ROSAENG-62716: add never-cron OSDFM int-canary gating job with backplane Hive access #82743
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,10 +15,96 @@ else | |
| JOB_LINK="${JOB_LINK}logs/${JOB_NAME}/${BUILD_ID}" | ||
| fi | ||
|
|
||
| # Prow-only: Hive via ocm-backplane when OCM_FVT_USE_BACKPLANE=true (Jenkins/Tekton skip this). | ||
| hive_kubeconfig="" | ||
| backplane_bin_dir="" | ||
| backplane_proxy_url="" | ||
| if [[ "${OCM_FVT_USE_BACKPLANE:-false}" == "true" ]]; then | ||
| echo "=== OCM backplane login (Hive) ===" | ||
| # (BACKPLANE_CLIENT_ID/SECRET env, or backplane_client_{id,secret} files). | ||
| cred_dir="${OCM_FVT_BACKPLANE_CREDENTIALS_DIR:-/usr/local/rosa-clusters-service-sandbox}" | ||
| # Disable tracing while reading backplane client credentials. | ||
| [[ $- == *x* ]] && WAS_TRACING_BP=true || WAS_TRACING_BP=false | ||
| set +x | ||
| backplane_client_id="${BACKPLANE_CLIENT_ID:-}" | ||
| backplane_client_secret="${BACKPLANE_CLIENT_SECRET:-}" | ||
| if [[ -z "${backplane_client_id}" && -f "${cred_dir}/backplane_client_id" ]]; then | ||
| backplane_client_id="$(cat "${cred_dir}/backplane_client_id")" | ||
| fi | ||
| if [[ -z "${backplane_client_secret}" && -f "${cred_dir}/backplane_client_secret" ]]; then | ||
| backplane_client_secret="$(cat "${cred_dir}/backplane_client_secret")" | ||
| fi | ||
| $WAS_TRACING_BP && set -x | ||
| if [[ -z "${backplane_client_id}" || -z "${backplane_client_secret}" ]]; then | ||
| echo "ERROR: OCM_FVT_USE_BACKPLANE=true but backplane client credentials are missing" >&2 | ||
| echo "Expected BACKPLANE_CLIENT_ID/SECRET env or ${cred_dir}/backplane_client_{id,secret}" >&2 | ||
| echo "(CS mounts these from ci/rosa-clusters-service-sandbox)" >&2 | ||
| exit 1 | ||
| fi | ||
| echo "Using backplane credentials from ${cred_dir} (or env)" | ||
|
|
||
| # Defaults match rosa-e2e-ocm-fvt*-ref.yaml; override via job/workflow env if needed. | ||
| backplane_cluster_id="${OCM_FVT_BACKPLANE_CLUSTER_ID:-1g268u7pp694gj152nj16me4sv615lpv}" | ||
| backplane_ocm_url="${OCM_FVT_BACKPLANE_OCM_URL:-https://api.openshift.com}" | ||
| backplane_proxy_url="${OCM_FVT_BACKPLANE_PROXY_URL:-http://squid.corp.redhat.com:3128}" | ||
| backplane_elevate_reason="${OCM_FVT_BACKPLANE_ELEVATE_REASON:-https://issues.redhat.com/browse/ROSAENG-62717}" | ||
|
|
||
| backplane_bin_dir="$(mktemp -d /tmp/ocm-backplane-bin.XXXXXX)" | ||
| export PATH="${backplane_bin_dir}:${PATH}" | ||
|
|
||
| echo "Installing ocm CLI into ${backplane_bin_dir}" | ||
| curl -sSL -o "${backplane_bin_dir}/ocm" \ | ||
| "https://github.com/openshift-online/ocm-cli/releases/download/v1.0.15/ocm-linux-amd64" | ||
| chmod 0755 "${backplane_bin_dir}/ocm" | ||
|
|
||
| echo "Installing ocm-backplane CLI into ${backplane_bin_dir}" | ||
| bp_ver="0.11.0" | ||
| bp_tar="$(mktemp /tmp/ocm-backplane.XXXXXX.tar.gz)" | ||
| curl -sSL -o "${bp_tar}" \ | ||
| "https://github.com/openshift/backplane-cli/releases/download/v${bp_ver}/ocm-backplane_${bp_ver}_Linux_x86_64.tar.gz" | ||
| tar -xzf "${bp_tar}" -C "${backplane_bin_dir}" ocm-backplane | ||
| chmod 0755 "${backplane_bin_dir}/ocm-backplane" | ||
| rm -f "${bp_tar}" | ||
|
Comment on lines
+55
to
+67
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the relevant command script and the repo-wide curl patterns without executing repository code.
if [ -f ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh ]; then
echo "== relevant files =="
wc -l ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
echo
echo "== lines 1-90 =="
sed -n '1,90p' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh | nl -ba
echo
echo "== shellcheck option parse behavior =="
if command -v bash >/dev/null; then
bash --noedit --version | head -1
fi
sed -n '145,155p' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh | nl -ba
else
echo "target file not found"
fi
echo
echo "== other ci-operator step registry curl examples =="
rg -n "curl -[a-zA-Z]*(?:-f|--fail|[^a-zA-Z][^a-zA-Z]*(?:-f|--fail))?|github\.com/.*/releases/download" ci-operator/step-registry -g '*.sh' | head -120Repository: openshift/release Length of output: 311 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Programmatic probe of bash errexit behavior around curl commands without network or execution.
# This reads the command strings only and models curl's documented non-zero-exit absence for HTTP errors.
python3 - <<'PY'
from pathlib import Path
p = Path('ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh')
if not p.exists():
print('file missing')
raise SystemExit(0)
s = p.read_text()
for label in ['ocm CLI', 'ocm-backplane CLI']:
start = s.index(label)
for i, line in enumerate(s[start:start+700].splitlines(), 1):
if ('backplane_bin_dir' in line and 'curl' in line) or (label == 'ocm-backplane CLI' and 'bp_tar' in line and 'curl' in line):
# print only original source line around curl
src = s.splitlines()[start+s[:len(s)-len(s[start:])*0].count('\n')]Repository: openshift/release Length of output: 352 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Programmatic probe of bash errexit behavior around curl commands without network or execution.
python3 - <<'PY'
import re
from pathlib import Path
p = Path('ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh')
if not p.exists():
print('file missing')
raise SystemExit(0)
lines = list(p.read_text().splitlines())
for i, line in enumerate(lines, 1):
if re.search(r'\bcurl\b', line):
print(f"{i}: {line}")
# Print nearby errexit options for state context.
for j in range(max(1, i-10), min(len(lines), i+15)+1):
if re.search(r'\b(set\s+.*?)\b|trap|chmod 0755', lines[j-1]):
print(f" -> {j}: {lines[j-1]}")
PYRepository: openshift/release Length of output: 470 🏁 Script executed: #!/bin/sh
set -euo pipefail
echo "== shell tool availability =="
command -v sed || true
command -v grep || true
command -v python3 || true
command -v awk || true
echo
echo "== relevant file imports/options and curl download commands =="
sed -n '1,90p' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh
echo
echo "== all curl commands in target =="
grep -n 'curl' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh || true
echo
echo "== grep for curl fail/timeout/ssh in step registry =="
grep -EIn '\bcurl\b|gh|ssh|ocm login|backplane' ci-operator/step-registry/rosa/e2e/ocm-fvt/rosa-e2e-ocm-fvt-commands.sh || trueRepository: openshift/release Length of output: 7952 🌐 Web query:
💡 Result: The --fail (or -f) command-line option for curl instructs it to fail silently when an HTTP server returns an error response code (400 or greater), rather than proceeding to output the response body as it does by default [1][2][3]. When this option is used and an HTTP server returns an error code of 400 or higher, curl will exit with the specific error code 22 [1][3][4]. Key details regarding this behavior include: 1. No Body Output: In the event of such a failure, curl will prevent the output of the server's error document, which often contains HTML text describing the error [2][3][5]. 2. Limitations: This mechanism is not fail-safe. Certain authentication-related responses, such as 401 (Unauthorized) and 407 (Proxy Authentication Required), may still pass through without triggering the error exit code, depending on how the server responds and how curl processes the authentication flow [1][2][6]. 3. Alternative Options: - --fail-with-body: Introduced as an alternative to --fail, this option also triggers an exit code of 22 for HTTP errors (400+) but allows the response body (the server's error message) to be output and saved [1][3][5]. - --fail-early: This is a distinct option that causes curl to exit immediately upon the first transfer error encountered, regardless of whether that error is related to an HTTP status code [1][2][7]. For scripts, --fail is a primary method for ensuring that HTTP errors are correctly surfaced as process exit codes, allowing for standard error handling [1][2][4]. Citations:
🌐 Web query:
💡 Result: In curl, --connect-timeout and --max-time serve distinct purposes for managing operation duration [1][2][3]. --connect-timeout This option sets the maximum time, in seconds, that curl is allowed to spend during the connection phase [4][5][6]. The connection phase is considered complete once DNS lookups and any required TCP, TLS, or QUIC handshakes are finished [2][4][6]. If the connection is not established within this time, curl will exit with a timeout error (exit code 28) [2][3][6]. --max-time (-m) This option sets the maximum total time, in seconds, that the entire curl operation is allowed to take [2][3][7]. When this limit is reached, curl will terminate the operation immediately, regardless of what is happening (e.g., even if it is in the middle of transferring data) [2][3]. Like the connection timeout, exceeding this limit results in a timeout exit code of 28 [2][3]. Key similarities: Both options accept decimal values for sub-second precision (e.g., 0.5 for 500 milliseconds) [1][2][7][4]. When specifying decimals, you must always use a dot (.) as the separator, regardless of your system's locale settings [7][4][6]. If these flags are provided multiple times in a command, the last provided value is used [4][5][6]. While --connect-timeout only restricts the initial setup, --max-time provides a hard limit on the lifetime of the request [1][2][3]. If you use both, the --connect-timeout will effectively act as a subset of the --max-time constraint [2][3]. Citations:
Add HTTP failure handling and a timeout to the CLI download Add 🤖 Prompt for AI Agents |
||
|
|
||
| # nested-podman image has no oc; ocm-backplane login/elevate invoke it. | ||
| echo "Installing oc CLI into ${backplane_bin_dir}" | ||
| oc_tar="$(mktemp /tmp/openshift-client.XXXXXX.tar.gz)" | ||
| curl -sSL -o "${oc_tar}" \ | ||
| "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/stable/openshift-client-linux.tar.gz" | ||
| tar -xzf "${oc_tar}" -C "${backplane_bin_dir}" oc | ||
| chmod 0755 "${backplane_bin_dir}/oc" | ||
| rm -f "${oc_tar}" | ||
|
|
||
| mkdir -p "${HOME}/.config/backplane" | ||
| printf '{"proxy-url":"%s"}\n' "${backplane_proxy_url}" > "${HOME}/.config/backplane/config.json" | ||
|
|
||
| # Disable tracing due to client-secret handling on ocm login. | ||
| [[ $- == *x* ]] && WAS_TRACING_BP=true || WAS_TRACING_BP=false | ||
| set +x | ||
| ocm login \ | ||
| --client-id="${backplane_client_id}" \ | ||
| --client-secret="${backplane_client_secret}" \ | ||
| --url="${backplane_ocm_url}" | ||
| ocm-backplane login "${backplane_cluster_id}" | ||
| $WAS_TRACING_BP && set -x | ||
| # Warm elevate: args after -- are oc verbs (not a shell command). | ||
| ocm-backplane elevate "${backplane_elevate_reason}" -- whoami | ||
|
|
||
| hive_kubeconfig="$(mktemp /tmp/hive-kubeconfig.XXXXXX)" | ||
| chmod 0600 "${hive_kubeconfig}" | ||
| # Rewrite exec plugin command to the path mounted inside the ocmci container. | ||
| sed -E \ | ||
| -e 's|command:[[:space:]]*ocm-backplane([[:space:]]*$)|command: /usr/local/backplane-bin/ocm-backplane\1|' \ | ||
| -e 's|command:[[:space:]]*ocm([[:space:]]*$)|command: /usr/local/backplane-bin/ocm\1|' \ | ||
| "${HOME}/.kube/config" > "${hive_kubeconfig}" | ||
| echo "Backplane kubeconfig ready for cluster ${backplane_cluster_id}" | ||
| echo "================================" | ||
| fi | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
|
|
||
| old_umask=$(umask) | ||
| umask 077 | ||
| podman_env_file="$(mktemp /tmp/podman.env.XXXXXX)" | ||
| trap 'rm -f "${podman_env_file}"; rm -f "${hive_kubeconfig:-}"' EXIT | ||
| umask "${old_umask}" | ||
|
|
||
| { | ||
|
|
@@ -29,6 +115,24 @@ umask "${old_umask}" | |
| echo "CONSOLE_CLIENT_SECRET=$(cat /usr/local/cs-qe-credentials/console_client_secret)" | ||
| } > "${podman_env_file}" | ||
|
|
||
| if [[ -n "${hive_kubeconfig}" ]]; then | ||
| # Current ocmci image expects kubeconfig YAML content in the env var. | ||
| # Pass via --env (preserves newlines); env-file cannot. Path mount is | ||
| # available for newer ocm-backend-tests that accept a file path. | ||
| # Disable tracing while loading kubeconfig content into the env var. | ||
| [[ $- == *x* ]] && WAS_TRACING_BP=true || WAS_TRACING_BP=false | ||
| set +x | ||
| export AWS_ACCOUNT_OPERATOR_KUBECONFIG | ||
| AWS_ACCOUNT_OPERATOR_KUBECONFIG="$(cat "${hive_kubeconfig}")" | ||
| $WAS_TRACING_BP && set -x | ||
| echo "PATH=/usr/local/backplane-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" >> "${podman_env_file}" | ||
| echo "HOME=/home/ci-user" >> "${podman_env_file}" | ||
| echo "HTTPS_PROXY=${backplane_proxy_url}" >> "${podman_env_file}" | ||
| echo "HTTP_PROXY=${backplane_proxy_url}" >> "${podman_env_file}" | ||
| echo "https_proxy=${backplane_proxy_url}" >> "${podman_env_file}" | ||
| echo "http_proxy=${backplane_proxy_url}" >> "${podman_env_file}" | ||
| fi | ||
|
|
||
| if [[ "${OCM_FVT_REPORT_JIRA:-true}" == "true" ]]; then | ||
| echo "ENABLE_JIRA_REPORTING=true" >> "${podman_env_file}" | ||
| fi | ||
|
|
@@ -46,7 +150,8 @@ fi | |
|
|
||
| osdfm_qe_creds_dir=/usr/local/osdfm-qe-credentials | ||
| aao_kubeconfig_env=() | ||
| # Prefer backplane-derived kubeconfig when enabled; do not override with the vault file. | ||
| if [[ -z "${hive_kubeconfig}" && -f "${osdfm_qe_creds_dir}/aws_account_operator_kubeconfig" ]]; then | ||
| [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false | ||
| set +x | ||
| aao_kubeconfig_env=("-e" "AWS_ACCOUNT_OPERATOR_KUBECONFIG=$(<"${osdfm_qe_creds_dir}/aws_account_operator_kubeconfig")") | ||
|
|
@@ -80,6 +185,15 @@ podman_args=( | |
| "-v" "/usr/local/cs-qe-credentials:/credentials:ro,z" | ||
| ) | ||
|
|
||
| if [[ -n "${hive_kubeconfig}" ]]; then | ||
| podman_args+=( | ||
| --env AWS_ACCOUNT_OPERATOR_KUBECONFIG | ||
| "-v" "${hive_kubeconfig}:/credentials-hive/kubeconfig:ro,z" | ||
| "-v" "${backplane_bin_dir}:/usr/local/backplane-bin:ro,z" | ||
| "-v" "${HOME}/.config:/home/ci-user/.config:ro,z" | ||
| ) | ||
| fi | ||
|
|
||
| if [[ "${OCM_FVT_GCP_CREDS:-false}" == "true" ]]; then | ||
| podman_args+=( | ||
| "-v" "/usr/local/cs-qe-credentials/osd-ccs-admin.json:/home/ci-user/.gcp/osd-ccs-admin.json:ro,z" | ||
|
|
@@ -132,4 +246,4 @@ done | |
| # whether it is safe to act on this run instead of always running. | ||
| echo "${exit_code}" > "${SHARED_DIR}/ocm-fvt-exit-code" 2>/dev/null || true | ||
|
|
||
| exit "${exit_code}" | ||
Uh oh!
There was an error while loading. Please reload this page.