Skip to content

Add rhcos10 node & platform jobs to test in PR #80528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Anna-Koudelkova wants to merge 1 commit into
base: main
Choose a base branch
from
+227 −4
Open

Add rhcos10 node & platform jobs to test in PR #80528

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 61 additions & 4 deletions ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ build_root:
image_stream_tag:
name: release
namespace: openshift
tag: rhel-9-release-golang-1.23-openshift-4.19
tag: rhel-9-release-golang-1.24-openshift-4.22
images:
items:
- additional_architectures:
Expand All @@ -15,16 +15,21 @@ releases:
architecture: arm64
product: ocp
stream: nightly
version: "4.16"
version: "4.22"
initial:
integration:
name: "4.16"
name: "4.22"
namespace: ocp
latest:
integration:
include_built_images: true
name: "4.16"
name: "4.22"
namespace: ocp
nightly-latest:
candidate:
product: ocp
stream: nightly
version: "4.22"
resources:
'*':
requests:
Expand Down Expand Up @@ -77,6 +82,58 @@ tests:
requests:
cpu: 100m
workflow: ipi-aws
- always_run: false
as: e2e-aws-openshift-platform-compliance-rhcos10
steps:
cluster_profile: quay-aws
dependencies:
OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:nightly-latest
env:
BASE_DOMAIN: quay.devcluster.openshift.com
COMPUTE_NODE_REPLICAS: "2"
FEATURE_SET: TechPreviewNoUpgrade
OS_IMAGE_STREAM: rhel-10
test:
- as: test
cli: latest
commands: |
set -x
export CONTENT_DIRECTORY=$PWD
git clone https://github.com/ComplianceAsCode/ocp4e2e.git ocp4e2e
pushd ocp4e2e; make install-jq
INSTALL_OPERATOR=${INSTALL_OPERATOR:-true}
PATH=$PATH:/tmp/bin go test -v -timeout 240m . -run=^TestPlatformCompliance$ -install-operator=${INSTALL_OPERATOR} -test-type="platform" -content-directory="$CONTENT_DIRECTORY"
from: src
resources:
requests:
cpu: 100m
workflow: ipi-aws
Comment on lines +85 to +110

@coderabbitai coderabbitai Bot Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Missing content image dependency in both RHCOS 10 compliance jobs. Both new RHCOS 10 jobs omit the ocp4-content-ds image dependency and the -content-image test flag, meaning they will not test the PR's ComplianceAsCode content changes—only default/missing content.

  • ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master.yaml#L85-L110: Add the ocp4-content-ds dependency block after Line 90 (in the test step's dependencies: list, similar to lines 54-56 in the existing platform job) and include -content-image="$CONTENT_IMAGE" in the go test command on Line 105.
  • ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master.yaml#L111-L136: Add the ocp4-content-ds dependency block after Line 116 (in the test step's dependencies: list, similar to lines 77-79 in the existing node job) and include -content-image="$CONTENT_IMAGE" in the go test command on Line 131.
📍 Affects 1 file
  • ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master.yaml#L85-L110 (this comment)
  • ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master.yaml#L111-L136
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master.yaml`
around lines 85 - 110, Both RHCOS 10 compliance jobs are missing critical
configuration to test the PR's content changes. In the
e2e-aws-openshift-platform-compliance-rhcos10 job (lines 85-110), add an
ocp4-content-ds dependency block in the test step's dependencies section (after
the line 90 area, following the pattern used in the existing platform compliance
job) and add the flag -content-image="$CONTENT_IMAGE" to the go test command.
Similarly, in the e2e-aws-openshift-node-compliance-rhcos10 job (lines 111-136),
add the same ocp4-content-ds dependency block in the test step's dependencies
section (after the line 116 area, following the pattern used in the existing
node compliance job) and add the same -content-image="$CONTENT_IMAGE" flag to
its go test command. This ensures both jobs will test against the PR's actual
ComplianceAsCode content rather than defaults.

- always_run: false
as: e2e-aws-openshift-node-compliance-rhcos10
steps:
cluster_profile: quay-aws
dependencies:
OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:nightly-latest
env:
BASE_DOMAIN: quay.devcluster.openshift.com
COMPUTE_NODE_REPLICAS: "2"
FEATURE_SET: TechPreviewNoUpgrade
OS_IMAGE_STREAM: rhel-10
test:
- as: test
cli: latest
commands: |
set -x
export CONTENT_DIRECTORY=$PWD
git clone https://github.com/ComplianceAsCode/ocp4e2e.git ocp4e2e
pushd ocp4e2e; make install-jq
INSTALL_OPERATOR=${INSTALL_OPERATOR:-true}
PATH=$PATH:/tmp/bin go test -v -timeout 240m . -run=^TestNodeCompliance$ -install-operator=${INSTALL_OPERATOR} -test-type="node" -content-directory="$CONTENT_DIRECTORY"
from: src
resources:
requests:
cpu: 100m
workflow: ipi-aws
- always_run: false
as: e2e-aws-ocp4-bsi
steps:
Expand Down
166 changes: 166 additions & 0 deletions ci-operator/jobs/ComplianceAsCode/content/ComplianceAsCode-content-master-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16992,6 +16992,89 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )e2e-aws-openshift-node-compliance,?($|\s.*)
- agent: kubernetes
always_run: false
branches:
- ^master$
- ^master-
cluster: build11
context: ci/prow/e2e-aws-openshift-node-compliance-rhcos10
decorate: true
decoration_config:
sparse_checkout_files:
- Dockerfiles/ocp4_content
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-ComplianceAsCode-content-master-e2e-aws-openshift-node-compliance-rhcos10
rerun_command: /test e2e-aws-openshift-node-compliance-rhcos10
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=e2e-aws-openshift-node-compliance-rhcos10
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )(e2e-aws-openshift-node-compliance-rhcos10|remaining-required),?($|\s.*)
- agent: kubernetes
always_run: true
branches:
Expand Down Expand Up @@ -17075,6 +17158,89 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )e2e-aws-openshift-platform-compliance,?($|\s.*)
- agent: kubernetes
always_run: false
branches:
- ^master$
- ^master-
cluster: build11
context: ci/prow/e2e-aws-openshift-platform-compliance-rhcos10
decorate: true
decoration_config:
sparse_checkout_files:
- Dockerfiles/ocp4_content
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-ComplianceAsCode-content-master-e2e-aws-openshift-platform-compliance-rhcos10
rerun_command: /test e2e-aws-openshift-platform-compliance-rhcos10
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=e2e-aws-openshift-platform-compliance-rhcos10
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )(e2e-aws-openshift-platform-compliance-rhcos10|remaining-required),?($|\s.*)
- agent: kubernetes
always_run: false
branches:
Expand Down