DNM: Experimental merge of PR #80851 and PR #80814#80856
Conversation
openshift-e2e-aws-disconnected calls ipi-aws-pre-disconnected and ipi-aws-post-disconnected. ipi-aws-pre-disconnected provisions an s3 bucket for the bastionhost, but ipi-aws-post-disconnected does not call aws-deprovision-s3buckets to clean it up, so it leaks. Subsequent runs of the job against the same PR re-use a namespace. As the buckets use the namespace in the name, this also means the second run in a PR will fail due to the name collision. This change fixes the leak by adding the missing cleanup step. It also tolerates a pre-existing bucket owned by us and re-uses it, cleaning it up after the run.
aws-provision-cco-manual-users-static was incorrectly filtering CredentialRequest manifests, resulting in attempting to create a CR secret in a namespace which was not created in the cluster. oc adm release extract --included is the modern solution to this.
…aws-post-disconnected
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (6)
WalkthroughThe PR makes the S3 bucket creation in the bastion host provisioning script idempotent by checking existence before creating, adds ChangesDisconnected Techpreview S3 Bucket Lifecycle and CI Config
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/hold I think I'm going to have to undraft this to get pj-rehearse to run. |
openshift-ci
Bot
added
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mdbooth The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: |
|
@mdbooth: your |
|
/pj-rehearse pull-ci-openshift-cluster-capi-operator-main-e2e-aws-capi-disconnected-techpreview |
|
@mdbooth: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@mdbooth: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
This is an experimental merge combining:
Summary by CodeRabbit
This PR makes changes to OpenShift CI infrastructure configuration for the Cluster API Operator and AWS disconnected installation tests. The changes address two distinct issues in the openshift-e2e-aws-disconnected CI job:
Bootstrap Failure Fix: CredentialRequest Manifest Filtering
Updated the
e2e-aws-capi-disconnected-techpreviewpipeline configuration in four cluster-capi-operator release branches (main, 4.23, 5.0, and 5.1) to add theEXTRACT_MANIFEST_INCLUDED: "true"environment variable. This enables the modern approach usingoc adm release extract --includedto properly filter CredentialRequest manifests during CCO manual user provisioning, resolving bootstrap failures that occurred when the old filtering logic attempted to create secrets in non-existent namespaces.S3 Bucket Leak Prevention: Idempotent Bucket Creation and Cleanup
Bastion host provisioning:
aws-provision-bastionhoststep by checking whether the per-cluster bucket already exists usingaws s3api head-bucketbefore attempting creationBastion host deprovisioning:
aws-deprovision-s3bucketsstep to theipi-aws-post-disconnectedchain to ensure S3 buckets provisioned during setup are properly cleaned up after test completionThese changes prevent resource leaks that previously caused subsequent runs of the same job on the same PR to fail due to bucket name collisions (since bucket names are derived from the namespace).