USHIFT-7441: Add on-demand MicroShift PR performance testing

[sjug]

Summary

• add optional /test perf-node-density presubmits for MicroShift main and release-4.22
• build and install the exact MicroShift pull request revision on self-scheduled bare-metal hardware before running node-density
• keep released-package deployment as the default for all existing users of the shared deployment step
• record the bastion checkout, node checkout, installed RPM, and MicroShift version as source-provenance artifacts

The jobs are optional, never run automatically, and are excluded from rehearsals. They reuse the performance workload and hardware settings added in #72356.

Dependencies

This pull request will remain on hold until:

• USHIFT-7440: Ansible: support alternate source checkouts microshift#7186 provides exact Git revision and refspec support to the deployment Ansible
• MicroShift source builds for unreleased streams have a valid dependency repository path, including CRI-O for 5.0

Validation

• make registry-metadata
• make ci-operator-config
• make jobs
• bash -n on the modified command script
• shellcheck -S warning on the modified command script
• fail-fast guard checks for invalid PR contexts
• git diff --check

make validate-step-registry remains affected by the existing upstream configresolver CLI mismatch: the Makefile passes -prow-config, which the current image no longer accepts. The registry check performed by make jobs passed.

Jira: https://redhat.atlassian.net/browse/USHIFT-7441

Summary by CodeRabbit

• Adds optional /test perf-node-density presubmits for MicroShift main and release-4.22.
• Builds and installs the exact pull request revision on self-scheduled bare-metal hardware before running node-density tests.
• Preserves released-package deployment as the default for existing users.
• Records checkout details, installed RPMs, and MicroShift version as source-provenance artifacts.
• Adds validation for PR build inputs, version data, refspecs, and node checkout consistency.
• Excludes these jobs from automatic execution and rehearsals.

[openshift-ci-robot]

@sjug: This pull request references USHIFT-7441 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• add optional /test perf-node-density presubmits for MicroShift main
  and release-4.22
• build and install the exact MicroShift pull request revision on
  self-scheduled bare-metal hardware before running node-density
• keep released-package deployment as the default for all existing users of
  the shared deployment step
• record the bastion checkout, node checkout, installed RPM, and MicroShift
  version as source-provenance artifacts

The jobs are optional, never run automatically, and are excluded from
rehearsals. They reuse the performance workload and hardware settings added
in #72356.

Dependencies

This pull request will remain on hold until:

• USHIFT-7440: Ansible: support alternate source checkouts microshift#7186 provides exact Git
  revision and refspec support to the deployment Ansible
• MicroShift source builds for unreleased streams have a valid dependency
  repository path, including CRI-O for 5.0

Validation

• make registry-metadata
• make ci-operator-config
• make jobs
• bash -n on the modified command script
• shellcheck -S warning on the modified command script
• fail-fast guard checks for invalid PR contexts
• git diff --check

make validate-step-registry remains affected by the existing upstream
configresolver CLI mismatch: the Makefile passes -prow-config, which the
current image no longer accepts. The registry check performed by make jobs
passed.

Jira: https://redhat.atlassian.net/browse/USHIFT-7441

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sjug]

/hold

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ffd2c52-1e54-4269-a2b7-238c4fe90a37

📥 Commits

Reviewing files that changed from the base of the PR and between b8c72f0 and 8ed45ba.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/openshift/microshift/openshift-microshift-main-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/microshift/openshift-microshift-release-4.22-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (4)

• ci-operator/config/openshift/microshift/openshift-microshift-main.yaml
• ci-operator/config/openshift/microshift/openshift-microshift-release-4.22.yaml
• ci-operator/step-registry/openshift-qe/microshift-deploy/openshift-qe-microshift-deploy-commands.sh
• ci-operator/step-registry/openshift-qe/microshift-deploy/openshift-qe-microshift-deploy-ref.yaml

---

Walkthrough

MicroShift CI adds optional node-density performance jobs for main and release-4.22 configurations. The deployment step adds validated pull-request checkout, source builds, architecture-based version selection, target-node verification, and published deployment metadata.

Changes

MicroShift CI execution

Layer / File(s)	Summary
Node-density performance job wiring ci-operator/config/openshift/microshift/*.yaml	The main and release-4.22 configurations add optional perf-node-density jobs with self-scheduler setup, MicroShift deployment, kube-burner tests, Prometheus logging, and cleanup.
Pull-request build contract and checkout ci-operator/step-registry/openshift-qe/microshift-deploy/openshift-qe-microshift-deploy-ref.yaml, ci-operator/step-registry/openshift-qe/microshift-deploy/openshift-qe-microshift-deploy-commands.sh	BUILD_FROM_PR controls pull-request builds. The deployment script validates required inputs, checks out the requested PR SHA, derives the architecture-specific MicroShift version, and passes source-build parameters to Ansible.
Target-node source verification ci-operator/step-registry/openshift-qe/microshift-deploy/openshift-qe-microshift-deploy-commands.sh	The script publishes the first node and Prometheus URL, retries source verification on the target node, writes expected and observed details, and fails when the checkout SHA differs.

Estimated code review effort: 4 (Complex) | ~45 minutes

Mergeability Score: ⚪ Minimal · up to 8ed45

The PR adds optional MicroShift performance jobs and generated CI configuration, with the stated generation checks completed successfully. No actionable merge-blocking risk remains beyond normal review.

Suggested reviewers: pacevedom

Sequence Diagram(s)

sequenceDiagram
  participant Deployment as microshift-deploy-commands.sh
  participant Repository as MicroShift repository
  participant Ansible
  participant TargetNode
  participant Artifacts
  Deployment->>Repository: Fetch and resolve the requested PR SHA
  Repository-->>Deployment: Return verified PR revision
  Deployment->>Ansible: Pass source-build version and refspec
  Ansible->>TargetNode: Build and install MicroShift
  Deployment->>TargetNode: Collect source SHA and runtime details
  TargetNode-->>Deployment: Return observed source details
  Deployment->>Artifacts: Write verification artifacts

Loading

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 inconclusive)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The new PR verification warning logs ${first_node} from QUADS .nodes[].name; this can expose an internal hostname in CI logs.	Log a generic verification warning without the node name. Also disable tracing around new commands that expand bastion or node hostnames.
No-Weak-Crypto	❓ Inconclusive	Preliminary diff shows exact 40-character Git SHA handling, but the check's SHA1 scope requires confirming whether this provenance identifier counts as weak-crypto usage.	Inspect the changed script and repository conventions to distinguish Git revision pinning from SHA1 cryptographic use.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR adds CI jobs and deployment shell logic only; the diff contains no Ginkgo It, Describe, Context, or When test titles, dynamic or otherwise.
Test Structure And Quality	✅ Passed	The PR changes only YAML job definitions and a deployment shell script; no Ginkgo test files, It blocks, or Ginkgo assertions were introduced.
Microshift Test Compatibility	✅ Passed	The PR changes CI YAML and a deployment script only; the diff adds no Ginkgo It, Describe, Context, or When tests, so this compatibility check is inapplicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only CI YAML, generated job configuration, and a shell deployment step; it adds no Ginkgo e2e tests or test bodies requiring SNO analysis.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff adds CI jobs and deployment-script logic only; it introduces no workload manifests, controllers, topology constraints, node selectors, affinity, tolerations, replica counts, or PDBs.
Ote Binary Stdout Contract	✅ Passed	The PR changes only YAML and a shell deployment script; the diff contains no Go OTE entry points or stdout logging, and the workload runs kube-burner rather than openshift-tests.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit adds CI YAML, presubmit jobs, and shell steps, but no new Ginkgo declarations or Ginkgo e2e test code; the IPv6/disconnected test check is not applicable.
Container-Privileges	✅ Passed	The PR adds no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or runAsUser settings. New root SSH use targets bare-metal deployment hosts; existing container root use is unchanged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding on-demand MicroShift pull request performance testing.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sjug
Once this PR has been reviewed and has the lgtm label, please assign agullon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/microshift/OWNERS
• ci-operator/jobs/openshift/microshift/OWNERS
• ci-operator/step-registry/openshift-qe/microshift-deploy/OWNERS [sjug]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@sjug: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-eng-ocp-qe-perfscale-ci-main-microshift-metal-selfsched-4.22-candidate-x86-deploy	openshift-eng/ocp-qe-perfscale-ci	presubmit	Registry content changed
pull-ci-openshift-eng-ocp-qe-perfscale-ci-main-microshift-metal-selfsched-4.22-candidate-x86-node-density	openshift-eng/ocp-qe-perfscale-ci	presubmit	Registry content changed

The following jobs are not rehearsable without the network-access-rehearsals-ok, and approved labels present on this PR. This is due to the restrict_network_access field being set to false. The network-access-rehearsals-ok label can be added by any openshift org member other than the PR's author by commenting: /pj-rehearse network-access-allowed:

Test name
pull-ci-openshift-microshift-main-perf-node-density
pull-ci-openshift-microshift-release-4.22-perf-node-density

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@sjug: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.