From 27fe9245681290ec140071ac17d48d0a3535926c Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 7 Oct 2025 10:21:58 +0200 Subject: [PATCH 01/44] WIP: Trying hive. Take #3 ;-) --- .../pipelines/e2e-main-pipeline.yaml | 4 +- integration-tests/pipelines/tssc-cli-e2e.yaml | 258 +++++++++++++----- 2 files changed, 193 insertions(+), 69 deletions(-) diff --git a/integration-tests/pipelines/e2e-main-pipeline.yaml b/integration-tests/pipelines/e2e-main-pipeline.yaml index 26d3dab72..c923330c6 100644 --- a/integration-tests/pipelines/e2e-main-pipeline.yaml +++ b/integration-tests/pipelines/e2e-main-pipeline.yaml @@ -65,9 +65,9 @@ spec: resolver: git params: - name: url - value: https://github.com/redhat-appstudio/tssc-cli.git + value: https://github.com/rhopp/tssc-cli.git - name: revision - value: main + value: hive-try3 - name: pathInRepo value: integration-tests/tasks/start-pipelines.yaml params: diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 8fdbee1b3..2c15b8eae 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -55,46 +55,175 @@ spec: description: 'Additional parameters for installation testing (e.g., PRE_RELEASE=TAS TAS_VERSION=1.3.2). When empty, does not alter normal installation.' default: "" tasks: - - name: rosa-hcp-metadata - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/rosa/hosted-cp/rosa-hcp-metadata/0.1/rosa-hcp-metadata.yaml - - name: provision-rosa - runAfter: - - rosa-hcp-metadata - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/rosa/hosted-cp/rosa-hcp-provision/0.2/rosa-hcp-provision.yaml - params: - - name: cluster-name - value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" - - name: ocp-version - value: "$(params.ocp-version)" - - name: replicas - value: "$(params.replicas)" - - name: machine-type - value: "$(params.machine-type)" - - name: konflux-test-infra-secret - value: "$(params.konflux-test-infra-secret)" - - name: cloud-credential-key - value: "$(params.cloud-credential-key)" - - name: oci-container - value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: provision-cluster + taskSpec: + results: + - name: ocp-login-command + value: "$(steps.claim-cluster.results.ocp-login-command)" + volumes: + - name: hive-creds-volume + secret: + secretName: rhopp-test + - name: credentials + emptyDir: {} + steps: + - name: claim-cluster + image: registry.redhat.io/openshift4/ose-cli@sha256:15da03b04318bcc842060b71e9dd6d6c2595edb4e8fdd11b0c6781eeb03ca182 + volumeMounts: + - name: hive-creds-volume + mountPath: /usr/local/hive-creds + results: + - name: ocp-login-command + description: "Ocp login command" + script: | + #!/usr/bin/bash + oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) + oc whoami + oc get clusterpool -n hive + oc create -f - < $(step.results.ocp-login-command.path) + + kubeconfig_secret=$(oc get clusterdeployment -n $cp_namespace $cp_namespace -o jsonpath={.spec.clusterMetadata.adminKubeconfigSecretRef.name}) + + oc get secret -n $cp_namespace $kubeconfig_secret -o jsonpath={.data.kubeconfig} |base64 -d > /tmp/ephemereal.config + export KUBECONFIG=/tmp/ephemereal.config + csr_max_retries=5 + csr_sleep_duration=10 + approved_csrs=false + + console_max_retries=30 + console_sleep_duration=10 + console_connect_timeout=10 + console_accessible=false + + echo "--- Starting CSR Approval Process ---" + for ((i=1; i<=csr_max_retries; i++)); do + echo "CSR Attempt $i of $csr_max_retries: Checking for pending CSRs..." + if ! oc get csr 2>/dev/null | grep -i Pending; then + echo "No pending CSRs found. Continuing" + approved_csrs=true + break + else + echo "There are pending CSRs. That probably means cluster was hibernated for more than 24 hours. Need to approve them (until OCPBUGS-55339 is resolved)" + if oc get csr -oname | xargs oc adm certificate approve; then + echo "Successfully submitted approval for CSRs on attempt $i." + sleep 2 # Small delay for changes to propagate + if ! oc get csr 2>/dev/null | grep -i Pending; then + echo "Confirmed no pending CSRs after approval." + approved_csrs=true + break + else + echo "Pending CSRs still exist after approval attempt $i." + fi + else + echo "Failed to run approval command for CSRs on attempt $i." + fi + fi + + if [[ "$i" -lt "$csr_max_retries" ]]; then + echo "Sleeping for $csr_sleep_duration seconds before next CSR retry..." + sleep "$csr_sleep_duration" + fi + done + + if [[ "$approved_csrs" == "true" ]]; then + echo "CSR check and approval process completed successfully." + else + echo "Failed to ensure all pending CSRs were approved after $csr_max_retries attempts." + exit 1 + fi + echo "--- CSR Approval Process Finished ---" + + # --- Console URL Accessibility Check --- + echo "--- Starting Console Accessibility Check ---" + + + oc whoami + console_url=$(oc whoami --show-console) + echo "Console URL: $console_url" + # # Check if routes are available (OpenShift-specific resource) + # echo "Checking if routes are available..." + # if ! oc api-resources | grep -q "routes"; then + # echo "Warning: Routes are not available. This might not be an OpenShift cluster or it's not fully ready." + # echo "Waiting for OpenShift components to be ready..." + # sleep 30 + # if ! oc api-resources | grep -q "routes"; then + # echo "Error: Routes still not available. This doesn't appear to be an OpenShift cluster." + # exit 1 + # fi + # fi + + # # Check if openshift-console namespace exists + # echo "Checking if openshift-console namespace exists..." + # if ! oc get namespace openshift-console &>/dev/null; then + # echo "Error: openshift-console namespace not found." + # exit 1 + # fi + + # # Wait for console route to be available + # echo "Waiting for console route to be available..." + # for ((k=1; k<=10; k++)); do + # if oc get route console -n openshift-console &>/dev/null; then + # echo "Console route found." + # break + # fi + # echo "Console route not found, attempt $k/10. Waiting 30 seconds..." + # sleep 30 + # done + + # console_url="https://$(oc get route console -n openshift-console -o jsonpath='{.spec.host}' 2>/dev/null)" + + if [[ -z "$console_url" ]]; then + echo "Error: Could not retrieve OpenShift console URL." + exit 1 + else + echo "Console URL found: $console_url" + for ((j=1; j<=console_max_retries; j++)); do + echo "Console Check Attempt $j of $console_max_retries: Checking console URL accessibility..." + if curl -k --silent --output /dev/null --head --fail --connect-timeout "$console_connect_timeout" "$console_url"; then + echo "Console URL $console_url is accessible (HTTP 2xx)." + console_accessible=true + break + else + curl_exit_code=$? + echo "Console URL $console_url not accessible on attempt $j (curl exit code: $curl_exit_code)." + fi + + if [[ "$j" -lt "$console_max_retries" ]]; then + echo "Sleeping for $console_sleep_duration seconds before next console check retry..." + sleep "$console_sleep_duration" + fi + done + + if [[ "$console_accessible" == "true" ]]; then + echo "Console is ready. Continuing." + else + echo "Failed to access console URL $console_url after $console_max_retries attempts." + exit 1 + fi + fi + echo "--- Console Accessibility Check Finished ---" - name: tssc-install runAfter: - - provision-rosa + - provision-cluster taskRef: resolver: git params: @@ -106,7 +235,7 @@ spec: value: integration-tests/tasks/tssc-install.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" + value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: job-spec value: "$(params.job-spec)" - name: rhads-config @@ -129,7 +258,7 @@ spec: value: tasks/sprayproxy/sprayproxy-provision/0.1/sprayproxy-provision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" + value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: tssc-e2e-tests runAfter: - sprayproxy-provision @@ -146,7 +275,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" + value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -170,7 +299,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" + value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -178,31 +307,26 @@ spec: - name: testplan value: $(params.testplan) finally: - - name: deprovision-rosa-collect-artifacts - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/rosa/hosted-cp/rosa-hcp-deprovision/0.2/rosa-hcp-deprovision.yaml - params: - - name: test-name - value: $(context.pipelineRun.name) - - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" - - name: oci-container - value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - - name: cluster-name - value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" - - name: konflux-test-infra-secret - value: "$(params.konflux-test-infra-secret)" - - name: cloud-credential-key - value: "$(params.cloud-credential-key)" - - name: pipeline-aggregate-status - value: "$(tasks.status)" + - name: deprovision-cluster + taskSpec: + volumes: + - name: hive-creds-volume + secret: + secretName: rhopp-test + - name: credentials + emptyDir: {} + steps: + - name: deprovision-cluster + image: registry.redhat.io/openshift4/ose-cli@sha256:15da03b04318bcc842060b71e9dd6d6c2595edb4e8fdd11b0c6781eeb03ca182 + volumeMounts: + - name: hive-creds-volume + mountPath: /usr/local/hive-creds + script: | + #!/usr/bin/bash + set -x + oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) + oc whoami + oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive - name: sprayproxy-deprovision when: - input: "$(tasks.sprayproxy-provision.status)" From 2c288efec3a5a87091f15f9ae8e2fd7f22340083 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 7 Oct 2025 10:34:28 +0200 Subject: [PATCH 02/44] fix result reference --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 2c15b8eae..c88fe8821 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -344,7 +344,7 @@ spec: value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" + value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git From 0cd0c108d12463fb735d9b5d8c0e76f07f0adde9 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 8 Oct 2025 14:51:31 +0200 Subject: [PATCH 03/44] increase timeout --- integration-tests/pipelines/tssc-cli-e2e.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index c88fe8821..825f13a88 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -89,9 +89,9 @@ spec: spec: clusterPoolName: clusterpool EOF - ## wait for cluster for up to 30 minutes - if ! kubectl wait --for=condition=ClusterRunning clusterclaims.hive.openshift.io/$(context.pipelineRun.name) -n hive --timeout 30m; then - echo "Cluster failed to start in 30 minutes. Deleting clusterClaim" + ## wait for cluster for up to 60 minutes + if ! kubectl wait --for=condition=ClusterRunning clusterclaims.hive.openshift.io/$(context.pipelineRun.name) -n hive --timeout 60m; then + echo "Cluster failed to start in 60 minutes. Deleting clusterClaim" oc delete clusterclaims.hive.openshift.io/$(context.pipelineRun.name) -n hive exit 1 fi From d84c7f8dc8f6ad0b720c7133f1f1bc03c6d3ff69 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 8 Oct 2025 14:52:44 +0200 Subject: [PATCH 04/44] run just single pipeline --- integration-tests/config/rhads-config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/config/rhads-config b/integration-tests/config/rhads-config index 3cf8761ba..0b86e2f50 100644 --- a/integration-tests/config/rhads-config +++ b/integration-tests/config/rhads-config @@ -1,4 +1,4 @@ -OCP="4.18,4.19,4.20" +OCP="4.19" ACS="remote" REGISTRY="quay,artifactory,nexus" TPA="local" From 0e2609a534f03968fbab0cb90a3e1dc2eae5b92b Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 8 Oct 2025 14:53:54 +0200 Subject: [PATCH 05/44] switch clusterpoo --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 825f13a88..9d8ed001b 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -79,7 +79,7 @@ spec: #!/usr/bin/bash oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) oc whoami - oc get clusterpool -n hive + oc get rhopp-test-clusterpool -n hive oc create -f - < Date: Wed, 8 Oct 2025 17:58:49 +0200 Subject: [PATCH 06/44] Increase some timeout ;-) --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 9d8ed001b..d78a618a9 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -125,7 +125,7 @@ spec: echo "There are pending CSRs. That probably means cluster was hibernated for more than 24 hours. Need to approve them (until OCPBUGS-55339 is resolved)" if oc get csr -oname | xargs oc adm certificate approve; then echo "Successfully submitted approval for CSRs on attempt $i." - sleep 2 # Small delay for changes to propagate + sleep 60 # Small delay for changes to propagate if ! oc get csr 2>/dev/null | grep -i Pending; then echo "Confirmed no pending CSRs after approval." approved_csrs=true From 97575bcc7ac0667769beabf660f5287e7a69e139 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 9 Oct 2025 16:16:51 +0200 Subject: [PATCH 07/44] Disable tls in tests --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index d78a618a9..473f5d89a 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -266,9 +266,9 @@ spec: resolver: git params: - name: url - value: https://github.com/redhat-appstudio/tssc-test.git + value: https://github.com/rhopp/tssc-test.git - name: revision - value: main + value: disable_tls - name: pathInRepo value: integration-tests/tasks/tssc-e2e.yaml params: From 409fc2dd0b258a5979b5ebbb99c2a7e00a8eca62 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Fri, 10 Oct 2025 13:44:12 +0200 Subject: [PATCH 08/44] Update tssc-test-image in e2e tests to use a specific self-signed image --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 473f5d89a..cbb6ef5ba 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -279,7 +279,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: $(params.tssc-test-image) + value: "quay.io/rhopp/tssc-tests:self_signed" - name: testplan value: $(params.testplan) - name: rhtap-ui-tests @@ -303,7 +303,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: $(params.tssc-test-image) + value: "$(params.tssc-test-image)" - name: testplan value: $(params.testplan) finally: From bcab4f9746875de3e37e4df2c425eacb94a78426 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 22 Oct 2025 17:21:10 +0200 Subject: [PATCH 09/44] try the convalescence logic multiple times --- integration-tests/pipelines/tssc-cli-e2e.yaml | 202 +++++++++--------- 1 file changed, 103 insertions(+), 99 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index cbb6ef5ba..de1e83192 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -105,122 +105,126 @@ spec: oc get secret -n $cp_namespace $kubeconfig_secret -o jsonpath={.data.kubeconfig} |base64 -d > /tmp/ephemereal.config export KUBECONFIG=/tmp/ephemereal.config - csr_max_retries=5 - csr_sleep_duration=10 - approved_csrs=false - console_max_retries=30 - console_sleep_duration=10 - console_connect_timeout=10 - console_accessible=false + # --- Cluster Provisioning Retry Loop --- + provisioning_max_retries=3 + provisioning_successful=false - echo "--- Starting CSR Approval Process ---" - for ((i=1; i<=csr_max_retries; i++)); do - echo "CSR Attempt $i of $csr_max_retries: Checking for pending CSRs..." - if ! oc get csr 2>/dev/null | grep -i Pending; then - echo "No pending CSRs found. Continuing" - approved_csrs=true - break - else - echo "There are pending CSRs. That probably means cluster was hibernated for more than 24 hours. Need to approve them (until OCPBUGS-55339 is resolved)" - if oc get csr -oname | xargs oc adm certificate approve; then - echo "Successfully submitted approval for CSRs on attempt $i." - sleep 60 # Small delay for changes to propagate - if ! oc get csr 2>/dev/null | grep -i Pending; then - echo "Confirmed no pending CSRs after approval." - approved_csrs=true - break + for ((provisioning_attempt=1; provisioning_attempt<=provisioning_max_retries; provisioning_attempt++)); do + echo "=== Cluster Provisioning Attempt $provisioning_attempt of $provisioning_max_retries ===" + + # Reset flags for this attempt + csr_max_retries=5 + csr_sleep_duration=10 + approved_csrs=false + + console_max_retries=30 + console_sleep_duration=10 + console_connect_timeout=10 + console_accessible=false + + echo "--- Starting CSR Approval Process ---" + for ((i=1; i<=csr_max_retries; i++)); do + echo "CSR Attempt $i of $csr_max_retries: Checking for pending CSRs..." + if ! oc get csr 2>/dev/null | grep -i Pending; then + echo "No pending CSRs found. Continuing" + approved_csrs=true + break + else + echo "There are pending CSRs. That probably means cluster was hibernated for more than 24 hours. Need to approve them (until OCPBUGS-55339 is resolved)" + if oc get csr -oname | xargs oc adm certificate approve; then + echo "Successfully submitted approval for CSRs on attempt $i." + sleep 60 # Small delay for changes to propagate + if ! oc get csr 2>/dev/null | grep -i Pending; then + echo "Confirmed no pending CSRs after approval." + approved_csrs=true + break + else + echo "Pending CSRs still exist after approval attempt $i." + fi else - echo "Pending CSRs still exist after approval attempt $i." + echo "Failed to run approval command for CSRs on attempt $i." fi - else - echo "Failed to run approval command for CSRs on attempt $i." fi - fi - if [[ "$i" -lt "$csr_max_retries" ]]; then - echo "Sleeping for $csr_sleep_duration seconds before next CSR retry..." - sleep "$csr_sleep_duration" - fi - done + if [[ "$i" -lt "$csr_max_retries" ]]; then + echo "Sleeping for $csr_sleep_duration seconds before next CSR retry..." + sleep "$csr_sleep_duration" + fi + done - if [[ "$approved_csrs" == "true" ]]; then + if [[ "$approved_csrs" == "false" ]]; then + echo "Failed to ensure all pending CSRs were approved after $csr_max_retries attempts." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + fi echo "CSR check and approval process completed successfully." - else - echo "Failed to ensure all pending CSRs were approved after $csr_max_retries attempts." - exit 1 - fi - echo "--- CSR Approval Process Finished ---" - - # --- Console URL Accessibility Check --- - echo "--- Starting Console Accessibility Check ---" - + echo "--- CSR Approval Process Finished ---" - oc whoami - console_url=$(oc whoami --show-console) - echo "Console URL: $console_url" - # # Check if routes are available (OpenShift-specific resource) - # echo "Checking if routes are available..." - # if ! oc api-resources | grep -q "routes"; then - # echo "Warning: Routes are not available. This might not be an OpenShift cluster or it's not fully ready." - # echo "Waiting for OpenShift components to be ready..." - # sleep 30 - # if ! oc api-resources | grep -q "routes"; then - # echo "Error: Routes still not available. This doesn't appear to be an OpenShift cluster." - # exit 1 - # fi - # fi - - # # Check if openshift-console namespace exists - # echo "Checking if openshift-console namespace exists..." - # if ! oc get namespace openshift-console &>/dev/null; then - # echo "Error: openshift-console namespace not found." - # exit 1 - # fi - - # # Wait for console route to be available - # echo "Waiting for console route to be available..." - # for ((k=1; k<=10; k++)); do - # if oc get route console -n openshift-console &>/dev/null; then - # echo "Console route found." - # break - # fi - # echo "Console route not found, attempt $k/10. Waiting 30 seconds..." - # sleep 30 - # done + # --- Console URL Accessibility Check --- + echo "--- Starting Console Accessibility Check ---" - # console_url="https://$(oc get route console -n openshift-console -o jsonpath='{.spec.host}' 2>/dev/null)" + oc whoami + console_url=$(oc whoami --show-console) + echo "Console URL: $console_url" - if [[ -z "$console_url" ]]; then - echo "Error: Could not retrieve OpenShift console URL." - exit 1 - else - echo "Console URL found: $console_url" - for ((j=1; j<=console_max_retries; j++)); do - echo "Console Check Attempt $j of $console_max_retries: Checking console URL accessibility..." - if curl -k --silent --output /dev/null --head --fail --connect-timeout "$console_connect_timeout" "$console_url"; then - echo "Console URL $console_url is accessible (HTTP 2xx)." - console_accessible=true - break + if [[ -z "$console_url" ]]; then + echo "Error: Could not retrieve OpenShift console URL." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue else - curl_exit_code=$? - echo "Console URL $console_url not accessible on attempt $j (curl exit code: $curl_exit_code)." + echo "All provisioning attempts exhausted. Exiting." + exit 1 fi + else + echo "Console URL found: $console_url" + for ((j=1; j<=console_max_retries; j++)); do + echo "Console Check Attempt $j of $console_max_retries: Checking console URL accessibility..." + if curl -k --silent --output /dev/null --head --fail --connect-timeout "$console_connect_timeout" "$console_url"; then + echo "Console URL $console_url is accessible (HTTP 2xx)." + console_accessible=true + break + else + curl_exit_code=$? + echo "Console URL $console_url not accessible on attempt $j (curl exit code: $curl_exit_code)." + fi - if [[ "$j" -lt "$console_max_retries" ]]; then - echo "Sleeping for $console_sleep_duration seconds before next console check retry..." - sleep "$console_sleep_duration" - fi - done + if [[ "$j" -lt "$console_max_retries" ]]; then + echo "Sleeping for $console_sleep_duration seconds before next console check retry..." + sleep "$console_sleep_duration" + fi + done - if [[ "$console_accessible" == "true" ]]; then - echo "Console is ready. Continuing." - else - echo "Failed to access console URL $console_url after $console_max_retries attempts." - exit 1 + if [[ "$console_accessible" == "false" ]]; then + echo "Failed to access console URL $console_url after $console_max_retries attempts." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + fi fi + echo "Console is ready. Continuing." + echo "--- Console Accessibility Check Finished ---" + + # If we reach here, both CSR approval and console accessibility succeeded + provisioning_successful=true + echo "=== Cluster Provisioning Completed Successfully on Attempt $provisioning_attempt ===" + break + done + + if [[ "$provisioning_successful" == "false" ]]; then + echo "Cluster provisioning failed after $provisioning_max_retries attempts." + exit 1 fi - echo "--- Console Accessibility Check Finished ---" - name: tssc-install runAfter: - provision-cluster From 89f4d7eb30f50d6da4415a1f5337a67a68c6f9a1 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 22 Oct 2025 17:49:14 +0200 Subject: [PATCH 10/44] Add retry loop for oc login with kubeadmin credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a 5-minute retry loop (30 attempts with 10-second intervals) to ensure successful login to the provisioned cluster using kubeadmin credentials. This handles cases where the cluster API is accessible but authentication may not be immediately ready. The retry loop includes proper validation via 'oc whoami' and integrates with the existing provisioning retry logic. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- integration-tests/pipelines/tssc-cli-e2e.yaml | 45 ++++++++++++++++++- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index de1e83192..b2425d5f1 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -215,12 +215,53 @@ spec: echo "Console is ready. Continuing." echo "--- Console Accessibility Check Finished ---" - # If we reach here, both CSR approval and console accessibility succeeded + # --- OC Login Retry Loop --- + echo "--- Starting OC Login Process ---" + login_max_retries=30 # 5 minutes with 10-second intervals + login_sleep_duration=10 + login_successful=false + + for ((k=1; k<=login_max_retries; k++)); do + echo "OC Login Attempt $k of $login_max_retries: Attempting to login with kubeadmin..." + if oc login --insecure-skip-tls-verify=true "$api_url" -u kubeadmin -p "$kubeadminpass" 2>&1; then + echo "Successfully logged in as kubeadmin on attempt $k." + if oc whoami 2>&1; then + echo "Confirmed login - current user: $(oc whoami)" + login_successful=true + break + else + echo "Login succeeded but 'oc whoami' failed on attempt $k." + fi + else + oc_login_exit_code=$? + echo "OC login failed on attempt $k (exit code: $oc_login_exit_code)." + fi + + if [[ "$k" -lt "$login_max_retries" ]]; then + echo "Sleeping for $login_sleep_duration seconds before next login retry..." + sleep "$login_sleep_duration" + fi + done + + if [[ "$login_successful" == "false" ]]; then + echo "Failed to login with kubeadmin after $login_max_retries attempts." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + fi + echo "OC login completed successfully." + echo "--- OC Login Process Finished ---" + + # If we reach here, CSR approval, console accessibility, and OC login all succeeded provisioning_successful=true echo "=== Cluster Provisioning Completed Successfully on Attempt $provisioning_attempt ===" break done - + oc get co if [[ "$provisioning_successful" == "false" ]]; then echo "Cluster provisioning failed after $provisioning_max_retries attempts." exit 1 From 7bd639a58e3b70977178a4b3c0ae44102b41a584 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 4 Nov 2025 09:35:58 +0100 Subject: [PATCH 11/44] Fix authentication race condition in OC login retry loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous implementation had a race condition where 'oc whoami' would succeed immediately after login but fail moments later when called again. This caused intermittent authentication failures even though login was reported as successful. Changes: - Add 2-second wait after successful login to allow auth to propagate - Capture 'oc whoami' output once instead of calling it multiple times - Add additional verification step with 'oc version' to ensure cluster commands work - Improve error logging to show exit codes and output for debugging This should resolve the "Unauthorized" errors that occurred right after successful login (as seen in lines 399-405 of the previous run logs). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- integration-tests/pipelines/tssc-cli-e2e.yaml | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index b2425d5f1..07c9941fd 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -225,12 +225,23 @@ spec: echo "OC Login Attempt $k of $login_max_retries: Attempting to login with kubeadmin..." if oc login --insecure-skip-tls-verify=true "$api_url" -u kubeadmin -p "$kubeadminpass" 2>&1; then echo "Successfully logged in as kubeadmin on attempt $k." - if oc whoami 2>&1; then - echo "Confirmed login - current user: $(oc whoami)" - login_successful=true - break + # Wait a moment for the authentication to fully propagate + sleep 2 + # Verify login with whoami and capture the output + whoami_output=$(oc whoami 2>&1) + whoami_exit_code=$? + if [[ "$whoami_exit_code" -eq 0 ]] && [[ -n "$whoami_output" ]]; then + echo "Confirmed login - current user: $whoami_output" + # Additional verification: try a simple cluster command + if oc version --short 2>/dev/null; then + echo "Login verification successful - can execute cluster commands." + login_successful=true + break + else + echo "Login succeeded but cannot execute cluster commands on attempt $k." + fi else - echo "Login succeeded but 'oc whoami' failed on attempt $k." + echo "Login succeeded but 'oc whoami' failed on attempt $k (exit code: $whoami_exit_code, output: '$whoami_output')." fi else oc_login_exit_code=$? From 8d8eba62b4cbf993c337919459e8465da8b0b94a Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 4 Nov 2025 13:03:33 +0100 Subject: [PATCH 12/44] Replace invalid oc version --short with oc get namespaces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The --short flag is not supported by the oc version command (unlike kubectl). Using 'oc get namespaces' instead provides better verification because: - It actually requires authentication and cluster access to succeed - oc version can show client version even without being logged in - This ensures we're truly authenticated and can access cluster resources 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 07c9941fd..69c2f6e61 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -232,8 +232,8 @@ spec: whoami_exit_code=$? if [[ "$whoami_exit_code" -eq 0 ]] && [[ -n "$whoami_output" ]]; then echo "Confirmed login - current user: $whoami_output" - # Additional verification: try a simple cluster command - if oc version --short 2>/dev/null; then + # Additional verification: try a simple cluster command that requires authentication + if oc get namespaces >/dev/null 2>&1; then echo "Login verification successful - can execute cluster commands." login_successful=true break From 79cf812ae807688af0c6790068cf9316aa511955 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 5 Nov 2025 16:02:13 +0100 Subject: [PATCH 13/44] Add CUSTOM_ROOT_CA var to gitops repo --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 ++-- integration-tests/tasks/tssc-install.yaml | 13 +++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 69c2f6e61..1c0b14084 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -284,9 +284,9 @@ spec: resolver: git params: - name: url - value: https://github.com/redhat-appstudio/tssc-cli.git + value: https://github.com/rhopp/tssc-cli.git - name: revision - value: main + value: hive-try3 - name: pathInRepo value: integration-tests/tasks/tssc-install.yaml params: diff --git a/integration-tests/tasks/tssc-install.yaml b/integration-tests/tasks/tssc-install.yaml index 46b76545c..e6a10ed3e 100644 --- a/integration-tests/tasks/tssc-install.yaml +++ b/integration-tests/tasks/tssc-install.yaml @@ -106,14 +106,15 @@ spec: echo "export pipeline_config=\"$PIPELINE_CONFIG\"" >> ${env_file} echo "export auth_config=\"$AUTH_CONFIG\"" >> ${env_file} - # Check if GIT_REPO is tssc-dev-multi-ci and update Developer Hub catalog url based on PR changes - if [[ "${GIT_REPO}" = "tssc-dev-multi-ci" ]]; then + + # Check if GIT_REPO is tssc-sample-templates and update Developer Hub catalog url based on PR changes + # if [[ "${GIT_REPO}" = "tssc-sample-templates" ]]; then GIT_REVISION="${GIT_REVISION:-$(echo "$JOB_SPEC" | jq -r '.git.commit_sha')}" GIT_URL="${GIT_URL:-$(echo "$JOB_SPEC" | jq -r '.git.source_repo_url')}" - TEST_DH_CATALOG_URL="$GIT_URL/blob/$GIT_REVISION/samples/all.yaml" - # Update DEVELOPER_HUB_CATALOG_URL value in .ci-env - sed -i "s|^export DEVELOPER_HUB_CATALOG_URL.*|export DEVELOPER_HUB_CATALOG_URL=${TEST_DH_CATALOG_URL}|" "${env_file}" - fi + TEST_DH_CATALOG_URL="$GIT_URL/blob/$GIT_REVISION/all.yaml" + # Update DEVELOPER_HUB__CATALOG__URL value in .ci-env + sed -i "s|^export DEVELOPER_HUB__CATALOG__URL.*|export DEVELOPER_HUB__CATALOG__URL=https://github.com/rhopp/tssc-sample-templates/blob/addCUSTOM_ROOT_CAGitops/all.yaml|" "${env_file}" + # fi echo "INFO: .env file for tssc installation" cat ${env_file} From 075541c7899617fd15bfd1d68a69d0786363f795 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 6 Nov 2025 10:15:06 +0100 Subject: [PATCH 14/44] Update test image Signed-off-by: Radim Hopp --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 1c0b14084..bc29904b3 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -335,7 +335,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: "quay.io/rhopp/tssc-tests:self_signed" + value: "quay.io/rhopp/tssc-tests:self_signed1" - name: testplan value: $(params.testplan) - name: rhtap-ui-tests From 2b22a437ff3f8e818c7c465fef7f06759ad8ff69 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 6 Nov 2025 17:25:33 +0100 Subject: [PATCH 15/44] New version of tesplan Signed-off-by: Radim Hopp --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index bc29904b3..c7d2d8db5 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -335,7 +335,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: "quay.io/rhopp/tssc-tests:self_signed1" + value: "quay.io/rhopp/tssc-tests:self_signed2" - name: testplan value: $(params.testplan) - name: rhtap-ui-tests From 6baae2354285711d16ad65ee512efb7dd2e53191 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 13 Nov 2025 12:24:07 +0100 Subject: [PATCH 16/44] Add 10-minute cluster stability observation after provisioning MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add comprehensive stability monitoring to diagnose intermittent authorization failures that occur after successful cluster provisioning. This will help identify if the cluster becomes unstable over time or if there are specific patterns to the failures. The observation loop runs for 10 minutes (120 iterations at 5-second intervals) and tests three critical components: 1. Cluster Operators (oc get co) - validates cluster operator availability 2. Console URL accessibility - ensures the web console remains reachable 3. API Server (oc get namespaces) - verifies authentication and API access For each test, the script tracks: - Success/failure counts - Pattern string showing timeline (e.g., "SSSSSFFFSSSS" where S=success, F=failure) - Timestamped logs for any failures - Progress updates every ~100 seconds This diagnostic data will help determine: - If failures are sporadic or follow a pattern - Which component(s) are unstable - How long it takes for the cluster to stabilize - Whether the issue is authentication-specific or broader 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- integration-tests/pipelines/tssc-cli-e2e.yaml | 90 ++++++++++++++++++- 1 file changed, 89 insertions(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index c7d2d8db5..48a1dd8ce 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -272,11 +272,99 @@ spec: echo "=== Cluster Provisioning Completed Successfully on Attempt $provisioning_attempt ===" break done - oc get co + if [[ "$provisioning_successful" == "false" ]]; then echo "Cluster provisioning failed after $provisioning_max_retries attempts." exit 1 fi + + # --- Cluster Stability Observation --- + echo "--- Starting Cluster Stability Observation ---" + observation_duration=600 # 10 minutes + observation_interval=5 # Check every 5 seconds + observation_iterations=$((observation_duration / observation_interval)) + + co_success=0 + co_failure=0 + console_success=0 + console_failure=0 + api_success=0 + api_failure=0 + + co_pattern="" + console_pattern="" + api_pattern="" + + echo "Will perform $observation_iterations observations over $observation_duration seconds" + echo "Observation interval: ${observation_interval}s" + echo "" + + for ((obs=1; obs<=observation_iterations; obs++)); do + timestamp=$(date '+%Y-%m-%d %H:%M:%S') + + # Test 1: Cluster Operators + if oc get co >/dev/null 2>&1; then + ((co_success++)) + co_pattern="${co_pattern}S" + else + ((co_failure++)) + co_pattern="${co_pattern}F" + echo "[$timestamp] Observation $obs: FAILURE - oc get co failed" + fi + + # Test 2: Console URL accessibility + if curl -k --silent --output /dev/null --head --fail --connect-timeout 5 "$console_url"; then + ((console_success++)) + console_pattern="${console_pattern}S" + else + ((console_failure++)) + console_pattern="${console_pattern}F" + echo "[$timestamp] Observation $obs: FAILURE - console URL not accessible" + fi + + # Test 3: API server (namespaces) + if oc get namespaces >/dev/null 2>&1; then + ((api_success++)) + api_pattern="${api_pattern}S" + else + ((api_failure++)) + api_pattern="${api_pattern}F" + echo "[$timestamp] Observation $obs: FAILURE - oc get namespaces failed" + fi + + # Print progress every 20 observations (approximately every 100 seconds) + if (( obs % 20 == 0 )); then + echo "[$timestamp] Progress: $obs/$observation_iterations observations completed" + fi + + # Sleep between observations (except on the last iteration) + if [[ "$obs" -lt "$observation_iterations" ]]; then + sleep "$observation_interval" + fi + done + + echo "" + echo "=== Cluster Stability Observation Results ===" + echo "Total observations: $observation_iterations" + echo "" + echo "Cluster Operators (oc get co):" + echo " Success: $co_success, Failures: $co_failure" + echo " Pattern: $co_pattern" + echo "" + echo "Console URL accessibility:" + echo " Success: $console_success, Failures: $console_failure" + echo " Pattern: $console_pattern" + echo "" + echo "API Server (oc get namespaces):" + echo " Success: $api_success, Failures: $api_failure" + echo " Pattern: $api_pattern" + echo "" + echo "--- Cluster Stability Observation Finished ---" + + # Show current cluster operator status for reference + echo "" + echo "Final cluster operator status:" + oc get co - name: tssc-install runAfter: - provision-cluster From de54eadb43b81db1c38271ae30fb389ad4b1ebb1 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 13 Nov 2025 14:57:19 +0100 Subject: [PATCH 17/44] Add cluster artifact collection task to finally section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a new task to collect cluster artifacts when the pipeline fails. This task: - Runs in the finally section to execute even when other tasks fail - Only executes when pipeline status is not "Succeeded" - Logs into the provisioned cluster using the ocp-login-command - Runs gather-extra.sh script to collect diagnostic information - Pushes collected artifacts to OCI storage for later analysis The collected artifacts will help diagnose issues that occur during test execution, particularly the intermittent authorization failures. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- integration-tests/pipelines/tssc-cli-e2e.yaml | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 48a1dd8ce..26957f81e 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -527,3 +527,44 @@ spec: value: $(tasks.status) - name: pipelinerun-name value: $(context.pipelineRun.name) + - name: collect-cluster-artifacts + taskSpec: + volumes: + - name: konflux-test-infra-volume + secret: + secretName: "$(params.konflux-test-infra-secret)" + steps: + - name: collect-artifacts + workingDir: /workspace/cluster-artifacts + onError: continue + image: quay.io/konflux-qe-incubator/konflux-qe-tools:latest + script: | + #!/bin/sh + $(tasks.provision-cluster.results.ocp-login-command) + + curl -sSL https://raw.githubusercontent.com/konflux-ci/konflux-qe-definitions/main/scripts/gather-extra.sh | bash + when: + - input: $(tasks.status) + operator: notin + values: ["Succeeded"] + - name: secure-push-oci + ref: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: stepactions/secure-push-oci/0.1/secure-push-oci.yaml + params: + - name: workdir-path + value: /workspace + - name: oci-ref + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: credentials-volume-name + value: konflux-test-infra-volume + when: + - input: $(tasks.status) + operator: notin + values: ["Succeeded"] From f62df0ca2d81d0728ecf90b0ff85049f31ac870a Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Fri, 14 Nov 2025 13:07:08 +0100 Subject: [PATCH 18/44] Add cert to proxy/cluster --- integration-tests/scripts/install.sh | 38 ++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/integration-tests/scripts/install.sh b/integration-tests/scripts/install.sh index b76d598dd..f7dd72ba7 100755 --- a/integration-tests/scripts/install.sh +++ b/integration-tests/scripts/install.sh @@ -435,6 +435,44 @@ configure_integrations() { echo "[INFO] Integration secrets in 'tssc' namespace:" kubectl -n tssc get secret 2>/dev/null | grep -E "(github|gitlab|bitbucket|acs|trustification)" || echo " (some secrets may not exist yet)" } +} + +wait_for() { + local command="${1}" + local description="${2}" + local timeout="${3}" + local interval="${4}" + printf "Waiting for %s for %s...\n" "${description}" "${timeout}" + timeout --foreground "${timeout}" bash -c " + set -x + until ${command} + do + printf \"Waiting for %s... Trying again in ${interval}s\n\" \"${description}\" + sleep ${interval} + done + set +x + " || return 1 + printf "%s finished!\n" "${description}" +} + +updateCert() { + set -x + kubectl create configmap root-ca -n openshift-config --from-literal=ca-bundle.crt="$(kubectl get configmap "kube-root-ca.crt" -o=json |jq -r '.data["ca.crt"]')" + BASE_DOMAIN=$(oc get ingress.config.openshift.io cluster -o jsonpath='{.spec.domain}') + REGISTRY_URL="rhtap-quay-quay-rhtap-quay.$BASE_DOMAIN" + # REGISTRY=$(oc get routes/rhtap-quay-quay -n rhtap-quay -o jsonpath="{.spec.host}") + kubectl create configmap root-ca-image -n openshift-config --from-literal="$REGISTRY_URL"="$(kubectl get configmap "kube-root-ca.crt" -o=json |jq -r '.data["ca.crt"]')" + kubectl get cm root-ca -n openshift-config + oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"root-ca"}}}' + oc patch image.config/cluster --type=merge --patch='{"spec":{"additionalTrustedCA":{"name":"root-ca-image"}}}' + + sleep 5 + oc get co + wait_for "kubectl get clusteroperators -A" "cluster operators to be accessible" "10m" "30" + echo "[INFO] Cluster operators were updated." + set +x +} + install_tssc() { echo "[INFO] Start installing TSSC" From 58da60b394fbe9dfd2a6dcb20f20d3c01d4cdcfd Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Fri, 14 Nov 2025 14:40:30 +0100 Subject: [PATCH 19/44] forgot to call the function :-( --- integration-tests/scripts/install.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/integration-tests/scripts/install.sh b/integration-tests/scripts/install.sh index f7dd72ba7..936e005c0 100755 --- a/integration-tests/scripts/install.sh +++ b/integration-tests/scripts/install.sh @@ -487,6 +487,19 @@ install_tssc() { cat "$tpl_file" set +x + updateCert + + jenkins_integration + azure_integration + tpa_integration + acs_integration + github_integration + gitlab_integration + bitbucket_integration + quay_integration + artifactory_integration + nexus_integration + echo "[INFO] Running 'tssc deploy' command..." set -x "${TSSC_BINARY}" deploy --timeout 35m --values-template "$tpl_file" --kube-config "$KUBECONFIG" From 1778ddfa9b93f53b0694383ce915003e4bee64de Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 19 Nov 2025 13:33:44 +0100 Subject: [PATCH 20/44] New version of tests --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 26957f81e..69123f67c 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -423,7 +423,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: "quay.io/rhopp/tssc-tests:self_signed2" + value: "quay.io/rhopp/tssc-tests:self_signed3" - name: testplan value: $(params.testplan) - name: rhtap-ui-tests From a6af8319d4b2511759f4117d075039784bac1da3 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 16 Dec 2025 17:48:12 +0100 Subject: [PATCH 21/44] Use main templates, Update tests --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- integration-tests/tasks/tssc-install.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 69123f67c..cfda1b5ce 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -423,7 +423,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: "quay.io/rhopp/tssc-tests:self_signed3" + value: "quay.io/rhopp/tssc-tests:self_signed4" - name: testplan value: $(params.testplan) - name: rhtap-ui-tests diff --git a/integration-tests/tasks/tssc-install.yaml b/integration-tests/tasks/tssc-install.yaml index e6a10ed3e..d2f7ea992 100644 --- a/integration-tests/tasks/tssc-install.yaml +++ b/integration-tests/tasks/tssc-install.yaml @@ -112,8 +112,8 @@ spec: GIT_REVISION="${GIT_REVISION:-$(echo "$JOB_SPEC" | jq -r '.git.commit_sha')}" GIT_URL="${GIT_URL:-$(echo "$JOB_SPEC" | jq -r '.git.source_repo_url')}" TEST_DH_CATALOG_URL="$GIT_URL/blob/$GIT_REVISION/all.yaml" - # Update DEVELOPER_HUB__CATALOG__URL value in .ci-env - sed -i "s|^export DEVELOPER_HUB__CATALOG__URL.*|export DEVELOPER_HUB__CATALOG__URL=https://github.com/rhopp/tssc-sample-templates/blob/addCUSTOM_ROOT_CAGitops/all.yaml|" "${env_file}" + # Update DEVELOPER_HUB_CATALOG_URL value in .ci-env + sed -i "s|^export DEVELOPER_HUB_CATALOG_URL.*|export DEVELOPER_HUB_CATALOG_URL=${TEST_DH_CATALOG_URL}|" "${env_file}" # fi echo "INFO: .env file for tssc installation" From 53b5371773e185db86146538a0ffd595e12138fa Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 16 Dec 2025 18:47:27 +0100 Subject: [PATCH 22/44] Keep the cluster running for debugging --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index cfda1b5ce..1e331f855 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -88,6 +88,7 @@ spec: namespace: hive spec: clusterPoolName: rhopp-test-clusterpool + lifetime: 6h EOF ## wait for cluster for up to 60 minutes if ! kubectl wait --for=condition=ClusterRunning clusterclaims.hive.openshift.io/$(context.pipelineRun.name) -n hive --timeout 60m; then @@ -470,7 +471,8 @@ spec: set -x oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) oc whoami - oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive + echo "/me Acting like I'm deleting a clusterclaim. tehehe" + # oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive - name: sprayproxy-deprovision when: - input: "$(tasks.sprayproxy-provision.status)" From 2179b896a162f319e0f8073a36d4056a7cdc6c72 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 16 Dec 2025 19:48:29 +0100 Subject: [PATCH 23/44] fix - I'm not in samples repo ;-) --- integration-tests/tasks/tssc-install.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/integration-tests/tasks/tssc-install.yaml b/integration-tests/tasks/tssc-install.yaml index d2f7ea992..02dfbbbb5 100644 --- a/integration-tests/tasks/tssc-install.yaml +++ b/integration-tests/tasks/tssc-install.yaml @@ -108,13 +108,13 @@ spec: # Check if GIT_REPO is tssc-sample-templates and update Developer Hub catalog url based on PR changes - # if [[ "${GIT_REPO}" = "tssc-sample-templates" ]]; then + if [[ "${GIT_REPO}" = "tssc-sample-templates" ]]; then GIT_REVISION="${GIT_REVISION:-$(echo "$JOB_SPEC" | jq -r '.git.commit_sha')}" GIT_URL="${GIT_URL:-$(echo "$JOB_SPEC" | jq -r '.git.source_repo_url')}" TEST_DH_CATALOG_URL="$GIT_URL/blob/$GIT_REVISION/all.yaml" # Update DEVELOPER_HUB_CATALOG_URL value in .ci-env sed -i "s|^export DEVELOPER_HUB_CATALOG_URL.*|export DEVELOPER_HUB_CATALOG_URL=${TEST_DH_CATALOG_URL}|" "${env_file}" - # fi + fi echo "INFO: .env file for tssc installation" cat ${env_file} From 9c8c525654c1d42da3106df6c373c38d95bb75c7 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 16 Dec 2025 22:12:00 +0100 Subject: [PATCH 24/44] Switch DH catalog to `main` (from default 1.8) --- integration-tests/tasks/tssc-install.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/integration-tests/tasks/tssc-install.yaml b/integration-tests/tasks/tssc-install.yaml index 02dfbbbb5..98a496d16 100644 --- a/integration-tests/tasks/tssc-install.yaml +++ b/integration-tests/tasks/tssc-install.yaml @@ -108,13 +108,13 @@ spec: # Check if GIT_REPO is tssc-sample-templates and update Developer Hub catalog url based on PR changes - if [[ "${GIT_REPO}" = "tssc-sample-templates" ]]; then + # if [[ "${GIT_REPO}" = "tssc-sample-templates" ]]; then GIT_REVISION="${GIT_REVISION:-$(echo "$JOB_SPEC" | jq -r '.git.commit_sha')}" GIT_URL="${GIT_URL:-$(echo "$JOB_SPEC" | jq -r '.git.source_repo_url')}" TEST_DH_CATALOG_URL="$GIT_URL/blob/$GIT_REVISION/all.yaml" # Update DEVELOPER_HUB_CATALOG_URL value in .ci-env - sed -i "s|^export DEVELOPER_HUB_CATALOG_URL.*|export DEVELOPER_HUB_CATALOG_URL=${TEST_DH_CATALOG_URL}|" "${env_file}" - fi + sed -i "s|^export DEVELOPER_HUB_CATALOG_URL.*|export DEVELOPER_HUB_CATALOG_URL=https://github.com/redhat-appstudio/tssc-sample-templates/blob/main/all.yaml|" "${env_file}" + # fi echo "INFO: .env file for tssc installation" cat ${env_file} From c44051de1f691d63ae988ad03739b4b6ff3f0bdf Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 8 Jan 2026 09:49:35 +0100 Subject: [PATCH 25/44] temp: remove sprayproxy deprovisioning Signed-off-by: Radim Hopp --- integration-tests/pipelines/tssc-cli-e2e.yaml | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 1e331f855..386370e76 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -473,24 +473,6 @@ spec: oc whoami echo "/me Acting like I'm deleting a clusterclaim. tehehe" # oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive - - name: sprayproxy-deprovision - when: - - input: "$(tasks.sprayproxy-provision.status)" - operator: in - values: - - "Succeeded" - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml - params: - - name: ocp-login-command - value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git From 3cc9986033766de0c7afb60aa07e6c1e4f0cf5c1 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Fri, 9 Jan 2026 10:33:50 +0100 Subject: [PATCH 26/44] return of sprayproxy deprovisioning and cluster deletion Signed-off-by: Radim Hopp --- integration-tests/pipelines/tssc-cli-e2e.yaml | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 386370e76..309623f20 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -472,7 +472,25 @@ spec: oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) oc whoami echo "/me Acting like I'm deleting a clusterclaim. tehehe" - # oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive + oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive + - name: sprayproxy-deprovision + when: + - input: "$(tasks.sprayproxy-provision.status)" + operator: in + values: + - "Succeeded" + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml + params: + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git From b1cf2e7355a7684927bd8fc5f95937cb01d55bf3 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 20 Jan 2026 15:01:45 +0100 Subject: [PATCH 27/44] Use main of tssc-test --- integration-tests/pipelines/tssc-cli-e2e.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 309623f20..0ec9f47c4 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -411,9 +411,9 @@ spec: resolver: git params: - name: url - value: https://github.com/rhopp/tssc-test.git + value: https://github.com/redhat-appstudio/tssc-test.git - name: revision - value: disable_tls + value: main - name: pathInRepo value: integration-tests/tasks/tssc-e2e.yaml params: @@ -424,7 +424,7 @@ spec: - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image - value: "quay.io/rhopp/tssc-tests:self_signed4" + value: $(params.tssc-test-image) - name: testplan value: $(params.testplan) - name: rhtap-ui-tests From 960468df5acf0ee55d6e9786fd6c0654b10b93e1 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 20 Jan 2026 15:35:20 +0100 Subject: [PATCH 28/44] Fix finally task --- integration-tests/pipelines/tssc-cli-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 0ec9f47c4..0b31cb943 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -490,7 +490,7 @@ spec: value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" + value: "$(tasks.provision-cluster.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git From 12b22731661fbfc605cc44b5780e357608858390 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 14:10:28 +0100 Subject: [PATCH 29/44] Extract provision-cluster task into separate file Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 319 +----------------- .../tasks/provision-cluster.yaml | 312 +++++++++++++++++ 2 files changed, 321 insertions(+), 310 deletions(-) create mode 100644 integration-tests/tasks/provision-cluster.yaml diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 0b31cb943..10af63b51 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -56,316 +56,15 @@ spec: default: "" tasks: - name: provision-cluster - taskSpec: - results: - - name: ocp-login-command - value: "$(steps.claim-cluster.results.ocp-login-command)" - volumes: - - name: hive-creds-volume - secret: - secretName: rhopp-test - - name: credentials - emptyDir: {} - steps: - - name: claim-cluster - image: registry.redhat.io/openshift4/ose-cli@sha256:15da03b04318bcc842060b71e9dd6d6c2595edb4e8fdd11b0c6781eeb03ca182 - volumeMounts: - - name: hive-creds-volume - mountPath: /usr/local/hive-creds - results: - - name: ocp-login-command - description: "Ocp login command" - script: | - #!/usr/bin/bash - oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) - oc whoami - oc get rhopp-test-clusterpool -n hive - oc create -f - < $(step.results.ocp-login-command.path) - - kubeconfig_secret=$(oc get clusterdeployment -n $cp_namespace $cp_namespace -o jsonpath={.spec.clusterMetadata.adminKubeconfigSecretRef.name}) - - oc get secret -n $cp_namespace $kubeconfig_secret -o jsonpath={.data.kubeconfig} |base64 -d > /tmp/ephemereal.config - export KUBECONFIG=/tmp/ephemereal.config - - # --- Cluster Provisioning Retry Loop --- - provisioning_max_retries=3 - provisioning_successful=false - - for ((provisioning_attempt=1; provisioning_attempt<=provisioning_max_retries; provisioning_attempt++)); do - echo "=== Cluster Provisioning Attempt $provisioning_attempt of $provisioning_max_retries ===" - - # Reset flags for this attempt - csr_max_retries=5 - csr_sleep_duration=10 - approved_csrs=false - - console_max_retries=30 - console_sleep_duration=10 - console_connect_timeout=10 - console_accessible=false - - echo "--- Starting CSR Approval Process ---" - for ((i=1; i<=csr_max_retries; i++)); do - echo "CSR Attempt $i of $csr_max_retries: Checking for pending CSRs..." - if ! oc get csr 2>/dev/null | grep -i Pending; then - echo "No pending CSRs found. Continuing" - approved_csrs=true - break - else - echo "There are pending CSRs. That probably means cluster was hibernated for more than 24 hours. Need to approve them (until OCPBUGS-55339 is resolved)" - if oc get csr -oname | xargs oc adm certificate approve; then - echo "Successfully submitted approval for CSRs on attempt $i." - sleep 60 # Small delay for changes to propagate - if ! oc get csr 2>/dev/null | grep -i Pending; then - echo "Confirmed no pending CSRs after approval." - approved_csrs=true - break - else - echo "Pending CSRs still exist after approval attempt $i." - fi - else - echo "Failed to run approval command for CSRs on attempt $i." - fi - fi - - if [[ "$i" -lt "$csr_max_retries" ]]; then - echo "Sleeping for $csr_sleep_duration seconds before next CSR retry..." - sleep "$csr_sleep_duration" - fi - done - - if [[ "$approved_csrs" == "false" ]]; then - echo "Failed to ensure all pending CSRs were approved after $csr_max_retries attempts." - if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then - echo "Will retry entire provisioning process..." - continue - else - echo "All provisioning attempts exhausted. Exiting." - exit 1 - fi - fi - echo "CSR check and approval process completed successfully." - echo "--- CSR Approval Process Finished ---" - - # --- Console URL Accessibility Check --- - echo "--- Starting Console Accessibility Check ---" - - oc whoami - console_url=$(oc whoami --show-console) - echo "Console URL: $console_url" - - if [[ -z "$console_url" ]]; then - echo "Error: Could not retrieve OpenShift console URL." - if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then - echo "Will retry entire provisioning process..." - continue - else - echo "All provisioning attempts exhausted. Exiting." - exit 1 - fi - else - echo "Console URL found: $console_url" - for ((j=1; j<=console_max_retries; j++)); do - echo "Console Check Attempt $j of $console_max_retries: Checking console URL accessibility..." - if curl -k --silent --output /dev/null --head --fail --connect-timeout "$console_connect_timeout" "$console_url"; then - echo "Console URL $console_url is accessible (HTTP 2xx)." - console_accessible=true - break - else - curl_exit_code=$? - echo "Console URL $console_url not accessible on attempt $j (curl exit code: $curl_exit_code)." - fi - - if [[ "$j" -lt "$console_max_retries" ]]; then - echo "Sleeping for $console_sleep_duration seconds before next console check retry..." - sleep "$console_sleep_duration" - fi - done - - if [[ "$console_accessible" == "false" ]]; then - echo "Failed to access console URL $console_url after $console_max_retries attempts." - if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then - echo "Will retry entire provisioning process..." - continue - else - echo "All provisioning attempts exhausted. Exiting." - exit 1 - fi - fi - fi - echo "Console is ready. Continuing." - echo "--- Console Accessibility Check Finished ---" - - # --- OC Login Retry Loop --- - echo "--- Starting OC Login Process ---" - login_max_retries=30 # 5 minutes with 10-second intervals - login_sleep_duration=10 - login_successful=false - - for ((k=1; k<=login_max_retries; k++)); do - echo "OC Login Attempt $k of $login_max_retries: Attempting to login with kubeadmin..." - if oc login --insecure-skip-tls-verify=true "$api_url" -u kubeadmin -p "$kubeadminpass" 2>&1; then - echo "Successfully logged in as kubeadmin on attempt $k." - # Wait a moment for the authentication to fully propagate - sleep 2 - # Verify login with whoami and capture the output - whoami_output=$(oc whoami 2>&1) - whoami_exit_code=$? - if [[ "$whoami_exit_code" -eq 0 ]] && [[ -n "$whoami_output" ]]; then - echo "Confirmed login - current user: $whoami_output" - # Additional verification: try a simple cluster command that requires authentication - if oc get namespaces >/dev/null 2>&1; then - echo "Login verification successful - can execute cluster commands." - login_successful=true - break - else - echo "Login succeeded but cannot execute cluster commands on attempt $k." - fi - else - echo "Login succeeded but 'oc whoami' failed on attempt $k (exit code: $whoami_exit_code, output: '$whoami_output')." - fi - else - oc_login_exit_code=$? - echo "OC login failed on attempt $k (exit code: $oc_login_exit_code)." - fi - - if [[ "$k" -lt "$login_max_retries" ]]; then - echo "Sleeping for $login_sleep_duration seconds before next login retry..." - sleep "$login_sleep_duration" - fi - done - - if [[ "$login_successful" == "false" ]]; then - echo "Failed to login with kubeadmin after $login_max_retries attempts." - if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then - echo "Will retry entire provisioning process..." - continue - else - echo "All provisioning attempts exhausted. Exiting." - exit 1 - fi - fi - echo "OC login completed successfully." - echo "--- OC Login Process Finished ---" - - # If we reach here, CSR approval, console accessibility, and OC login all succeeded - provisioning_successful=true - echo "=== Cluster Provisioning Completed Successfully on Attempt $provisioning_attempt ===" - break - done - - if [[ "$provisioning_successful" == "false" ]]; then - echo "Cluster provisioning failed after $provisioning_max_retries attempts." - exit 1 - fi - - # --- Cluster Stability Observation --- - echo "--- Starting Cluster Stability Observation ---" - observation_duration=600 # 10 minutes - observation_interval=5 # Check every 5 seconds - observation_iterations=$((observation_duration / observation_interval)) - - co_success=0 - co_failure=0 - console_success=0 - console_failure=0 - api_success=0 - api_failure=0 - - co_pattern="" - console_pattern="" - api_pattern="" - - echo "Will perform $observation_iterations observations over $observation_duration seconds" - echo "Observation interval: ${observation_interval}s" - echo "" - - for ((obs=1; obs<=observation_iterations; obs++)); do - timestamp=$(date '+%Y-%m-%d %H:%M:%S') - - # Test 1: Cluster Operators - if oc get co >/dev/null 2>&1; then - ((co_success++)) - co_pattern="${co_pattern}S" - else - ((co_failure++)) - co_pattern="${co_pattern}F" - echo "[$timestamp] Observation $obs: FAILURE - oc get co failed" - fi - - # Test 2: Console URL accessibility - if curl -k --silent --output /dev/null --head --fail --connect-timeout 5 "$console_url"; then - ((console_success++)) - console_pattern="${console_pattern}S" - else - ((console_failure++)) - console_pattern="${console_pattern}F" - echo "[$timestamp] Observation $obs: FAILURE - console URL not accessible" - fi - - # Test 3: API server (namespaces) - if oc get namespaces >/dev/null 2>&1; then - ((api_success++)) - api_pattern="${api_pattern}S" - else - ((api_failure++)) - api_pattern="${api_pattern}F" - echo "[$timestamp] Observation $obs: FAILURE - oc get namespaces failed" - fi - - # Print progress every 20 observations (approximately every 100 seconds) - if (( obs % 20 == 0 )); then - echo "[$timestamp] Progress: $obs/$observation_iterations observations completed" - fi - - # Sleep between observations (except on the last iteration) - if [[ "$obs" -lt "$observation_iterations" ]]; then - sleep "$observation_interval" - fi - done - - echo "" - echo "=== Cluster Stability Observation Results ===" - echo "Total observations: $observation_iterations" - echo "" - echo "Cluster Operators (oc get co):" - echo " Success: $co_success, Failures: $co_failure" - echo " Pattern: $co_pattern" - echo "" - echo "Console URL accessibility:" - echo " Success: $console_success, Failures: $console_failure" - echo " Pattern: $console_pattern" - echo "" - echo "API Server (oc get namespaces):" - echo " Success: $api_success, Failures: $api_failure" - echo " Pattern: $api_pattern" - echo "" - echo "--- Cluster Stability Observation Finished ---" - - # Show current cluster operator status for reference - echo "" - echo "Final cluster operator status:" - oc get co + taskRef: + resolver: git + params: + - name: url + value: https://github.com/rhopp/tssc-cli.git + - name: revision + value: hive-try3 + - name: pathInRepo + value: integration-tests/tasks/provision-cluster.yaml - name: tssc-install runAfter: - provision-cluster diff --git a/integration-tests/tasks/provision-cluster.yaml b/integration-tests/tasks/provision-cluster.yaml new file mode 100644 index 000000000..44e27254b --- /dev/null +++ b/integration-tests/tasks/provision-cluster.yaml @@ -0,0 +1,312 @@ +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: provision-cluster +spec: + results: + - name: ocp-login-command + description: "OCP login command for accessing the provisioned cluster" + volumes: + - name: hive-creds-volume + secret: + secretName: rhopp-test + - name: credentials + emptyDir: {} + steps: + - name: claim-cluster + image: registry.redhat.io/openshift4/ose-cli@sha256:15da03b04318bcc842060b71e9dd6d6c2595edb4e8fdd11b0c6781eeb03ca182 + volumeMounts: + - name: hive-creds-volume + mountPath: /usr/local/hive-creds + script: | + #!/usr/bin/bash + oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) + oc whoami + oc get rhopp-test-clusterpool -n hive + oc create -f - < $(results.ocp-login-command.path) + + kubeconfig_secret=$(oc get clusterdeployment -n $cp_namespace $cp_namespace -o jsonpath={.spec.clusterMetadata.adminKubeconfigSecretRef.name}) + + oc get secret -n $cp_namespace $kubeconfig_secret -o jsonpath={.data.kubeconfig} |base64 -d > /tmp/ephemereal.config + export KUBECONFIG=/tmp/ephemereal.config + + # --- Cluster Provisioning Retry Loop --- + provisioning_max_retries=3 + provisioning_successful=false + + for ((provisioning_attempt=1; provisioning_attempt<=provisioning_max_retries; provisioning_attempt++)); do + echo "=== Cluster Provisioning Attempt $provisioning_attempt of $provisioning_max_retries ===" + + # Reset flags for this attempt + csr_max_retries=5 + csr_sleep_duration=10 + approved_csrs=false + + console_max_retries=30 + console_sleep_duration=10 + console_connect_timeout=10 + console_accessible=false + + echo "--- Starting CSR Approval Process ---" + for ((i=1; i<=csr_max_retries; i++)); do + echo "CSR Attempt $i of $csr_max_retries: Checking for pending CSRs..." + if ! oc get csr 2>/dev/null | grep -i Pending; then + echo "No pending CSRs found. Continuing" + approved_csrs=true + break + else + echo "There are pending CSRs. That probably means cluster was hibernated for more than 24 hours. Need to approve them (until OCPBUGS-55339 is resolved)" + if oc get csr -oname | xargs oc adm certificate approve; then + echo "Successfully submitted approval for CSRs on attempt $i." + sleep 60 # Small delay for changes to propagate + if ! oc get csr 2>/dev/null | grep -i Pending; then + echo "Confirmed no pending CSRs after approval." + approved_csrs=true + break + else + echo "Pending CSRs still exist after approval attempt $i." + fi + else + echo "Failed to run approval command for CSRs on attempt $i." + fi + fi + + if [[ "$i" -lt "$csr_max_retries" ]]; then + echo "Sleeping for $csr_sleep_duration seconds before next CSR retry..." + sleep "$csr_sleep_duration" + fi + done + + if [[ "$approved_csrs" == "false" ]]; then + echo "Failed to ensure all pending CSRs were approved after $csr_max_retries attempts." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + fi + echo "CSR check and approval process completed successfully." + echo "--- CSR Approval Process Finished ---" + + # --- Console URL Accessibility Check --- + echo "--- Starting Console Accessibility Check ---" + + oc whoami + console_url=$(oc whoami --show-console) + echo "Console URL: $console_url" + + if [[ -z "$console_url" ]]; then + echo "Error: Could not retrieve OpenShift console URL." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + else + echo "Console URL found: $console_url" + for ((j=1; j<=console_max_retries; j++)); do + echo "Console Check Attempt $j of $console_max_retries: Checking console URL accessibility..." + if curl -k --silent --output /dev/null --head --fail --connect-timeout "$console_connect_timeout" "$console_url"; then + echo "Console URL $console_url is accessible (HTTP 2xx)." + console_accessible=true + break + else + curl_exit_code=$? + echo "Console URL $console_url not accessible on attempt $j (curl exit code: $curl_exit_code)." + fi + + if [[ "$j" -lt "$console_max_retries" ]]; then + echo "Sleeping for $console_sleep_duration seconds before next console check retry..." + sleep "$console_sleep_duration" + fi + done + + if [[ "$console_accessible" == "false" ]]; then + echo "Failed to access console URL $console_url after $console_max_retries attempts." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + fi + fi + echo "Console is ready. Continuing." + echo "--- Console Accessibility Check Finished ---" + + # --- OC Login Retry Loop --- + echo "--- Starting OC Login Process ---" + login_max_retries=30 # 5 minutes with 10-second intervals + login_sleep_duration=10 + login_successful=false + + for ((k=1; k<=login_max_retries; k++)); do + echo "OC Login Attempt $k of $login_max_retries: Attempting to login with kubeadmin..." + if oc login --insecure-skip-tls-verify=true "$api_url" -u kubeadmin -p "$kubeadminpass" 2>&1; then + echo "Successfully logged in as kubeadmin on attempt $k." + # Wait a moment for the authentication to fully propagate + sleep 2 + # Verify login with whoami and capture the output + whoami_output=$(oc whoami 2>&1) + whoami_exit_code=$? + if [[ "$whoami_exit_code" -eq 0 ]] && [[ -n "$whoami_output" ]]; then + echo "Confirmed login - current user: $whoami_output" + # Additional verification: try a simple cluster command that requires authentication + if oc get namespaces >/dev/null 2>&1; then + echo "Login verification successful - can execute cluster commands." + login_successful=true + break + else + echo "Login succeeded but cannot execute cluster commands on attempt $k." + fi + else + echo "Login succeeded but 'oc whoami' failed on attempt $k (exit code: $whoami_exit_code, output: '$whoami_output')." + fi + else + oc_login_exit_code=$? + echo "OC login failed on attempt $k (exit code: $oc_login_exit_code)." + fi + + if [[ "$k" -lt "$login_max_retries" ]]; then + echo "Sleeping for $login_sleep_duration seconds before next login retry..." + sleep "$login_sleep_duration" + fi + done + + if [[ "$login_successful" == "false" ]]; then + echo "Failed to login with kubeadmin after $login_max_retries attempts." + if [[ "$provisioning_attempt" -lt "$provisioning_max_retries" ]]; then + echo "Will retry entire provisioning process..." + continue + else + echo "All provisioning attempts exhausted. Exiting." + exit 1 + fi + fi + echo "OC login completed successfully." + echo "--- OC Login Process Finished ---" + + # If we reach here, CSR approval, console accessibility, and OC login all succeeded + provisioning_successful=true + echo "=== Cluster Provisioning Completed Successfully on Attempt $provisioning_attempt ===" + break + done + + if [[ "$provisioning_successful" == "false" ]]; then + echo "Cluster provisioning failed after $provisioning_max_retries attempts." + exit 1 + fi + + # --- Cluster Stability Observation --- + echo "--- Starting Cluster Stability Observation ---" + observation_duration=600 # 10 minutes + observation_interval=5 # Check every 5 seconds + observation_iterations=$((observation_duration / observation_interval)) + + co_success=0 + co_failure=0 + console_success=0 + console_failure=0 + api_success=0 + api_failure=0 + + co_pattern="" + console_pattern="" + api_pattern="" + + echo "Will perform $observation_iterations observations over $observation_duration seconds" + echo "Observation interval: ${observation_interval}s" + echo "" + + for ((obs=1; obs<=observation_iterations; obs++)); do + timestamp=$(date '+%Y-%m-%d %H:%M:%S') + + # Test 1: Cluster Operators + if oc get co >/dev/null 2>&1; then + ((co_success++)) + co_pattern="${co_pattern}S" + else + ((co_failure++)) + co_pattern="${co_pattern}F" + echo "[$timestamp] Observation $obs: FAILURE - oc get co failed" + fi + + # Test 2: Console URL accessibility + if curl -k --silent --output /dev/null --head --fail --connect-timeout 5 "$console_url"; then + ((console_success++)) + console_pattern="${console_pattern}S" + else + ((console_failure++)) + console_pattern="${console_pattern}F" + echo "[$timestamp] Observation $obs: FAILURE - console URL not accessible" + fi + + # Test 3: API server (namespaces) + if oc get namespaces >/dev/null 2>&1; then + ((api_success++)) + api_pattern="${api_pattern}S" + else + ((api_failure++)) + api_pattern="${api_pattern}F" + echo "[$timestamp] Observation $obs: FAILURE - oc get namespaces failed" + fi + + # Print progress every 20 observations (approximately every 100 seconds) + if (( obs % 20 == 0 )); then + echo "[$timestamp] Progress: $obs/$observation_iterations observations completed" + fi + + # Sleep between observations (except on the last iteration) + if [[ "$obs" -lt "$observation_iterations" ]]; then + sleep "$observation_interval" + fi + done + + echo "" + echo "=== Cluster Stability Observation Results ===" + echo "Total observations: $observation_iterations" + echo "" + echo "Cluster Operators (oc get co):" + echo " Success: $co_success, Failures: $co_failure" + echo " Pattern: $co_pattern" + echo "" + echo "Console URL accessibility:" + echo " Success: $console_success, Failures: $console_failure" + echo " Pattern: $console_pattern" + echo "" + echo "API Server (oc get namespaces):" + echo " Success: $api_success, Failures: $api_failure" + echo " Pattern: $api_pattern" + echo "" + echo "--- Cluster Stability Observation Finished ---" + + # Show current cluster operator status for reference + echo "" + echo "Final cluster operator status:" + oc get co From 19b70763b30ac103e3f9695ab80a5f854a5b2844 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 14:25:53 +0100 Subject: [PATCH 30/44] Add support for both ROSA and Hive cluster provisioning Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 113 ++++++++++++++++-- 1 file changed, 104 insertions(+), 9 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 10af63b51..86d22a62d 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -10,22 +10,30 @@ spec: the ROSA cluster, installs TSSC using the installer, runs the tests, collects artifacts, and finally deprovisions the ROSA cluster. params: + - name: cluster-provider + description: 'Cluster provider to use for testing. Valid values: "rosa" or "hive"' + type: string + default: "hive" - name: test-name description: 'The name of the test corresponding to a defined Konflux integration test.' default: '' type: string - name: ocp-version - description: 'The OpenShift version to use for the ephemeral cluster deployment.' + description: 'The OpenShift version to use for the ephemeral cluster deployment (ROSA only).' type: string + default: "" - name: cloud-credential-key type: string - description: The key secret from konflux-test-infra-secret where all AWS ROSA configurations are stored. + description: The key secret from konflux-test-infra-secret where all AWS ROSA configurations are stored (ROSA only). + default: "" - name: replicas - description: 'The number of replicas for the cluster nodes.' + description: 'The number of replicas for the cluster nodes (ROSA only).' type: string + default: "" - name: machine-type - description: 'The type of machine to use for the cluster nodes.' + description: 'The type of machine to use for the cluster nodes (ROSA only).' type: string + default: "" - name: job-spec type: string - name: konflux-test-infra-secret @@ -55,7 +63,56 @@ spec: description: 'Additional parameters for installation testing (e.g., PRE_RELEASE=TAS TAS_VERSION=1.3.2). When empty, does not alter normal installation.' default: "" tasks: + - name: rosa-hcp-metadata + when: + - input: "$(params.cluster-provider)" + operator: in + values: ["rosa"] + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/rosa/hosted-cp/rosa-hcp-metadata/0.1/rosa-hcp-metadata.yaml + - name: provision-rosa + when: + - input: "$(params.cluster-provider)" + operator: in + values: ["rosa"] + runAfter: + - rosa-hcp-metadata + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/rosa/hosted-cp/rosa-hcp-provision/0.2/rosa-hcp-provision.yaml + params: + - name: cluster-name + value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" + - name: ocp-version + value: "$(params.ocp-version)" + - name: replicas + value: "$(params.replicas)" + - name: machine-type + value: "$(params.machine-type)" + - name: konflux-test-infra-secret + value: "$(params.konflux-test-infra-secret)" + - name: cloud-credential-key + value: "$(params.cloud-credential-key)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: provision-cluster + when: + - input: "$(params.cluster-provider)" + operator: in + values: ["hive"] taskRef: resolver: git params: @@ -68,6 +125,7 @@ spec: - name: tssc-install runAfter: - provision-cluster + - provision-rosa taskRef: resolver: git params: @@ -79,7 +137,7 @@ spec: value: integration-tests/tasks/tssc-install.yaml params: - name: ocp-login-command - value: "$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" - name: job-spec value: "$(params.job-spec)" - name: rhads-config @@ -102,7 +160,7 @@ spec: value: tasks/sprayproxy/sprayproxy-provision/0.1/sprayproxy-provision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" - name: tssc-e2e-tests runAfter: - sprayproxy-provision @@ -119,7 +177,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -143,7 +201,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -151,7 +209,40 @@ spec: - name: testplan value: $(params.testplan) finally: + - name: deprovision-rosa-collect-artifacts + when: + - input: "$(params.cluster-provider)" + operator: in + values: ["rosa"] + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/rosa/hosted-cp/rosa-hcp-deprovision/0.2/rosa-hcp-deprovision.yaml + params: + - name: test-name + value: $(context.pipelineRun.name) + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: cluster-name + value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" + - name: konflux-test-infra-secret + value: "$(params.konflux-test-infra-secret)" + - name: cloud-credential-key + value: "$(params.cloud-credential-key)" + - name: pipeline-aggregate-status + value: "$(tasks.status)" - name: deprovision-cluster + when: + - input: "$(params.cluster-provider)" + operator: in + values: ["hive"] taskSpec: volumes: - name: hive-creds-volume @@ -189,7 +280,7 @@ spec: value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git @@ -229,6 +320,10 @@ spec: - name: pipelinerun-name value: $(context.pipelineRun.name) - name: collect-cluster-artifacts + when: + - input: "$(params.cluster-provider)" + operator: in + values: ["hive"] taskSpec: volumes: - name: konflux-test-infra-volume From e7b9965c3b850845b2992dd5ed2fab2aef49bf3c Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 14:29:02 +0100 Subject: [PATCH 31/44] Rename provision-cluster to provision-hive for consistency Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 26 +++++++++---------- ...ision-cluster.yaml => provision-hive.yaml} | 2 +- 2 files changed, 14 insertions(+), 14 deletions(-) rename integration-tests/tasks/{provision-cluster.yaml => provision-hive.yaml} (99%) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 86d22a62d..a5dab7884 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -108,7 +108,7 @@ spec: value: "$(params.cloud-credential-key)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - - name: provision-cluster + - name: provision-hive when: - input: "$(params.cluster-provider)" operator: in @@ -121,10 +121,10 @@ spec: - name: revision value: hive-try3 - name: pathInRepo - value: integration-tests/tasks/provision-cluster.yaml + value: integration-tests/tasks/provision-hive.yaml - name: tssc-install runAfter: - - provision-cluster + - provision-hive - provision-rosa taskRef: resolver: git @@ -137,7 +137,7 @@ spec: value: integration-tests/tasks/tssc-install.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" - name: job-spec value: "$(params.job-spec)" - name: rhads-config @@ -160,7 +160,7 @@ spec: value: tasks/sprayproxy/sprayproxy-provision/0.1/sprayproxy-provision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" - name: tssc-e2e-tests runAfter: - sprayproxy-provision @@ -177,7 +177,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -201,7 +201,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -238,7 +238,7 @@ spec: value: "$(params.cloud-credential-key)" - name: pipeline-aggregate-status value: "$(tasks.status)" - - name: deprovision-cluster + - name: deprovision-hive when: - input: "$(params.cluster-provider)" operator: in @@ -251,7 +251,7 @@ spec: - name: credentials emptyDir: {} steps: - - name: deprovision-cluster + - name: deprovision-hive image: registry.redhat.io/openshift4/ose-cli@sha256:15da03b04318bcc842060b71e9dd6d6c2595edb4e8fdd11b0c6781eeb03ca182 volumeMounts: - name: hive-creds-volume @@ -280,7 +280,7 @@ spec: value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-cluster.results.ocp-login-command)" + value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git @@ -319,7 +319,7 @@ spec: value: $(tasks.status) - name: pipelinerun-name value: $(context.pipelineRun.name) - - name: collect-cluster-artifacts + - name: collect-hive-artifacts when: - input: "$(params.cluster-provider)" operator: in @@ -330,13 +330,13 @@ spec: secret: secretName: "$(params.konflux-test-infra-secret)" steps: - - name: collect-artifacts + - name: collect-hive-artifacts workingDir: /workspace/cluster-artifacts onError: continue image: quay.io/konflux-qe-incubator/konflux-qe-tools:latest script: | #!/bin/sh - $(tasks.provision-cluster.results.ocp-login-command) + $(tasks.provision-hive.results.ocp-login-command) curl -sSL https://raw.githubusercontent.com/konflux-ci/konflux-qe-definitions/main/scripts/gather-extra.sh | bash when: diff --git a/integration-tests/tasks/provision-cluster.yaml b/integration-tests/tasks/provision-hive.yaml similarity index 99% rename from integration-tests/tasks/provision-cluster.yaml rename to integration-tests/tasks/provision-hive.yaml index 44e27254b..606fc1aba 100644 --- a/integration-tests/tasks/provision-cluster.yaml +++ b/integration-tests/tasks/provision-hive.yaml @@ -2,7 +2,7 @@ apiVersion: tekton.dev/v1 kind: Task metadata: - name: provision-cluster + name: provision-hive spec: results: - name: ocp-login-command From 8e52e4d85f5deea8cf8f2d7b6b2ef6852d7994f5 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 15:36:47 +0100 Subject: [PATCH 32/44] Fix context.pipelineRun.name usage in provision-hive task Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 11 ++++++++++- integration-tests/tasks/provision-hive.yaml | 12 ++++++++---- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index a5dab7884..122a0af7d 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -122,6 +122,9 @@ spec: value: hive-try3 - name: pathInRepo value: integration-tests/tasks/provision-hive.yaml + params: + - name: cluster-name + value: "$(context.pipelineRun.name)" - name: tssc-install runAfter: - provision-hive @@ -243,7 +246,13 @@ spec: - input: "$(params.cluster-provider)" operator: in values: ["hive"] + params: + - name: cluster-name + value: "$(context.pipelineRun.name)" taskSpec: + params: + - name: cluster-name + type: string volumes: - name: hive-creds-volume secret: @@ -262,7 +271,7 @@ spec: oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) oc whoami echo "/me Acting like I'm deleting a clusterclaim. tehehe" - oc delete clusterclaims.hive.openshift.io $(context.pipelineRun.name) -n hive + oc delete clusterclaims.hive.openshift.io $(params.cluster-name) -n hive - name: sprayproxy-deprovision when: - input: "$(tasks.sprayproxy-provision.status)" diff --git a/integration-tests/tasks/provision-hive.yaml b/integration-tests/tasks/provision-hive.yaml index 606fc1aba..7709b1b32 100644 --- a/integration-tests/tasks/provision-hive.yaml +++ b/integration-tests/tasks/provision-hive.yaml @@ -4,6 +4,10 @@ kind: Task metadata: name: provision-hive spec: + params: + - name: cluster-name + type: string + description: "Name to use for the cluster claim" results: - name: ocp-login-command description: "OCP login command for accessing the provisioned cluster" @@ -28,19 +32,19 @@ spec: apiVersion: hive.openshift.io/v1 kind: ClusterClaim metadata: - name: $(context.pipelineRun.name) + name: $(params.cluster-name) namespace: hive spec: clusterPoolName: rhopp-test-clusterpool lifetime: 6h EOF ## wait for cluster for up to 60 minutes - if ! kubectl wait --for=condition=ClusterRunning clusterclaims.hive.openshift.io/$(context.pipelineRun.name) -n hive --timeout 60m; then + if ! kubectl wait --for=condition=ClusterRunning clusterclaims.hive.openshift.io/$(params.cluster-name) -n hive --timeout 60m; then echo "Cluster failed to start in 60 minutes. Deleting clusterClaim" - oc delete clusterclaims.hive.openshift.io/$(context.pipelineRun.name) -n hive + oc delete clusterclaims.hive.openshift.io/$(params.cluster-name) -n hive exit 1 fi - cp_namespace=$(oc get clusterclaims.hive.openshift.io -n hive $(context.pipelineRun.name) -o jsonpath={.spec.namespace}) + cp_namespace=$(oc get clusterclaims.hive.openshift.io -n hive $(params.cluster-name) -o jsonpath={.spec.namespace}) api_url=$(oc get clusterdeployment -n $cp_namespace $cp_namespace -o jsonpath={.status.apiURL}) admin_pass_secret=$(oc get clusterdeployment -n $cp_namespace $cp_namespace -o jsonpath={.spec.clusterMetadata.adminPasswordSecretRef.name}) kubeadminpass=$(oc get secret $admin_pass_secret -n $cp_namespace -o jsonpath={.data.password} |base64 -d) From 4bc43641da2e9691d6fedee6ccc653c347c37677 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 18:58:26 +0100 Subject: [PATCH 33/44] Migrate to Tekton v1 with CEL expressions for conditional results Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 122a0af7d..926c55049 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -126,9 +126,10 @@ spec: - name: cluster-name value: "$(context.pipelineRun.name)" - name: tssc-install - runAfter: - - provision-hive - - provision-rosa + when: + - input: "$(tasks.status)" + operator: in + values: ["Succeeded", "Completed"] taskRef: resolver: git params: @@ -140,7 +141,7 @@ spec: value: integration-tests/tasks/tssc-install.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" + value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" - name: job-spec value: "$(params.job-spec)" - name: rhads-config @@ -163,7 +164,7 @@ spec: value: tasks/sprayproxy/sprayproxy-provision/0.1/sprayproxy-provision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" + value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" - name: tssc-e2e-tests runAfter: - sprayproxy-provision @@ -180,7 +181,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" + value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -204,7 +205,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" + value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -289,7 +290,7 @@ spec: value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml params: - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)$(tasks.provision-hive.results.ocp-login-command)" + value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git From 21e481fdf3bd5d9661d91f37b088dadcfc731692 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 19:34:41 +0100 Subject: [PATCH 34/44] Add ROSA-specific pipeline variant Co-Authored-By: Claude Sonnet 4.5 --- .../pipelines/tssc-cli-e2e-rosa.yaml | 251 ++++++++++++++++++ 1 file changed, 251 insertions(+) create mode 100644 integration-tests/pipelines/tssc-cli-e2e-rosa.yaml diff --git a/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml b/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml new file mode 100644 index 000000000..2ee71f61f --- /dev/null +++ b/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml @@ -0,0 +1,251 @@ +--- +apiVersion: tekton.dev/v1beta1 +kind: Pipeline +metadata: + name: tssc-install-e2e +spec: + description: |- + This pipeline automates the process of running end-to-end tests for TSSC + using a ROSA (Red Hat OpenShift Service on AWS) cluster. The pipeline provisions + the ROSA cluster, installs TSSC using the installer, runs the tests, collects artifacts, + and finally deprovisions the ROSA cluster. + params: + - name: test-name + description: 'The name of the test corresponding to a defined Konflux integration test.' + default: '' + type: string + - name: ocp-version + description: 'The OpenShift version to use for the ephemeral cluster deployment.' + type: string + - name: cloud-credential-key + type: string + description: The key secret from konflux-test-infra-secret where all AWS ROSA configurations are stored. + - name: replicas + description: 'The number of replicas for the cluster nodes.' + type: string + - name: machine-type + description: 'The type of machine to use for the cluster nodes.' + type: string + - name: job-spec + type: string + - name: konflux-test-infra-secret + description: The name of secret where testing infrastructures credentials are stored. + type: string + - name: rhads-config + type: string + description: "The rhads-config file in string format." + - name: tssc-image + type: string + description: "Image from where the `tssc` binary will be extracted (from path /usr/local/bin)." + default: "quay.io/redhat-user-workloads/rhtap-shared-team-tenant/tssc-cli:latest" + - name: tssc-test-image + type: string + description: "Image from where the `tssc-test` binary will be extracted (from path /usr/local/bin)." + default: "quay.io/redhat-user-workloads/rhtap-shared-team-tenant/tssc-test:latest" + - name: testplan + type: string + description: 'Optional testplan.json content encoded in base64 format. If not provided, testplan will be downloaded from the repository.' + default: "" + tasks: + - name: rosa-hcp-metadata + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/rosa/hosted-cp/rosa-hcp-metadata/0.1/rosa-hcp-metadata.yaml + - name: provision-rosa + runAfter: + - rosa-hcp-metadata + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/rosa/hosted-cp/rosa-hcp-provision/0.2/rosa-hcp-provision.yaml + params: + - name: cluster-name + value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" + - name: ocp-version + value: "$(params.ocp-version)" + - name: replicas + value: "$(params.replicas)" + - name: machine-type + value: "$(params.machine-type)" + - name: konflux-test-infra-secret + value: "$(params.konflux-test-infra-secret)" + - name: cloud-credential-key + value: "$(params.cloud-credential-key)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: tssc-install + runAfter: + - provision-rosa + taskRef: + resolver: git + params: + - name: url + value: https://github.com/redhat-appstudio/tssc-cli.git + - name: revision + value: main + - name: pathInRepo + value: integration-tests/tasks/tssc-install.yaml + params: + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: job-spec + value: "$(params.job-spec)" + - name: rhads-config + value: $(params.rhads-config) + - name: tssc-image + value: $(params.tssc-image) + - name: sprayproxy-provision + runAfter: + - tssc-install + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/sprayproxy/sprayproxy-provision/0.1/sprayproxy-provision.yaml + params: + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: tssc-e2e-tests + runAfter: + - sprayproxy-provision + taskRef: + resolver: git + params: + - name: url + value: https://github.com/redhat-appstudio/tssc-test.git + - name: revision + value: main + - name: pathInRepo + value: integration-tests/tasks/tssc-e2e.yaml + params: + - name: job-spec + value: $(params.job-spec) + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: tssc-test-image + value: $(params.tssc-test-image) + - name: testplan + value: $(params.testplan) + - name: rhtap-ui-tests + runAfter: + - tssc-e2e-tests + onError: continue + taskRef: + resolver: git + params: + - name: url + value: https://github.com/redhat-appstudio/tssc-test.git + - name: revision + value: main + - name: pathInRepo + value: integration-tests/tasks/tssc-ui.yaml + params: + - name: job-spec + value: $(params.job-spec) + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: tssc-test-image + value: $(params.tssc-test-image) + - name: testplan + value: $(params.testplan) + finally: + - name: deprovision-rosa-collect-artifacts + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/rosa/hosted-cp/rosa-hcp-deprovision/0.2/rosa-hcp-deprovision.yaml + params: + - name: test-name + value: $(context.pipelineRun.name) + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: cluster-name + value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" + - name: konflux-test-infra-secret + value: "$(params.konflux-test-infra-secret)" + - name: cloud-credential-key + value: "$(params.cloud-credential-key)" + - name: pipeline-aggregate-status + value: "$(tasks.status)" + - name: sprayproxy-deprovision + when: + - input: "$(tasks.sprayproxy-provision.status)" + operator: in + values: + - "Succeeded" + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml + params: + - name: ocp-login-command + value: "$(tasks.provision-rosa.results.ocp-login-command)" + - name: pull-request-status-message + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/pull-request-comment/0.2/pull-request-comment.yaml + params: + - name: test-name + value: "$(context.pipelineRun.name)" + - name: oci-container + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: pipeline-aggregate-status + value: "$(tasks.status)" + - name: job-spec + value: "$(params.job-spec)" + - name: store-pipeline-status + taskRef: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/tekton-integration-catalog.git + - name: revision + value: main + - name: pathInRepo + value: tasks/store-pipeline-status/0.1/store-pipeline-status.yaml + params: + - name: oci-ref + value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" + - name: credentials-secret-name + value: "$(params.konflux-test-infra-secret)" + - name: pipeline-aggregate-status + value: $(tasks.status) + - name: pipelinerun-name + value: $(context.pipelineRun.name) \ No newline at end of file From 72096ea1df3c9b748755ba6e5ab65a2ac0c15717 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 19:39:15 +0100 Subject: [PATCH 35/44] Refactor to separate Hive and ROSA pipelines Split the conditional pipeline into two separate files to work around Tekton v1 limitations with referencing results from skipped tasks. Changes: - tssc-cli-e2e.yaml: Hive-only pipeline (simplified, no conditionals) - tssc-cli-e2e-rosa.yaml: ROSA-only pipeline (from backup) - Next: update start-pipelines.yaml to choose which pipeline to start Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 135 ++---------------- 1 file changed, 14 insertions(+), 121 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index 926c55049..b71c00def 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -6,34 +6,14 @@ metadata: spec: description: |- This pipeline automates the process of running end-to-end tests for TSSC - using a ROSA (Red Hat OpenShift Service on AWS) cluster. The pipeline provisions - the ROSA cluster, installs TSSC using the installer, runs the tests, collects artifacts, - and finally deprovisions the ROSA cluster. + using Hive cluster provisioning. The pipeline provisions the cluster, + installs TSSC using the installer, runs the tests, collects artifacts, + and finally deprovisions the cluster. params: - - name: cluster-provider - description: 'Cluster provider to use for testing. Valid values: "rosa" or "hive"' - type: string - default: "hive" - name: test-name description: 'The name of the test corresponding to a defined Konflux integration test.' default: '' type: string - - name: ocp-version - description: 'The OpenShift version to use for the ephemeral cluster deployment (ROSA only).' - type: string - default: "" - - name: cloud-credential-key - type: string - description: The key secret from konflux-test-infra-secret where all AWS ROSA configurations are stored (ROSA only). - default: "" - - name: replicas - description: 'The number of replicas for the cluster nodes (ROSA only).' - type: string - default: "" - - name: machine-type - description: 'The type of machine to use for the cluster nodes (ROSA only).' - type: string - default: "" - name: job-spec type: string - name: konflux-test-infra-secret @@ -63,56 +43,7 @@ spec: description: 'Additional parameters for installation testing (e.g., PRE_RELEASE=TAS TAS_VERSION=1.3.2). When empty, does not alter normal installation.' default: "" tasks: - - name: rosa-hcp-metadata - when: - - input: "$(params.cluster-provider)" - operator: in - values: ["rosa"] - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/rosa/hosted-cp/rosa-hcp-metadata/0.1/rosa-hcp-metadata.yaml - - name: provision-rosa - when: - - input: "$(params.cluster-provider)" - operator: in - values: ["rosa"] - runAfter: - - rosa-hcp-metadata - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/rosa/hosted-cp/rosa-hcp-provision/0.2/rosa-hcp-provision.yaml - params: - - name: cluster-name - value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" - - name: ocp-version - value: "$(params.ocp-version)" - - name: replicas - value: "$(params.replicas)" - - name: machine-type - value: "$(params.machine-type)" - - name: konflux-test-infra-secret - value: "$(params.konflux-test-infra-secret)" - - name: cloud-credential-key - value: "$(params.cloud-credential-key)" - - name: oci-container - value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: provision-hive - when: - - input: "$(params.cluster-provider)" - operator: in - values: ["hive"] taskRef: resolver: git params: @@ -126,10 +57,8 @@ spec: - name: cluster-name value: "$(context.pipelineRun.name)" - name: tssc-install - when: - - input: "$(tasks.status)" - operator: in - values: ["Succeeded", "Completed"] + runAfter: + - provision-hive taskRef: resolver: git params: @@ -141,7 +70,7 @@ spec: value: integration-tests/tasks/tssc-install.yaml params: - name: ocp-login-command - value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" + value: "$(tasks.provision-hive.results.ocp-login-command)" - name: job-spec value: "$(params.job-spec)" - name: rhads-config @@ -164,7 +93,7 @@ spec: value: tasks/sprayproxy/sprayproxy-provision/0.1/sprayproxy-provision.yaml params: - name: ocp-login-command - value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" + value: "$(tasks.provision-hive.results.ocp-login-command)" - name: tssc-e2e-tests runAfter: - sprayproxy-provision @@ -181,7 +110,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" + value: "$(tasks.provision-hive.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -205,7 +134,7 @@ spec: - name: job-spec value: $(params.job-spec) - name: ocp-login-command - value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" + value: "$(tasks.provision-hive.results.ocp-login-command)" - name: oci-container value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - name: tssc-test-image @@ -213,47 +142,12 @@ spec: - name: testplan value: $(params.testplan) finally: - - name: deprovision-rosa-collect-artifacts - when: - - input: "$(params.cluster-provider)" - operator: in - values: ["rosa"] - taskRef: - resolver: git - params: - - name: url - value: https://github.com/konflux-ci/tekton-integration-catalog.git - - name: revision - value: main - - name: pathInRepo - value: tasks/rosa/hosted-cp/rosa-hcp-deprovision/0.2/rosa-hcp-deprovision.yaml - params: - - name: test-name - value: $(context.pipelineRun.name) - - name: ocp-login-command - value: "$(tasks.provision-rosa.results.ocp-login-command)" - - name: oci-container - value: "quay.io/konflux-test-storage/rhtap-team/rhtap-cli:$(context.pipelineRun.name)" - - name: cluster-name - value: "$(tasks.rosa-hcp-metadata.results.cluster-name)" - - name: konflux-test-infra-secret - value: "$(params.konflux-test-infra-secret)" - - name: cloud-credential-key - value: "$(params.cloud-credential-key)" - - name: pipeline-aggregate-status - value: "$(tasks.status)" - name: deprovision-hive - when: - - input: "$(params.cluster-provider)" - operator: in - values: ["hive"] - params: - - name: cluster-name - value: "$(context.pipelineRun.name)" taskSpec: params: - name: cluster-name type: string + description: "Name of the cluster claim to delete" volumes: - name: hive-creds-volume secret: @@ -273,6 +167,9 @@ spec: oc whoami echo "/me Acting like I'm deleting a clusterclaim. tehehe" oc delete clusterclaims.hive.openshift.io $(params.cluster-name) -n hive + params: + - name: cluster-name + value: "$(context.pipelineRun.name)" - name: sprayproxy-deprovision when: - input: "$(tasks.sprayproxy-provision.status)" @@ -290,7 +187,7 @@ spec: value: tasks/sprayproxy/sprayproxy-deprovision/0.1/sprayproxy-deprovision.yaml params: - name: ocp-login-command - value: "$(params.cluster-provider == 'rosa' ? tasks.provision-rosa.results.ocp-login-command : tasks.provision-hive.results.ocp-login-command)" + value: "$(tasks.provision-hive.results.ocp-login-command)" - name: pull-request-status-message taskRef: resolver: git @@ -330,10 +227,6 @@ spec: - name: pipelinerun-name value: $(context.pipelineRun.name) - name: collect-hive-artifacts - when: - - input: "$(params.cluster-provider)" - operator: in - values: ["hive"] taskSpec: volumes: - name: konflux-test-infra-volume From 35abab9e368b4f7635e44ce17e831d9e158eb311 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 19:40:15 +0100 Subject: [PATCH 36/44] Add cluster-provider parameter for Hive/ROSA selection Add cluster-provider parameter to choose between Hive and ROSA cluster provisioning. Defaults to "hive". Co-Authored-By: Claude Sonnet 4.5 --- .../pipelines/e2e-main-pipeline.yaml | 6 ++++++ integration-tests/tasks/start-pipelines.yaml | 17 +++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/integration-tests/pipelines/e2e-main-pipeline.yaml b/integration-tests/pipelines/e2e-main-pipeline.yaml index c923330c6..be4219908 100644 --- a/integration-tests/pipelines/e2e-main-pipeline.yaml +++ b/integration-tests/pipelines/e2e-main-pipeline.yaml @@ -27,6 +27,10 @@ spec: description: 'The number of replicas for the cluster nodes.' default: "3" type: string + - name: cluster-provider + description: 'Cluster provider to use for testing. Valid values: "rosa" or "hive"' + type: string + default: "hive" tasks: - name: test-metadata taskRef: @@ -87,6 +91,8 @@ spec: value: $(params.ocp-instance-type) - name: ocp-replicas value: $(params.ocp-replicas) + - name: cluster-provider + value: $(params.cluster-provider) - name: context-pipeline-run-name value: $(context.pipelineRun.name) finally: diff --git a/integration-tests/tasks/start-pipelines.yaml b/integration-tests/tasks/start-pipelines.yaml index 311e8b3e8..293b4de20 100644 --- a/integration-tests/tasks/start-pipelines.yaml +++ b/integration-tests/tasks/start-pipelines.yaml @@ -44,6 +44,10 @@ spec: description: "Additional parameters for installation testing (e.g., PRE_RELEASE=TAS TAS_VERSION=1.3.2). When empty, does not alter normal installation." type: string default: "" + - name: cluster-provider + description: 'Cluster provider to use for testing. Valid values: "rosa" or "hive"' + type: string + default: "hive" - name: context-pipeline-run-name description: "Context pipeline run name for labeling" type: string @@ -75,6 +79,8 @@ spec: value: $(params.ocp-replicas) - name: INSTALL_PARAMS value: $(params.install-params) + - name: CLUSTER_PROVIDER + value: $(params.cluster-provider) - name: KONFLUX_NAMESPACE valueFrom: fieldRef: @@ -195,11 +201,22 @@ spec: ) echo "Starting pipeline with testplan (${#testplan_b64} chars): ${testplan_b64:0:50}..." +<<<<<<< HEAD pipeline_run=$(tkn pipeline start -f https://raw.githubusercontent.com/$REPO_ORG/$REPO/refs/heads/$BRANCH/integration-tests/pipelines/tssc-cli-e2e.yaml "${tkn_params[@]}") #Verifying Timeout pipeline_timeout=$(oc get pipelinerun "${pipeline_run}" -n "${KONFLUX_NAMESPACE}" -o jsonpath='{.spec.timeouts.pipeline}') echo "Pipeline run timeout set to ${pipeline_timeout}" +======= + # Choose pipeline file based on cluster provider + if [[ "$CLUSTER_PROVIDER" == "rosa" ]]; then + PIPELINE_FILE="tssc-cli-e2e-rosa.yaml" + else + PIPELINE_FILE="tssc-cli-e2e.yaml" + fi + echo "Using pipeline file: $PIPELINE_FILE for cluster provider: $CLUSTER_PROVIDER" + pipeline_run=$(tkn pipeline start -f https://raw.githubusercontent.com/rhopp/tssc-cli/refs/heads/hive-try3/integration-tests/pipelines/$PIPELINE_FILE "${tkn_params[@]}") +>>>>>>> 7bfd452c (Add cluster-provider parameter for Hive/ROSA selection) # Construct console URL for the new PipelineRun CONSOLE_URL="${KONFLUX_URL}/ns/${KONFLUX_NAMESPACE}/applications/${KONFLUX_APPLICATION_NAME}/pipelineruns/${pipeline_run}" echo "Started new pipelinerun: ${CONSOLE_URL}" From a14c13767536c638233091f2b2a4a3ee7813cc9c Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Wed, 21 Jan 2026 19:57:57 +0100 Subject: [PATCH 37/44] Add ocp-version param and fix ROSA-specific parameter passing Add ocp-version to Hive pipeline. Only pass ROSA-specific parameters when cluster-provider is "rosa" to prevent validation errors. Co-Authored-By: Claude Sonnet 4.5 --- integration-tests/pipelines/tssc-cli-e2e.yaml | 4 ++++ integration-tests/tasks/start-pipelines.yaml | 24 ++++++++++--------- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e.yaml index b71c00def..a79da950a 100644 --- a/integration-tests/pipelines/tssc-cli-e2e.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e.yaml @@ -14,6 +14,10 @@ spec: description: 'The name of the test corresponding to a defined Konflux integration test.' default: '' type: string + - name: ocp-version + description: 'The OpenShift version to use for the ephemeral cluster deployment (for future use).' + type: string + default: "" - name: job-spec type: string - name: konflux-test-infra-secret diff --git a/integration-tests/tasks/start-pipelines.yaml b/integration-tests/tasks/start-pipelines.yaml index 293b4de20..b6a8827ca 100644 --- a/integration-tests/tasks/start-pipelines.yaml +++ b/integration-tests/tasks/start-pipelines.yaml @@ -159,9 +159,6 @@ spec: "--param" "konflux-test-infra-secret=$KONFLUX_TEST_INFRA_SECRET" "--param" "rhads-config=$config" "--param" "testplan=${testplan_b64:-}" - "--param" "cloud-credential-key=$CLOUD_CREDENTIAL_KEY" - "--param" "machine-type=$OCP_INSTANCE_TYPE" - "--param" "replicas=$OCP_REPLICAS" ) # Add install params if provided @@ -169,6 +166,15 @@ spec: tkn_params+=("--param" "install-params=$INSTALL_PARAMS") fi + # Add ROSA-specific parameters only when using ROSA + if [[ "$CLUSTER_PROVIDER" == "rosa" ]]; then + tkn_params+=( + "--param" "cloud-credential-key=$CLOUD_CREDENTIAL_KEY" + "--param" "machine-type=$OCP_INSTANCE_TYPE" + "--param" "replicas=$OCP_REPLICAS" + ) + fi + # Add optional image parameters if [[ "${tssc_image}" != "" ]]; then tkn_params+=("--param" "tssc-image=${tssc_image}") @@ -201,13 +207,7 @@ spec: ) echo "Starting pipeline with testplan (${#testplan_b64} chars): ${testplan_b64:0:50}..." -<<<<<<< HEAD - pipeline_run=$(tkn pipeline start -f https://raw.githubusercontent.com/$REPO_ORG/$REPO/refs/heads/$BRANCH/integration-tests/pipelines/tssc-cli-e2e.yaml "${tkn_params[@]}") - #Verifying Timeout - pipeline_timeout=$(oc get pipelinerun "${pipeline_run}" -n "${KONFLUX_NAMESPACE}" -o jsonpath='{.spec.timeouts.pipeline}') - echo "Pipeline run timeout set to ${pipeline_timeout}" -======= # Choose pipeline file based on cluster provider if [[ "$CLUSTER_PROVIDER" == "rosa" ]]; then PIPELINE_FILE="tssc-cli-e2e-rosa.yaml" @@ -215,8 +215,10 @@ spec: PIPELINE_FILE="tssc-cli-e2e.yaml" fi echo "Using pipeline file: $PIPELINE_FILE for cluster provider: $CLUSTER_PROVIDER" - pipeline_run=$(tkn pipeline start -f https://raw.githubusercontent.com/rhopp/tssc-cli/refs/heads/hive-try3/integration-tests/pipelines/$PIPELINE_FILE "${tkn_params[@]}") ->>>>>>> 7bfd452c (Add cluster-provider parameter for Hive/ROSA selection) + pipeline_run=$(tkn pipeline start -f https://raw.githubusercontent.com/$REPO_ORG/$REPO/refs/heads/$BRANCH/integration-tests/pipelines/$PIPELINE_FILE "${tkn_params[@]}") + #Verifying Timeout + pipeline_timeout=$(oc get pipelinerun "${pipeline_run}" -n "${KONFLUX_NAMESPACE}" -o jsonpath='{.spec.timeouts.pipeline}') + echo "Pipeline run timeout set to ${pipeline_timeout}" # Construct console URL for the new PipelineRun CONSOLE_URL="${KONFLUX_URL}/ns/${KONFLUX_NAMESPACE}/applications/${KONFLUX_APPLICATION_NAME}/pipelineruns/${pipeline_run}" echo "Started new pipelinerun: ${CONSOLE_URL}" From 4a3394273d4e036b912989b83838cdff3d12376e Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 22 Jan 2026 15:37:42 +0100 Subject: [PATCH 38/44] Add validation for cluster-provider parameter Co-Authored-By: Claude Sonnet 4.5 --- .../pipelines/{tssc-cli-e2e.yaml => tssc-cli-e2e-hive.yaml} | 0 integration-tests/tasks/start-pipelines.yaml | 5 ++++- 2 files changed, 4 insertions(+), 1 deletion(-) rename integration-tests/pipelines/{tssc-cli-e2e.yaml => tssc-cli-e2e-hive.yaml} (100%) diff --git a/integration-tests/pipelines/tssc-cli-e2e.yaml b/integration-tests/pipelines/tssc-cli-e2e-hive.yaml similarity index 100% rename from integration-tests/pipelines/tssc-cli-e2e.yaml rename to integration-tests/pipelines/tssc-cli-e2e-hive.yaml diff --git a/integration-tests/tasks/start-pipelines.yaml b/integration-tests/tasks/start-pipelines.yaml index b6a8827ca..ed1041beb 100644 --- a/integration-tests/tasks/start-pipelines.yaml +++ b/integration-tests/tasks/start-pipelines.yaml @@ -211,8 +211,11 @@ spec: # Choose pipeline file based on cluster provider if [[ "$CLUSTER_PROVIDER" == "rosa" ]]; then PIPELINE_FILE="tssc-cli-e2e-rosa.yaml" - else + elif [[ "$CLUSTER_PROVIDER" == "hive" ]]; then PIPELINE_FILE="tssc-cli-e2e.yaml" + else + echo "ERROR: Invalid cluster-provider value: '$CLUSTER_PROVIDER'. Valid values are 'rosa' or 'hive'." + exit 1 fi echo "Using pipeline file: $PIPELINE_FILE for cluster provider: $CLUSTER_PROVIDER" pipeline_run=$(tkn pipeline start -f https://raw.githubusercontent.com/$REPO_ORG/$REPO/refs/heads/$BRANCH/integration-tests/pipelines/$PIPELINE_FILE "${tkn_params[@]}") From 9de957ca994f4870545144e04a5c4628f1730740 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 22 Jan 2026 15:52:09 +0100 Subject: [PATCH 39/44] Satisfy yamllint --- integration-tests/pipelines/tssc-cli-e2e-rosa.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml b/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml index 2ee71f61f..72e9ae6e4 100644 --- a/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e-rosa.yaml @@ -248,4 +248,4 @@ spec: - name: pipeline-aggregate-status value: $(tasks.status) - name: pipelinerun-name - value: $(context.pipelineRun.name) \ No newline at end of file + value: $(context.pipelineRun.name) From bec47ffcb972fbde829562779deede8cf101da5e Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Thu, 22 Jan 2026 16:48:56 +0100 Subject: [PATCH 40/44] Fix hive pipeline name --- integration-tests/tasks/start-pipelines.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/tasks/start-pipelines.yaml b/integration-tests/tasks/start-pipelines.yaml index ed1041beb..5c839b122 100644 --- a/integration-tests/tasks/start-pipelines.yaml +++ b/integration-tests/tasks/start-pipelines.yaml @@ -212,7 +212,7 @@ spec: if [[ "$CLUSTER_PROVIDER" == "rosa" ]]; then PIPELINE_FILE="tssc-cli-e2e-rosa.yaml" elif [[ "$CLUSTER_PROVIDER" == "hive" ]]; then - PIPELINE_FILE="tssc-cli-e2e.yaml" + PIPELINE_FILE="tssc-cli-e2e-hive.yaml" else echo "ERROR: Invalid cluster-provider value: '$CLUSTER_PROVIDER'. Valid values are 'rosa' or 'hive'." exit 1 From dcd1bd7dedce6516213fc5d9d12e950bfa73c18b Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Fri, 23 Jan 2026 13:38:21 +0100 Subject: [PATCH 41/44] Use different clusterpools --- integration-tests/pipelines/tssc-cli-e2e-hive.yaml | 2 ++ integration-tests/tasks/provision-hive.yaml | 11 +++++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/integration-tests/pipelines/tssc-cli-e2e-hive.yaml b/integration-tests/pipelines/tssc-cli-e2e-hive.yaml index a79da950a..962a720e8 100644 --- a/integration-tests/pipelines/tssc-cli-e2e-hive.yaml +++ b/integration-tests/pipelines/tssc-cli-e2e-hive.yaml @@ -60,6 +60,8 @@ spec: params: - name: cluster-name value: "$(context.pipelineRun.name)" + - name: ocp-version + value: "$(params.ocp-version)" - name: tssc-install runAfter: - provision-hive diff --git a/integration-tests/tasks/provision-hive.yaml b/integration-tests/tasks/provision-hive.yaml index 7709b1b32..4fab61ab2 100644 --- a/integration-tests/tasks/provision-hive.yaml +++ b/integration-tests/tasks/provision-hive.yaml @@ -8,6 +8,9 @@ spec: - name: cluster-name type: string description: "Name to use for the cluster claim" + - name: ocp-version + type: string + description: "OpenShift version in format 4.xx (e.g., 4.18)" results: - name: ocp-login-command description: "OCP login command for accessing the provisioned cluster" @@ -25,9 +28,13 @@ spec: mountPath: /usr/local/hive-creds script: | #!/usr/bin/bash + # Convert ocp-version format (4.xx) to clusterpool name (clusterpool4xx) + CLUSTERPOOL_NAME="clusterpool$(echo $(params.ocp-version) | tr -d '.')" + echo "Using cluster pool: $CLUSTERPOOL_NAME" + oc login $(cat /usr/local/hive-creds/kube_api_url) -u cluster-admin -p $(cat /usr/local/hive-creds/password) oc whoami - oc get rhopp-test-clusterpool -n hive + oc get clusterpool "$CLUSTERPOOL_NAME" -n hive oc create -f - < Date: Fri, 23 Jan 2026 14:52:08 +0100 Subject: [PATCH 42/44] Try 3 clusters at once. Shorten stability observation duration --- integration-tests/config/rhads-config | 2 +- integration-tests/tasks/provision-hive.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/integration-tests/config/rhads-config b/integration-tests/config/rhads-config index 0b86e2f50..b3dd62962 100644 --- a/integration-tests/config/rhads-config +++ b/integration-tests/config/rhads-config @@ -1,4 +1,4 @@ -OCP="4.19" +OCP="4.18, 4.19, 4.20" ACS="remote" REGISTRY="quay,artifactory,nexus" TPA="local" diff --git a/integration-tests/tasks/provision-hive.yaml b/integration-tests/tasks/provision-hive.yaml index 4fab61ab2..1db210423 100644 --- a/integration-tests/tasks/provision-hive.yaml +++ b/integration-tests/tasks/provision-hive.yaml @@ -236,7 +236,7 @@ spec: # --- Cluster Stability Observation --- echo "--- Starting Cluster Stability Observation ---" - observation_duration=600 # 10 minutes + observation_duration=60 # 10 minutes observation_interval=5 # Check every 5 seconds observation_iterations=$((observation_duration / observation_interval)) From 46072536699770ad1ed073aa84d7da54958fb3e5 Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Fri, 23 Jan 2026 15:39:08 +0100 Subject: [PATCH 43/44] Fix whitespaces --- integration-tests/config/rhads-config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-tests/config/rhads-config b/integration-tests/config/rhads-config index b3dd62962..3cf8761ba 100644 --- a/integration-tests/config/rhads-config +++ b/integration-tests/config/rhads-config @@ -1,4 +1,4 @@ -OCP="4.18, 4.19, 4.20" +OCP="4.18,4.19,4.20" ACS="remote" REGISTRY="quay,artifactory,nexus" TPA="local" From b0802e1bb1eb02db5821703cb327487b198b516b Mon Sep 17 00:00:00 2001 From: Radim Hopp Date: Tue, 27 Jan 2026 10:08:27 +0100 Subject: [PATCH 44/44] Fix bracket --- integration-tests/scripts/install.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/integration-tests/scripts/install.sh b/integration-tests/scripts/install.sh index 936e005c0..718e16a04 100755 --- a/integration-tests/scripts/install.sh +++ b/integration-tests/scripts/install.sh @@ -435,7 +435,6 @@ configure_integrations() { echo "[INFO] Integration secrets in 'tssc' namespace:" kubectl -n tssc get secret 2>/dev/null | grep -E "(github|gitlab|bitbucket|acs|trustification)" || echo " (some secrets may not exist yet)" } -} wait_for() { local command="${1}"