Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ images:
items:
- dockerfile_path: Dockerfile
to: zero-trust-workload-identity-manager
- dockerfile_path: Dockerfile.coverage
to: zero-trust-workload-identity-manager-coverage
operator:
bundles:
- as: zero-trust-workload-identity-manager-bundle
Expand Down Expand Up @@ -145,6 +147,120 @@ tests:
requests:
cpu: 100m
workflow: optional-operators-ci-operator-sdk-aws
- always_run: false
as: operator-e2e-coverage
cluster_claim:
architecture: amd64
cloud: aws
owner: openshift-ci
product: ocp
timeout: 2h0m0s
version: "4.20"
steps:
post:
- as: collect-coverage
best_effort: true
cli: latest
commands: hack/e2e-coverage.sh collect
credentials:
- mount_path: /var/run/secrets/codecov
name: ztwim-codecov-token
namespace: test-credentials
from: src
resources:
requests:
cpu: 100m
timeout: 15m0s
- chain: gather
test:
- as: install
cli: latest
commands: |
oc create namespace zero-trust-workload-identity-manager
operator-sdk run bundle --timeout=10m --security-context-config=restricted --install-mode=AllNamespaces -n zero-trust-workload-identity-manager "$OO_BUNDLE" --verbose
oc wait --for condition=Available -n zero-trust-workload-identity-manager deployment zero-trust-workload-identity-manager-controller-manager
dependencies:
- env: OO_BUNDLE
name: zero-trust-workload-identity-manager-bundle
from: operator-sdk
resources:
requests:
cpu: 100m
- as: setup-coverage
cli: latest
commands: hack/e2e-coverage.sh setup
dependencies:
- env: COVERAGE_IMAGE
name: zero-trust-workload-identity-manager-coverage
from: src
resources:
requests:
cpu: 100m
Comment on lines +189 to +198

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Keep coverage setup out of the required e2e-operator signal.

setup-coverage is now a mandatory step inside the existing presubmit. If hack/e2e-coverage.sh setup or the coverage image regresses, the functional E2E lane starts failing for coverage/tooling reasons rather than operator behavior. Given the stated goal here was an optional coverage presubmit, this should stay decoupled from the required e2e-operator path.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml`
around lines 91 - 100, The presubmit currently makes the coverage setup ("as:
setup-coverage", "commands: hack/e2e-coverage.sh setup", "name:
zero-trust-workload-identity-manager-coverage", "cli: latest", "from: src") a
required step in the e2e-operator signal; remove or move this job out of the
required e2e-operator presubmit path so coverage setup is optional — either
delete the setup-coverage entry from the e2e-operator signal or place it in a
separate optional presubmit job (keeping the same commands and dependencies) so
failures in hack/e2e-coverage.sh or the coverage image don’t block operator E2E
tests.

- as: test
cli: latest
commands: make test-e2e
from: src
resources:
requests:
cpu: 100m
workflow: generic-claim
- as: publish-e2e-coverage
cluster_claim:
architecture: amd64
cloud: aws
owner: openshift-ci
product: ocp
timeout: 2h0m0s
version: "4.20"
postsubmit: true
steps:
post:
- as: collect-coverage
best_effort: true
cli: latest
commands: hack/e2e-coverage.sh collect
credentials:
- mount_path: /var/run/secrets/codecov
name: ztwim-codecov-token
namespace: test-credentials
from: src
resources:
requests:
cpu: 100m
timeout: 15m0s
Comment on lines +218 to +230

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fail the postsubmit when baseline publication breaks.

In publish-e2e-coverage, collect-coverage is the step that actually publishes the baseline. Leaving it best_effort: true means the job can stay green while coverage publication is silently broken, which defeats the purpose of this postsubmit.

Suggested change
     post:
     - as: collect-coverage
-      best_effort: true
       cli: latest
       commands: hack/e2e-coverage.sh collect
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml`
around lines 120 - 132, The postsubmit uses a step labeled "as:
collect-coverage" inside the "publish-e2e-coverage" job but it is marked
best_effort: true so coverage baseline publication can silently fail; change the
step definition for collect-coverage (the block with as: collect-coverage,
commands: hack/e2e-coverage.sh collect, credentials: ztwim-codecov-token) to
remove or set best_effort to false so the job fails when baseline publication
fails, ensuring the postsubmit fails on publication errors.

- chain: gather
test:
- as: install
cli: latest
commands: |
oc create namespace zero-trust-workload-identity-manager
operator-sdk run bundle --timeout=10m --security-context-config=restricted --install-mode=AllNamespaces -n zero-trust-workload-identity-manager "$OO_BUNDLE" --verbose
oc wait --for condition=Available -n zero-trust-workload-identity-manager deployment zero-trust-workload-identity-manager-controller-manager
dependencies:
- env: OO_BUNDLE
name: zero-trust-workload-identity-manager-bundle
from: operator-sdk
resources:
requests:
cpu: 100m
- as: setup-coverage
cli: latest
commands: hack/e2e-coverage.sh setup
dependencies:
- env: COVERAGE_IMAGE
name: zero-trust-workload-identity-manager-coverage
from: src
resources:
requests:
cpu: 100m
- as: test
cli: latest
commands: make test-e2e
from: src
resources:
requests:
cpu: 100m
workflow: generic-claim
zz_generated_metadata:
branch: main
org: openshift
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,88 @@
postsubmits:
openshift/zero-trust-workload-identity-manager:
- agent: kubernetes
always_run: true
branches:
- ^main$
cluster: build01
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
max_concurrency: 1
name: branch-ci-openshift-zero-trust-workload-identity-manager-main-publish-e2e-coverage
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --hive-kubeconfig=/secrets/hive-hive-credentials/kubeconfig
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=publish-e2e-coverage
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/hive-hive-credentials
name: hive-hive-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: hive-hive-credentials
secret:
secretName: hive-hive-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
Expand Down Expand Up @@ -69,6 +70,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
Expand Down Expand Up @@ -159,6 +161,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
Expand Down Expand Up @@ -244,6 +247,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
Expand Down Expand Up @@ -329,6 +333,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
Expand Down Expand Up @@ -414,6 +419,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
Expand Down Expand Up @@ -459,6 +465,96 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )images,?($|\s.*)
- agent: kubernetes
always_run: false
branches:
- ^main$
- ^main-
cluster: build03
context: ci/prow/operator-e2e-coverage
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-zero-trust-workload-identity-manager-main-operator-e2e-coverage
rerun_command: /test operator-e2e-coverage
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --hive-kubeconfig=/secrets/hive-hive-credentials/kubeconfig
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=operator-e2e-coverage
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/hive-hive-credentials
name: hive-hive-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: hive-hive-credentials
secret:
secretName: hive-hive-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )(operator-e2e-coverage|remaining-required),?($|\s.*)
- agent: kubernetes
always_run: true
branches:
Expand All @@ -471,6 +567,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
Expand Down Expand Up @@ -536,6 +633,7 @@ presubmits:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
- Dockerfile.coverage
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
Expand Down
3 changes: 3 additions & 0 deletions core-services/pipeline-controller/lgtm-config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,9 @@ orgs:
- route-override-cni
- whereabouts-cni
- hypershift
- name: zero-trust-workload-identity-manager
branches:
- main
- org: openshift-priv
repos:
- api
Expand Down