[WIP] Test install-trustee-operator step for OCP 4.21 AWS CoCo#80236
[WIP] Test install-trustee-operator step for OCP 4.21 AWS CoCo#80236tbuskey wants to merge 4 commits into
Conversation
This PR adds the install-trustee-operator step to enable automated Trustee operator installation in sandboxed-containers-operator CoCo tests. Changes: - Add install-trustee-operator step to step-registry - Enable TRUSTEE_INSTALL for all CoCo periodic jobs (aws, azure, aro) - Configure Trustee catalog source and installation parameters - Add step to sandboxed-containers-operator-pre chain The step: - Installs Trustee operator via OLM (CatalogSource → Subscription → CSV) - Deploys Trustee operands (KBS, Attestation Service) - Generates INITDATA for confidential containers - Verifies connectivity using kbs-client - Updates osc-config ConfigMap with TRUSTEE_URL and INITDATA - Works with network restrictions (uses pre-rendered manifests) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add TRUSTEE_NAMESPACE environment variable to aws-ipi-coco test configuration to make it appear in REHEARSALNOTIFIER affected jobs list for testing install-trustee-operator step. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Modified timeout from 24h to 24h1m for candidate421 aws-ipi-coco to force job file regeneration. Environment variable changes alone don't trigger job updates in variant configs. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
openshift-ci
Bot
added
do-not-merge/hold
|
Caution Review failedAn error occurred during the review process. Please try again later. WalkthroughThis PR introduces comprehensive Trustee operator installation and verification into the sandboxed-containers-operator CI pipeline. A 934-line bash script handles cluster domain discovery, OLM-based operator installation with staged readiness polling, operand deployment, Trustee KBS URL resolution, INITDATA artifact generation, and connectivity verification via kbs-client test pod deployment. The script is wired as a new CI step and integrated into the test pre-chain, and test configurations across five downstream-candidate variants are updated to enable Trustee installation. ChangesTrustee operator installation in sandboxed-containers CI
🎯 4 (Complex) | ⏱️ ~60 minutes Suggested labels
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate421-aws-ipi-coco-e2e |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@tbuskey: job(s): periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate421-aws-ipi-coco-e2e either don't exist or were not found to be affected, and cannot be rehearsed |
|
/pj-rehearse network-access-allowed |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@tbuskey: PR author isn't allowed to allow network access rehearsals. This must be done by a different member of the |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate421-aws-ipi-coco |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@tbuskey: job(s): periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate421-aws-ipi-coco either don't exist or were not found to be affected, and cannot be rehearsed |
…i-coco rehearsal To make the job rehearsable without requiring network-access-rehearsals-ok label. Will revert after testing install-trustee-operator step.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: tbuskey The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
removed
the
approved
|
[REHEARSALNOTIFIER]
A total of 32 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate421-aws-ipi-coco |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate421-aws-ipi-coco |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@tbuskey: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Testing the install-trustee-operator step implementation for Confidential Containers on OCP 4.21 AWS.
Purpose: Rehearsal testing only - validate install-trustee-operator step works correctly
Changes:
Test Plan:
/hold
/assign @tbuskey
Summary by CodeRabbit
This PR introduces Trustee operator installation automation to the sandboxed-containers-operator CI pipeline. Here's what changes:
New Install-Trustee-Operator Step
A comprehensive new step has been added (
sandboxed-containers-operator-install-trustee-operator) that automates Trustee operator provisioning for Confidential Containers (CoCo) workloads. The step:osc-configConfigMap with derivedtrusteeUrlandINITDATAkbs-clientpod and testing artifact retrieval from Trustee KBSThe step is guarded by
TRUSTEE_INSTALLand configurable via environment variables for catalog source, namespace, and KBS client tag discovery.CI Configuration Updates Across All Candidate Branches
The CI configuration for sandboxed-containers-operator has been updated across all candidate versions (417, 418, 419, 420, 421, and the main candidate) to enable Trustee installation for Azure, ARO, and AWS CoCo test variants:
TRUSTEE_INSTALL: Set to"true"to enable the new stepTRUSTEE_CATALOG_SOURCE_IMAGE: Points totrustee-test-fbc:1.1.0-1776506656TRUSTEE_CATALOG_SOURCE_NAME: Set totrustee-catalogFor the candidate421 variant specifically,
TRUSTEE_NAMESPACEis also added to make it appear in rehearsal notifications, and the job timeout was increased by 1 minute to force job file regeneration.Pre-Chain Integration
The new step has been added to the
sandboxed-containers-operator-prechain, so Trustee operator installation runs automatically before CoCo workload tests execute.