Skip to content

Bump AWS FIPS IPI jobs to m6a.2xlarge instances#82033

Open
mkowalski wants to merge 2 commits into
openshift:mainfrom
mkowalski:bump-fips-ipi-instances
Open

Bump AWS FIPS IPI jobs to m6a.2xlarge instances#82033
mkowalski wants to merge 2 commits into
openshift:mainfrom
mkowalski:bump-fips-ipi-instances

Conversation

@mkowalski

@mkowalski mkowalski commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Sets COMPUTE_NODE_TYPE and CONTROL_PLANE_INSTANCE_TYPE to m6a.2xlarge for e2e-aws-ovn-fips (and e2e-aws-ovn-fips-serial) tests in current development releases (main/master, release-4.22, release-4.23) of installer, kubernetes, machine-config-operator, origin, and the nightly-4.22/4.23 release periodics, per Slack thread.

Replaces #82030, which wrongly targeted CVP cluster pools instead of the IPI jobs.

Summary by CodeRabbit

Updates OpenShift CI “AWS OVN FIPS” IPI e2e jobs to run on m6a.2xlarge instead of the default instance sizing by setting COMPUTE_NODE_TYPE and CONTROL_PLANE_INSTANCE_TYPE to m6a.2xlarge. This is applied across the OpenShift component CI config for installer, Kubernetes, machine-config-operator, and origin (development/current release configs), and across nightly release periodics for 4.22 and 4.23 (including the serial and upgrade/no-NAT variants). A follow-up extends the same instance overrides to the previously-missed upgrade FIPS family and the nightly-5.0 FIPS jobs (including the RHCOs9 techpreview variants), ensuring all e2e-aws-ovn*fips* nightly configurations consistently use m6a.2xlarge.

The e2e-aws-ovn-fips jobs are hitting resource pressure on the default
m6a.xlarge nodes. Set COMPUTE_NODE_TYPE and CONTROL_PLANE_INSTANCE_TYPE
to m6a.2xlarge for the FIPS tests in current development releases
(main/master, release-4.22, release-4.23) of installer, kubernetes,
machine-config-operator and origin, plus the nightly-4.22/4.23 release
periodics (including e2e-aws-ovn-fips-serial).

Assisted-By: Claude Fable 5
Signed-off-by: Mat Kowalski <mko@redhat.com>
@openshift-ci

openshift-ci Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mkowalski
Once this PR has been reviewed and has the lgtm label, please assign bertinatto, cheesesashimi, stbenjam, tthvo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: db322149-94b0-4d33-a8ef-ac207d1a6262

📥 Commits

Reviewing files that changed from the base of the PR and between e17539b and 9aa330d.

📒 Files selected for processing (3)
  • ci-operator/config/openshift/release/openshift-release-main__nightly-4.22.yaml
  • ci-operator/config/openshift/release/openshift-release-main__nightly-4.23.yaml
  • ci-operator/config/openshift/release/openshift-release-main__nightly-5.0.yaml

Walkthrough

The CI configurations for OpenShift FIPS AWS e2e jobs now set both compute and control-plane instance types to m6a.2xlarge, including nightly serial and upgrade jobs.

Changes

FIPS AWS instance sizing

Layer / File(s) Summary
Component FIPS job environments
ci-operator/config/openshift*/...
Adds COMPUTE_NODE_TYPE and CONTROL_PLANE_INSTANCE_TYPE, both set to m6a.2xlarge, across installer, Kubernetes, Machine Config Operator, and origin FIPS jobs.
Nightly FIPS job environments
ci-operator/config/openshift/release/*
Adds the same instance sizing variables to nightly 4.22, 4.23, and 5.0 FIPS, upgrade, no-NAT, tech-preview, and serial jobs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested labels: rehearsals-ack

Suggested reviewers: droslean, jubittajohn, vr4manta

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: updating AWS FIPS IPI jobs to use m6a.2xlarge instances.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PASS: The PR only changes ci-operator YAML job configs; no Ginkgo test titles or It/Describe/Context/When calls were added or modified.
Test Structure And Quality ✅ Passed PR only changes CI YAML env vars; no Ginkgo/Go test code was modified, so the test-structure checklist is not applicable.
Microshift Test Compatibility ✅ Passed Only CI release YAML changed (instance-type env vars); no new Ginkgo tests or MicroShift-sensitive code was added, so the check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Only CI YAML env vars changed; no Go/Ginkgo tests were added or modified, so the SNO test-compatibility check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PASS: only ci-operator test configs were changed to set AWS instance types; no deployment manifests, operator code, or controllers were modified.
Ote Binary Stdout Contract ✅ Passed Only CI YAML env vars changed; no OTE binary code or process-level stdout writes were touched.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS: The diff only changes CI YAML env vars for existing jobs; no Go/Ginkgo test code or new It/Describe/Context/When blocks were added.
No-Weak-Crypto ✅ Passed Touched YAML only adds AWS instance-type env vars; exact weak-crypto scan found no MD5/SHA1/DES/RC4/etc or custom crypto.
Container-Privileges ✅ Passed Only env vars were added in the touched YAMLs; no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings were introduced.
No-Sensitive-Data-In-Logs ✅ Passed PR only adds COMPUTE_NODE_TYPE/CONTROL_PLANE_INSTANCE_TYPE env vars in CI YAML; no log statements, secrets, or PII-like content in added lines.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from droslean and jubittajohn July 16, 2026 18:26
@dgoodwin

Copy link
Copy Markdown
Contributor

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview and periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips are the two jobs on my radar, but I don't see them in the list of affected jobs. They must be using a slightly different step? The list of jobs above looks good, just needs more I think. Possibility the list is not exhaustive, which could be verified by using /pj-rehearse on the job names I just gave, but it looks to me like upgrade was missed.

Once that's identified then you can rehearse on a selection of the jobs above, and we can verify they got the right instances sizes and hopefully saw no cpu disruption.

Follow-up to the previous commit: the e2e-aws-ovn-upgrade-fips family
and the nightly-5.0 FIPS jobs were missed. Add the same
COMPUTE_NODE_TYPE/CONTROL_PLANE_INSTANCE_TYPE=m6a.2xlarge overrides to
all e2e-aws-ovn*fips* tests in nightly-4.22, nightly-4.23 and
nightly-5.0 release configs.

Assisted-By: Claude Fable 5
Signed-off-by: Mat Kowalski <mko@redhat.com>
@mkowalski

Copy link
Copy Markdown
Contributor Author

Good catch — the e2e-aws-ovn-upgrade-fips family and all nightly-5.0 FIPS jobs were indeed missed (the first pass only covered e2e-aws-ovn-fips(-serial) in nightly-4.22/4.23). Added in 9aa330d: all e2e-aws-ovn*fips* tests in nightly-4.22, nightly-4.23 and nightly-5.0 now set COMPUTE_NODE_TYPE/CONTROL_PLANE_INSTANCE_TYPE to m6a.2xlarge, including:

  • periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview
  • ...-upgrade-fips-rhcos9-10-techpreview, ...-upgrade-fips-no-nat-instance, and the plain fips/fips-serial 5.0 jobs

@mkowalski

Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@mkowalski: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@mkowalski: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-machine-config-operator-release-4.22-e2e-aws-ovn-fips openshift/machine-config-operator presubmit Ci-operator config changed
pull-ci-openshift-machine-config-operator-main-e2e-aws-ovn-fips openshift/machine-config-operator presubmit Ci-operator config changed
pull-ci-openshift-machine-config-operator-release-4.23-e2e-aws-ovn-fips openshift/machine-config-operator presubmit Ci-operator config changed
pull-ci-openshift-origin-release-4.23-e2e-aws-ovn-fips openshift/origin presubmit Ci-operator config changed
pull-ci-openshift-origin-main-e2e-aws-ovn-fips openshift/origin presubmit Ci-operator config changed
pull-ci-openshift-origin-release-4.22-e2e-aws-ovn-fips openshift/origin presubmit Ci-operator config changed
pull-ci-openshift-installer-main-e2e-aws-ovn-fips openshift/installer presubmit Ci-operator config changed
pull-ci-openshift-installer-release-4.23-e2e-aws-ovn-fips openshift/installer presubmit Ci-operator config changed
pull-ci-openshift-installer-release-4.22-e2e-aws-ovn-fips openshift/installer presubmit Ci-operator config changed
pull-ci-openshift-kubernetes-release-4.23-e2e-aws-ovn-fips openshift/kubernetes presubmit Ci-operator config changed
pull-ci-openshift-kubernetes-master-e2e-aws-ovn-fips openshift/kubernetes presubmit Ci-operator config changed
pull-ci-openshift-kubernetes-release-4.22-e2e-aws-ovn-fips openshift/kubernetes presubmit Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-fips N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-fips-serial N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips-no-nat-instance N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips-serial N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.23-e2e-aws-ovn-upgrade-fips N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.23-e2e-aws-ovn-upgrade-fips-no-nat-instance N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-no-nat-instance N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.23-e2e-aws-ovn-fips N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-4.23-e2e-aws-ovn-fips-serial N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips N/A periodic Ci-operator config changed
periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-10-techpreview N/A periodic Ci-operator config changed

A total of 26 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@dgoodwin

Copy link
Copy Markdown
Contributor

On hold while we see if openshift/origin#31377 works

@mkowalski

Copy link
Copy Markdown
Contributor Author

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 20, 2026
@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

@mkowalski: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview 9aa330d link unknown /pj-rehearse periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants