From 3c2250465779be2b9b7920002ad3678ef6b901ff Mon Sep 17 00:00:00 2001 From: Ori Braunshtein Date: Tue, 4 Aug 2026 13:19:55 +0300 Subject: [PATCH] ci: add openperouter deploy-verify test on AWS Add a lightweight test that deploys openperouter via OLM on an AWS cluster and verifies operator, controller, and router pods come up healthy. Uses the optional-operators-ci-operator-sdk-aws workflow following the MetalLB operator-e2e pattern. Changes: - Switch bundle to simple bundle.Dockerfile (no submodule dependency) - Substitute raw CSV pullspecs (quay.io/openperouter/router:main) - Add operator-deploy-verify test with cluster_profile: openshift-org-aws - Add openperouter to aws cluster profile owners - Add cli-operator-sdk base image Co-Authored-By: Claude Opus 4.6 (1M context) --- .../openshift-kni-openperouter-main.yaml | 84 ++++++++++++++++++- ...hift-kni-openperouter-main-presubmits.yaml | 82 ++++++++++++++++++ .../cluster-profiles-config.yaml | 1 + 3 files changed, 164 insertions(+), 3 deletions(-) diff --git a/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml b/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml index 529b5cd31f10c..de21269eed5fb 100644 --- a/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml +++ b/ci-operator/config/openshift-kni/openperouter/openshift-kni-openperouter-main.yaml @@ -1,3 +1,8 @@ +base_images: + cli-operator-sdk: + name: cli-operator-sdk + namespace: ocp + tag: v1.31.0 binary_build_commands: make build build_root: image_stream_tag: @@ -9,7 +14,8 @@ images: items: - dockerfile_path: Dockerfile.openshift to: openperouter-operator - - dockerfile_path: operator/bundle.Dockerfile.openshift + - context_dir: operator + dockerfile_path: bundle.Dockerfile to: openperouter-operator-bundle - build_args: - name: BASE_IMAGE @@ -19,10 +25,11 @@ images: operator: bundles: - as: operator-bundle - dockerfile_path: operator/bundle.Dockerfile.openshift + context_dir: operator + dockerfile_path: bundle.Dockerfile skip_building_index: true substitutions: - - pullspec: quay.io/redhat-user-workloads/telco-5g-tenant/openperouter-operator-[\d].* + - pullspec: quay.io/openperouter/router:main with: pipeline:openperouter-operator promotion: to: @@ -47,6 +54,77 @@ resources: requests: cpu: 100m memory: 200Mi +tests: +- as: operator-deploy-verify + steps: + allow_best_effort_post_steps: true + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: operator-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: openshift-openperouter-system + test: + - as: verify + cli: latest + commands: | + set -exo pipefail + + echo "### Label namespace privileged" + oc label --overwrite ns openshift-openperouter-system \ + pod-security.kubernetes.io/enforce=privileged \ + pod-security.kubernetes.io/audit=privileged \ + pod-security.kubernetes.io/warn=privileged + + echo "### Verify operator deployment" + oc wait --for condition=Available -n openshift-openperouter-system \ + deployment --all --timeout=300s + oc get deployments -n openshift-openperouter-system + + echo "### Create OpenPERouter CR" + cat <<'EOF' | oc apply -f - + apiVersion: network.openperouter.io/v1alpha1 + kind: OpenPERouter + metadata: + name: openperouter + namespace: openshift-openperouter-system + spec: + logLevel: debug + EOF + + echo "### Wait for controller daemonset" + until oc get daemonset controller -n openshift-openperouter-system &>/dev/null; do + sleep 5 + done + oc rollout status daemonset/controller -n openshift-openperouter-system --timeout=300s + + echo "### Wait for router daemonset" + until oc get daemonset router -n openshift-openperouter-system &>/dev/null; do + sleep 5 + done + oc rollout status daemonset/router -n openshift-openperouter-system --timeout=300s + + echo "### All pods" + oc get pods -n openshift-openperouter-system -o wide + + echo "### Verify all containers are ready" + NOT_READY=$(oc get pods -n openshift-openperouter-system --no-headers \ + | grep -v Completed | grep -v "Running" || true) + if [ -n "$NOT_READY" ]; then + echo "ERROR: Some pods are not healthy:" + echo "$NOT_READY" + oc describe pods -n openshift-openperouter-system + oc logs -n openshift-openperouter-system -l app=router --all-containers --tail=50 + exit 1 + fi + + echo "### Deploy verification passed" + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + workflow: optional-operators-ci-operator-sdk-aws zz_generated_metadata: branch: main org: openshift-kni diff --git a/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml b/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml index e7cd5b88239fb..9b7553dc2c1b4 100644 --- a/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml +++ b/ci-operator/jobs/openshift-kni/openperouter/openshift-kni-openperouter-main-presubmits.yaml @@ -111,3 +111,85 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build11 + context: ci/prow/operator-deploy-verify + decorate: true + decoration_config: {} + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-kni-openperouter-main-operator-deploy-verify + path_alias: github.com/openperouter/openperouter + rerun_command: /test operator-deploy-verify + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=operator-deploy-verify + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )operator-deploy-verify,?($|\s.*) diff --git a/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml b/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml index 2dafaaacf4046..9313cbe2065a1 100644 --- a/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml +++ b/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml @@ -134,6 +134,7 @@ cluster_profiles: repos: - baremetal-deploy - lifecycle-agent + - openperouter - org: openshift-pipelines repos: - console-plugin