OCPQE-30425: Add metal SNO IPv6 http-proxy jobs for 4.18-5.0 - #83261
OCPQE-30425: Add metal SNO IPv6 http-proxy jobs for 4.18-5.0#83261snaoum-lang wants to merge 15 commits into
Conversation
dd baremetal-lab-sno-ipv6-static workflow/chain and amd64/arm64 periodics so SNO BIP with IPv6 single-stack and cluster-wide proxy is covered without changing existing SNO jobs.
openshift-ci-robot
added
the
jira/valid-reference
|
@snaoum-lang: This pull request references OCPQE-30425 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdded an IPv6 static bare-metal SNO workflow, its provisioning chain, proxy and bootstrap configuration, ownership metadata, and scheduled amd64 and arm64 HTTP proxy test jobs for releases 4.18 through 5.0. ChangesIPv6 static SNO coverage
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseSchedule
participant SNOWorkflow
participant SNOConfigChain
participant ProxyConfig
ReleaseSchedule->>SNOWorkflow: Start scheduled IPv6 HTTP proxy test
SNOWorkflow->>SNOConfigChain: Run IPv6 static SNO provisioning
SNOConfigChain->>ProxyConfig: Generate proxy and NO_PROXY settings
ProxyConfig-->>SNOConfigChain: Return generated proxy configuration
SNOConfigChain-->>SNOWorkflow: Provide configured SNO environment
SNOWorkflow-->>ReleaseSchedule: Report results and deprovision
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 inconclusive)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
do-not-merge/invalid-owners-file
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml`:
- Around line 5545-5559: Regenerate the Prow job configuration by running make
update, then commit all resulting generated metadata and job changes for
metal-sno-ipv6-http-proxy-f28 in
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yaml#L5545-L5559
and
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__arm64-nightly.yaml#L658-L674,
and for metal-sno-ipv6-http-proxy-f7 in
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.22__amd64-nightly.yaml#L5765-L5779,
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.22__arm64-nightly.yaml#L699-L715,
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__amd64-nightly.yaml#L4870-L4884,
and
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__arm64-nightly.yaml#L658-L674.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: a6f9e9c5-67c6-4521-b782-c77885eb46b8
⛔ Files ignored due to path filters (6)
ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.22-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0-periodics.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (18)
ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__arm64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__arm64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__amd64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.20__arm64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__amd64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__arm64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.22__amd64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.22__arm64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__amd64-nightly.yamlci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-5.0__arm64-nightly.yamlci-operator/step-registry/baremetal/lab/sno/ipv6/static/OWNERSci-operator/step-registry/baremetal/lab/sno/ipv6/static/baremetal-lab-sno-ipv6-static-workflow.metadata.jsonci-operator/step-registry/baremetal/lab/sno/ipv6/static/baremetal-lab-sno-ipv6-static-workflow.yamlci-operator/step-registry/baremetal/lab/sno/ipv6/static/conf/OWNERSci-operator/step-registry/baremetal/lab/sno/ipv6/static/conf/baremetal-lab-sno-ipv6-static-conf-chain.metadata.jsonci-operator/step-registry/baremetal/lab/sno/ipv6/static/conf/baremetal-lab-sno-ipv6-static-conf-chain.yaml
Use one-level OWNERS symlinks to match baremetal lab conventions and resolve do-not-merge/invalid-owners-file on the PR.
openshift-ci
Bot
removed
the
do-not-merge/invalid-owners-file
|
@snaoum-lang: |
Required by ci/prow/owners for new step-registry component paths.
|
@snaoum-lang: |
|
/pj-rehearse periodic-ci-openshift-release-master-periodic-ci-openshift-openshift-tests-private-release-4.22-periodics-metal-sno-ipv6-http-proxy-f7 |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-sno-ipv6-http-proxy-f7 |
|
@snaoum-lang: your |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-sno-ipv6-http-proxy-f7 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-sno-ipv6-http-proxy-f7 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Two issues were preventing SNO IPv6 with HTTP proxy from bootstrapping:
1. ipi-conf-proxy: Missing noProxy configuration caused installer to
route cluster-internal API traffic through the proxy. Now dynamically
builds noProxy list from cluster/service/machine CIDRs and domain.
2. baremetal-lab-upi-conf-grub2-ipv6-static: Missing BOOTSTRAP_IN_PLACE
check caused SNO to fetch wrong ignition file. Now matches IPv4 logic
to use bootstrap.ign for SNO instead of console-hook.ign.
Fixes: OCPQE-30425
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/ipi/conf/proxy/ipi-conf-proxy-commands.sh`:
- Around line 29-41: Initialize CLUSTER_CIDRS, SERVICE_CIDRS, and MACHINE_CIDRS
to empty values before the NETWORK_PATCH file-existence check, so nounset-safe
references later in the script remain defined when the optional patch is absent.
Preserve the existing extraction and NO_PROXY updates inside the conditional
block.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 671c0584-50ef-4c0d-abdb-77ef144e014e
📒 Files selected for processing (2)
ci-operator/step-registry/baremetal/lab/upi/conf/grub2/ipv6/static/baremetal-lab-upi-conf-grub2-ipv6-static-commands.shci-operator/step-registry/ipi/conf/proxy/ipi-conf-proxy-commands.sh
| NETWORK_PATCH="${SHARED_DIR}/network_patch_install_config.yaml" | ||
| if [ -f "${NETWORK_PATCH}" ]; then | ||
| # Extract cluster network CIDRs from patch | ||
| CLUSTER_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.clusterNetwork[*].cidr' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | ||
| [ -n "${CLUSTER_CIDRS}" ] && NO_PROXY="${NO_PROXY},${CLUSTER_CIDRS}" | ||
|
|
||
| # Extract service network CIDRs from patch | ||
| SERVICE_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.serviceNetwork[*]' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | ||
| [ -n "${SERVICE_CIDRS}" ] && NO_PROXY="${NO_PROXY},${SERVICE_CIDRS}" | ||
|
|
||
| # Extract machine network CIDRs from patch | ||
| MACHINE_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.machineNetwork[*].cidr' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | ||
| [ -n "${MACHINE_CIDRS}" ] && NO_PROXY="${NO_PROXY},${MACHINE_CIDRS}" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Initialize the CIDR variables before the optional patch check.
If ${SHARED_DIR}/network_patch_install_config.yaml is absent, Lines 55, 59, and 63 expand unset variables. set -o nounset then terminates the step before it can read network values from install-config.yaml.
Proposed fix
NETWORK_PATCH="${SHARED_DIR}/network_patch_install_config.yaml"
+CLUSTER_CIDRS=""
+SERVICE_CIDRS=""
+MACHINE_CIDRS=""
+
if [ -f "${NETWORK_PATCH}" ]; then📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| NETWORK_PATCH="${SHARED_DIR}/network_patch_install_config.yaml" | |
| if [ -f "${NETWORK_PATCH}" ]; then | |
| # Extract cluster network CIDRs from patch | |
| CLUSTER_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.clusterNetwork[*].cidr' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | |
| [ -n "${CLUSTER_CIDRS}" ] && NO_PROXY="${NO_PROXY},${CLUSTER_CIDRS}" | |
| # Extract service network CIDRs from patch | |
| SERVICE_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.serviceNetwork[*]' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | |
| [ -n "${SERVICE_CIDRS}" ] && NO_PROXY="${NO_PROXY},${SERVICE_CIDRS}" | |
| # Extract machine network CIDRs from patch | |
| MACHINE_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.machineNetwork[*].cidr' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | |
| [ -n "${MACHINE_CIDRS}" ] && NO_PROXY="${NO_PROXY},${MACHINE_CIDRS}" | |
| NETWORK_PATCH="${SHARED_DIR}/network_patch_install_config.yaml" | |
| CLUSTER_CIDRS="" | |
| SERVICE_CIDRS="" | |
| MACHINE_CIDRS" | |
| if [ -f "${NETWORK_PATCH}" ]; then | |
| # Extract cluster network CIDRs from patch | |
| CLUSTER_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.clusterNetwork[*].cidr' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | |
| [ -n "${CLUSTER_CIDRS}" ] && NO_PROXY="${NO_PROXY},${CLUSTER_CIDRS}" | |
| # Extract service network CIDRs from patch | |
| SERVICE_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.serviceNetwork[*]' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | |
| [ -n "${SERVICE_CIDRS}" ] && NO_PROXY="${NO_PROXY},${SERVICE_CIDRS}" | |
| # Extract machine network CIDRs from patch | |
| MACHINE_CIDRS=$(yq-go r "${NETWORK_PATCH}" 'networking.machineNetwork[*].cidr' 2>/dev/null | tr '\n' ',' | sed 's/,$//') | |
| [ -n "${MACHINE_CIDRS}" ] && NO_PROXY="${NO_PROXY},${MACHINE_CIDRS}" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/ipi/conf/proxy/ipi-conf-proxy-commands.sh` around
lines 29 - 41, Initialize CLUSTER_CIDRS, SERVICE_CIDRS, and MACHINE_CIDRS to
empty values before the NETWORK_PATCH file-existence check, so nounset-safe
references later in the script remain defined when the optional patch is absent.
Preserve the existing extraction and NO_PROXY updates inside the conditional
block.
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-sno-ipv6-http-proxy-f7 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The step was failing with 'unbound variable' error because the script references BOOTSTRAP_IN_PLACE but it wasn't defined in the ref.yaml. Added BOOTSTRAP_IN_PLACE env variable with default 'false'. The workflow overrides this to 'true' for SNO deployments to use bootstrap.ign instead of console-hook.ign files.
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-metal-sno-ipv6-http-proxy-f7 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/ping @vrutkovs @deads2k @jianlinliu @yunjiang29 @patrickdillon @gpei @jianlin-wei |
|
|
||
| # Add cluster name for API endpoint | ||
| CLUSTER_NAME=$(yq-go r "${CONFIG}" 'metadata.name' 2>/dev/null) | ||
| [ -n "${CLUSTER_NAME}" ] && [ -n "${BASE_DOMAIN}" ] && NO_PROXY="${NO_PROXY},api.${CLUSTER_NAME}.${BASE_DOMAIN},api-int.${CLUSTER_NAME}.${BASE_DOMAIN}" |
There was a problem hiding this comment.
these values should already be configured automatically by the manifest generated by the installer--should be unnecessary to add them here. And if the installer does not generate them it would be a bug..
Let the installer populate noProxy from install-config networking CIDRs.
|
New changes are detected. LGTM label has been removed. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jadhaj, mhanss, snaoum-lang The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse periodic-ci-openshift-eng-openshift-eng-agent-qe-infra-release-4.22-amd64-nightly-baremetal-compact-agent-ipv6-dynamic-f7 |
|
@snaoum-lang: your |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@patrickdillon @jadhaj @mhanss - Update:
|
The installer does not auto-populate proxy.noProxy from networking CIDRs on ARM baremetal SNO BIP IPv6 installations, causing bootstrap to fail with API connection errors. Add noProxy patch creation to baremetal-lab-pre-firewall step (which already handles proxy setup) to work around this installer limitation. The patch includes cluster/service/machine CIDRs plus API endpoints, and is merged with install-config by baremetal-lab-upi-install. This keeps the workaround baremetal-specific and doesn't affect the shared ipi-conf-proxy step used by other teams. Reference: openshift#83261
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
2 similar comments
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The proxy-conf.sh file is sourced by CI scripts like openshift-install when they run in the CI pod. The previous hardcoded NO_PROXY value of "localhost,127.0.0.1" was too restrictive and caused failures when CI scripts tried to access infrastructure through the baremetal proxy that wasn't reachable from the CI pod. Changes: - Build NO_PROXY dynamically from environment variables only - Add AUX_HOST (CI scripts SSH to auxiliary host) - Add INTERNAL_NET_CIDR and INTERNAL_NET_V6_CIDR (internal lab networks) - Add .ci.openshift.org (CI infrastructure should not be proxied) - No hardcoded cluster CIDRs (those remain in noproxy_patch_install_config.yaml for the cluster being installed, not for CI scripts) This fixes the error: error: unable to read image registry.build10.ci.openshift.org/ci-op-*/release@sha256:* Get "https://registry.build10.ci.openshift.org/v2/": proxyconnect tcp: dial tcp 10.10.137.10:3128: connect: no route to host The fix works for both CI and production deployments because it only uses dynamic values from the environment, not hardcoded CIDRs.
|
[REHEARSALNOTIFIER]
A total of 557 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.21-arm64-nightly-metal-sno-ipv6-http-proxy-f28 |
|
@snaoum-lang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@snaoum-lang: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
5 participants
Summary
baremetal-lab-sno-ipv6-staticfor SNO BIP + IPv6 single-stack + cluster-wide HTTP proxy on RDU2 baremetal labbaremetal-lab-sno-ipv6-static-conf(usesbaremetal-lab-upi-conf-grub2-ipv6-staticinstead of IPv4 grub2 step)metal-sno-ipv6-http-proxy-*for OCP 4.18–5.0 (amd64 + arm64), reusing one workflow without per-version duplicationRelated
versioned-installer-packet-sno_bip-single_stack-http_proxyTest plan
make updatecompletedmetal-sno-ipv6-http-proxy-f7)Summary by CodeRabbit
Adds IPv6 single-stack and cluster-wide HTTP proxy coverage for RDU2 bare-metal SNO clusters.
baremetal-lab-sno-ipv6-staticworkflow and configuration chain.noProxyentries from cluster networks, service networks, cluster domain, and API endpoints.bootstrap.ignfor SNO bootstrap-in-place deployments.