Import a cluster into rancher that was created on harvester infrastructure

[lscalabrini01]

This pull request introduces a new Jenkins pipeline and supporting scripts to automate the provisioning, configuration, and teardown of Harvester VMs for Rancher downstream cluster end-to-end testing. The changes add a Jenkinsfile for orchestrating the workflow and two bash scripts for building and destroying the test infrastructure using Tofu (Terraform alternative) and Ansible.

Automation for Harvester Downstream Cluster E2E Testing:

Pipeline Orchestration:

• Added a new Jenkinsfile (Jenkinsfile.harvester.downstream.e2e) to automate the end-to-end process of provisioning Harvester VMs, configuring Rancher and downstream clusters, running tests in Docker, and cleaning up resources. The pipeline manages environment variables, credentials, repository checkouts, and container/volume lifecycle.

Infrastructure Provisioning and Configuration:

• Introduced build_harvester_downstream_qa_infra.sh script to provision Harvester VMs with Tofu, configure them with Ansible, and import them as a downstream cluster into Rancher. The script includes robust error handling and cleanup logic to destroy resources on failure.

Infrastructure Teardown:

• Added destroy_harvester_downstream_qa_infra.sh script to reliably destroy both the imported downstream cluster and the Harvester VM infrastructure, ensuring a clean test environment after runs.

[Copilot]

Pull request overview

Adds a new TFP Jenkins pipeline to provision Harvester-backed VMs via qa-infra-automation, run the downstream import playbook against an existing Rancher instance, and optionally destroy the created infra.

Changes:

• Added Jenkinsfile.harvester.downstream.e2e to checkout tests + qa-infra-automation, build the E2E image, run build/destroy scripts, and clean up containers/volumes.
• Added build_harvester_downstream_qa_infra.sh to run the Harvester downstream Ansible playbook and (optionally) destroy tofu-managed infra on failure.
• Added destroy_harvester_downstream_qa_infra.sh to destroy the Harvester tofu module resources.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
validation/pipeline/tfp/Jenkinsfile.harvester.downstream.e2e	New Jenkins pipeline to provision/import a Harvester-created downstream cluster via qa-infra-automation and run in the standard E2E container workflow.
validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh	Orchestrates the qa-infra-automation Harvester downstream playbook and conditional cleanup via tofu.
validation/pipeline/scripts/destroy_harvester_downstream_qa_infra.sh	Standalone tofu destroy helper for the Harvester downstream module.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

Suppressed comments (8)

validation/pipeline/qainfra/Jenkinsfile.harvester.downstream.e2e:116

• This command executes the newly added build script by path, but the Jenkinsfile does not chmod it first. If the script is committed without the executable bit, the Build Environment stage fails with permission denied; neighboring qainfra pipelines explicitly chmod scripts before direct execution. Commit the script as mode 100755 or chmod it in this command.

                "${imageName} sh -c \"${workPath}pipeline/scripts/build_harvester_downstream_qa_infra.sh\""

validation/pipeline/qainfra/Jenkinsfile.harvester.downstream.e2e:127

• The cleanup stage likewise executes the newly added destroy script directly without ensuring it is executable. If its mode is not 100755, cleanup fails before either Terraform destroy runs and leaves the infrastructure behind. Commit the script with executable mode or chmod it before invocation.

                    "${imageName} sh -c \"${workPath}pipeline/scripts/destroy_harvester_downstream_qa_infra.sh\""

validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh:25

• When CLEANUP=false, a nonzero Tofu apply skips this entire branch and the script continues to tofu output, Ansible, and the import steps as if provisioning succeeded. Cleanup should be optional rollback behavior, not a condition for treating a failed apply as successful; always exit nonzero after the failed apply.

if [ $? -ne 0 ] && [[ $CLEANUP == "true" ]]; then

validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh:53

• The same CLEANUP gating makes a failed Rancher playbook non-fatal when cleanup is disabled. The script then proceeds to downstream registration and can report success even though Rancher was never configured; return a failure for the playbook regardless of whether rollback is requested.

if [ $? -ne 0 ] && [[ $CLEANUP == "true" ]]; then

validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh:86

• If the downstream registration fails while CLEANUP=false, this condition is skipped and execution reaches the success message below, so a failed import is reported as successful. Keep VM rollback conditional if desired, but always propagate the registration failure with a nonzero exit.

if [ $? -ne 0 ] && [[ $CLEANUP == "true" ]]; then

validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh:98

• Because this script does not enable errexit, a failed redirection here is ignored. If the state directory is missing or unwritable, the name is not persisted; the cleanup script then skips imported-cluster cleanup, while the next line still reports success. Check the write result and route the failure through rollback instead of continuing.

echo "$DOWNSTREAM_CLUSTER_NAME" > "$QAINFRA_SCRIPT_PATH/$RANCHER_IMPORT_TOFU_PATH/downstream_cluster_name.txt"
echo "Downstream cluster '$DOWNSTREAM_CLUSTER_NAME' imported and registered successfully!"

validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh:75

• After the Rancher playbook runs, Rancher has already used bootstrap_password to set the permanent admin password; the qa-infra documentation notes that the bootstrap password is only valid during first-time setup. Extracting bootstrap_password here and passing it as rancher_bootstrap_password to the downstream playbook will therefore commonly make its login fail with 401. Pass the permanent password value instead (the playbook variable is unfortunately named rancher_bootstrap_password).

RANCHER_BOOTSTRAP_PASSWORD=$(grep -oP '(?<=bootstrap_password: ").*(?=")' "$QAINFRA_SCRIPT_PATH/$RANCHER_DEFAULT_PATH/$HARVESTER_VARS_FILE")

validation/pipeline/scripts/build_harvester_downstream_qa_infra.sh:10

• With the Jenkinsfile's default checkout of qa-infra-automation on main, this default points to a file that is not present in that branch (main has ansible/harvester/upgrade-harvester.yml, not harvester-rancher-playbook.yml). The default job therefore fails at the Ansible step before it can import the downstream cluster; please align the default path with the checked-out branch or pin the job to a branch that contains this playbook.

: "${RANCHER_PLAYBOOK_PATH:=ansible/harvester/harvester-rancher-playbook.yml}"

[floatingman]

Just a few comments. All in all I feel like these scripts can be added to qa-infra-automation and ran with the makefile there.

[floatingman]

This should have the set -uoe pipefail option set; otherwise, what Copilot pointed out will happen. Failures should always exit with a non-zero value.

[lscalabrini01]

done

[floatingman]

Why not add an error output like for IP_ADDRESS?

[lscalabrini01]

done

[floatingman]

The shell linter is complaining that there is no newline here.

[lscalabrini01]

done