Skip to content

Commit ab827ec

Browse files
pperiyasamypperiyasamy
committed
Add e2e-aws-ovn-ipsec-external-serial CI lane
When IPsec mode are changed across tests within IPsec test suite, it causes reboot of ovnkube-node daemonset pods, It's expected workload traffic would fail temporarily until pods are settle down after IPsec is properly configured in every node's OVN and OvS across the cluster. So we should not test ipsec mode change in the ipsec test suite and instead for every ipsec mode, there should be one CI lane, then in the test corresponding configuration and traffic must be tested. Hence this PR introduces another CI lane called e2e-aws-ovn-ipsec-external-serial for testing External mode. The Full mode is already covered with the existing e2e-aws-ovn-ipsec-serial CI lane. Signed-off-by: Periyasamy Palanisamy <[email protected]>
1 parent 2e80747 commit ab827ec

File tree

6 files changed

+176
-1
lines changed

6 files changed

+176
-1
lines changed

‎ci-operator/config/openshift/cluster-network-operator/openshift-cluster-network-operator-master.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,16 @@ tests:
122122
EXTRA_MG_ARGS: --host-network
123123
workflow: openshift-e2e-aws-ovn-ipsec-serial
124124
timeout: 6h0m0s
125+
- always_run: false
126+
as: e2e-aws-ovn-ipsec-external-serial
127+
optional: true
128+
steps:
129+
cluster_profile: aws
130+
env:
131+
EXTRA_MG_ARGS: --host-network
132+
IPSEC_MODE: External
133+
workflow: openshift-e2e-aws-ovn-ipsec-serial
134+
timeout: 6h0m0s
125135
- as: e2e-metal-ipi-ovn-ipv6
126136
cluster: build05
127137
steps:

‎ci-operator/config/openshift/origin/openshift-origin-master.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,16 @@ tests:
332332
BASE_DOMAIN: aws-2.ci.openshift.org
333333
workflow: openshift-e2e-aws-ovn-ipsec-serial
334334
timeout: 6h0m0s
335+
- always_run: false
336+
as: e2e-aws-ovn-ipsec-external-serial
337+
optional: true
338+
steps:
339+
cluster_profile: aws-2
340+
env:
341+
BASE_DOMAIN: aws-2.ci.openshift.org
342+
IPSEC_MODE: External
343+
workflow: openshift-e2e-aws-ovn-ipsec-serial
344+
timeout: 6h0m0s
335345
- as: e2e-aws-csi
336346
optional: true
337347
skip_if_only_changed: ^(?:docs|\.github)/|\.md$|^(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$

‎ci-operator/jobs/openshift/cluster-network-operator/openshift-cluster-network-operator-master-presubmits.yaml

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -425,6 +425,81 @@ presubmits:
425425
secret:
426426
secretName: result-aggregator
427427
trigger: (?m)^/test( | .* )e2e-aws-ovn-hypershift-conformance,?($|\s.*)
428+
- agent: kubernetes
429+
always_run: false
430+
branches:
431+
- ^master$
432+
- ^master-
433+
cluster: build03
434+
context: ci/prow/e2e-aws-ovn-ipsec-external-serial
435+
decorate: true
436+
decoration_config:
437+
timeout: 6h0m0s
438+
labels:
439+
ci-operator.openshift.io/cloud: aws
440+
ci-operator.openshift.io/cloud-cluster-profile: aws
441+
ci.openshift.io/generator: prowgen
442+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
443+
name: pull-ci-openshift-cluster-network-operator-master-e2e-aws-ovn-ipsec-external-serial
444+
optional: true
445+
rerun_command: /test e2e-aws-ovn-ipsec-external-serial
446+
spec:
447+
containers:
448+
- args:
449+
- --gcs-upload-secret=/secrets/gcs/service-account.json
450+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
451+
- --lease-server-credentials-file=/etc/boskos/credentials
452+
- --report-credentials-file=/etc/report/credentials
453+
- --secret-dir=/secrets/ci-pull-credentials
454+
- --target=e2e-aws-ovn-ipsec-external-serial
455+
command:
456+
- ci-operator
457+
image: ci-operator:latest
458+
imagePullPolicy: Always
459+
name: ""
460+
resources:
461+
requests:
462+
cpu: 10m
463+
volumeMounts:
464+
- mountPath: /etc/boskos
465+
name: boskos
466+
readOnly: true
467+
- mountPath: /secrets/ci-pull-credentials
468+
name: ci-pull-credentials
469+
readOnly: true
470+
- mountPath: /secrets/gcs
471+
name: gcs-credentials
472+
readOnly: true
473+
- mountPath: /secrets/manifest-tool
474+
name: manifest-tool-local-pusher
475+
readOnly: true
476+
- mountPath: /etc/pull-secret
477+
name: pull-secret
478+
readOnly: true
479+
- mountPath: /etc/report
480+
name: result-aggregator
481+
readOnly: true
482+
serviceAccountName: ci-operator
483+
volumes:
484+
- name: boskos
485+
secret:
486+
items:
487+
- key: credentials
488+
path: credentials
489+
secretName: boskos-credentials
490+
- name: ci-pull-credentials
491+
secret:
492+
secretName: ci-pull-credentials
493+
- name: manifest-tool-local-pusher
494+
secret:
495+
secretName: manifest-tool-local-pusher
496+
- name: pull-secret
497+
secret:
498+
secretName: registry-pull-credentials
499+
- name: result-aggregator
500+
secret:
501+
secretName: result-aggregator
502+
trigger: (?m)^/test( | .* )e2e-aws-ovn-ipsec-external-serial,?($|\s.*)
428503
- agent: kubernetes
429504
always_run: false
430505
branches:

‎ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1033,6 +1033,81 @@ presubmits:
10331033
secret:
10341034
secretName: result-aggregator
10351035
trigger: (?m)^/test( | .* )e2e-aws-ovn-image-registry,?($|\s.*)
1036+
- agent: kubernetes
1037+
always_run: false
1038+
branches:
1039+
- ^master$
1040+
- ^master-
1041+
cluster: build09
1042+
context: ci/prow/e2e-aws-ovn-ipsec-external-serial
1043+
decorate: true
1044+
decoration_config:
1045+
timeout: 6h0m0s
1046+
labels:
1047+
ci-operator.openshift.io/cloud: aws
1048+
ci-operator.openshift.io/cloud-cluster-profile: aws-2
1049+
ci.openshift.io/generator: prowgen
1050+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
1051+
name: pull-ci-openshift-origin-master-e2e-aws-ovn-ipsec-external-serial
1052+
optional: true
1053+
rerun_command: /test e2e-aws-ovn-ipsec-external-serial
1054+
spec:
1055+
containers:
1056+
- args:
1057+
- --gcs-upload-secret=/secrets/gcs/service-account.json
1058+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
1059+
- --lease-server-credentials-file=/etc/boskos/credentials
1060+
- --report-credentials-file=/etc/report/credentials
1061+
- --secret-dir=/secrets/ci-pull-credentials
1062+
- --target=e2e-aws-ovn-ipsec-external-serial
1063+
command:
1064+
- ci-operator
1065+
image: ci-operator:latest
1066+
imagePullPolicy: Always
1067+
name: ""
1068+
resources:
1069+
requests:
1070+
cpu: 10m
1071+
volumeMounts:
1072+
- mountPath: /etc/boskos
1073+
name: boskos
1074+
readOnly: true
1075+
- mountPath: /secrets/ci-pull-credentials
1076+
name: ci-pull-credentials
1077+
readOnly: true
1078+
- mountPath: /secrets/gcs
1079+
name: gcs-credentials
1080+
readOnly: true
1081+
- mountPath: /secrets/manifest-tool
1082+
name: manifest-tool-local-pusher
1083+
readOnly: true
1084+
- mountPath: /etc/pull-secret
1085+
name: pull-secret
1086+
readOnly: true
1087+
- mountPath: /etc/report
1088+
name: result-aggregator
1089+
readOnly: true
1090+
serviceAccountName: ci-operator
1091+
volumes:
1092+
- name: boskos
1093+
secret:
1094+
items:
1095+
- key: credentials
1096+
path: credentials
1097+
secretName: boskos-credentials
1098+
- name: ci-pull-credentials
1099+
secret:
1100+
secretName: ci-pull-credentials
1101+
- name: manifest-tool-local-pusher
1102+
secret:
1103+
secretName: manifest-tool-local-pusher
1104+
- name: pull-secret
1105+
secret:
1106+
secretName: registry-pull-credentials
1107+
- name: result-aggregator
1108+
secret:
1109+
secretName: result-aggregator
1110+
trigger: (?m)^/test( | .* )e2e-aws-ovn-ipsec-external-serial,?($|\s.*)
10361111
- agent: kubernetes
10371112
always_run: false
10381113
branches:

‎ci-operator/step-registry/ovn/conf/ipsec-manifest/ovn-conf-ipsec-manifest-commands.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ EOF
3232

3333
# adapt to newer ipsec config for ocp versions >= 4.15
3434
if (( ocp_minor_version >= 15 && ocp_major_version == 4 )); then
35-
/tmp/yq e '.spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig.mode = "Full"' -i ${SHARED_DIR}/manifest_cluster-network-03-config.yml
35+
/tmp/yq e '.spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig.mode = env(IPSEC_MODE)' -i ${SHARED_DIR}/manifest_cluster-network-03-config.yml
3636
fi
3737

3838
cat ${SHARED_DIR}/manifest_cluster-network-03-config.yml

‎ci-operator/step-registry/ovn/conf/ipsec-manifest/ovn-conf-ipsec-manifest-ref.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ ref:
44
name: cli-yq
55
namespace: ocp
66
tag: latest
7+
env:
8+
- name: IPSEC_MODE
9+
default: "Full"
10+
documentation: |-
11+
Defines the behaviour of the ipsec configuration within the platform.
712
commands: ovn-conf-ipsec-manifest-commands.sh
813
resources:
914
requests:

0 commit comments

Comments
 (0)