trusted-execution-clusters: Introduce Azure tests#79393
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds an Azure CI operator variant that builds an azure-test-image (Rust + Azure CLI), registers an optional nested-podman integration test, provides a step-registry ref and execution script for Azure integration tests, and updates OWNERS metadata. ChangesAzure Integration Test
Sequence DiagramsequenceDiagram
participant Script as azure-integration-test-commands.sh
participant OC as oc
participant Podman as podman
participant Az as az
participant Registry as InternalRegistry
Script->>OC: discover namespace & internal registry (oc project, oc get)
Script->>Podman: podman login to InternalRegistry using oc whoami token
Script->>Az: az login using service-principal secrets
Script->>Registry: make push -> push built images (azure-test-image)
Script->>Script: make integration-tests (run tests against pushed images)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml`:
- Around line 31-61: This config is missing the required top-level promotion
section; add a promotion: block alongside releases/tests/build_root/images that
provides the promotion namespace and a tag_specification mapping image stream
tags to the release tags (e.g., a namespace for the release image push and a
tag_specification object that lists the image stream names/tags to promote), so
the ci-operator can promote built images into the release stream; update the
existing config to include this promotion block at top level (referencing
promotion and tag_specification to align with the releases/tests entries).
In
`@ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh`:
- Around line 9-23: Wrap all secret-handling commands (the podman login
invocation, the az login invocation, and the secret reads that set
AZURE_SUBSCRIPTION_ID and TEST_IMAGE) with a saved/restore xtrace guard: capture
current tracing state, disable tracing (set +x) before reading files and
invoking podman/az, then restore the original tracing state afterward; update
the block around the podman login, the AZURE_SUBSCRIPTION_ID/TEST_IMAGE exports
and the az login to use this save/restore pattern so credentials written by
VIRT_PROVIDER/PLATFORM/REGISTRY/TEST_IMAGE/AZURE_SUBSCRIPTION_ID are never
printed when tracing is enabled upstream.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 70a64ce8-0bb8-4e16-a449-f00bf55e1a68
⛔ Files ignored due to path filters (1)
ci-operator/jobs/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (6)
ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yamlci-operator/step-registry/trusted-execution-clusters/ref/OWNERSci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERSci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.shci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.jsonci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml
💤 Files with no reviewable changes (1)
- ci-operator/step-registry/trusted-execution-clusters/ref/OWNERS
| releases: | ||
| latest: | ||
| candidate: | ||
| architecture: amd64 | ||
| product: ocp | ||
| stream: nightly | ||
| version: "4.21" | ||
| resources: | ||
| '*': | ||
| limits: | ||
| memory: 4Gi | ||
| requests: | ||
| cpu: 100m | ||
| memory: 200Mi | ||
| tests: | ||
| - always_run: false | ||
| as: integration-test | ||
| capabilities: | ||
| - nested-podman | ||
| optional: true | ||
| skip_if_only_changed: ^(\.github|LICENSES|bundle|docs|examples)/|^(README\.md|\.gitignore)$ | ||
| steps: | ||
| cluster_profile: openshift-org-aws | ||
| test: | ||
| - ref: trusted-execution-clusters-ref-azure-integration-test | ||
| workflow: ipi-aws | ||
| zz_generated_metadata: | ||
| branch: main | ||
| org: trusted-execution-clusters | ||
| repo: operator | ||
| variant: azure |
There was a problem hiding this comment.
Add the missing promotion section to this ci-operator config.
This config defines build_root, images, tests, and releases, but it omits promotion, which is required for files under ci-operator/config/.
Suggested structure
releases:
latest:
candidate:
architecture: amd64
product: ocp
stream: nightly
version: "4.21"
+promotion:
+ to:
+ - namespace: trusted-execution-clusters
+ name: operatorAs per coding guidelines, "CI configuration files should define build_root, images, tests (referencing step-registry workflows), promotion, and releases sections in ci-operator/config///".
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| releases: | |
| latest: | |
| candidate: | |
| architecture: amd64 | |
| product: ocp | |
| stream: nightly | |
| version: "4.21" | |
| resources: | |
| '*': | |
| limits: | |
| memory: 4Gi | |
| requests: | |
| cpu: 100m | |
| memory: 200Mi | |
| tests: | |
| - always_run: false | |
| as: integration-test | |
| capabilities: | |
| - nested-podman | |
| optional: true | |
| skip_if_only_changed: ^(\.github|LICENSES|bundle|docs|examples)/|^(README\.md|\.gitignore)$ | |
| steps: | |
| cluster_profile: openshift-org-aws | |
| test: | |
| - ref: trusted-execution-clusters-ref-azure-integration-test | |
| workflow: ipi-aws | |
| zz_generated_metadata: | |
| branch: main | |
| org: trusted-execution-clusters | |
| repo: operator | |
| variant: azure | |
| releases: | |
| latest: | |
| candidate: | |
| architecture: amd64 | |
| product: ocp | |
| stream: nightly | |
| version: "4.21" | |
| promotion: | |
| to: | |
| - namespace: trusted-execution-clusters | |
| name: operator | |
| resources: | |
| '*': | |
| limits: | |
| memory: 4Gi | |
| requests: | |
| cpu: 100m | |
| memory: 200Mi | |
| tests: | |
| - always_run: false | |
| as: integration-test | |
| capabilities: | |
| - nested-podman | |
| optional: true | |
| skip_if_only_changed: ^(\.github|LICENSES|bundle|docs|examples)/|^(README\.md|\.gitignore)$ | |
| steps: | |
| cluster_profile: openshift-org-aws | |
| test: | |
| - ref: trusted-execution-clusters-ref-azure-integration-test | |
| workflow: ipi-aws | |
| zz_generated_metadata: | |
| branch: main | |
| org: trusted-execution-clusters | |
| repo: operator | |
| variant: azure |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml`
around lines 31 - 61, This config is missing the required top-level promotion
section; add a promotion: block alongside releases/tests/build_root/images that
provides the promotion namespace and a tag_specification mapping image stream
tags to the release tags (e.g., a namespace for the release image push and a
tag_specification object that lists the image stream names/tags to promote), so
the ci-operator can promote built images into the release stream; update the
existing config to include this promotion block at top level (referencing
promotion and tag_specification to align with the releases/tests entries).
| podman login -u "$(oc whoami)" -p "$(oc whoami -t)" \ | ||
| image-registry.openshift-image-registry.svc:5000 --tls-verify=false | ||
|
|
||
| AZURE_SUBSCRIPTION_ID=$(cat /tmp/secrets/azure/subscription-id) | ||
| TEST_IMAGE=$(cat /tmp/secrets/azure/test-image) | ||
| export AZURE_SUBSCRIPTION_ID TEST_IMAGE | ||
|
|
||
| export VIRT_PROVIDER=azure | ||
| export PLATFORM=openshift | ||
| export REGISTRY="${REGISTRY}" | ||
|
|
||
| az login --service-principal \ | ||
| -u "$(cat /tmp/secrets/azure/client-id)" \ | ||
| -p "$(cat /tmp/secrets/azure/client-secret)" \ | ||
| --tenant "$(cat /tmp/secrets/azure/tenant-id)" |
There was a problem hiding this comment.
Guard secret/token operations by saving/restoring tracing state.
Sensitive values are handled on Lines 9-23, but there is no explicit xtrace guard. Add set +x with state restore around these operations to prevent credential leaks in CI logs when tracing is enabled upstream.
Proposed hardening patch
echo "[INFO] Logging in to internal registry..."
-podman login -u "$(oc whoami)" -p "$(oc whoami -t)" \
- image-registry.openshift-image-registry.svc:5000 --tls-verify=false
+restore_xtrace=0
+[[ $- == *x* ]] && restore_xtrace=1 && set +x
+podman login -u "$(oc whoami)" -p "$(oc whoami -t)" \
+ image-registry.openshift-image-registry.svc:5000 --tls-verify=false
+(( restore_xtrace )) && set -x
-AZURE_SUBSCRIPTION_ID=$(cat /tmp/secrets/azure/subscription-id)
-TEST_IMAGE=$(cat /tmp/secrets/azure/test-image)
+restore_xtrace=0
+[[ $- == *x* ]] && restore_xtrace=1 && set +x
+AZURE_SUBSCRIPTION_ID=$(cat /tmp/secrets/azure/subscription-id)
+TEST_IMAGE=$(cat /tmp/secrets/azure/test-image)
+(( restore_xtrace )) && set -x
export AZURE_SUBSCRIPTION_ID TEST_IMAGE
@@
-az login --service-principal \
+restore_xtrace=0
+[[ $- == *x* ]] && restore_xtrace=1 && set +x
+az login --service-principal \
-u "$(cat /tmp/secrets/azure/client-id)" \
-p "$(cat /tmp/secrets/azure/client-secret)" \
--tenant "$(cat /tmp/secrets/azure/tenant-id)"
+(( restore_xtrace )) && set -xAs per coding guidelines, "Use set +x and save/restore tracing state when handling passwords, tokens, or sensitive URLs in step registry scripts to prevent credential leakage in CI logs".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh`
around lines 9 - 23, Wrap all secret-handling commands (the podman login
invocation, the az login invocation, and the secret reads that set
AZURE_SUBSCRIPTION_ID and TEST_IMAGE) with a saved/restore xtrace guard: capture
current tracing state, disable tracing (set +x) before reading files and
invoking podman/az, then restore the original tracing state afterward; update
the block around the podman login, the AZURE_SUBSCRIPTION_ID/TEST_IMAGE exports
and the az login to use this save/restore pattern so credentials written by
VIRT_PROVIDER/PLATFORM/REGISTRY/TEST_IMAGE/AZURE_SUBSCRIPTION_ID are never
printed when tracing is enabled upstream.
|
/test all |
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml`:
- Around line 11-12: The top-level `images` key is using an invalid object shape
with an `items:` sub-key; change `images:` to be a direct list (array) instead
of `images: items:` so each image entry is a YAML list item (e.g. `-
dockerfile_literal: | ...`, ` from: ...`, ` inputs: ...`, ` to: ...`); remove
the `items:` wrapper and un-indent its entries so the ci-operator can validate
the `images` list properly.
- Around line 51-55: Update the CI job to use Azure-specific settings: change
the cluster_profile value from openshift-org-aws to openshift-org-azure and
change the workflow from ipi-aws to ipi-azure so the test ref
trusted-execution-clusters-ref-azure-integration-test runs with the Azure
credentials and VIRT_PROVIDER=azure as expected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: bfc57765-2cfa-410c-a385-f5e534190bd3
⛔ Files ignored due to path filters (1)
ci-operator/jobs/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (6)
ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yamlci-operator/step-registry/trusted-execution-clusters/ref/OWNERSci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERSci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.shci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.jsonci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml
💤 Files with no reviewable changes (1)
- ci-operator/step-registry/trusted-execution-clusters/ref/OWNERS
✅ Files skipped from review due to trivial changes (1)
- ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/OWNERS
🚧 Files skipped from review as they are similar to previous changes (3)
- ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.yaml
- ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-ref.metadata.json
- ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.sh
| steps: | ||
| cluster_profile: openshift-org-aws | ||
| test: | ||
| - ref: trusted-execution-clusters-ref-azure-integration-test | ||
| workflow: ipi-aws |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if there are Azure cluster profiles or workflows available
echo "=== Available Azure cluster profiles ==="
fd -t d 'azure' ci-operator/config/jobs --max-depth 3 2>/dev/null || echo "No azure job configs found"
echo -e "\n=== Azure workflows in step-registry ==="
fd -t d 'azure' ci-operator/step-registry --max-depth 4 2>/dev/null | head -20
echo -e "\n=== Existing Azure cluster profiles ==="
ls -la cluster/test-deploy/azure* 2>/dev/null || fd -t d 'azure' cluster/ --max-depth 3 2>/dev/null | head -10Repository: openshift/release
Length of output: 1266
🏁 Script executed:
# Check the file structure and look for __azure variants
echo "=== File under review ==="
cat ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml
echo -e "\n=== Other __azure variants in same directory ==="
ls -la ci-operator/config/trusted-execution-clusters/operator/ | grep __Repository: openshift/release
Length of output: 1888
🏁 Script executed:
# Look for the test reference definition
echo "=== Search for the test reference ==="
rg 'trusted-execution-clusters-ref-azure-integration-test' --type yaml -A 5 -B 2Repository: openshift/release
Length of output: 2949
🏁 Script executed:
# Check for Azure cluster profile definitions
echo "=== Search for Azure cluster profiles ==="
rg 'openshift-org-azure' --type yamlRepository: openshift/release
Length of output: 50375
🏁 Script executed:
# Look at similar Azure test configurations
echo "=== Search for other Azure integration tests ==="
fd -t f '*.yaml' ci-operator/config | xargs grep -l 'azure.*integration' 2>/dev/null | head -5Repository: openshift/release
Length of output: 414
🏁 Script executed:
cat ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test/trusted-execution-clusters-ref-azure-integration-test-commands.shRepository: openshift/release
Length of output: 917
🏁 Script executed:
# Check for similar test configs with cluster/workflow mismatch
rg 'cluster_profile:.*aws' ci-operator/config/trusted-execution-clusters/ -A 3 -B 1Repository: openshift/release
Length of output: 746
🏁 Script executed:
# Check CI naming convention violations in this directory
ls -la ci-operator/config/trusted-execution-clusters/operator/Repository: openshift/release
Length of output: 426
Fix cluster profile and workflow to match Azure integration test requirements.
The test trusted-execution-clusters-ref-azure-integration-test explicitly uses Azure credentials (subscription-id, client-id, client-secret, tenant-id) and runs az login with a service principal, setting VIRT_PROVIDER=azure. However, the configuration uses cluster_profile: openshift-org-aws and workflow: ipi-aws. This will cause the test to fail. Change both to use the Azure equivalents: cluster_profile: openshift-org-azure and workflow: ipi-azure.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml`
around lines 51 - 55, Update the CI job to use Azure-specific settings: change
the cluster_profile value from openshift-org-aws to openshift-org-azure and
change the workflow from ipi-aws to ipi-azure so the test ref
trusted-execution-clusters-ref-azure-integration-test runs with the Azure
credentials and VIRT_PROVIDER=azure as expected.
|
removed buggy line in containerfile looks like it had not been updated yet? |
|
/retest |
|
or retest only works on non-draft? /pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
♻️ Duplicate comments (3)
ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml (3)
15-16:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winInvalid
imagesstructure:items:sub-key is still present.
images:must be a direct list per the ci-operator schema, not an object wrappingitems:. As-is this will fail config validation.Proposed fix
images: - items: - - dockerfile_literal: | +- dockerfile_literal: | FROM nested-podman(also un-indent the remaining entries one level)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml` around lines 15 - 16, The ci-operator config uses an incorrect images structure: the top-level "images" key currently contains an "items:" sub-key; remove the "items:" wrapper so "images" is a direct list and un-indent the existing image entries one level. Locate the "images" block (the "images:" key and its child "items:") and transform it into a plain list under "images" (drop "items:" and shift all its entries up) so the file conforms to the ci-operator schema.
61-65:⚠️ Potential issue | 🟠 Major | ⚡ Quick winCluster profile and workflow still target AWS on the Azure variant.
The integration test ref
trusted-execution-clusters-ref-azure-integration-testperformsaz loginwith Azure SP credentials and setsVIRT_PROVIDER=azure, butcluster_profileandworkflowhere are AWS. The job will not have an Azure cluster to attest against.Proposed fix
steps: - cluster_profile: openshift-org-aws + cluster_profile: openshift-org-azure test: - ref: trusted-execution-clusters-ref-azure-integration-test - workflow: ipi-aws + workflow: ipi-azure🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml` around lines 61 - 65, The CI job for the Azure integration uses the Azure test ref trusted-execution-clusters-ref-azure-integration-test but still sets AWS targets; change the cluster_profile and workflow to the Azure equivalents so the job provisions an Azure cluster (update cluster_profile from openshift-org-aws to the Azure profile and workflow from ipi-aws to the Azure workflow, e.g., cluster_profile: openshift-org-azure and workflow: ipi-azure) to match the test ref and VIRT_PROVIDER=azure.
40-70:⚠️ Potential issue | 🟠 Major | ⚡ Quick winTop-level
promotion:block is still missing.This ci-operator config builds an image (
azure-test-image) but provides nopromotiontarget, so the built image will not be promoted. Add apromotionsection consistent with the other variants underci-operator/config/trusted-execution-clusters/operator/.Proposed addition
releases: latest: candidate: architecture: amd64 product: ocp stream: nightly version: "4.21" +promotion: + to: + - namespace: trusted-execution-clusters + name: operatorConfirm the expected promotion namespace/name by checking the sibling (non-
__azure) variant in the same directory:#!/bin/bash fd -t f . ci-operator/config/trusted-execution-clusters/operator/ -x grep -lH '^promotion:' {} \; fd -t f . ci-operator/config/trusted-execution-clusters/operator/ -x sed -n '/^promotion:/,/^[^ ]/p' {} \;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml` around lines 40 - 70, Add a top-level promotion: block so the built image (azure-test-image) is promoted — create a promotion: entry that specifies the target namespace and name for the image and the tag to promote (match the release/version semantics used in this file), and populate those values by copying the promotion namespace/name/tag from the sibling non-__azure variant in the same directory; ensure the new promotion: key is at top level (alongside releases/resources/tests) and references the same built image name (azure-test-image).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In
`@ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml`:
- Around line 15-16: The ci-operator config uses an incorrect images structure:
the top-level "images" key currently contains an "items:" sub-key; remove the
"items:" wrapper so "images" is a direct list and un-indent the existing image
entries one level. Locate the "images" block (the "images:" key and its child
"items:") and transform it into a plain list under "images" (drop "items:" and
shift all its entries up) so the file conforms to the ci-operator schema.
- Around line 61-65: The CI job for the Azure integration uses the Azure test
ref trusted-execution-clusters-ref-azure-integration-test but still sets AWS
targets; change the cluster_profile and workflow to the Azure equivalents so the
job provisions an Azure cluster (update cluster_profile from openshift-org-aws
to the Azure profile and workflow from ipi-aws to the Azure workflow, e.g.,
cluster_profile: openshift-org-azure and workflow: ipi-azure) to match the test
ref and VIRT_PROVIDER=azure.
- Around line 40-70: Add a top-level promotion: block so the built image
(azure-test-image) is promoted — create a promotion: entry that specifies the
target namespace and name for the image and the tag to promote (match the
release/version semantics used in this file), and populate those values by
copying the promotion namespace/name/tag from the sibling non-__azure variant in
the same directory; ensure the new promotion: key is at top level (alongside
releases/resources/tests) and references the same built image name
(azure-test-image).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 5cd285c6-31d0-4a89-ab58-69566b11cdcd
📒 Files selected for processing (1)
ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse |
|
@Jakob-Naucke: no rehearsable tests are affected by this change |
Use native OpenShift as Trustee platform, attest Azure VMs against it. Optional test. Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: Claude Opus 4.6
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Jakob-Naucke The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
again, TokenVerifierError and PluginInternalError. start by testing with a
more recent Trustee from
trusted-execution-clusters/operator#248
/pj-rehearse
…On Wed, Jul 1, 2026 at 10:41 PM openshift-ci[bot] ***@***.***> wrote:
*openshift-ci[bot]* left a comment (openshift/release#79393)
<#79393 (comment)>
@Jakob-Naucke <https://github.com/Jakob-Naucke>: The following test
*failed*, say /retest to rerun all failed tests or /retest-required to
rerun all mandatory failed tests:
Test name Commit Details Required Rerun command
ci/rehearse/trusted-execution-clusters/operator/main/azure-integration-test
eef186d
<eef186d>
link
<https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/79393/rehearse-79393-pull-ci-trusted-execution-clusters-operator-main-azure-integration-test/2072380440957685760>
unknown /pj-rehearse
pull-ci-trusted-execution-clusters-operator-main-azure-integration-test
Full PR test history
<https://prow.ci.openshift.org/pr-history?org=openshift&repo=release&pr=79393>.
Your PR dashboard
<https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:Jakob-Naucke>
.
Details
Instructions for interacting with me using PR comments are available here
<https://git.k8s.io/community/contributors/guide/pull-requests.md>. If
you have questions or suggestions related to my behavior, please file an
issue against the kubernetes-sigs/prow
<https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:>
repository. I understand the commands that are listed here
<https://go.k8s.io/bot-commands>.
—
Reply to this email directly, view it on GitHub
<#79393?email_source=notifications&email_token=AKDRZETKWNUO6IYN7FFVK3D5CVZNNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBVHE4DMNJWGQY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4859865641>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AKDRZEWLLFTUB6AEZGUERIL5CVZNNAVCNFSNUABEKJSXA33TNF2G64TZHM3TKMRSGQYTINB3JFZXG5LFHM2DINRXGQ3DINJWG2QXMAQ>
.
Triage notifications, keep track of coding agent tasks and review pull
requests on the go with GitHub Mobile for iOS
<https://github.com/notifications/mobile/ios/AKDRZEW6LLUQP7PX4LTWAKL5CVZNNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBVHE4DMNJWGQY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y>
and Android
<https://github.com/notifications/mobile/android/AKDRZEWBDUTG76KJUH4VEQD5CVZNNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBVHE4DMNJWGQY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>.
Download it today!
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
Best regards
Jakob Naucke
|
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
forgot buildroot changes...
/pj-rehearse
…On Thu, Jul 2, 2026 at 7:16 PM openshift-ci[bot] ***@***.***> wrote:
*openshift-ci[bot]* left a comment (openshift/release#79393)
<#79393 (comment)>
@Jakob-Naucke <https://github.com/Jakob-Naucke>: The following test
*failed*, say /retest to rerun all failed tests or /retest-required to
rerun all mandatory failed tests:
Test name Commit Details Required Rerun command
ci/rehearse/trusted-execution-clusters/operator/main/azure-integration-test
61743b9
<61743b9>
link
<https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/79393/rehearse-79393-pull-ci-trusted-execution-clusters-operator-main-azure-integration-test/2072706751102193664>
unknown /pj-rehearse
pull-ci-trusted-execution-clusters-operator-main-azure-integration-test
Full PR test history
<https://prow.ci.openshift.org/pr-history?org=openshift&repo=release&pr=79393>.
Your PR dashboard
<https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:Jakob-Naucke>
.
Details
Instructions for interacting with me using PR comments are available here
<https://git.k8s.io/community/contributors/guide/pull-requests.md>. If
you have questions or suggestions related to my behavior, please file an
issue against the kubernetes-sigs/prow
<https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:>
repository. I understand the commands that are listed here
<https://go.k8s.io/bot-commands>.
—
Reply to this email directly, view it on GitHub
<#79393?email_source=notifications&email_token=AKDRZEWN35B47YYUDZ2WJUL5C2KGNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBWHA2TINZVHAY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4868547581>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AKDRZEQFCIXW42DNA565WID5C2KGNAVCNFSNUABEKJSXA33TNF2G64TZHM3TKMRSGQYTINB3JFZXG5LFHM2DINRXGQ3DINJWG2QXMAQ>
.
Triage notifications, keep track of coding agent tasks and review pull
requests on the go with GitHub Mobile for iOS
<https://github.com/notifications/mobile/ios/AKDRZEUZSPA72UPYJXYHWWL5C2KGNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBWHA2TINZVHAY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y>
and Android
<https://github.com/notifications/mobile/android/AKDRZEXBSYISEERQJOLDTUL5C2KGNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBWHA2TINZVHAY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>.
Download it today!
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
Best regards
Jakob Naucke
|
|
@Jakob-Naucke: your |
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Test relied on moving PR code to another host and running KinD there, which has been superseded by running on GHA trusted-execution-clusters/operator#287. Keeping basic structure for trusted-execution-clusters because we still intend to utilize OpenShift on openshift#79393. Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
|
/pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
resources that stayed behind, again. trying with an experimental requeue
/pj-rehearse
…On Fri, Jul 3, 2026 at 3:16 PM openshift-ci[bot] ***@***.***> wrote:
*openshift-ci[bot]* left a comment (openshift/release#79393)
<#79393 (comment)>
@Jakob-Naucke <https://github.com/Jakob-Naucke>: The following test
*failed*, say /retest to rerun all failed tests or /retest-required to
rerun all mandatory failed tests:
Test name Commit Details Required Rerun command
ci/rehearse/trusted-execution-clusters/operator/main/azure-integration-test
6b4733a
<6b4733a>
link
<https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/79393/rehearse-79393-pull-ci-trusted-execution-clusters-operator-main-azure-integration-test/2072972779061252096>
unknown /pj-rehearse
pull-ci-trusted-execution-clusters-operator-main-azure-integration-test
Full PR test history
<https://prow.ci.openshift.org/pr-history?org=openshift&repo=release&pr=79393>.
Your PR dashboard
<https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:Jakob-Naucke>
.
Details
Instructions for interacting with me using PR comments are available here
<https://git.k8s.io/community/contributors/guide/pull-requests.md>. If
you have questions or suggestions related to my behavior, please file an
issue against the kubernetes-sigs/prow
<https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:>
repository. I understand the commands that are listed here
<https://go.k8s.io/bot-commands>.
—
Reply to this email directly, view it on GitHub
<#79393?email_source=notifications&email_token=AKDRZEXODEGAGVIM6RJSGO35C6WZDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBXGY3TCMRWHEY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4876712691>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AKDRZESLXO75RHJOTM5VD5T5C6WZDAVCNFSNUABEKJSXA33TNF2G64TZHM3TKMRSGQYTINB3JFZXG5LFHM2DINRXGQ3DINJWG2QXMAQ>
.
Triage notifications, keep track of coding agent tasks and review pull
requests on the go with GitHub Mobile for iOS
<https://github.com/notifications/mobile/ios/AKDRZESJBZEPP42LWVLUV3D5C6WZDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBXGY3TCMRWHEY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y>
and Android
<https://github.com/notifications/mobile/android/AKDRZESJ6WMCTZAWPQUQRGD5C6WZDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBXGY3TCMRWHEY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>.
Download it today!
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
Best regards
Jakob Naucke
|
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
no available nodes /pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
improved shutdown logic /pj-rehearse |
|
@Jakob-Naucke: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@Jakob-Naucke: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Test relied on moving PR code to another host and running KinD there, which has been superseded by running on GHA trusted-execution-clusters/operator#287. Keeping basic structure for trusted-execution-clusters because we still intend to utilize OpenShift on openshift#79393. Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
1 participant
Use native OpenShift as Trustee platform, attest Azure VMs against it. Optional test.
Summary by CodeRabbit
This PR adds optional Azure integration testing to the OpenShift CI configuration for the trusted-execution-clusters operator. It introduces an Azure CI variant, a build image and step-ref that run Azure-focused integration tests which attest Azure VMs against a native OpenShift Trustee cluster, and the CI wiring to build/push a test image and provide Azure credentials. The change is gated and only runs when the optional job/ref is invoked.
What changed (practical terms)
ci-operator config (ci-operator/config/trusted-execution-clusters/operator/trusted-execution-clusters-operator-main__azure.yaml)
step-registry ref and commands (ci-operator/step-registry/trusted-execution-clusters/ref/azure-integration-test)
OWNERS
Practical impact
Notes for reviewers