From ea0335dd43c9e5edba8183be7cc3f2296205959a Mon Sep 17 00:00:00 2001 From: Jakob Naucke Date: Fri, 15 May 2026 14:53:39 +0200 Subject: [PATCH 1/2] trusted-execution-clusters: Introduce Azure tests Use native OpenShift as Trustee platform, attest Azure VMs against it. Optional test. Signed-off-by: Jakob Naucke Assisted-by: Claude Opus 4.6 --- ...sted-execution-clusters-operator-main.yaml | 18 ++ ...ecution-clusters-operator-main__azure.yaml | 73 ++++++ ...ion-clusters-operator-main-presubmits.yaml | 210 ++++++++++++++++++ .../ref/azure-integration-test/OWNERS | 1 + ...ers-ref-azure-integration-test-commands.sh | 32 +++ ...f-azure-integration-test-ref.metadata.json | 13 ++ ...usters-ref-azure-integration-test-ref.yaml | 23 ++ 7 files changed, 370 insertions(+) create mode 100644 ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main.yaml create mode 100644 ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml create mode 100644 ci-operator/jobs/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main-presubmits.yaml create mode 120000 ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERS create mode 100755 ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh create mode 100644 ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.json create mode 100644 ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml diff --git a/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main.yaml b/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main.yaml new file mode 100644 index 0000000000000..bdde7d7fc441c --- /dev/null +++ b/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main.yaml @@ -0,0 +1,18 @@ +build_root: + image_stream_tag: + name: builder + namespace: ocp + tag: rhel-9-golang-1.25-openshift-4.21 +images: + items: + - dockerfile_literal: FROM src + from: src + to: dummy +resources: + '*': + requests: + cpu: 100m +zz_generated_metadata: + branch: main + org: trusted-execution-clusters + repo: operator diff --git a/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml b/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml new file mode 100644 index 0000000000000..6157dc43fa83e --- /dev/null +++ b/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml @@ -0,0 +1,73 @@ +base_images: + cli: + name: "4.21" + namespace: ocp + tag: cli +build_root: + image_stream_tag: + name: builder + namespace: ocp + tag: rhel-9-golang-1.25-openshift-4.21 +images: + items: + - dockerfile_literal: | + FROM src + COPY oc /usr/bin/oc + RUN dnf install -y jq python3-pip && \ + dnf clean all + from: src + inputs: + cli: + paths: + - destination_dir: . + source_path: /usr/bin/oc + to: azure-test-image + - dockerfile_path: Containerfile + build_args: + - name: build_type + value: release + to: operator + - dockerfile_path: compute-pcrs/Containerfile + build_args: + - name: build_type + value: release + to: compute-pcrs + - dockerfile_path: register-server/Containerfile + build_args: + - name: build_type + value: release + to: register-server + - dockerfile_path: attestation-key-register/Containerfile + build_args: + - name: build_type + value: release + to: attestation-key-register +releases: + latest: + candidate: + architecture: amd64 + product: ocp + stream: nightly + version: "4.21" +resources: + '*': + limits: + memory: 8Gi + requests: + cpu: 100m + memory: 200Mi +tests: +- always_run: false + as: integration-test + optional: true + skip_if_only_changed: ^(\.github|LICENSES|bundle|docs|examples)/|^(README\.md|\.gitignore)$ + steps: + cluster_profile: openshift-org-aws + test: + - ref: trusted-execution-clusters-ref-azure-integration-test + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: trusted-execution-clusters + repo: operator + variant: azure diff --git a/ci-operator/jobs/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main-presubmits.yaml b/ci-operator/jobs/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main-presubmits.yaml new file mode 100644 index 0000000000000..96f6ac074ab1a --- /dev/null +++ b/ci-operator/jobs/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main-presubmits.yaml @@ -0,0 +1,210 @@ +presubmits: + trusted-execution-clusters/operator: + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/azure-images + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + - attestation-key-register/Containerfile + - compute-pcrs/Containerfile + - register-server/Containerfile + labels: + ci-operator.openshift.io/variant: azure + ci.openshift.io/generator: prowgen + job-release: "4.21" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-trusted-execution-clusters-operator-main-azure-images + rerun_command: /test azure-images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + - --variant=azure + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )azure-images,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/azure-integration-test + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + - attestation-key-register/Containerfile + - compute-pcrs/Containerfile + - register-server/Containerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci-operator.openshift.io/variant: azure + ci.openshift.io/generator: prowgen + job-release: "4.21" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-trusted-execution-clusters-operator-main-azure-integration-test + optional: true + rerun_command: /test azure-integration-test + skip_if_only_changed: ^(\.github|LICENSES|bundle|docs|examples)/|^(README\.md|\.gitignore)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=integration-test + - --variant=azure + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )azure-integration-test,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/images + decorate: true + decoration_config: + skip_cloning: true + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-trusted-execution-clusters-operator-main-images + rerun_command: /test images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )images,?($|\s.*) diff --git a/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERS b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh new file mode 100755 index 0000000000000..ebba686f94fdf --- /dev/null +++ b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh @@ -0,0 +1,32 @@ +#!/bin/bash + +set -euo pipefail + +curl https://sh.rustup.rs | sh -s -- -y +source "$HOME/.cargo/env" +export PATH="$HOME/.local/bin:$PATH" +unset GOFLAGS + +pip install azure-cli + +AZURE_SUBSCRIPTION_ID=$(cat /tmp/secrets/azure/subscription-id) +TEST_IMAGE=$(cat /tmp/secrets/azure/test-image) +TEST_NAMESPACE_PREFIX="ci-${PULL_NUMBER:+${PULL_NUMBER}-}$(uuidgen | cut -d- -f1)-" +export AZURE_SUBSCRIPTION_ID TEST_IMAGE TEST_NAMESPACE_PREFIX + +export VIRT_PROVIDER=azure +export PLATFORM=openshift + +az login --service-principal \ + -u "$(cat /tmp/secrets/azure/client-id)" \ + -p "$(cat /tmp/secrets/azure/client-secret)" \ + --tenant "$(cat /tmp/secrets/azure/tenant-id)" + +eval "$(ssh-agent -s)" + +echo "[INFO] Install cert-manager" +CRT_MGR_VERSION=$(go list -m -f '{{.Version}}' github.com/cert-manager/cert-manager) +oc apply -f "https://github.com/cert-manager/cert-manager/releases/download/${CRT_MGR_VERSION}/cert-manager.yaml" + +echo "[INFO] Running integration tests..." +make integration-tests diff --git a/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.json b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.json new file mode 100644 index 0000000000000..61feb7fa803ca --- /dev/null +++ b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.json @@ -0,0 +1,13 @@ +{ + "path": "trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml", + "owners": { + "approvers": [ + "alicefr", + "Jakob-Naucke" + ], + "reviewers": [ + "alicefr", + "Jakob-Naucke" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml new file mode 100644 index 0000000000000..9a3273ed2de15 --- /dev/null +++ b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml @@ -0,0 +1,23 @@ +ref: + as: trusted-execution-clusters-ref-azure-integration-test + from: azure-test-image + commands: trusted-execution-clusters-ref-azure-integration-test-commands.sh + dependencies: + - name: operator + env: OPERATOR_IMAGE + - name: compute-pcrs + env: RELATED_IMAGE_COMPUTE_PCRS + - name: register-server + env: RELATED_IMAGE_REGISTRATION_SERVER + - name: attestation-key-register + env: RELATED_IMAGE_ATTESTATION_KEY_REGISTER + credentials: + - namespace: test-credentials + name: trusted-execution-clusters-azure + mount_path: /tmp/secrets/azure + resources: + requests: + cpu: 500m + memory: 500Mi + documentation: |- + Runs Azure integration tests for the trusted-execution-clusters operator From 2a258293c29637eba507c02b694c8ffb87eae27c Mon Sep 17 00:00:00 2001 From: Jakob Naucke Date: Thu, 4 Jun 2026 13:42:15 +0200 Subject: [PATCH 2/2] debug only --- ...rusted-execution-clusters-operator-main__azure.yaml | 2 +- ...ion-clusters-ref-azure-integration-test-commands.sh | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml b/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml index 6157dc43fa83e..83162f5540fa1 100644 --- a/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml +++ b/ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml @@ -13,7 +13,7 @@ images: - dockerfile_literal: | FROM src COPY oc /usr/bin/oc - RUN dnf install -y jq python3-pip && \ + RUN dnf install -y jq perl-FindBin perl-core python3-pip && \ dnf clean all from: src inputs: diff --git a/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh index ebba686f94fdf..d7885fa17fe37 100755 --- a/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh +++ b/ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh @@ -16,6 +16,7 @@ export AZURE_SUBSCRIPTION_ID TEST_IMAGE TEST_NAMESPACE_PREFIX export VIRT_PROVIDER=azure export PLATFORM=openshift +export TEST_TIMEOUT_MULTIPLIER=3 az login --service-principal \ -u "$(cat /tmp/secrets/azure/client-id)" \ @@ -24,6 +25,15 @@ az login --service-principal \ eval "$(ssh-agent -s)" +git remote add test https://github.com/Jakob-Naucke/trusted-cluster-operator +git fetch test +git switch openshift-ci-noreque + +export REGISTRY=quay.io/jnaucke +export TAG=20260702-kbs20-2bef27f +export OPERATOR_IMAGE=quay.io/jnaucke/trusted-cluster-operator:20260716-9081728 +export INTEGRATION_TEST_THREADS=2 + echo "[INFO] Install cert-manager" CRT_MGR_VERSION=$(go list -m -f '{{.Version}}' github.com/cert-manager/cert-manager) oc apply -f "https://github.com/cert-manager/cert-manager/releases/download/${CRT_MGR_VERSION}/cert-manager.yaml"