From 169dedc510495422b0a268122591beea513f3e80 Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Tue, 28 Jul 2026 10:43:34 -0500 Subject: [PATCH 1/7] INTEROP-9361: Add FIPS variant ci-operator config for OPP Add a FIPS-enabled ci-operator config for OPP interop testing on OCP 4.22. Based on existing ocp4.22 AWS config with FIPS_ENABLED=true and FIPS-specific Jira routing (epic INTEROP-9104). --- ...-policy-collection-main__ocp4.22-fips.yaml | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml diff --git a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml new file mode 100644 index 0000000000000..dcdb556a5a04b --- /dev/null +++ b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml @@ -0,0 +1,136 @@ +base_images: + acmqe-grc-test: + name: "2.16" + namespace: acm-qe + tag: acmqe-grc-test + clc-ui-e2e: + name: "2.16" + namespace: acm-qe + tag: clc-ui-e2e + cli: + name: "4.22" + namespace: ocp + tag: cli + console-e2e: + name: main + namespace: acm-qe + tag: console-e2e + fetch-managed-clusters: + name: autotest + namespace: acm-qe + tag: fetch-managed-clusters + multicluster-observability-operator-opp: + name: "2.16" + namespace: acm-qe + tag: multicluster-observability-operator-opp + ocs-ci-tests: + name: ocs-ci-container + namespace: ci + tag: stable + tests-private: + name: tests-private + namespace: ci + tag: "4.22" + upi-installer: + name: "4.22" + namespace: ocp + tag: upi-installer +build_root: + image_stream_tag: + name: release + namespace: openshift + tag: rhel-9-release-golang-1.24-openshift-4.22 +images: + items: + - dockerfile_literal: | + FROM this-is-ignored + RUN dnf install -y git python39 + from: cli + optional: true + to: cli-with-git +releases: + latest: + candidate: + product: ocp + stream: nightly + version: "4.22" +resources: + '*': + requests: + cpu: 100m + memory: 200Mi +tests: +- as: interop-opp-aws + capabilities: + - intranet + cron: 0 23 31 2 * + reporter_config: + channel: '#opp-discussion' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + allow_best_effort_post_steps: true + cluster_profile: aws-cspi-qe + env: + BASE_DOMAIN: cspilp.interop.ccitredhat.com + COMPUTE_NODE_REPLICAS: "6" + COMPUTE_NODE_TYPE: m6a.2xlarge + CONTROL_PLANE_INSTANCE_TYPE: m6a.2xlarge + FIPS_ENABLED: "true" + FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/refs/heads/main/firewatch-base-configs/opp/lp-interop-aws.json + FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.22-lp","opp-aws-lp","opp-lp","fips"]' + FIREWATCH_DEFAULT_JIRA_ASSIGNEE: ftan@redhat.com + FIREWATCH_DEFAULT_JIRA_EPIC: INTEROP-9104 + FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP + FIREWATCH_FAIL_WITH_TEST_FAILURES: "true" + IGNORE_SECONDARY_POLICIES: "true" + ODF_VERSION_MAJOR_MINOR: "4.21" + OPERATORS: | + [ + {"name": "advanced-cluster-management", "source": "redhat-operators", "channel": "release-2.16", "install_namespace": "ocm", "target_namespaces": "ocm", "operator_group": "acm-operator-group"} + ] + QUAY_OPERATOR_CHANNEL: stable-3.17 + TEST_IMPORTANCE: LEVEL0 + TEST_SCENARIOS: Cluster_Observability + ZONES_COUNT: "3" + post: + - ref: acm-fetch-operator-versions + - ref: acm-must-gather + - ref: acm-inspector + - ref: acm-tests-clc-destroy + - ref: gather-aws-console + - chain: ipi-deprovision + - ref: firewatch-report-issues + pre: + - ref: ipi-conf + - ref: ipi-conf-telemetry + - ref: ipi-conf-aws-custom-az + - ref: ipi-conf-aws + - ref: ipi-install-monitoringpvc + - chain: ipi-install + test: + - ref: install-operators + - ref: acm-mch + - ref: acm-policies-openshift-plus-setup + - ref: acm-policies-openshift-plus + - chain: cucushift-installer-check-cluster-health + - ref: acm-tests-clc-create + - ref: acm-fetch-managed-clusters + - ref: acm-opp-app + - ref: interop-tests-ocs-tests + - ref: quay-tests-quay-interop-test + - ref: acm-tests-observability + - ref: acm-tests-grc + - ref: acm-tests-alc + - ref: openshift-extended-test +zz_generated_metadata: + branch: main + org: stolostron + repo: policy-collection + variant: ocp4.22-fips From a9fed6a4af384bd741e147dafaef413c1cf28aac Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Tue, 28 Jul 2026 11:57:08 -0500 Subject: [PATCH 2/7] INTEROP-9361: Address review feedback and regenerate jobs - Update FIREWATCH_DEFAULT_JIRA_ASSIGNEE to mpruitt@redhat.com - Add FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "4.22" - Regenerate Prow job YAML for the new FIPS variant --- ...-policy-collection-main__ocp4.22-fips.yaml | 3 +- ...tron-policy-collection-main-periodics.yaml | 95 +++++++++++++++++++ ...ron-policy-collection-main-presubmits.yaml | 59 ++++++++++++ 3 files changed, 156 insertions(+), 1 deletion(-) diff --git a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml index dcdb556a5a04b..3e5c50b8ce180 100644 --- a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml +++ b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml @@ -85,7 +85,8 @@ tests: FIPS_ENABLED: "true" FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/refs/heads/main/firewatch-base-configs/opp/lp-interop-aws.json FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.22-lp","opp-aws-lp","opp-lp","fips"]' - FIREWATCH_DEFAULT_JIRA_ASSIGNEE: ftan@redhat.com + FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "4.22" + FIREWATCH_DEFAULT_JIRA_ASSIGNEE: mpruitt@redhat.com FIREWATCH_DEFAULT_JIRA_EPIC: INTEROP-9104 FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP FIREWATCH_FAIL_WITH_TEST_FAILURES: "true" diff --git a/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml b/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml index c60bc3013326b..29a3f176c03df 100644 --- a/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml +++ b/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml @@ -6,6 +6,101 @@ periodics: decoration_config: skip_cloning: true extra_refs: + - base_ref: main + org: stolostron + repo: policy-collection + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: aws-cspi-qe + ci-operator.openshift.io/variant: ocp4.22-fips + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-stolostron-policy-collection-main-ocp4.22-fips-interop-opp-aws + reporter_config: + slack: + channel: '#opp-discussion' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=interop-opp-aws + - --variant=ocp4.22-fips + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build03 + cron: 0 23 31 2 * + decorate: true + decoration_config: + skip_cloning: true + extra_refs: - base_ref: main org: stolostron repo: policy-collection diff --git a/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-presubmits.yaml b/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-presubmits.yaml index c9c232d396ddd..15b28203ddbfe 100644 --- a/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-presubmits.yaml +++ b/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-presubmits.yaml @@ -1,5 +1,64 @@ presubmits: stolostron/policy-collection: + - agent: kubernetes + always_run: true + branches: + - ^main$ + - ^main- + cluster: build01 + context: ci/prow/ocp4.22-fips-images + decorate: true + decoration_config: + skip_cloning: true + labels: + ci-operator.openshift.io/variant: ocp4.22-fips + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-stolostron-policy-collection-main-ocp4.22-fips-images + optional: true + rerun_command: /test ocp4.22-fips-images + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=[images] + - --variant=ocp4.22-fips + command: + - ci-operator + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )ocp4.22-fips-images,?($|\s.*) - agent: kubernetes always_run: true branches: From 4bc40152a193bbe89558b6413f792f6731314c37 Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Wed, 29 Jul 2026 13:45:21 -0500 Subject: [PATCH 3/7] Add FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION to FIPS config --- .../stolostron-policy-collection-main__ocp4.22-fips.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml index 3e5c50b8ce180..ce133cbe292ba 100644 --- a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml +++ b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml @@ -85,7 +85,7 @@ tests: FIPS_ENABLED: "true" FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/refs/heads/main/firewatch-base-configs/opp/lp-interop-aws.json FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.22-lp","opp-aws-lp","opp-lp","fips"]' - FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "4.22" + FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "5.0.0" FIREWATCH_DEFAULT_JIRA_ASSIGNEE: mpruitt@redhat.com FIREWATCH_DEFAULT_JIRA_EPIC: INTEROP-9104 FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP From 4aea50b96bcf7776f3d5220c85cbc00b72eddd5a Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Thu, 30 Jul 2026 08:56:29 -0500 Subject: [PATCH 4/7] Regenerate config via make update Run determinize-ci-operator to canonicalize YAML formatting for the FIPS variant config (fixes ci-operator-config-metadata). --- .../stolostron-policy-collection-main__ocp4.22-fips.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml index ce133cbe292ba..59c27b4826996 100644 --- a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml +++ b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml @@ -85,7 +85,7 @@ tests: FIPS_ENABLED: "true" FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/refs/heads/main/firewatch-base-configs/opp/lp-interop-aws.json FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.22-lp","opp-aws-lp","opp-lp","fips"]' - FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "5.0.0" + FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: 5.0.0 FIREWATCH_DEFAULT_JIRA_ASSIGNEE: mpruitt@redhat.com FIREWATCH_DEFAULT_JIRA_EPIC: INTEROP-9104 FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP From b9eb194d5d17805152cff4a20205b322646e4650 Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Fri, 14 Aug 2026 07:29:13 -0500 Subject: [PATCH 5/7] Address review feedback: ACM 2.17, channel, env improvements - Update ACM base images from 2.16 to 2.17 - Update operator channel from release-2.16 to release-2.17 - Add DR__RP__CR_COMP_NAME for data router integration - Add mpiit-data-router-reporter post step --- ...tolostron-policy-collection-main__ocp4.22-fips.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml index 59c27b4826996..53f3fcec5ce89 100644 --- a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml +++ b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml @@ -1,10 +1,10 @@ base_images: acmqe-grc-test: - name: "2.16" + name: "2.17" namespace: acm-qe tag: acmqe-grc-test clc-ui-e2e: - name: "2.16" + name: "2.17" namespace: acm-qe tag: clc-ui-e2e cli: @@ -20,7 +20,7 @@ base_images: namespace: acm-qe tag: fetch-managed-clusters multicluster-observability-operator-opp: - name: "2.16" + name: "2.17" namespace: acm-qe tag: multicluster-observability-operator-opp ocs-ci-tests: @@ -84,6 +84,7 @@ tests: CONTROL_PLANE_INSTANCE_TYPE: m6a.2xlarge FIPS_ENABLED: "true" FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/refs/heads/main/firewatch-base-configs/opp/lp-interop-aws.json + DR__RP__CR_COMP_NAME: lp-interop--OPP FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.22-lp","opp-aws-lp","opp-lp","fips"]' FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: 5.0.0 FIREWATCH_DEFAULT_JIRA_ASSIGNEE: mpruitt@redhat.com @@ -94,7 +95,7 @@ tests: ODF_VERSION_MAJOR_MINOR: "4.21" OPERATORS: | [ - {"name": "advanced-cluster-management", "source": "redhat-operators", "channel": "release-2.16", "install_namespace": "ocm", "target_namespaces": "ocm", "operator_group": "acm-operator-group"} + {"name": "advanced-cluster-management", "source": "redhat-operators", "channel": "release-2.17", "install_namespace": "ocm", "target_namespaces": "ocm", "operator_group": "acm-operator-group"} ] QUAY_OPERATOR_CHANNEL: stable-3.17 TEST_IMPORTANCE: LEVEL0 @@ -107,6 +108,7 @@ tests: - ref: acm-tests-clc-destroy - ref: gather-aws-console - chain: ipi-deprovision + - ref: mpiit-data-router-reporter - ref: firewatch-report-issues pre: - ref: ipi-conf From 06d15620821f94757bc23cc6a8a55add48f8a916 Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Fri, 14 Aug 2026 07:37:59 -0500 Subject: [PATCH 6/7] Fix env var alphabetical ordering --- .../stolostron-policy-collection-main__ocp4.22-fips.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml index 53f3fcec5ce89..22133eafe39e2 100644 --- a/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml +++ b/ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml @@ -82,9 +82,9 @@ tests: COMPUTE_NODE_REPLICAS: "6" COMPUTE_NODE_TYPE: m6a.2xlarge CONTROL_PLANE_INSTANCE_TYPE: m6a.2xlarge + DR__RP__CR_COMP_NAME: lp-interop--OPP FIPS_ENABLED: "true" FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/refs/heads/main/firewatch-base-configs/opp/lp-interop-aws.json - DR__RP__CR_COMP_NAME: lp-interop--OPP FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.22-lp","opp-aws-lp","opp-lp","fips"]' FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: 5.0.0 FIREWATCH_DEFAULT_JIRA_ASSIGNEE: mpruitt@redhat.com From 2994c4045e230dfbf07ec7a8edc35ff3b3089282 Mon Sep 17 00:00:00 2001 From: Michael Pruitt Date: Mon, 17 Aug 2026 15:31:44 -0500 Subject: [PATCH 7/7] Regenerate periodics via make jobs Fixes cron schedule ordering in generated job config. --- .../stolostron-policy-collection-main-periodics.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml b/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml index 29a3f176c03df..5a4f4114e058f 100644 --- a/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml +++ b/ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yaml @@ -1,7 +1,7 @@ periodics: - agent: kubernetes cluster: build03 - cron: 0 3,15 * * * + cron: 0 23 31 2 * decorate: true decoration_config: skip_cloning: true @@ -96,7 +96,7 @@ periodics: secretName: result-aggregator - agent: kubernetes cluster: build03 - cron: 0 23 31 2 * + cron: 0 3,15 * * * decorate: true decoration_config: skip_cloning: true