feat(RELEASE-1387): use trusted artifacts #784

scoheb · 2025-01-23T19:20:09Z

Describe your changes

in an effort to move away from PVCs, we are trying
trusted artifacts based on https://github.com/konflux-ci/build-trusted-artifacts/tree/main
tasks that have been updated now support 2 modes:
- PVC based workspaces
- Trusted artifacts with emptyDir workspaces
CI changes:
- it now attempts to detect if a Trusted Artifacts based task has been changes and runs the tests with trusted artifacts enabled.
- tests now create a on-local-cluster registry.

requires konflux-ci/release-service@c92d422 for use on real clusters

Relevant Jira

RELEASE-1387

Checklist before requesting a review

I have marked as draft or added do not merge label if there's a dependency PR
- If you want reviews on your draft PR, you can add reviewers or add the release-service-maintainers handle if you are unsure who to tag
My commit message includes Signed-off-by: My name <email>
I have bumped the task/pipeline version string and updated changelog in the relevant README
I read CONTRIBUTING.MD and commit formatting

openshift-ci · 2025-01-23T19:20:14Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

johnbieren · 2025-02-18T18:39:30Z

tasks/managed/apply-mapping/README.md

+| sourceDataArtifact      | Location of trusted artifacts to be used to populate data directory                                                         | No       | -             |
+| subdirectory            | Subdirectory inside the workspace to be used                                                                                | No       | -             |
+
+## Changes in 1.10.0


I think this definitely warrants going to 2.0.0

johnbieren · 2025-02-18T18:39:49Z

tasks/managed/apply-mapping/README.md

+| snapshotPath            | Path to the JSON string of the Snapshot spec in the config workspace to apply the mapping to                                | No       | -             |
+| dataPath                | Path to the JSON string of the merged data to use in the data workspace                                                     | No       | -             |
+| failOnEmptyResult       | Fail the task if the resulting snapshot contains zero components                                                            | Yes      | false         |
+| ociStorage              | The OCI repository where the Trusted Artifacts are stored.                                                                  | No       | -             |


This and line 34 are the only ones with . at the end. Probably don't need it

johnbieren · 2025-02-18T18:44:56Z

tasks/managed/apply-mapping/apply-mapping.yaml

+    - name: subdirectory
+      description: Subdirectory inside the workspace to be used
+      type: string
+      default: ""


The README says this isn't optional and has no default

johnbieren · 2025-02-18T18:45:50Z

tasks/managed/apply-mapping/apply-mapping.yaml

+        #!/usr/bin/env bash
+        set -eo pipefail
+
+        if [ "$(params.ociStorage)" == "empty" ]; then


Should empty be the default for this parameter then?

johnbieren · 2025-02-18T18:47:16Z

tasks/managed/apply-mapping/apply-mapping.yaml

@@ -353,3 +391,29 @@ spec:
              "${SNAPSHOT_SPEC_FILE}" > /tmp/temp && mv /tmp/temp "${SNAPSHOT_SPEC_FILE}"
            fi
        done
+    - name: create-trusted-artifact


The first step says we will skip trusted-artifacts steps if the param is empty, but I don't see any when condition on this step. Is that intended?

johnbieren · 2025-02-18T18:48:26Z

tasks/managed/apply-mapping/tests/test-apply-mapping-content-gateway-disabled.yaml

@@ -54,40 +68,98 @@ spec:
                ]
              }
              EOF
+          - name: skip-trusted-artifact-operations


Why are these steps here? They look the same as the one added in the task

- in an effort to move away from PVCs, we are trying trusted artifacts. - this PR makes the following changes: - PipelineRun uses an EmptyDir now for the workspace - the subDirectory parameter is removed - the data path is now saved as an artifact in quay - the check-result task then uses it for testing - a local registry is installed on the cluster under test in order to create and use trusted artifacts during testing - If we go ahead with this, then we would create a new task called `collect-data-oci-ta` alongside `collect-data` and gradually build up new `-oci-ta` pipelines. Signed-off-by: Scott Hebert <[email protected]>

Signed-off-by: Scott Hebert <[email protected]>

- 1 run as PVC based - 1 run as Trusted Artifacts based if found Signed-off-by: Scott Hebert <[email protected]>

- remove DEBUG env vars Signed-off-by: Scott Hebert <[email protected]>

Signed-off-by: Scott Hebert <[email protected]>

konflux-ci-qe-bot · 2025-02-19T19:18:26Z

@scoheb: The following test has Failed, say /retest to rerun failed tests.

PipelineRun Name	Status	Rerun command	Build Log	Test Log
`konflux-e2e-tests-catalog-ljnwv`	Failed	`/retest`	View Pipeline Log	View Test Logs

Inspecting Test Artifacts

To inspect your test artifacts, follow these steps:

Install ORAS (see the ORAS installation guide).
Download artifacts with the following commands:

mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/konflux-test-storage/konflux-team/release-service-catalog:konflux-e2e-tests-catalog-ljnwv

Test results analysis

🚨 Error occurred while running the E2E tests, list of failed Spec(s):

➡️ [failed] [It] [release-pipelines-suite [HACBS-1571]test-release-e2e-push-image-to-pyxis] Post-release verification verifies a release PipelineRun is started and succeeded in managed namespace [release-pipelines, pushPyxis]

Click to view logs

Error when waiting for a release pipelinerun for release push-pyxis-dnud-tenant/snapshot-sample-jszf-xfb6h to finish
Expected success, but got an error:
    <*errors.errorString | 0xc001597d60>: 
    Pipelinerun 'managed-fbl8j' didn't succeed
    
    {
        s: "Pipelinerun 'managed-fbl8j' didn't succeed\n",
    }

➡️ [failed] [It] [release-pipelines-suite FBC e2e-tests] with FBC happy path Post-release verification verifies the fbc release pipelinerun is running and succeeds [release-pipelines, fbc-tests, fbcHappyPath]

Click to view logs

PipelineRun managed-b4twn failed
Expected
    : Pipelinerun 'managed-b4twn' didn't succeed\n
to equal
    :

➡️ [failed] [It] [release-pipelines-suite e2e tests for rhtap-service-push pipeline] Rhtap-service-push happy path Post-release verification verifies the rhtap release pipelinerun is running and succeeds [release-pipelines, rhtap-service-push, RhtapServicePush]

Click to view logs

PipelineRun managed-fknn4 failed
Expected
    : Pipelinerun 'managed-fknn4' didn't succeed\n
to equal
    :

➡️ [failed] [It] [release-pipelines-suite e2e tests for rh-push-to-redhat-io pipeline] Rh-push-to-redhat-io happy path Post-release verification verifies the rhio release pipelinerun is running and succeeds [release-pipelines, rh-push-to-redhat-io, PushToRedhatIO]

Click to view logs

PipelineRun managed-dmhk9 failed
Expected
    : Pipelinerun 'managed-dmhk9' didn't succeed\n
to equal
    :

➡️ [failed] [It] [release-pipelines-suite e2e tests for multi arch with rh-advisories pipeline] Multi arch test happy path Post-release verification verifies the multiarch release pipelinerun is running and succeeds [release-pipelines, multiarch-advisories, multiArchAdvisories]

Click to view logs

PipelineRun managed-hv6zz failed
Expected
    : Pipelinerun 'managed-hv6zz' didn't succeed\n
to equal
    :

➡️ [failed] [It] [release-pipelines-suite e2e tests for rh-advisories pipeline] Rh-advisories happy path Post-release verification verifies the advs release pipelinerun is running and succeeds [release-pipelines, rh-advisories, rhAdvisories]

Click to view logs

PipelineRun managed-g4cp2 failed
Expected
    : Pipelinerun 'managed-g4cp2' didn't succeed\n
to equal
    :

➡️ [failed] [It] [release-pipelines-suite Push to external registry] Post-release verification verifies that Release PipelineRun should eventually succeed [release-pipelines, push-to-external-registry]

Click to view logs

Error when waiting for a release pipelinerun for release ex-registry-liiu-tenant/snapshot-sample-gwvk-94m8h to finish
Expected success, but got an error:
    <*errors.errorString | 0xc000ef5c00>: 
    Pipelinerun 'managed-cphc8' didn't succeed
    
    {
        s: "Pipelinerun 'managed-cphc8' didn't succeed\n",
    }

openshift-ci bot added the do-not-merge/work-in-progress label Jan 23, 2025

scoheb force-pushed the use-trusted-artifacts branch 28 times, most recently from c5831b5 to 92310a3 Compare January 28, 2025 18:28

scoheb changed the title ~~feat(RELEASE-1291): use trusted artifacts~~ feat(RELEASE-1387): use trusted artifacts Feb 4, 2025

scoheb force-pushed the use-trusted-artifacts branch 4 times, most recently from 4adff68 to 8779560 Compare February 12, 2025 01:35

scoheb force-pushed the use-trusted-artifacts branch from 8779560 to 09144e8 Compare February 18, 2025 01:28

johnbieren reviewed Feb 18, 2025

View reviewed changes

scoheb added 21 commits February 19, 2025 13:36

feat(RELEASE-1387): use ta for verify-access

b9e9f99

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): use ta for reduce-snapshot

add53d2

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): remove debug

a99ed7d

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): use ta for apply-mapping

cf2f8d5

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): test pipeline

2ca48a5

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): cleanup

6397e78

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): before rework back to subdir

17b80ea

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): use subdirectory for collect-data

7882c20

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): collect-data uses both workspace types

5be8b8d

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): change variable names

42fe900

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): reduce-snapshot uses both workspace types

e949930

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): apply-mapping uses both workspace types

c7167b3

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): reduce step count

635c18c

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): pvc version

01ce188

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): fix apply-labels tests

cdc5d61

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): support 2 runs of tasks

b672d4a

- 1 run as PVC based - 1 run as Trusted Artifacts based if found Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): remove debug

25d0247

- remove DEBUG env vars Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): fix yamllint errors

0d74b5d

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): update versions and readme

16818be

Signed-off-by: Scott Hebert <[email protected]>

feat(RELEASE-1387): cleanup old comments

6bef15b

Signed-off-by: Scott Hebert <[email protected]>

scoheb force-pushed the use-trusted-artifacts branch from 09144e8 to 6bef15b Compare February 19, 2025 18:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(RELEASE-1387): use trusted artifacts #784

feat(RELEASE-1387): use trusted artifacts #784

scoheb commented Jan 23, 2025 •

edited

Loading

openshift-ci bot commented Jan 23, 2025

johnbieren Feb 18, 2025

johnbieren Feb 18, 2025

johnbieren Feb 18, 2025

johnbieren Feb 18, 2025

johnbieren Feb 18, 2025

johnbieren Feb 18, 2025

konflux-ci-qe-bot commented Feb 19, 2025

feat(RELEASE-1387): use trusted artifacts #784

Are you sure you want to change the base?

feat(RELEASE-1387): use trusted artifacts #784

Conversation

scoheb commented Jan 23, 2025 • edited Loading

Describe your changes

Relevant Jira

Checklist before requesting a review

openshift-ci bot commented Jan 23, 2025

johnbieren Feb 18, 2025

Choose a reason for hiding this comment

johnbieren Feb 18, 2025

Choose a reason for hiding this comment

johnbieren Feb 18, 2025

Choose a reason for hiding this comment

johnbieren Feb 18, 2025

Choose a reason for hiding this comment

johnbieren Feb 18, 2025

Choose a reason for hiding this comment

johnbieren Feb 18, 2025

Choose a reason for hiding this comment

konflux-ci-qe-bot commented Feb 19, 2025

Inspecting Test Artifacts

Test results analysis

scoheb commented Jan 23, 2025 •

edited

Loading