Migrate int and stg e2e jobs to slot-manager#80467
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (12)
💤 Files with no reviewable changes (8)
🚧 Files skipped from review as they are similar to previous changes (4)
WalkthroughIntroduces a new ChangesARO-HCP Persistent E2E Workflow and -rh Credential Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yaml`:
- Around line 239-240: VAULT_SECRET_PROFILE was changed to an int-rh value
without updating the step-level credential profile contracts, so runtime will
not find the mounted credentials; update the step credential declarations used
by the aro-hcp jobs to include the new "-rh" profile names (or revert
VAULT_SECRET_PROFILE to the original profile) so the step
contract/path-derivation logic exposes/mounts the declared profile;
specifically, ensure the steps that reference VAULT_SECRET_PROFILE (the
aro-hcp-persistent-e2e workflow and its related e2e/periodic/periodic-cleanup
job step definitions) declare and mount the "int-rh" (and any other migrated
"*-rh") profiles in their credentials/profile contract blocks to match the env
value.
In
`@ci-operator/step-registry/aro-hcp/test/persistent/aro-hcp-test-persistent-commands.sh`:
- Around line 14-20: When sourcing env_file="${SHARED_DIR}/aro-hcp-slot.env",
preserve the existing fallback behavior for CUSTOMER_SUBSCRIPTION so the script
won't fail under set -u if the env file doesn't set that variable: after
sourcing (inside the branch where env_file exists) export CUSTOMER_SUBSCRIPTION
using the current CUSTOMER_SUBSCRIPTION if present, otherwise read the
subscription from the cluster profile file (the same file used in the else
branch, referenced by CLUSTER_PROFILE_DIR/subscription-name); update the logic
in aro-hcp-test-persistent-commands.sh to perform this conditional export so
both the env file and the cluster-profile fallback are honored.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 87e3db46-4ec4-4fe5-b556-1b24529ce291
📒 Files selected for processing (10)
ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yamlci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__e2e.yamlci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__periodic-cleanup.yamlci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__periodic.yamlci-operator/step-registry/aro-hcp/persistent-e2e/OWNERSci-operator/step-registry/aro-hcp/persistent-e2e/aro-hcp-persistent-e2e-workflow.metadata.jsonci-operator/step-registry/aro-hcp/persistent-e2e/aro-hcp-persistent-e2e-workflow.yamlci-operator/step-registry/aro-hcp/test/persistent/aro-hcp-test-persistent-commands.shcore-services/prow/02_config/_boskos.yamlcore-services/prow/02_config/generate-boskos.py
| VAULT_SECRET_PROFILE: int-rh | ||
| workflow: aro-hcp-persistent-e2e |
There was a problem hiding this comment.
Root cause: VAULT_SECRET_PROFILE values were migrated to *-rh without matching step-level credential profile contract updates across all affected configs.
Affected files: ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yaml, ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__e2e.yaml, ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__periodic.yaml, and ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__periodic-cleanup.yaml.
All these jobs now rely on profile names that the referenced step contracts (and path derivation logic) do not currently show as mounted/declared, which can cause deterministic runtime auth/bootstrap failures.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main.yaml` around lines 239 -
240, VAULT_SECRET_PROFILE was changed to an int-rh value without updating the
step-level credential profile contracts, so runtime will not find the mounted
credentials; update the step credential declarations used by the aro-hcp jobs to
include the new "-rh" profile names (or revert VAULT_SECRET_PROFILE to the
original profile) so the step contract/path-derivation logic exposes/mounts the
declared profile; specifically, ensure the steps that reference
VAULT_SECRET_PROFILE (the aro-hcp-persistent-e2e workflow and its related
e2e/periodic/periodic-cleanup job step definitions) declare and mount the
"int-rh" (and any other migrated "*-rh") profiles in their credentials/profile
contract blocks to match the env value.
| env_file="${SHARED_DIR}/aro-hcp-slot.env" | ||
| if [[ -f "${env_file}" ]]; then | ||
| # shellcheck disable=SC1090 | ||
| source "${env_file}" | ||
| export LOCATION="${SELECTED_LOCATION:-${LOCATION:-}}" | ||
| else | ||
| export CUSTOMER_SUBSCRIPTION; CUSTOMER_SUBSCRIPTION=$(cat "${CLUSTER_PROFILE_DIR}/subscription-name") |
There was a problem hiding this comment.
Preserve the cluster-profile fallback for CUSTOMER_SUBSCRIPTION.
If Line 15 finds ${SHARED_DIR}/aro-hcp-slot.env but that file does not export CUSTOMER_SUBSCRIPTION, Line 24 aborts under set -u. The new branch makes the env file optional for discovery, but mandatory for this value.
Proposed fix
env_file="${SHARED_DIR}/aro-hcp-slot.env"
if [[ -f "${env_file}" ]]; then
# shellcheck disable=SC1090
source "${env_file}"
+ export CUSTOMER_SUBSCRIPTION="${CUSTOMER_SUBSCRIPTION:-$(< "${CLUSTER_PROFILE_DIR}/subscription-name")}"
export LOCATION="${SELECTED_LOCATION:-${LOCATION:-}}"
else
- export CUSTOMER_SUBSCRIPTION; CUSTOMER_SUBSCRIPTION=$(cat "${CLUSTER_PROFILE_DIR}/subscription-name")
+ export CUSTOMER_SUBSCRIPTION="$(< "${CLUSTER_PROFILE_DIR}/subscription-name")"
fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/aro-hcp/test/persistent/aro-hcp-test-persistent-commands.sh`
around lines 14 - 20, When sourcing env_file="${SHARED_DIR}/aro-hcp-slot.env",
preserve the existing fallback behavior for CUSTOMER_SUBSCRIPTION so the script
won't fail under set -u if the env file doesn't set that variable: after
sourcing (inside the branch where env_file exists) export CUSTOMER_SUBSCRIPTION
using the current CUSTOMER_SUBSCRIPTION if present, otherwise read the
subscription from the cluster profile file (the same file used in the else
branch, referenced by CLUSTER_PROFILE_DIR/subscription-name); update the logic
in aro-hcp-test-persistent-commands.sh to perform this conditional export so
both the env file and the cluster-profile fallback are honored.
|
/pj-rehearse pull-ci-Azure-ARO-HCP-main-stage-e2e-parallel |
|
@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@roivaz, |
roivaz
force-pushed
the
migrate-int-and-stg-to-slot-manager
branch
from
343dc44 to
3fa2a8c
Compare
|
@roivaz, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
roivaz
force-pushed
the
migrate-int-and-stg-to-slot-manager
branch
from
3fa2a8c to
f2ed65c
Compare
openshift-ci
Bot
added
the
approved
|
[REHEARSALNOTIFIER]
A total of 27 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-Azure-ARO-HCP-main-stage-e2e-parallel |
|
@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-Azure-ARO-HCP-main-stage-e2e-parallel |
|
@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-Azure-ARO-HCP-main-stage-e2e-parallel |
|
@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: raelga, roivaz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse pull-ci-Azure-ARO-HCP-main-stage-e2e-parallel |
|
@roivaz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
/hold Blocked until we get DSv3 SKU restriction lifted in the new STG subscription (support req ID 2606160050001594) or we somehow switch the SKU for this particular sub. |
openshift-ci
Bot
added
the
do-not-merge/hold
|
@roivaz: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary by CodeRabbit
This PR migrates Azure ARO-HCP's integration (INT) and staging (STG) end-to-end testing jobs from a lease-based resource acquisition model to a slot-manager system for managing Azure subscriptions and service identities.
What Changed
Vault Secret Profiles: The e2e job definitions now reference new Red Hat-specific Vault secret profiles:
int→int-rhstg→stg-rhWorkflow Transition: All affected e2e jobs switch from the
aro-hcp-e2eworkflow to a newaro-hcp-persistent-e2eworkflow. This new workflow is designed to work against pre-deployed persistent environments managed by slot-manager, eliminating the need for job-level resource provisioning/deprovisioning.Lease Removal: The
leasesblocks have been removed from INT and STG job variants across multiple CI configurations (main, periodic) since slot-manager handles resource allocation instead.Subscription Management: Updated cleanup jobs to explicitly specify
CUSTOMER_SUBSCRIPTIONand use environment-specific Vault profiles (int-rh,stg-rh), enabling subscription-specific resource cleanup.Azure Authentication Script: The test execution script now conditionally sources slot-manager-provided environment variables (
aro-hcp-slot.env) for subscription and location configuration, with fallback to cluster profile defaults when not available.Files Modified
Azure-ARO-HCP-main.yaml,Azure-ARO-HCP-main__e2e.yaml,Azure-ARO-HCP-main__periodic.yaml,Azure-ARO-HCP-main__periodic-cleanup.yaml): Updated vault profiles, workflows, and lease removalpersistent-e2e/directory): Added newaro-hcp-persistent-e2e-workflow.yamlwith supporting owners and metadata filesint-rhandstg-rhsecret mountsaro-hcp-test-persistent-commands.sh): Updated subscription and location handling to support slot-manager integrationImpact
This migration enables centralized resource management through slot-manager, reducing per-job provisioning overhead and improving resource utilization for INT and STG environments in the ARO-HCP testing pipeline. The parallel job variants (standard OCP plus nightly/fast/stable) are included in this transition.