From ff5538bc770d70c0d7e70f32ace170c6dfa400bf Mon Sep 17 00:00:00 2001 From: Brandon Palm Date: Tue, 14 Jul 2026 15:10:52 -0500 Subject: [PATCH] OCPBUGS-85579: Add consoleless e2e CI job for cert-manager-operator Add an optional e2e-operator-consoleless pre-submit job that provisions an AWS cluster with BASELINE_CAPABILITY_SET=None (Console capability disabled) to verify that the cert-manager operator installs and runs correctly on consoleless RAN/RDS clusters. --- ...rt-manager-operator-cert-manager-1.19.yaml | 26 ++++++ ...rt-manager-operator-cert-manager-1.20.yaml | 26 ++++++ ...penshift-cert-manager-operator-master.yaml | 26 ++++++ ...operator-cert-manager-1.19-presubmits.yaml | 90 ++++++++++++++++++ ...operator-cert-manager-1.20-presubmits.yaml | 90 ++++++++++++++++++ ...rt-manager-operator-master-presubmits.yaml | 91 +++++++++++++++++++ 6 files changed, 349 insertions(+) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19.yaml index bc1edc4c1591b..5391b330952cf 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19.yaml @@ -152,6 +152,32 @@ tests: requests: cpu: 100m workflow: optional-operators-ci-operator-sdk-hypershift +- always_run: false + as: e2e-operator-consoleless + optional: true + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + ADDITIONAL_ENABLED_CAPABILITIES: marketplace CloudControllerManager CloudCredential + MachineAPI ImageRegistry Storage + BASELINE_CAPABILITY_SET: None + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + test: + - ref: optional-operators-operator-sdk + - as: test + cli: latest + commands: | + E2E_GINKGO_LABEL_FILTER='"Platform: isSubsetOf {AWS,Generic} && CredentialsMode: isSubsetOf {Mint} && !TechPreview"' make test-e2e + from: src + resources: + requests: + cpu: 100m + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-operator-aws-proxy optional: true diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20.yaml index b1811a01b67c7..bf34e32651188 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20.yaml @@ -152,6 +152,32 @@ tests: requests: cpu: 100m workflow: optional-operators-ci-operator-sdk-hypershift +- always_run: false + as: e2e-operator-consoleless + optional: true + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + ADDITIONAL_ENABLED_CAPABILITIES: marketplace CloudControllerManager CloudCredential + MachineAPI ImageRegistry Storage + BASELINE_CAPABILITY_SET: None + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + test: + - ref: optional-operators-operator-sdk + - as: test + cli: latest + commands: | + E2E_GINKGO_LABEL_FILTER='"Platform: isSubsetOf {AWS,Generic} && CredentialsMode: isSubsetOf {Mint} && !TechPreview"' make test-e2e + from: src + resources: + requests: + cpu: 100m + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-operator-aws-proxy optional: true diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index d7cd74a54c900..6161db8ad1a53 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -270,6 +270,32 @@ tests: requests: cpu: 100m workflow: optional-operators-ci-operator-sdk-hypershift +- always_run: false + as: e2e-operator-consoleless + optional: true + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + ADDITIONAL_ENABLED_CAPABILITIES: marketplace CloudControllerManager CloudCredential + MachineAPI ImageRegistry Storage + BASELINE_CAPABILITY_SET: None + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + test: + - ref: optional-operators-operator-sdk + - as: test + cli: latest + commands: | + E2E_GINKGO_LABEL_FILTER='Platform: isSubsetOf {AWS,Generic} && CredentialsMode: isSubsetOf {Mint} && !TechPreview' make test-e2e + from: src + resources: + requests: + cpu: 100m + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-operator-aws-proxy optional: true diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19-presubmits.yaml index 73f942a1617be..64f2ae52c1c83 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19-presubmits.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.19-presubmits.yaml @@ -600,6 +600,96 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-operator-azure-workload-identity,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^cert-manager-1\.19$ + - ^cert-manager-1\.19- + cluster: build03 + context: ci/prow/e2e-operator-consoleless + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.20" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cert-manager-operator-cert-manager-1.19-e2e-operator-consoleless + optional: true + rerun_command: /test e2e-operator-consoleless + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-operator-consoleless + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-operator-consoleless,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20-presubmits.yaml index 99474f3e426be..a2e4452b45691 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20-presubmits.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-cert-manager-1.20-presubmits.yaml @@ -600,6 +600,96 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-operator-azure-workload-identity,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^cert-manager-1\.20$ + - ^cert-manager-1\.20- + cluster: build03 + context: ci/prow/e2e-operator-consoleless + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cert-manager-operator-cert-manager-1.20-e2e-operator-consoleless + optional: true + rerun_command: /test e2e-operator-consoleless + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-operator-consoleless + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-operator-consoleless,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml index 04e8fe2a11d0e..3ee250f2962fb 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml @@ -607,6 +607,97 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-operator-azure-workload-identity,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^master$ + - ^master- + cluster: build10 + context: ci/prow/e2e-operator-consoleless + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cert-manager-operator-master-e2e-operator-consoleless + optional: true + rerun_command: /test e2e-operator-consoleless + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-operator-consoleless + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-operator-consoleless,?($|\s.*) - agent: kubernetes always_run: false branches: