[DEBUG][DO NOT MERGE] Add azure-ipi-peerpods-ga job for candidate422 - #82806
[DEBUG][DO NOT MERGE] Add azure-ipi-peerpods-ga job for candidate422#82806tbuskey wants to merge 16 commits into
Conversation
Add peer-pod GA workload on Azure with 8h wait for debugging. Uses redhat-operators catalog, no RPM install, restrict_network_access: true. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a CI step and Bash script to install the OpenShift Sandboxed Containers Operator. The step configures peer-pods, waits for readiness, updates shared state, and runs before tests. Azure Kata testing now includes restricted networking and a peer-pods GA job. ChangesSandboxed Containers Operator installation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant PreChain
participant InstallScript
participant Helm
participant OpenShift
participant KataConfig
participant OSCConfig
PreChain->>InstallScript: invoke OSC installation
InstallScript->>Helm: fetch and render OSC charts
InstallScript->>OpenShift: apply operator resources
OpenShift-->>InstallScript: report operator readiness
InstallScript->>OpenShift: apply operands and peer-pod credentials
InstallScript->>KataConfig: poll readiness
KataConfig-->>InstallScript: report readiness
InstallScript->>OSCConfig: patch oscInstalled=true
Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tbuskey The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh (3)
93-100: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove the unused
retryhelper, or use it for the transientoccalls.No call site for
retryexists in this script. Dead helpers add maintenance cost. Either delete it or wrap the transient calls, such as theoc get configmapreads.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh` around lines 93 - 100, Remove the unused retry function from the script, or apply it consistently to transient oc calls such as the configmap reads so the helper has an active call site.
429-436: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winSelect the CSV by name prefix instead of
.items[0].
.items[0]returns an arbitrary CSV. The operator namespace can contain copied CSVs from other operators, and the index order is not stable. Filter for the sandboxed containers CSV.♻️ Proposed change
if ! wait_until "CSV Succeeded" 600 5 \ - "[[ \"\$(oc get csv -n '${OSC_NAMESPACE}' -o jsonpath='{.items[0].status.phase}' 2>/dev/null)\" == \"Succeeded\" ]]"; then + "oc get csv -n '${OSC_NAMESPACE}' -o jsonpath='{range .items[?(@.spec.displayName)]}{.metadata.name}={.status.phase}{\"\\n\"}{end}' 2>/dev/null | grep -q '^sandboxed-containers-operator.*=Succeeded$'"; then oc get csv -n "${OSC_NAMESPACE}" -o yaml || true return 1 fi local csv_name - csv_name=$(oc get csv -n "${OSC_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "") + csv_name=$(oc get csv -n "${OSC_NAMESPACE}" -o name 2>/dev/null | grep 'sandboxed-containers-operator' | head -1 || echo "")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh` around lines 429 - 436, Update the CSV lookups in the install flow around wait_until and csv_name so they select the sandboxed containers CSV by its expected name prefix rather than relying on .items[0]. Apply the same prefix filter to both the status-phase check and metadata.name retrieval, preserving the existing timeout, diagnostics, and failure behavior.
271-311: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winUse
--set-stringfor ConfigMap values.
helm --setcoerces types and treats,and unescaped.as separators.VXLAN_PORTbecomes an integer, and any value that contains a comma splits into a list. ConfigMapdatarequires strings. Use--set-stringfor all of these provider values.♻️ Example change (apply to every value assignment in this block)
- [[ -n "${vxlan_port}" ]] && helm_args+=("--set" "peerpods.providersConfigs.all.VXLAN_PORT=${vxlan_port}") - [[ -n "${proxy_timeout}" ]] && helm_args+=("--set" "peerpods.providersConfigs.all.PROXY_TIMEOUT=${proxy_timeout}") + [[ -n "${vxlan_port}" ]] && helm_args+=("--set-string" "peerpods.providersConfigs.all.VXLAN_PORT=${vxlan_port}") + [[ -n "${proxy_timeout}" ]] && helm_args+=("--set-string" "peerpods.providersConfigs.all.PROXY_TIMEOUT=${proxy_timeout}")Note: the upstream producer
sandboxed-containers-operator-peerpods-param-cm-commands.shwritesVXLAN_PORT: "9000"as a quoted string, so the string form matches the producer contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh` around lines 271 - 311, Update every Helm argument assignment in the provider configuration block, including VXLAN_PORT, PROXY_TIMEOUT, and all Azure, AWS, and GCP ConfigMap-derived values, to use --set-string instead of --set. Preserve the existing conditional assignments and value paths while ensuring all ConfigMap data remains string-typed and values containing commas or dots are not coerced or split.ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml (1)
3-12: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winSet an explicit step
timeoutfor the long OSC waits.The script adds 600s plus 600s, then KataConfig waits 7200s, so this single step can exceed the two-hour default. Add
timeout: 9h0m0sso failures include command output rather than an implicit step cutoff.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml` around lines 3 - 12, Add an explicit timeout of 9h0m0s to the step configuration alongside grace_period and commands, ensuring the long OSC and KataConfig waits can complete without the default two-hour cutoff.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh`:
- Around line 376-380: Fix the ready_catalogs assignment in the catalog
readiness check so a no-match grep result remains a single numeric value; avoid
appending an extra fallback line after grep -c already prints 0. Keep the
existing total_catalogs calculation and readiness comparison unchanged.
- Around line 470-478: Restrict the operands patch around the kataconfig rename
so it changes only the targeted top-level resource name, preserving ConfigMap,
Secret, and nested name fields; use an anchored or structure-aware match tied to
the KataConfig object. Replace the full operands manifest dump after the
“Rendered operands YAML” message with an object-list-only dry-run output using
oc apply --dry-run=client -f "${operands_yaml}" -o name, and apply the same safe
object-list output to the operator manifest logging near the existing line-350
output.
In
`@ci-operator/step-registry/sandboxed-containers-operator/pre/sandboxed-containers-operator-pre-chain.yaml`:
- Line 7: Reorder the pre-chain so
sandboxed-containers-operator-install-trustee-operator runs before
sandboxed-containers-operator-install-osc-operator for existing coco jobs,
ensuring Trustee is installed before OSC KataConfig readiness is awaited.
---
Nitpick comments:
In
`@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh`:
- Around line 93-100: Remove the unused retry function from the script, or apply
it consistently to transient oc calls such as the configmap reads so the helper
has an active call site.
- Around line 429-436: Update the CSV lookups in the install flow around
wait_until and csv_name so they select the sandboxed containers CSV by its
expected name prefix rather than relying on .items[0]. Apply the same prefix
filter to both the status-phase check and metadata.name retrieval, preserving
the existing timeout, diagnostics, and failure behavior.
- Around line 271-311: Update every Helm argument assignment in the provider
configuration block, including VXLAN_PORT, PROXY_TIMEOUT, and all Azure, AWS,
and GCP ConfigMap-derived values, to use --set-string instead of --set. Preserve
the existing conditional assignments and value paths while ensuring all
ConfigMap data remains string-typed and values containing commas or dots are not
coerced or split.
In
`@ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml`:
- Around line 3-12: Add an explicit timeout of 9h0m0s to the step configuration
alongside grace_period and commands, ensuring the long OSC and KataConfig waits
can complete without the default two-hour cutoff.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 27dc1291-c4a4-4eaa-b430-3b5e0878ab22
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel-periodics.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (7)
ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yamlci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/OWNERSci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/README.mdci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.shci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.metadata.jsonci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yamlci-operator/step-registry/sandboxed-containers-operator/pre/sandboxed-containers-operator-pre-chain.yaml
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
- Fix grep -c "=READY" || echo "0" producing two lines causing arithmetic syntax error when no CatalogSources are ready yet - Anchor sed pattern for kataconfig rename to avoid rewriting all name: fields - Replace cat of rendered YAML with dry-run object list to prevent leaking SSH keys into CI logs - Reorder pre-chain: install-trustee-operator before install-osc-operator Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse abort |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
/pj-rehearse list |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
1 similar comment
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The operator expects individual keys (AZURE_CLIENT_ID, AZURE_TENANT_ID, etc.) not a JSON file. Use --from-literal instead of --from-file. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse abort |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The WAS_TRACING pattern ($false && set -x) returns exit code 1, which set -e catches. Since the script never enables tracing, remove the save/restore entirely. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
@tbuskey: |
|
/pj-rehearse periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse abort |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The verify_peerpod_pods() function used stale label selectors (app=cloud-api-adaptor, app=peerpodconfig-ctrl-caa-daemon) that don't match current OSC pod labels (name=osc-caa-ds, peer-pods-webhook). Rather than fix the labels, remove the check entirely — KataConfig InProgress=False already confirms the operator finished reconciling nodes, runtime classes, and all managed pods. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse abort |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse |
|
@tbuskey: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Signed-off-by: Tom Buskey <tbuskey@redhat.com>
|
[REHEARSALNOTIFIER]
A total of 50 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@tbuskey: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
azure-ipi-peerpods-gajob to candidate422 config for peer-pod GA workload on Azureredhat-operatorscatalog (GA), no RPM installrestrict_network_access: truefor rehearsal compatibilityTest plan
azure-ipi-peerpods-gajob via/pj-rehearse🤖 Generated with Claude Code
Summary by CodeRabbit
azure-ipi-peerpods-gaperiodic job to thecandidate422OpenShift CI configuration.redhat-operatorscatalog, no RPM installation, and an 8-hour debugging wait.install-osc-operatorstep to install and configure the Sandboxed Containers Operator and peer-pod components.osc-configConfigMap.