From b96d3e09babaada2f7d539b622cac53c493009b6 Mon Sep 17 00:00:00 2001 From: Brandon Palm Date: Thu, 16 Jul 2026 15:39:20 -0500 Subject: [PATCH 1/3] CM-716: Add baremetal e2e CI job for cert-manager-operator --- ...penshift-cert-manager-operator-master.yaml | 35 ++++++ ...rt-manager-operator-master-presubmits.yaml | 108 ++++++++++++++++-- 2 files changed, 135 insertions(+), 8 deletions(-) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index 97425613231ff..9d3238b1e80b6 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -584,6 +584,41 @@ tests: skip_if_only_changed: .* steps: workflow: cert-manager-review-agent-trigger +- always_run: false + as: e2e-operator-metal-ipi + capabilities: + - intranet + optional: true + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + test: + - as: install + cli: latest + commands: | + oc create namespace cert-manager-operator + operator-sdk run bundle --timeout=10m --security-context-config=restricted --install-mode=AllNamespaces -n cert-manager-operator "$OO_BUNDLE" --verbose + oc wait --for condition=Available -n cert-manager-operator deployment cert-manager-operator-controller-manager + dependencies: + - env: OO_BUNDLE + name: cert-manager-operator-bundle + from: operator-sdk + resources: + requests: + cpu: 100m + - as: test + cli: latest + commands: | + E2E_GINKGO_LABEL_FILTER='Platform: isSubsetOf {Generic} && !TechPreview' make test-e2e + from: src + resources: + requests: + cpu: 100m + workflow: baremetalds-e2e zz_generated_metadata: branch: master org: openshift diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml index 6fc189ab3e6eb..4bdbcb0de22e8 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml @@ -251,7 +251,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build01 + cluster: build10 context: ci/prow/e2e-operator-aws-proxy decorate: true decoration_config: @@ -341,7 +341,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build01 + cluster: build10 context: ci/prow/e2e-operator-aws-sts decorate: true decoration_config: @@ -431,7 +431,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build01 + cluster: build10 context: ci/prow/e2e-operator-aws-upi-proxy decorate: true decoration_config: @@ -701,7 +701,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build01 + cluster: build10 context: ci/prow/e2e-operator-consoleless decorate: true decoration_config: @@ -886,7 +886,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build08 + cluster: build13 context: ci/prow/e2e-operator-gcp-ovn decorate: true decoration_config: @@ -976,7 +976,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build08 + cluster: build13 context: ci/prow/e2e-operator-gcp-workload-identity decorate: true decoration_config: @@ -1066,7 +1066,99 @@ presubmits: branches: - ^master$ - ^master- - cluster: build01 + cluster: build11 + context: ci/prow/e2e-operator-metal-ipi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cert-manager-operator-master-e2e-operator-metal-ipi + optional: true + rerun_command: /test e2e-operator-metal-ipi + skip_if_only_changed: ^(docs/|deploy/|jsonnet/)|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-operator-metal-ipi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-operator-metal-ipi,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^master$ + - ^master- + cluster: build10 context: ci/prow/e2e-operator-tech-preview decorate: true decoration_config: @@ -1567,7 +1659,7 @@ presubmits: branches: - ^master$ - ^master- - cluster: build01 + cluster: build10 context: ci/prow/tls-scanner decorate: true decoration_config: From 292cbe51146d44ee32c4bd301102dd91fd0bf91c Mon Sep 17 00:00:00 2001 From: Brandon Palm Date: Tue, 11 Aug 2026 08:08:58 -0500 Subject: [PATCH 2/3] ci: add explicit timeout to oc wait in metal-ipi test The oc wait command for the cert-manager-operator deployment was using the default 30s timeout, which can be too short for operator startup. Add --timeout=5m consistent with other oc wait calls in the file. --- .../openshift-cert-manager-operator-master.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index 9d3238b1e80b6..115797fbc248c 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -602,7 +602,7 @@ tests: commands: | oc create namespace cert-manager-operator operator-sdk run bundle --timeout=10m --security-context-config=restricted --install-mode=AllNamespaces -n cert-manager-operator "$OO_BUNDLE" --verbose - oc wait --for condition=Available -n cert-manager-operator deployment cert-manager-operator-controller-manager + oc wait --for condition=Available -n cert-manager-operator deployment cert-manager-operator-controller-manager --timeout=5m dependencies: - env: OO_BUNDLE name: cert-manager-operator-bundle From f2709700724cfda529fc68ac32b0b9adda5979d7 Mon Sep 17 00:00:00 2001 From: Brandon Palm Date: Thu, 3 Sep 2026 13:37:17 -0500 Subject: [PATCH 3/3] cert-manager-operator: improve resources and quoting for metal-ipi job Co-authored-by: Cursor --- .../openshift-cert-manager-operator-master.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index 115797fbc248c..dc0941c283de7 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -69,9 +69,11 @@ releases: version: "4.22" resources: '*': + limits: + memory: 4Gi requests: cpu: 100m - memory: 200Mi + memory: 1Gi tests: - as: verify commands: | @@ -613,11 +615,12 @@ tests: - as: test cli: latest commands: | - E2E_GINKGO_LABEL_FILTER='Platform: isSubsetOf {Generic} && !TechPreview' make test-e2e + E2E_GINKGO_LABEL_FILTER='"Platform: isSubsetOf {Generic} && !TechPreview"' make test-e2e from: src resources: requests: cpu: 100m + memory: 1Gi workflow: baremetalds-e2e zz_generated_metadata: branch: master