SPLAT-2253: CCM-AWS config enforce to provision Service NLB with SG under gate #391
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
mtulio
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@mtulio: This pull request references SPLAT-2253 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test all |
mtulio
changed the title
|
PR rebased with upstream updates, and CCCMO FG support by #400 |
|
Next step: create a CI job to exercise this scenario. |
|
/test ? |
|
@mtulio: The following commands are available to trigger required jobs: The following commands are available to trigger optional jobs: Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@mtulio: This pull request references SPLAT-2253 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
mtulio
changed the title
openshift-ci-robot
removed
the
jira/valid-reference
|
@mtulio: No Jira issue is referenced in the title of this pull request. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/payload-job ? |
|
/testwith openshift/cluster-cloud-controller-manager-operator/main/e2e-aws-ovn openshift/origin#30235 openshift/cloud-provider-aws#117 |
|
/testwith openshift/cluster-cloud-controller-manager-operator/main/e2e-aws-ovn openshift/cloud-provider-aws#117 |
mtulio
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@mtulio: This pull request references SPLAT-2253 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Update kubernetes/cloud-provider-aws lib to use latest support of Service type-loadBalancer NLB with support of Security Groups. Also update the openshift clients with support of kube 1.34.
Update kubernetes/cloud-provider-aws lib to use latest support of Service type-loadBalancer NLB with support of Security Groups.
|
/test all |
|
/testwith openshift/origin/main/e2e-aws-ovn openshift/cloud-provider-aws#117 |
|
@mtulio, |
|
/test ? |
|
@mtulio: The following commands are available to trigger required jobs: The following commands are available to trigger optional jobs: Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Checking TP job while investigating unit: |
Enforce CCM to manage Security Group by default for security compliance and best practices on Service type-loadBalancer when using Network Load Balancer (NLB).
|
Still investigating to fix the units due FG, but the TP job e2e-aws-ovn-techpreview is reporting with the SG attached, meaning the cloud-config is correctly enforced, and CCM is managing SG as expected: |
|
Unit is ok locally: /test unit |
|
verify and vendor are also green. Let me convert to ready for review and trigger the option TP job again followed by OTE (test with CCM and Origin - next comment): /test e2e-aws-ovn-techpreview |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/testwith openshift/cluster-cloud-controller-manager-operator/main/e2e-aws-ovn-techpreview openshift/cloud-provider-aws#117 openshift/origin#30235 |
|
@mtulio: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@mtulio: This pull request references SPLAT-2253 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Upgrading from k8s 1.33 to 1.34 introduced JSON marshaling behavior changed, and looks like when updating openshift clients it is hitting the unit tests resourceapply to fail when calculating the hash of object. Considering this would be unrelated with changes introduced to this PR, I will open a different thread to discuss the correct approach. As for now my view is this is blocking this PR as it requires to update cloud-provider-aws to 1.34 (which requires o && k 1.34) cc @rvanderp3 @damdo |
|
This PR is blocked by #428 where there will provide the bump as well fixes found in the unit tests. /hold |
openshift-ci
bot
added
the
do-not-merge/hold
3 participants
Updating the cloud-provider-aws and OpenShift clients to gather the NLB+SG feature, enabling the configuration to provision SGs for all NLBs through the sync transformer.
Ref: openshift/cloud-provider-aws#117