Skip to content

Conversation

@danpawlik
Copy link
Contributor

No description provided.

amartyasinha and others added 30 commits July 22, 2025 16:57
The new release of Ansible Core 2.19 is breaking our doc jobs. Until the reason is investigated, doc jobs should use older Ansible version.
We are investigating a case and it appeared that despite
setting the variable to the desired value, in the end
in the job it ends up requesting something else...
This debug task would allow us inspecting what we really get.
This patch introduces the variables and the tasks required to deploy
rbd-mirror, useful to test cinder replication.
We enable rbd_mirror daemon in a DCN scenario to see if we can properly
enable and configure replication.

Signed-off-by: Francesco Pantano <fpantano@redhat.com>
cifmw_bop_skipped_projects contains lists of projects on which
build_openstack_package should not run.

We should not parse zuul change url on cifmw_bop_skipped_projects
to avoid unwanted error. This pr adds the conditional for
the same to avoid parsing.

Note:
- This pr also adds infrawatch/feature-verification-tests
  to cifmw_bop_skipped_projects list also. As there is no packaging
  support for this project.
- Donot run DLRN if cifmw_bop_change_list is empty

Signed-off-by: Chandan Kumar (raukadah) <raukadah@gmail.com>

Resolves: OSPCIX-983
New tests including QoS gateway bandwidth checks [1] should be skipped
until whitebox-neutron-tempest-plugin job uses newer version than
antelope (when LP#2110018 [2] supported in 2025.1).

[1]
954607: Test QoS max bandwidth limit for router gateways, along with other types | https://review.opendev.org/c/x/whitebox-neutron-tempest-plugin/+/954607
[2]
https://bugs.launchpad.net/neutron/+bug/2110018
Since we can neither install cifmw collection on Zuul executor nor make Zuul to use cifmw's ansible.cfg to find our custom plugins, we are going with the installation of cifmw collection adjacent to all ci playbooks [1]. To avoid duplicate code, symlink is used.

[1] https://docs.ansible.com/ansible/latest/collections_guide/collections_installing.html#installing-collections-adjacent-to-playbooks
We don't want the job to fail because monitoring had some issue.
It is not a first time, that some molecule job is missing, because
some role was added and cifmw-pod-zuul-files job was not triggered.

Add the CI job and run it for each change that was done.

Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
This role automates the deployment and verification of Self Node Remediation
(SNR) and Node Health Check (NHC) components on OpenShift clusters. Includes
namespace creation, operator installation, CR verification, and comprehensive
molecule testing framework.
Follow-up the similar install_yamls change
openstack-k8s-operators/install_yamls#1077

Signed-off-by: Bohdan Dobrelia <bdobreli@redhat.com>
We should be consistent and pass the namespace to the csv deployment
command.

Signed-off-by: Francesco Pantano <fpantano@redhat.com>
I encountered a case where the hook related to cinder
multi-attach volume type fails, as on some race condition
between commands execution the default OpenShift project
was changed and the assumed pod was not found.

To make the shell call more predictable, it is better
to run `oc` command with `-n` parameter, rather than
relying on switching the default project in earlier command.
Move parameter to section 2: tempest parameters
In Current CS10 zuul node, namespaces are not configured
for podman leading to failure while pulling the image.

This pr adds task for configuring namespace for podman.
This pr also modifies build_containers and registry_deploy role
to use podman role to install podman.

Resolves: OSPCIX-995

Signed-off-by: Chandan Kumar (raukadah) <raukadah@gmail.com>
Adding KRB5_TRACE to have more information about the authentication. OSPCIX-936
Sometime meta content provider is failing with ansible_user
udefined. Let's set the default value to avoid issue.

Signed-off-by: Chandan Kumar (raukadah) <raukadah@gmail.com>
In the run playbook `ci/playbooks/pod-jobs.yml` there is
a hard-coded dependency on CI-Framework in Zuul projects.
However, if that job is called in other repositories,
such as `edpm-ansible`, the ci-framework will not exist
in the Zuul environment. This change ensures the `ci-framework`
repository to be always present in job environment.
Missing namespace var in shell script
- Allow multiple interfaces to be attached from the same network.
- Use bm mapping for mac mapping in edpm values

Jira: OSPRH-18516
- tenant networks should not be in the public zone because nat is
  enabled and breaks geneve tunnels between AZs
- fixed the name of the tenant vlan network
- Enable Octavia in ACTIVE_STANDBY mode
- Configure Management network on all the AZs except az0 (the control
  plane)

JIRA: OSPRH-14215
After we migrate some playbooks into roles, we can drop
the convention how it was done earlier - few plays where each
was done on same host and each was calling one (or few) task in role.
It is not needed, we can call other tasks in role in one play,
because all is done on same host.

Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
There is no need to write bool values as string. They should be written
directly as bool: true, false.

Example command how it was done:

    find ci docs hooks playbooks roles scenarios -type f -exec sed -i "s@('true')@(true)@g" {} \;
    find ci docs hooks playbooks roles scenarios -type f -exec sed -i "s@('false')@(false)@g" {} \;

Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
This DRLN tag would be used just for building the containers,
so the `podified-ci-testing` then will be only updated after
we ensure we can properly build the containers. The reason
for this is that we have a lot of jobs that expect to find
container tag for `podified-ci-testing` already in repository,
while the containers may never be pushed due to tcib issues.
The intermediate tag would allow us to bypass this without
redesigning all existing jobs.
Watcher is now integrated into the openstack-controlplane [1].

This patch is adding a new option to the update_containers role to
enable updating the watcher containers in the OpenStackVersion based on
the same parameters as the rest of OpenStack operators.

I am adding them with a different parameter
cifmw_update_containers_watcher for two reason:

- In case ci-framework is also used in environments where watcher is
  still not integrated.
- In watcher-operator pipelines there are some jobs where it is desired
  to update only the watcher containers while keeping the rest by
default

Signed-off-by: Alfredo Moralejo <amoralej@redhat.com>
Override no start for VMs layout except those explicitly configured to
start early.

Signed-off-by: Bohdan Dobrelia <bdobreli@redhat.com>
amartyasinha and others added 7 commits November 6, 2025 17:08
Some hardcoded paths landed again. Let's use relative path vars to avoid hardcoding.

Signed-off-by: Amartya Sinha <amsinha@redhat.com>
The script is verifying if the minimum body length contains
10 characters. Also raise a warning if there is no: "Signed-Off-By".

Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
This patch will resolve horizon OIDC users running into
issues when logging out as one IDP user and then trying
to login with a user from a different IDP before the
first users OIDC session times out.
We're moving /home/zuul hardcoded paths from root-level files and ocurrences
in files at playbook folder.
Change MetalLB controller-manager and webhook-server wait tasks to
check for Deployment Available condition instead of Pod Ready condition.
This ensures service endpoints are fully registered before applying
MetalLB CRs, preventing intermittent webhook errors:
"failed calling webhook...no endpoints available for service"

The Available condition on Deployments is more reliable than Pod Ready
for webhook availability, as it confirms the service is reachable.
This follows the same pattern used for NMstate webhook deployment.

Jira: OSPCIX-1095
Assisted-By: Claude Code/claude-4.5-sonnet
Signed-off-by: Harald Jensås <hjensas@redhat.com>
…is enabled

When mirror_images is enabled in dev-scripts (either explicitly or
automatically for IPv6 deployments), the pull-secret is replaced with
only the local mirror registry credentials during installation. This
causes operator installation and workload deployments to fail because
the cluster cannot authenticate to external registries like quay.io,
registry.redhat.io, etc.

This change adds post-installation logic to:
- Merge the original pull-secret with the local mirror credentials
- Update the cluster's pull-secret in openshift-config namespace
- Re-enable OperatorHub default sources (disabled during mirroring)
- Preserve ImageContentSourcePolicy manifests for mirror preference

The merged pull-secret allows the cluster to pull from both the local
mirror (when available) and external registries (as fallback), enabling
operator installation while maintaining the benefits of image mirroring.

This particularly helps IPv6 deployments where dev-scripts automatically
sets MIRROR_IMAGES=true by default.

Changes:
- roles/devscripts/tasks/320_restore_pull_secret.yml (new)
- roles/devscripts/tasks/300_post.yml
- roles/devscripts/README.md

Goal:
  The goal is to improve stability, especially for IPv6 jobs that
operate behind the nat64-appliance VM for all external traffic.

Assisted-By: Claude Code/claude-4.5-sonnet
Signed-off-by: Harald Jensås <hjensas@redhat.com>
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 7, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign bshewale for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@danpawlik danpawlik closed this Nov 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.