SDN-4168: Fix IPsec tests for monitor failures #29437
Conversation
|
/test e2e-aws-ovn-ipsec-serial |
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
2 times, most recently
from
0edd5b6 to
dd54a1d
Compare
|
/test e2e-aws-ovn-ipsec-serial |
|
Job Failure Risk Analysis for sha: dd54a1d
|
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
from
dd54a1d to
e68a744
Compare
|
Job Failure Risk Analysis for sha: e68a744
|
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
from
e68a744 to
744915f
Compare
|
/test e2e-aws-ovn-ipsec-serial |
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
from
744915f to
cab8327
Compare
|
/assign @tssurya |
|
/test e2e-aws-ovn-ipsec-serial |
1 similar comment
|
/test e2e-aws-ovn-ipsec-serial |
|
Job Failure Risk Analysis for sha: cab8327
|
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
from
cab8327 to
59fcece
Compare
|
/test e2e-aws-ovn-ipsec-serial |
2 similar comments
|
/test e2e-aws-ovn-ipsec-serial |
|
/test e2e-aws-ovn-ipsec-serial |
|
Job Failure Risk Analysis for sha: f41d22e
|
|
/assign @huiran0826 |
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
from
f41d22e to
dba2246
Compare
|
/test e2e-aws-ovn-ipsec-serial |
pperiyasamy
force-pushed
the
ipsec-debug-monitor-test-failure
branch
2 times, most recently
from
8eaaaa4 to
5db298d
Compare
pperiyasamy
changed the title
|
/test e2e-aws-ovn-ipsec-serial |
|
Job Failure Risk Analysis for sha: c53288d
Risk analysis has seen new tests most likely introduced by this PR. New tests seen in this PR at sha: c53288d
|
|
/test e2e-aws-ovn-ipsec-serial |
|
@pperiyasamy: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Job Failure Risk Analysis for sha: c53288d
Risk analysis has seen new tests most likely introduced by this PR. New Test Risks for sha: c53288d
New tests seen in this PR at sha: c53288d
|
pperiyasamy
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@pperiyasamy: This pull request references SDN-4168 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/hold cancel we are tracking |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/assign @dgoodwin |
|
All looks good but you appear to have renamed some tests, in which case for things to work best you should submit a test rename request here after this merges: https://github.com/openshift-eng/ci-test-mapping Doing so will allow component readiness to track the new tests performance against it's old name in 4.18 at GA time. /approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dgoodwin, martinkennelly, pperiyasamy The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
1 similar comment
openshift-merge-bot
bot
merged commit 59d86be
into
openshift:main
|
[ART PR BUILD NOTIFIER] Distgit: openshift-enterprise-tests |
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested with two different CI lanes, so this commit replaces existing e2e-aws-ovn-ipsec-serial CI lane with e2e-aws-ovn-ipsec-full-mode and e2e-aws-ovn-ipsec-external-mode CI lanes. This commit also makes both jobs mandatory and periodic jobs which helps to make IPsec eligible for component readiness. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested with two different CI lanes, so this commit replaces existing e2e-aws-ovn-ipsec-serial CI lane with e2e-aws-ovn-ipsec-full-mode and e2e-aws-ovn-ipsec-external-mode CI lanes. This commit also makes both jobs as default presubmit for cluster network operator. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested with two different CI lanes, so this commit replaces existing e2e-aws-ovn-ipsec-serial CI lane with e2e-aws-ovn-ipsec-full-mode and e2e-aws-ovn-ipsec-external-mode CI lanes. This commit also makes both jobs as default presubmit for cluster network operator. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit f5df7d1)
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]>
As per changes in openshift/origin#29437 for IPsec E2E tests, each IPsec mode Full and External must be tested separately, so this commit updates openshift-e2e-test step with new test type called ipsec-suite and ipsec test suite is executed under this test type for each ipsec modes. Signed-off-by: Periyasamy Palanisamy <[email protected]>
This PR fixes following issues to stabilize monitor tests while running IPsec tests.
When IPsec tests configuring certificates into libreswan nss db for north south traffic via a machine config, it's rebooting worker nodes by default which still makes a monitor test to fail. Actually it is not required to reboot the nodes just for configuring certs on the nss db. Hence adding node disruption machine configuration policy so that nodes are not rebooted while deploying certificates on the worker nodes.
When IPsec mode are changed across tests within IPsec test suite, it causes reboot of ovnkube-node daemonset pods, It's expected workload traffic would fail temporarily until pods are settle down after IPsec is properly configured in every node's OVN and OvS across the cluster. So we should not test ipsec mode change in the ipsec test suite and instead for every ipsec mode, there should be one CI lane, then in the test corresponding configuration and traffic must be tested. So it merges everything with a single test which can be run from CI lanes for Full and External IPsec modes.
Depends on openshift/machine-config-operator#4864.