openshift/install e2e-aws add run smoke tests - #1317
Conversation
790c36f to
aafe668
Compare
There was a problem hiding this comment.
you should be able to just bazel run
There was a problem hiding this comment.
Why does this vary per job?
There was a problem hiding this comment.
nope, it should not
There was a problem hiding this comment.
WIP lol It was wrong.. I've updated (since I was kind of able to test locally) I've made the change to the correct template now
aafe668 to
63e0e75
Compare
There was a problem hiding this comment.
@stevekuznetsov This is only to get the bazel binary available, to run bazel build smoke_tests . If we can add that to the base image, we won't need this.
There was a problem hiding this comment.
@stevekuznetsov I need to run above 2 lines from directory where openshift/installer source code is.. is this where it is?? I haven't gotten that far in my testing to find out...
There was a problem hiding this comment.
You want a cluster-launch-installer-src template, look at cluster-launch-src for examples
63e0e75 to
64d5368
Compare
There was a problem hiding this comment.
@stevekuznetsov This is for local testing using rh-dev account.. will change it back or put in an if_local_dev block or something
There was a problem hiding this comment.
Let's remove the local dev bits
a7afe39 to
806c4c7
Compare
afec203 to
f0ebf51
Compare
f0ebf51 to
169fc45
Compare
There was a problem hiding this comment.
We can remove "(if post remove etcd)", since both this repo and the installer repo are past that point.
There was a problem hiding this comment.
ok, there was talk that the bootstrap instance would eventually not be included in the overall node count though? if it's terminated after the bootstrap is complete? we'll have to keep an eye on that number, it definitely shouldn't be hardcoded the way it is
There was a problem hiding this comment.
...there was talk that the bootstrap instance would eventually not be included in the overall node count though?
I'm hoping that when that happens, we'll have terminated the bootstrap node by tge time the installer exits. We may need parallel release/installer PRs for that, but the etcd comment is stale ;).
There was a problem hiding this comment.
What's this about? Are you suggesting calculating this from inputs.yaml?
There was a problem hiding this comment.
yea, or keeping it in a variable rather than hardcoded there
169fc45 to
b675583
Compare
There was a problem hiding this comment.
nit: we should be able to drop this. cp can create the target directory on its own:
$ mkdir -p a/b
$ cd a
$ cp -vR . /tmp/installer-src
‘.’ -> ‘/tmp/installer-src’
‘./b’ -> ‘/tmp/installer-src/b’Once we drop the mkdir, the only thing left is the cp call. So we should be able to drop the shell entirely, and go straight to cp:
command:
- cp
- -R
- .
- /tmp/installer-srcor something like that.
There was a problem hiding this comment.
There's previous discussion of source access here. But using parallel containers for the copy and Bazel tests seems pretty complicated. I'm fine with this approach to get this PR landed, but it would be nice if there was an easier way...
There was a problem hiding this comment.
it would be nice! took me quite awhile to figure that out lol
There was a problem hiding this comment.
What's this which doing? Can we drop it?
There was a problem hiding this comment.
yea, it was also debugging, fixing..
There was a problem hiding this comment.
Does the cache need to be mounted into the container? We don't mount it here, and the tarball build seems to work. After a successful build, you're already copying the smoke-test binary out of its symlinked location into /tmp/smoke. I expect all other Bazel files could die with the container.
There was a problem hiding this comment.
yes, I can def delete the other files, meant to do that.. I was stumped with the .cache stuff, I'm not sure what's going on there, yea, our other job does not require that, I know! I kept getting Permission Denied, can't create .cache/bazel-something so creating a writable path for that solved the issue.. anyways, I'll clean up the other files we don't need...
There was a problem hiding this comment.
cleaned up bazel-bin
There was a problem hiding this comment.
I kept getting Permission Denied, can't create .cache/bazel-something so creating a writable path for that solved the issue...
Ah, probably because of the random UID Prow uses and the lack of $HOME. More on this issue in #1178 and #1185. Try something like this (and if you also go that route for USER, you can drop your internal export from the script).
There was a problem hiding this comment.
Can we drop the "${@}"? This script isn't going to be called with arguments, is it?
There was a problem hiding this comment.
These two lines feel like debugging information that we can drop, now that you have the wait loop set up.
There was a problem hiding this comment.
yea, right. fixing..
e515cac to
04fdedc
Compare
3776f5c to
a1e585d
Compare
a1e585d to
199f2e0
Compare
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sallyom, smarterclayton The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@sallyom: Updated the following 2 configmaps:
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@sallyom: The following updates succeeded:
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
This is giving us errors like: This is possibly because the |
|
And also #1431. |
|
And also #1433. |
|
And also #1434. |
Like 81a9e69 (openshift-installer-presubmits: Normalize job names, 2018-09-04, openshift#1354), but for the new smoke-test job from 199f2e0 (openshift/install e2e-aws add run smoke tests, 2018-08-28, openshift#1317).
Since 199f2e07 (openshift/install e2e-aws add run smoke tests, 2018-08-28, openshift/release#1317) we've been running the smoke tests on AWS via Prow, so we can drop our Jenkins bindings. This commit also drops Dockerfiles for some images which have been supplanted in Prow by 5e94276 (add Dockerfiles for ci, 2018-09-06, openshift#223).
…onfig Catching up with 56600df (add configmap for e2e-aws-smoke, 2018-09-10, openshift#1434) and ultimately with 199f2e0 (openshift/install e2e-aws add run smoke tests, 2018-08-28, openshift#1317).
This is only needed in rhcos.sh for old versions which lack the openshift-install coreos-print-stream-json option, and the file moved in openshift/installer#5252 so we should only copy if the "old" location is detected
…83501) * feat(gcp-hcp): implement ArgoCD sync validation with Ginkgo v2 tests Implements GCP-557: Replace placeholder ArgoCD validation step with real Ginkgo v2 tests Changes: - ci-operator config: Add gcp-hcp-e2e-tests image build from Dockerfile.e2e - verify-argocd-sync commands.sh: Replace placeholder with full implementation - Authenticate with WIF credential from hypershift-gcp-wif-auth step - Generate region and MC cluster kubeconfigs via gcloud CLI - Run Ginkgo v2 test binary with JUnit output - Export REGION_KUBECONFIG and MC_KUBECONFIG to test environment - verify-argocd-sync ref.yaml: Update step configuration - Use gcp-hcp-e2e-tests image (from gcp-hcp-infra repo) - Increase resources: 500m CPU, 1Gi memory (for Go client libraries) - Increase timeout: 60min (accommodates 30min sync + retries + setup) - Update documentation with dependencies and environment variables Architecture: - Bash wrapper: WIF auth + kubeconfig generation via gcloud CLI - Ginkgo test binary: Pure Go validation using controller-runtime/client-go - No gcloud SDK in test image (only in wrapper script) - JUnit XML output to ARTIFACT_DIR for Prow test grid Test flow: 1. Wait for ArgoCD namespace (20min timeout) 2. Wait for ArgoCD server deployment ready (20min timeout) 3. Poll Applications for Synced status (30min timeout, configurable) 4. Auto-retry stuck apps every 2 minutes 5. Optional MC cluster validation (skips if MC_KUBECONFIG not set) Related: openshift-online/gcp-hcp-infra commit 29b7ce7f * fix(ci-operator): correct images section format to use items key The images section requires an 'items' key for the list of images. This matches the format used in other ci-operator configs like openshift/hypershift. * fix(ci): regenerate Prow jobs for gcp-hcp-e2e-tests image Running make jobs with increased Docker memory (8GB) to regenerate Prow job configurations after adding gcp-hcp-e2e-tests image to ci-operator config. Changes: - Update decoration_config to use sparse checkout for Dockerfile.e2e - Move github-credentials from volumes to oauth_token_secret in decoration - Remove redundant github-credentials volume definitions Resolves generated-config CI check failure. * fix(ci): remove github-credentials volumeMounts after moving to oauth_token_secret The previous commit moved github-credentials to decoration_config oauth_token_secret but left the volumeMount references, causing: 'volumeMount named "github-credentials-openshift-ci-robot-private-git-cloner" is undefined' Removed all volumeMount entries for github-credentials since oauth_token_secret in decoration_config provides credentials without explicit volume mounts. * fix(security): remove MC_CLUSTER_ENDPOINT from log output Cluster endpoints can expose internal hostnames/IPs. Remove from diagnostic logging per CodeRabbit security finding. * fix: use distinct region cluster name and make MC kubeconfig conditional - Export region.value.cluster_name as region-cluster-name in provision step - Use REGION_CLUSTER_NAME for region kubeconfig (not MC_CLUSTER_NAME) - Make MC kubeconfig generation conditional (don't fail if MC unavailable) - Tests will skip MC validation if MC_KUBECONFIG not set Addresses CodeRabbit findings: - 3793583558: Use region cluster name for region kubeconfig - 3793583560: Keep region validation available when MC unavailable * fix: address remaining CodeRabbit findings - Update workflow doc to describe real ArgoCD validation (not placeholder) - Add curl timeouts (--connect-timeout 10 --max-time 60) to tfc_api_call - Fix errexit control flow in terraform apply/destroy retry loops (capture command in if statement to prevent set -e exit before retry) Addresses CodeRabbit findings: - 3793583549: Update test phase documentation - 3793583551: Set timeout for TFC API requests - 3793583554: Fix errexit control flow in terraform retry loops * feat(ci): add image promotion for gcp-hcp-e2e-tests Following HyperShift pattern, add promotion config to push the gcp-hcp-e2e-tests image to ci namespace on merge. This replaces the deprecated BuildConfig pattern with modern ci-operator image building and promotion. Without promotion, the image is rebuilt from scratch for every e2e job run. With promotion, the image is pushed to registry on merge and reused by subsequent jobs. Pattern matches openshift/hypershift config: - Build image during CI from Dockerfile.e2e - Promote to ci namespace with latest tag on postsubmit - Step-registry references via 'from: gcp-hcp-e2e-tests' Context: Builds on app.ci are deprecated (per DPTP). The modern pattern is ci-operator images + promotion config instead of BuildConfigs in clusters/app.ci/supplemental-ci-images/. * chore(ci): regenerate Prow jobs for image promotion Regenerated after adding promotion config. Creates new postsubmit job 'branch-ci-openshift-online-gcp-hcp-infra-main-images' that pushes gcp-hcp-e2e-tests to ci namespace on merge. * fix(e2e): split kubeconfig generation into separate step to avoid gcloud dependency in test image The verify-argocd-sync step was trying to run gcloud commands inside the gcp-hcp-e2e-tests image, which only contains the compiled Go test binary. This caused failures with 'gcloud: command not found'. Solution: Create new gcp-hcp-generate-kubeconfigs step that: - Runs in upi-installer image (has gcloud) - Generates static kubeconfigs with embedded access tokens - Saves kubeconfigs to SHARED_DIR for downstream steps The verify-argocd-sync step now: - Runs in gcp-hcp-e2e-tests image (test binary only) - Reads pre-generated kubeconfigs from SHARED_DIR - Executes Ginkgo v2 tests using native Kubernetes client-go This follows the same pattern as HyperShift E2E tests and avoids mixing infrastructure tooling (gcloud) with test execution (Go binary). * Use DNS/public endpoint for GKE kubeconfig generation Private GKE clusters with enable_private_endpoint=true return the internal endpoint when queried with --format='value(endpoint)'. Test pods cannot reach the private endpoint from the Prow cluster. This change prioritizes DNS-based endpoints (dnsConfig.clusterDns) which are publicly accessible when dns_allow_external_traffic=true, and falls back to the public IP endpoint (privateClusterConfig.publicEndpoint) if DNS endpoints are not configured. This ensures kubectl can access the clusters without requiring gcloud credential helpers or VPN connectivity. * Trigger rehearsal after gcp-hcp-infra PR #1317 merge * Add missing github-credentials volume to e2e-platform job The volumeMount was present but the corresponding volume definition was missing, causing pj-rehearse configuration validation to fail. This volume is needed for ci-operator's --oauth-token-path argument which provides GitHub authentication for private repo access during the test workflow. * Revert: Remove manually-added github-credentials volume The volume 'github-credentials-openshift-ci-robot-private-git-cloner' is reserved for Prow's decoration system and is automatically added based on the --oauth-token-path argument. Adding it manually causes a conflict: 'volume github-credentials-openshift-ci-robot-private-git-cloner is a reserved for decoration' Prow's decorator handles this volume automatically - no manual definition needed. * Update Dockerfile path for e2e test relocation Updates ci-operator config to use test/Dockerfile.e2e after the e2e test files were moved from repo root to test/ directory. Changes: - dockerfile_path: Dockerfile.e2e → test/Dockerfile.e2e - sparse_checkout_files: Dockerfile.e2e → test/Dockerfile.e2e (6 jobs) This change must be applied atomically with openshift-online/gcp-hcp-infra#1326. Related: GCP-557 * Disable Ginkgo color output for cleaner CI logs Adds --ginkgo.no-color flag to test execution. Color codes don't render well in CI log viewers and make output harder to read. Related: GCP-557 * Fix build context for relocated test files Sets context_dir: test so Dockerfile.e2e can find go.mod/go.sum in the correct location. The dockerfile_path is relative to context_dir. Without this, the build fails with: error: copier: stat: "/go.mod": no such file or directory Changes: - context_dir: test (new) - dockerfile_path: test/Dockerfile.e2e → Dockerfile.e2e (relative to context_dir) Related: GCP-557 * Fix sparse checkout by using inputs.src.paths for complete test/ directory The previous approach only checked out test/Dockerfile.e2e via sparse_checkout_files, but the build needs: - test/go.mod - test/go.sum - test/e2e/ Using inputs.src.paths copies the entire test/ directory into the build context, ensuring all required files are available. This replaces sparse checkout with explicit source path mapping: source: /go/src/github.com/openshift-online/gcp-hcp-infra/test dest: . (build context root) Related: GCP-557 * Fix sparse checkout to include entire test/ directory Prowgen auto-generates sparse_checkout_files based on dockerfile_path, but only includes the Dockerfile itself. This causes build failures because go.mod, go.sum, and e2e/ directory are not checked out. Manual fix: Change sparse_checkout_files from 'test/Dockerfile.e2e' to 'test/' to check out the entire test directory. This is the CORRECT and FINAL fix. All required files will now be available: - test/go.mod - test/go.sum - test/e2e/ - test/Dockerfile.e2e Related: GCP-557 * Use private endpoint for cluster connectivity from Prow GKE private clusters are not reachable via public IP from Prow pods. The test was failing with: dial tcp 34.41.118.126:443: i/o timeout This was because we were using publicEndpoint as the fallback when DNS endpoint was unavailable. Fix: Use privateEndpoint instead of publicEndpoint for cluster-to-cluster connectivity. Prow pods run in the same GCP network and can reach private endpoints. Endpoint priority: 1. DNS endpoint (dnsConfig.clusterDns) - preferred 2. Private endpoint (privateClusterConfig.privateEndpoint) - fallback Related: GCP-557 * Revert incorrect private endpoint change - need to research actual network topology * Use gcloud get-credentials with --dns-endpoint for kubeconfig generation Instead of manually constructing kubeconfigs, use gcloud's built-in get-credentials command with the --dns-endpoint flag. This matches the working manual connection method. Benefits: - Uses the same method that works for manual access - Automatically handles authentication and endpoint selection - Simpler and more maintainable code - gcloud handles DNS endpoint resolution correctly The --dns-endpoint flag tells gcloud to use the DNS-based cluster endpoint (e.g., clustername.p.googleapis.com) instead of IP addresses. Related: GCP-557 * Revert "Use gcloud get-credentials with --dns-endpoint for kubeconfig generation" This reverts commit 962f370. * Use Connect Gateway for cluster access instead of public endpoint Connect Gateway allows secure access to GKE clusters without requiring public master endpoints. This works with private clusters and uses fleet membership (which is already configured). Endpoint format: https://{region}-connectgateway.googleapis.com/v1/projects/{projectNumber}/locations/{region}/gkeMemberships/{clusterName} Benefits: - Works with private master endpoints (no need for enable_private_endpoint=false) - Uses existing fleet enrollment - Same embedded access token pattern (valid for 1 hour) - More secure than public endpoints The kubeconfig uses an embedded access token from WIF which is valid for 1 hour - sufficient for CI jobs that run 30-60 minutes max. Related: GCP-557 * Fix Connect Gateway TLS: remove cluster CA from kubeconfig Connect Gateway (connectgateway.googleapis.com) uses Google's public TLS certificates signed by Google Trust Services, not the cluster's self-signed CA. Including certificate-authority-data caused x509 validation failure: tls: failed to verify certificate: x509: certificate signed by unknown authority Fix: omit certificate-authority-data entirely and let the system CA bundle validate Google's public certs. Also removed the now-unnecessary gcloud container clusters describe calls that were only used to fetch the CA certificate. Related: GCP-557 * Workaround Firestore provider bug: import orphaned databases on 409 hashicorp/terraform-provider-google#22533: on freshly created projects, google_firestore_database has a read-after-write consistency bug. The provider creates the database successfully, but the immediate GET returns 404 (~80ms after creation), so the resource is dropped from state. The next apply attempt fails with 409 'Database already exists' because the database exists in GCP but not in state. Fix: detect the 409 pattern in apply output, extract the MC project ID from terraform state/outputs, and terraform import the orphaned database resources before retrying. This restores state consistency so the retry succeeds. Affects ~60% of freshly created projects per upstream bug report. Related: GCP-557 * Fix MC Connect Gateway: use region project for fleet membership MC clusters are registered in the region project's fleet, not their own project's fleet. The Connect Gateway URL must reference the project that owns the fleet membership. Before: projects/{MC_PROJECT_NUMBER}/locations/.../gkeMemberships/... After: projects/{REGION_PROJECT_NUMBER}/locations/.../gkeMemberships/... This fixes the 403 Forbidden error when accessing MC clusters via Connect Gateway. The region project number is already available from the region kubeconfig generation earlier in the script. Related: GCP-557 * Increase ArgoCD sync validation timeouts - Step timeout: 60m -> 90m - Ginkgo suite timeout: add --ginkgo.timeout=85m (5m grace before step kill) Initial conservative timeouts to establish a baseline for how long ArgoCD app sync takes in e2e. Can be scaled back once we know what stable looks like. Individual per-app sync timeouts (45m) are configured in gcp-hcp-infra test code via env vars. Related: GCP-557 * Add pre-destroy-cleanup step to remove resources blocking terraform destroy ArgoCD-deployed applications create GCP resources that terraform does not manage and cannot delete: - Gateway API resources (HTTPRoute, Gateway) trigger GKE to create Network Endpoint Groups (NEGs) that hold VPC references - external-dns creates DNS records in regional zones - These block terraform destroy with 'network in use' and 'zone not empty' errors The pre-destroy-cleanup step runs before tf-deprovision and: 1. Stops ArgoCD (scale down, delete all Applications/ApplicationSets) 2. Deletes Gateway API resources to trigger GKE NEG cleanup 3. Deletes DNS records from regional managed zones 4. Force-deletes remaining NEGs via gcloud Uses best_effort: true so cleanup failures don't block the job. Uses Connect Gateway with fresh WIF token (original may have expired). Does NOT delete resources terraform handles (IAM, KCC resources, Spanner — these cascade with project deletion). Related: GCP-557 * Fix pre-destroy-cleanup: bash arithmetic bug and connectivity checks 1. Fix 'syntax error in expression' from wc -l whitespace in arithmetic. Added safe_count() helper to strip whitespace before evaluation. 2. Add connectivity verification before attempting kubectl operations. Clusters may be unreachable if the access token expired or the cluster is already being torn down. Skip kubectl phases gracefully. 3. Improve 'Unable to list' error messages to indicate the project may be in deletion state. Related: GCP-557 * Fix CI checks: add metadata.json, disable sparse checkout, add cluster assignments - Add missing gcp-hcp-pre-destroy-cleanup-ref.metadata.json - Add disable_sparse_checkout: true to ci-operator config (the Dockerfile needs the full test/ directory, not just test/Dockerfile.e2e) - Remove prowgen-generated sparse_checkout_files from job configs - Add cluster assignments (build04 postsubmit, build06 presubmit images) Related: GCP-557 * Fix CI: move disable_sparse_checkout under prowgen, fix metadata trailing newline * Fix pre-destroy-cleanup: exit gracefully when provision didn't complete If tf-provision was interrupted or never ran, the SHARED_DIR won't have region-project-id. Exit cleanly instead of failing with 'No such file or directory'. Also fixes: disable_sparse_checkout under prowgen (not top-level), metadata.json trailing newline. * Add missing metadata.json for generate-kubeconfigs step * Replace terraform destroy with force project deletion for reliable cleanup terraform destroy fails unreliably when orphaned NEGs or other resources block VPC deletion. This change replaces the pre-destroy-cleanup + tf-deprovision approach with a single cleanup-infrastructure step that: 1. Stops ArgoCD (prevents resource recreation) 2. Deletes Gateway API resources + removes finalizers 3. Force-deletes remaining NEGs (zonal and regional) 4. Deletes DNS records from regional zones 5. **Force-deletes GCP projects** (bypasses terraform destroy) 6. Clears TFC workspace state via API This approach is modeled after the Tekton cleanup-infrastructure task but adapted for Prow/TFC workflow. Project deletion cascades to all resources (NEGs, VPCs, DNS, GKE, etc.) regardless of terraform state, making cleanup reliable for ephemeral e2e environments. Projects enter PENDING_DELETE state (30-day soft delete). The e2e-render script already generates unique project IDs per run to avoid collisions. Removes: - gcp-hcp-pre-destroy-cleanup (partial cleanup, didn't solve the NEG issue) - gcp-hcp-tf-deprovision (fails when resources block terraform destroy) Adds: - gcp-hcp-cleanup-infrastructure (comprehensive cleanup via project deletion) * Fix critical bugs in cleanup-infrastructure script Issues fixed: 1. **CRITICAL: Fixed project deletion exit code check** - Was checking exit code of 'tee', not 'gcloud projects delete' - Now captures output and exit code separately - Actually returns non-zero on failure 2. **Added dependency validation** - Validates jq, kubectl, gcloud exist at startup - Prevents silent failures from missing tools 3. **Fixed TFC workspace deletion exit code** - Same pattern as project deletion fix - Captures curl exit code correctly 4. **Added curl timeouts** - 30s max-time, 10s connect-timeout on TFC API calls - Prevents hanging if TFC is slow/down 5. **Better error handling for Gateway finalizer removal** - Captures kubectl output before piping to jq - Handles missing Gateway CRD gracefully 6. **Made TFC org configurable** - Uses TFC_ORGANIZATION env var with fallback - Hard-coded value now default, not mandatory 7. **Added comment about 120s wait** - Documents that it's a conservative estimate - Explains tuning rationale * Fix cleanup-infrastructure image reference Use 'from: gcp-hcp-e2e-tests' instead of 'from_image' with ci namespace. The gcp-hcp-e2e-tests image is built during the job, not imported from a registry, so we need to reference it as a pipeline image. This fixes the rehearsal failure: failed to import tag ci-gcp-hcp-e2e-tests-latest image not found in quay.io/openshift/ci * Fix cleanup-infrastructure credentials: use correct secret names - WIF credential comes from SHARED_DIR/wif-cred.json (no mount needed) - TFC token: use tfcloud-ci-secret in ci namespace (matches tf-provision/tf-deprovision) - Remove non-existent gcp-hcp-ci-workload-identity and terraform-cloud-token refs - Add GCP_REGION env var (matches other steps) * Add best_effort and grace_period to cleanup-infrastructure step Without best_effort: true, cleanup failures would fail the entire job. Post-phase cleanup steps should not determine pass/fail — only the test phase should. Matches the pattern from tf-deprovision and pre-destroy-cleanup. * Fix Firestore 409 import detection for TFC remote output TFC formats error output with │ prefix characters and splits the error across multiple lines: │ Error: Error creating Database: googleapi: Error 409: Database already exists. │ with module.management_cluster.google_firestore_database.status The previous grep pattern 'google_firestore_database.*Database already exists' requires both strings on the same line, which never matches TFC output. Fix: use two separate greps to check for each string independently. * Fix cleanup-infrastructure: use upi-installer image (has jq/gcloud/kubectl) The gcp-hcp-e2e-tests image is a Go binary for Ginkgo tests — it doesn't include jq, gcloud, or kubectl. Use ocp/4.22:upi-installer instead, which is the same image used by pre-destroy-cleanup and generate-kubeconfigs. * TEMPORARY: Add image check step + use oc instead of kubectl 1. Add check-cleanup-image step as first pre step to validate the upi-installer image has all required binaries (jq, gcloud, curl, kubectl/oc) before spending 40 min on provision. Will fail fast in ~10 seconds if anything is missing. 2. Fix cleanup-infrastructure to use oc as kubectl fallback since upi-installer has oc but not kubectl. TODO: Remove check-cleanup-image step after validation. * Fix TFC cleanup: use terraform CLI to clear state before workspace delete The TFC API rejects workspace deletion when it manages resources (403), and pushing empty state via API fails with lineage/lock conflicts. Fix: install terraform CLI, create minimal cloud backend config, and use 'terraform state rm' at the module level to clear all resources in ~3s. Then safe-delete the empty workspace. Tested locally against platform-e2e-be2f7703 (466 resources): - terraform state rm module.{customer_project,management_cluster,region}: 3s - safe-delete: HTTP 204 success Also handles: - Force-unlock if workspace locked from previous run - Fallback to per-resource rm if top-level data sources remain - Correct terraform version (1.15.8) to match workspace constraint * Remove check-cleanup-image hack + fix TFC state rm to include data sources 1. Remove temporary check-cleanup-image step (validated upi-installer has jq, gcloud, oc, curl — no longer needed) 2. Fix TFC state rm to include data.terraform_remote_state.* sources in the bulk rm call. Previous run left 4 data sources in state, causing safe-delete to return 409. 3. Remove individual-resource fallback loop (all known addresses are now in the bulk rm call)
This PR depends on openshift/installer#223 for Dockerfiles
@bbguimaraes @stevekuznetsov
EDITED:
Ran this from local system, from openshift/ci-operator dir:
and I've placed 3 files in a
local installer/secret dir: license, pull-secret, and .aws/credentialsRunning this cmd:
And then, creating like so (noting here so I have record/don't forget):
1.
oc create secret generic dev-cluster-profile --from-file=/local/path/to/aws/openshift.yaml -n myns2.
oc create secret -n myns generic cluster-secrets-aws --from-file=/path/to/secret/pull-secret --from-file=/path/to/secret/license --from-file=/path/to/secret/credentials -o yaml --dry-run | oc apply -n myns -f -3.
oc create -f release/cluster/ci/config/installer-origin-release-bazel.yaml -n openshift(tested in my ns)I have tested this several times locally, all looks good, hoping it works same way w/in the presubmit job