From d307ccb5fb34ff56ba81060f611f795126564a38 Mon Sep 17 00:00:00 2001 From: Jad Haj Yahya Date: Sun, 21 Sep 2025 10:26:26 +0300 Subject: [PATCH] Implement UPI OVN dual-stack with FIPS and IPSEC --- ...s-private-release-4.15__arm64-nightly.yaml | 18 ++++ ...s-private-release-4.16__amd64-nightly.yaml | 16 ++++ ...s-private-release-4.17__arm64-nightly.yaml | 18 ++++ ...s-private-release-4.18__amd64-nightly.yaml | 16 ++++ ...s-private-release-4.19__arm64-nightly.yaml | 18 ++++ ...s-private-release-4.20__amd64-nightly.yaml | 16 ++++ ...s-private-release-4.21__amd64-nightly.yaml | 16 ++++ ...-tests-private-release-4.15-periodics.yaml | 83 +++++++++++++++++++ ...-tests-private-release-4.16-periodics.yaml | 83 +++++++++++++++++++ ...-tests-private-release-4.17-periodics.yaml | 83 +++++++++++++++++++ ...-tests-private-release-4.18-periodics.yaml | 83 +++++++++++++++++++ ...-tests-private-release-4.19-periodics.yaml | 83 +++++++++++++++++++ ...-tests-private-release-4.20-periodics.yaml | 83 +++++++++++++++++++ ...-tests-private-release-4.21-periodics.yaml | 83 +++++++++++++++++++ .../baremetal/lab/ipsec-ovn/OWNERS | 1 + .../baremetal-lab-ipsec-ovn-commands.sh | 30 +++++++ .../baremetal-lab-ipsec-ovn-ref.metadata.json | 21 +++++ .../baremetal-lab-ipsec-ovn-ref.yaml | 17 ++++ .../conf/baremetal-lab-upi-conf-chain.yaml | 1 + .../baremetal-lab-upi-install-commands.sh | 4 + .../baremetal-lab-upi-install-ref.yaml | 2 + 21 files changed, 775 insertions(+) create mode 120000 ci-operator/step-registry/baremetal/lab/ipsec-ovn/OWNERS create mode 100644 ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-commands.sh create mode 100644 ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.metadata.json create mode 100644 ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.yaml diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15__arm64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15__arm64-nightly.yaml index 1c24360c27335..0f864f0dbf493 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15__arm64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15__arm64-nightly.yaml @@ -697,6 +697,24 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-upi-dual-stack +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f360 + capabilities: + - intranet + cron: 26 18 20 11 * + steps: + cluster_profile: equinix-ocp-metal-qe + dependencies: + OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: arm64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.15 org: openshift diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16__amd64-nightly.yaml index 22d36b47cab90..2ed94db3f6771 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16__amd64-nightly.yaml @@ -3183,6 +3183,22 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-upi-dual-stack +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f360 + capabilities: + - intranet + cron: 21 14 7 6 * + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: amd64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.16 org: openshift diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17__arm64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17__arm64-nightly.yaml index 16fdc6c07e6ca..07da07008d0e3 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17__arm64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17__arm64-nightly.yaml @@ -673,6 +673,24 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-upi-dual-stack +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f360 + capabilities: + - intranet + cron: 54 18 4 4 * + steps: + cluster_profile: equinix-ocp-metal-qe + dependencies: + OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: arm64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.17 org: openshift diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly.yaml index 55e3b296dcab3..96e8576485c32 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly.yaml @@ -3792,6 +3792,22 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-upi-dual-stack +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f360 + capabilities: + - intranet + cron: 14 17 12 12 * + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: amd64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.18 org: openshift diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__arm64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__arm64-nightly.yaml index b485f6ac8f361..1fc98a515c913 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__arm64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__arm64-nightly.yaml @@ -664,6 +664,24 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-upi-dual-stack +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f28 + capabilities: + - intranet + cron: 14 19 20 * * + steps: + cluster_profile: equinix-ocp-metal-qe + dependencies: + OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: arm64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.19 org: openshift diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml index bda2014720fa3..d7a5171376494 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yaml @@ -4066,6 +4066,22 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-upi-dual-stack +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f14 + capabilities: + - intranet + cron: 16 16 9,23 * * + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: amd64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.20 org: openshift diff --git a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml index c1fdd91a3b738..68f678fb071c0 100644 --- a/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml +++ b/ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml @@ -3981,6 +3981,22 @@ tests: test: - chain: openshift-e2e-test-qe workflow: baremetal-lab-sno +- as: baremetal-upi-ovn-ipsec-dualstack-fips-f7 + capabilities: + - intranet + cron: 27 17 2,9,16,25 * * + steps: + cluster_profile: equinix-ocp-metal-qe + env: + AUX_HOST: openshift-qe-metal-ci.arm.eng.rdu2.redhat.com + FIPS_ENABLED: "true" + IPSEC_OVN: "true" + architecture: amd64 + masters: "3" + workers: "2" + test: + - chain: openshift-e2e-test-qe + workflow: baremetal-lab-upi-dual-stack zz_generated_metadata: branch: release-4.21 org: openshift diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15-periodics.yaml index 06a382a5861b8..51b42a932149b 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.15-periodics.yaml @@ -31891,6 +31891,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 26 18 20 11 * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.15 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: arm64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.15" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.15-arm64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f360 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f360 + - --variant=arm64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 21 13 13 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16-periodics.yaml index 7d582a73b69f7..88c7b9ccc6586 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.16-periodics.yaml @@ -17903,6 +17903,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 21 14 7 6 * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.16 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.16" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.16-amd64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f360 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f360 + - --variant=amd64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 16 13 1 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17-periodics.yaml index 791e597248515..70940f2a0e0e6 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.17-periodics.yaml @@ -42741,6 +42741,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 54 18 4 4 * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.17 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: arm64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.17" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.17-arm64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f360 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f360 + - --variant=arm64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 44 16 20 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18-periodics.yaml index f5a138b3d8619..29831d91ae931 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18-periodics.yaml @@ -26239,6 +26239,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 14 17 12 12 * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.18 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.18" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.18-amd64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f360 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f360 + - --variant=amd64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 46 18 16,30 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml index ffed0a36cdcff..7205f50c8bd59 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml @@ -49123,6 +49123,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 14 19 20 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.19 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: arm64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.19" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.19-arm64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f28 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f28 + - --variant=arm64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 32 16 3,12,19,26 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml index a8899980a4f8a..f63260079b639 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yaml @@ -29152,6 +29152,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 16 16 9,23 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.20 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.20" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.20-amd64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f14 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f14 + - --variant=amd64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 27 21 14,28 * * diff --git a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml index b8593ca4c2215..43ae1d5cd638e 100644 --- a/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml +++ b/ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml @@ -27686,6 +27686,89 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 27 17 2,9,16,25 * * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: + - base_ref: release-4.21 + org: openshift + repo: openshift-tests-private + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal-qe + ci-operator.openshift.io/variant: amd64-nightly + ci.openshift.io/generator: prowgen + job-release: "4.21" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-openshift-tests-private-release-4.21-amd64-nightly-baremetal-upi-ovn-ipsec-dualstack-fips-f7 + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --oauth-token-path=/usr/local/github-credentials/oauth + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=baremetal-upi-ovn-ipsec-dualstack-fips-f7 + - --variant=amd64-nightly + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /usr/local/github-credentials + name: github-credentials-openshift-ci-robot-private-git-cloner + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: github-credentials-openshift-ci-robot-private-git-cloner + secret: + secretName: github-credentials-openshift-ci-robot-private-git-cloner + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator - agent: kubernetes cluster: build07 cron: 3 18 3,19 * * diff --git a/ci-operator/step-registry/baremetal/lab/ipsec-ovn/OWNERS b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-commands.sh b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-commands.sh new file mode 100644 index 0000000000000..b25241a75d09a --- /dev/null +++ b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-commands.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +set -o errtrace +set -o errexit +set -o pipefail +set -o nounset + +if [ "${IPSEC_OVN:-false}" != "true" ]; then + echo "IPSec is not enabled. Skipping..." + exit 0 +fi + +# Trap to kill children processes +trap 'CHILDREN=$(jobs -p); if test -n "${CHILDREN}"; then kill ${CHILDREN} && wait; fi' TERM ERR +# Save exit code for must-gather to generate junit +trap 'echo "$?" > "${SHARED_DIR}/install-status.txt"' TERM ERR + +cat < "${SHARED_DIR}/manifest_cluster-network-99-ipsec.yaml" +apiVersion: operator.openshift.io/v1 +kind: Network +metadata: + name: cluster +spec: + defaultNetwork: + type: OVNKubernetes + ovnKubernetesConfig: + ipsecConfig: {} +EOF + +echo "Created manifest file to enable IPsec on OVN networking" diff --git a/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.metadata.json b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.metadata.json new file mode 100644 index 0000000000000..c0df9fa2f1526 --- /dev/null +++ b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.metadata.json @@ -0,0 +1,21 @@ +{ + "path": "baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.yaml", + "owners": { + "approvers": [ + "aleskandro", + "jadhaj", + "jhou1", + "mhanss", + "pamoedom", + "sgoveas" + ], + "reviewers": [ + "aleskandro", + "jadhaj", + "jhou1", + "mhanss", + "pamoedom", + "sgoveas" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.yaml b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.yaml new file mode 100644 index 0000000000000..ef625aa36138c --- /dev/null +++ b/ci-operator/step-registry/baremetal/lab/ipsec-ovn/baremetal-lab-ipsec-ovn-ref.yaml @@ -0,0 +1,17 @@ +ref: + as: baremetal-lab-ipsec-ovn + from_image: + namespace: ci + name: "baremetal-qe-base" + tag: latest + grace_period: 10m + commands: baremetal-lab-ipsec-ovn-commands.sh + resources: + requests: + cpu: '1' + memory: 128Mi + env: + - name: IPSEC_OVN + default: "false" + documentation: |- + Generate manifest file for IPsec OVN networking diff --git a/ci-operator/step-registry/baremetal/lab/upi/conf/baremetal-lab-upi-conf-chain.yaml b/ci-operator/step-registry/baremetal/lab/upi/conf/baremetal-lab-upi-conf-chain.yaml index d8c9ba9005864..d2b4e1c9f2b42 100644 --- a/ci-operator/step-registry/baremetal/lab/upi/conf/baremetal-lab-upi-conf-chain.yaml +++ b/ci-operator/step-registry/baremetal/lab/upi/conf/baremetal-lab-upi-conf-chain.yaml @@ -14,6 +14,7 @@ chain: - ref: baremetal-lab-upi-conf-network - ref: baremetal-lab-rt-kernel - ref: baremetal-lab-storage + - ref: baremetal-lab-ipsec-ovn documentation: |- The baremetal-lab-upi-conf-base chain executes all the steps that provision the common configuration for OpenShift bare-metal clusters to install via UPI in the RH labs. Workflows and other chains will be responsible diff --git a/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-commands.sh b/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-commands.sh index f30739fd80166..69894acb69dc3 100644 --- a/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-commands.sh +++ b/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-commands.sh @@ -305,6 +305,10 @@ cp "${SHARED_DIR}/install-config.yaml" "${INSTALL_DIR}/" # From now on, we assume no more patches to the install-config.yaml are needed. # We can create the installation dir with the manifests and, finally, the ignition configs +if [ "${FIPS_ENABLED:-false}" = "true" ]; then + export OPENSHIFT_INSTALL_SKIP_HOSTCRYPT_VALIDATION=true +fi + grep -v "password\|username\|pullSecret" "${SHARED_DIR}/install-config.yaml" > "${ARTIFACT_DIR}/install-config.yaml" ### Create manifests diff --git a/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-ref.yaml b/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-ref.yaml index 84d3f9496fae4..bac7a6025bba6 100644 --- a/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-ref.yaml +++ b/ci-operator/step-registry/baremetal/lab/upi/install/baremetal-lab-upi-install-ref.yaml @@ -26,6 +26,8 @@ ref: - name: AUX_HOST default: "" documentation: "" + - name: FIPS_ENABLED + default: "false" - name: ADDITIONAL_WORKERS default: "0" documentation: |