Skip to content

Commit 714853e

Browse files
JoelSpeedJoelSpeed
authored
OCPSTRAT-3686: Bootstrap hypershift release controller (openshift#81750)
* Generate HyperShift release controller deployments * Switch hypershift release controller to hypershift namespace * Ensure release payload controller has permissions for hypershift namespace * Add initial hypershift release configuration * Add external OIDC release 5.1 periodics
1 parent ba89b03 commit 714853e

12 files changed

Lines changed: 1241 additions & 0 deletions

File tree

‎ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.1__periodics.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,6 +317,25 @@ tests:
317317
OAUTH_EXTERNAL_OIDC_PROVIDER: keycloak
318318
TECH_PREVIEW_NO_UPGRADE: "true"
319319
workflow: hypershift-aws-e2e-external-oidc
320+
- as: e2e-azure-aks-external-oidc
321+
cron: 0 9 * * *
322+
steps:
323+
cluster_profile: hypershift-aks
324+
env:
325+
AUTH_THROUGH_CERTS: "true"
326+
CI_TESTS_RUN: TestExternalOIDC
327+
ENABLE_HYPERSHIFT_CERT_ROTATION_SCALE: "true"
328+
workflow: hypershift-azure-aks-external-oidc
329+
- as: e2e-azure-aks-external-oidc-techpreview
330+
cron: 0 20 9,18,25 * *
331+
steps:
332+
cluster_profile: hypershift-aks
333+
env:
334+
AUTH_THROUGH_CERTS: "true"
335+
CI_TESTS_RUN: TestExternalOIDC
336+
ENABLE_HYPERSHIFT_CERT_ROTATION_SCALE: "true"
337+
TECH_PREVIEW_NO_UPGRADE: "true"
338+
workflow: hypershift-azure-aks-external-oidc
320339
- as: e2e-powervs-ovn
321340
cron: 0 4 1 12 *
322341
steps:

‎ci-operator/jobs/openshift/hypershift/openshift-hypershift-release-5.1-periodics.yaml‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2159,6 +2159,210 @@ periodics:
21592159
- name: result-aggregator
21602160
secret:
21612161
secretName: result-aggregator
2162+
- agent: kubernetes
2163+
cluster: build12
2164+
cron: 0 9 * * *
2165+
decorate: true
2166+
decoration_config:
2167+
skip_cloning: true
2168+
extra_refs:
2169+
- base_ref: release-5.1
2170+
org: openshift
2171+
repo: hypershift
2172+
labels:
2173+
ci-operator.openshift.io/cloud: hypershift-aks
2174+
ci-operator.openshift.io/cloud-cluster-profile: hypershift-aks
2175+
ci-operator.openshift.io/variant: periodics
2176+
ci.openshift.io/generator: prowgen
2177+
job-release: "5.1"
2178+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
2179+
name: periodic-ci-openshift-hypershift-release-5.1-periodics-e2e-azure-aks-external-oidc
2180+
spec:
2181+
containers:
2182+
- args:
2183+
- --enable-secrets-store-csi-driver=true
2184+
- --gcs-upload-secret=/secrets/gcs/service-account.json
2185+
- --gsm-config=/etc/gsm-config/gsm-config.yaml
2186+
- --gsm-credentials-file=/etc/gsm-credentials/key.json
2187+
- --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml
2188+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
2189+
- --lease-server-credentials-file=/etc/boskos/credentials
2190+
- --report-credentials-file=/etc/report/credentials
2191+
- --secret-dir=/secrets/ci-pull-credentials
2192+
- --target=e2e-azure-aks-external-oidc
2193+
- --variant=periodics
2194+
command:
2195+
- ci-operator
2196+
env:
2197+
- name: HTTP_SERVER_IP
2198+
valueFrom:
2199+
fieldRef:
2200+
fieldPath: status.podIP
2201+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
2202+
imagePullPolicy: Always
2203+
name: ""
2204+
ports:
2205+
- containerPort: 8080
2206+
name: http
2207+
resources:
2208+
requests:
2209+
cpu: 10m
2210+
volumeMounts:
2211+
- mountPath: /etc/boskos
2212+
name: boskos
2213+
readOnly: true
2214+
- mountPath: /secrets/ci-pull-credentials
2215+
name: ci-pull-credentials
2216+
readOnly: true
2217+
- mountPath: /secrets/gcs
2218+
name: gcs-credentials
2219+
readOnly: true
2220+
- mountPath: /etc/gsm-config
2221+
name: gsm-config
2222+
readOnly: true
2223+
- mountPath: /etc/gsm-credentials
2224+
name: gsm-sa-key
2225+
readOnly: true
2226+
- mountPath: /secrets/manifest-tool
2227+
name: manifest-tool-local-pusher
2228+
readOnly: true
2229+
- mountPath: /etc/pull-secret
2230+
name: pull-secret
2231+
readOnly: true
2232+
- mountPath: /etc/report
2233+
name: result-aggregator
2234+
readOnly: true
2235+
serviceAccountName: ci-operator
2236+
volumes:
2237+
- name: boskos
2238+
secret:
2239+
items:
2240+
- key: credentials
2241+
path: credentials
2242+
secretName: boskos-credentials
2243+
- name: ci-pull-credentials
2244+
secret:
2245+
secretName: ci-pull-credentials
2246+
- configMap:
2247+
name: gsm-config
2248+
name: gsm-config
2249+
- csi:
2250+
driver: secrets-store.csi.k8s.io
2251+
readOnly: true
2252+
volumeAttributes:
2253+
secretProviderClass: ci-operator-sa-key-spc
2254+
name: gsm-sa-key
2255+
- name: manifest-tool-local-pusher
2256+
secret:
2257+
secretName: manifest-tool-local-pusher
2258+
- name: pull-secret
2259+
secret:
2260+
secretName: registry-pull-credentials
2261+
- name: result-aggregator
2262+
secret:
2263+
secretName: result-aggregator
2264+
- agent: kubernetes
2265+
cluster: build12
2266+
cron: 0 20 9,18,25 * *
2267+
decorate: true
2268+
decoration_config:
2269+
skip_cloning: true
2270+
extra_refs:
2271+
- base_ref: release-5.1
2272+
org: openshift
2273+
repo: hypershift
2274+
labels:
2275+
ci-operator.openshift.io/cloud: hypershift-aks
2276+
ci-operator.openshift.io/cloud-cluster-profile: hypershift-aks
2277+
ci-operator.openshift.io/variant: periodics
2278+
ci.openshift.io/generator: prowgen
2279+
job-release: "5.1"
2280+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
2281+
name: periodic-ci-openshift-hypershift-release-5.1-periodics-e2e-azure-aks-external-oidc-techpreview
2282+
spec:
2283+
containers:
2284+
- args:
2285+
- --enable-secrets-store-csi-driver=true
2286+
- --gcs-upload-secret=/secrets/gcs/service-account.json
2287+
- --gsm-config=/etc/gsm-config/gsm-config.yaml
2288+
- --gsm-credentials-file=/etc/gsm-credentials/key.json
2289+
- --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml
2290+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
2291+
- --lease-server-credentials-file=/etc/boskos/credentials
2292+
- --report-credentials-file=/etc/report/credentials
2293+
- --secret-dir=/secrets/ci-pull-credentials
2294+
- --target=e2e-azure-aks-external-oidc-techpreview
2295+
- --variant=periodics
2296+
command:
2297+
- ci-operator
2298+
env:
2299+
- name: HTTP_SERVER_IP
2300+
valueFrom:
2301+
fieldRef:
2302+
fieldPath: status.podIP
2303+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
2304+
imagePullPolicy: Always
2305+
name: ""
2306+
ports:
2307+
- containerPort: 8080
2308+
name: http
2309+
resources:
2310+
requests:
2311+
cpu: 10m
2312+
volumeMounts:
2313+
- mountPath: /etc/boskos
2314+
name: boskos
2315+
readOnly: true
2316+
- mountPath: /secrets/ci-pull-credentials
2317+
name: ci-pull-credentials
2318+
readOnly: true
2319+
- mountPath: /secrets/gcs
2320+
name: gcs-credentials
2321+
readOnly: true
2322+
- mountPath: /etc/gsm-config
2323+
name: gsm-config
2324+
readOnly: true
2325+
- mountPath: /etc/gsm-credentials
2326+
name: gsm-sa-key
2327+
readOnly: true
2328+
- mountPath: /secrets/manifest-tool
2329+
name: manifest-tool-local-pusher
2330+
readOnly: true
2331+
- mountPath: /etc/pull-secret
2332+
name: pull-secret
2333+
readOnly: true
2334+
- mountPath: /etc/report
2335+
name: result-aggregator
2336+
readOnly: true
2337+
serviceAccountName: ci-operator
2338+
volumes:
2339+
- name: boskos
2340+
secret:
2341+
items:
2342+
- key: credentials
2343+
path: credentials
2344+
secretName: boskos-credentials
2345+
- name: ci-pull-credentials
2346+
secret:
2347+
secretName: ci-pull-credentials
2348+
- configMap:
2349+
name: gsm-config
2350+
name: gsm-config
2351+
- csi:
2352+
driver: secrets-store.csi.k8s.io
2353+
readOnly: true
2354+
volumeAttributes:
2355+
secretProviderClass: ci-operator-sa-key-spc
2356+
name: gsm-sa-key
2357+
- name: manifest-tool-local-pusher
2358+
secret:
2359+
secretName: manifest-tool-local-pusher
2360+
- name: pull-secret
2361+
secret:
2362+
secretName: registry-pull-credentials
2363+
- name: result-aggregator
2364+
secret:
2365+
secretName: result-aggregator
21622366
- agent: kubernetes
21632367
cluster: build12
21642368
cron: 0 */2 * * *

‎clusters/app.ci/release-controller/admin_deploy-hypershift-controller.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
##################################################################################
2+
# DO NOT EDIT
3+
# File generated during execution of: generate-release-controllers.py
4+
##################################################################################
5+
6+
7+
#---------------------------------------------------------------------------------
8+
# hypershift_admin_resources.py added the following resource
9+
#---------------------------------------------------------------------------------
10+
11+
apiVersion: rbac.authorization.k8s.io/v1
12+
kind: Role
13+
metadata:
14+
name: release-controller-modify
15+
namespace: hypershift
16+
rules:
17+
- apiGroups:
18+
- ''
19+
resourceNames:
20+
- release-upgrade-graph
21+
resources:
22+
- secrets
23+
verbs:
24+
- get
25+
- update
26+
- patch
27+
- apiGroups:
28+
- image.openshift.io
29+
resources:
30+
- imagestreams
31+
- imagestreamtags
32+
verbs:
33+
- get
34+
- list
35+
- watch
36+
- create
37+
- delete
38+
- update
39+
- patch
40+
- apiGroups:
41+
- release.openshift.io
42+
resources:
43+
- releasepayloads
44+
verbs:
45+
- get
46+
- list
47+
- watch
48+
- create
49+
- delete
50+
- update
51+
- patch
52+
- apiGroups:
53+
- ''
54+
resources:
55+
- events
56+
verbs:
57+
- create
58+
- patch
59+
- update
60+
---
61+
#---------------------------------------------------------------------------------
62+
# hypershift_admin_resources.py added the following resource
63+
#---------------------------------------------------------------------------------
64+
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
kind: RoleBinding
67+
metadata:
68+
name: release-controller-binding
69+
namespace: hypershift
70+
roleRef:
71+
apiGroup: rbac.authorization.k8s.io
72+
kind: Role
73+
name: release-controller-modify
74+
subjects:
75+
- kind: ServiceAccount
76+
name: release-controller
77+
namespace: ci

0 commit comments

Comments
 (0)