to validate the
   upi-installer image has all required binaries (jq, gcloud, curl,
   kubectl/oc) before spending 40 min on provision. Will fail fast
   in ~10 seconds if anything is missing.

2. Fix cleanup-infrastructure to use oc as kubectl fallback since
   upi-installer has oc but not kubectl.

TODO: Remove check-cleanup-image step after validation.

* Fix TFC cleanup: use terraform CLI to clear state before workspace delete

The TFC API rejects workspace deletion when it manages resources (403),
and pushing empty state via API fails with lineage/lock conflicts.

Fix: install terraform CLI, create minimal cloud backend config, and use
'terraform state rm' at the module level to clear all resources in ~3s.
Then safe-delete the empty workspace.

Tested locally against platform-e2e-be2f7703 (466 resources):
- terraform state rm module.{customer_project,management_cluster,region}: 3s
- safe-delete: HTTP 204 success

Also handles:
- Force-unlock if workspace locked from previous run
- Fallback to per-resource rm if top-level data sources remain
- Correct terraform version (1.15.8) to match workspace constraint

* Remove check-cleanup-image hack + fix TFC state rm to include data sources

1. Remove temporary check-cleanup-image step (validated upi-installer
   has jq, gcloud, oc, curl — no longer needed)

2. Fix TFC state rm to include data.terraform_remote_state.* sources
   in the bulk rm call. Previous run left 4 data sources in state,
   causing safe-delete to return 409.

3. Remove individual-resource fallback loop (all known addresses are
   now in the bulk rm call)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants