Skip to content

Commit fcc832f

Browse files
hasbro17hasbro17
committed
ci(installer): Add CI tests for ConfigurablePKI feature
The ConfigurablePKI feature gate changes installer-generated signer certificates from RSA-2048 to ECDSA P-384 by default. Add CI coverage to validate both the default ECDSA behavior and explicit RSA-4096 override, using TechPreviewNoUpgrade. A new openshift-installer-pki-verify step checks the 7 cluster-accessible signer CA secrets and PKI CR post-install, running before the e2e suite to fail fast on mismatches. Assisted-by: Claude Code (Opus 4.6)
1 parent 927a66b commit fcc832f

16 files changed

Lines changed: 1219 additions & 0 deletions

‎ci-operator/config/openshift/installer/openshift-installer-main.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,60 @@ tests:
271271
keyB valueB
272272
keyC valueC
273273
workflow: openshift-e2e-aws
274+
- always_run: false
275+
as: e2e-aws-ovn-pki-default-techpreview
276+
optional: true
277+
steps:
278+
cluster_profile: openshift-org-aws
279+
env:
280+
EXPECTED_ALGORITHM: ECDSA
281+
EXPECTED_KEY_PARAM: secp384r1
282+
FEATURE_SET: TechPreviewNoUpgrade
283+
test:
284+
- ref: openshift-installer-pki-verify
285+
- ref: openshift-e2e-test
286+
workflow: openshift-e2e-aws
287+
- always_run: false
288+
as: e2e-aws-ovn-pki-rsa-techpreview
289+
optional: true
290+
steps:
291+
cluster_profile: openshift-org-aws
292+
env:
293+
EXPECTED_ALGORITHM: RSA
294+
EXPECTED_KEY_PARAM: "4096"
295+
FEATURE_SET: TechPreviewNoUpgrade
296+
PKI_ALGORITHM: RSA
297+
PKI_RSA_KEY_SIZE: "4096"
298+
test:
299+
- ref: openshift-installer-pki-verify
300+
- ref: openshift-e2e-test
301+
workflow: openshift-e2e-aws
302+
- as: periodic-e2e-aws-ovn-pki-default-techpreview
303+
interval: 72h
304+
steps:
305+
cluster_profile: openshift-org-aws
306+
env:
307+
EXPECTED_ALGORITHM: ECDSA
308+
EXPECTED_KEY_PARAM: secp384r1
309+
FEATURE_SET: TechPreviewNoUpgrade
310+
test:
311+
- ref: openshift-installer-pki-verify
312+
- ref: openshift-e2e-test
313+
workflow: openshift-e2e-aws
314+
- as: periodic-e2e-aws-ovn-pki-rsa-techpreview
315+
interval: 72h
316+
steps:
317+
cluster_profile: openshift-org-aws
318+
env:
319+
EXPECTED_ALGORITHM: RSA
320+
EXPECTED_KEY_PARAM: "4096"
321+
FEATURE_SET: TechPreviewNoUpgrade
322+
PKI_ALGORITHM: RSA
323+
PKI_RSA_KEY_SIZE: "4096"
324+
test:
325+
- ref: openshift-installer-pki-verify
326+
- ref: openshift-e2e-test
327+
workflow: openshift-e2e-aws
274328
- always_run: false
275329
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
276330
optional: true

‎ci-operator/config/openshift/installer/openshift-installer-release-4.22.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,34 @@ tests:
272272
keyB valueB
273273
keyC valueC
274274
workflow: openshift-e2e-aws
275+
- always_run: false
276+
as: e2e-aws-ovn-pki-default-techpreview
277+
optional: true
278+
steps:
279+
cluster_profile: openshift-org-aws
280+
env:
281+
EXPECTED_ALGORITHM: ECDSA
282+
EXPECTED_KEY_PARAM: secp384r1
283+
FEATURE_SET: TechPreviewNoUpgrade
284+
test:
285+
- ref: openshift-installer-pki-verify
286+
- ref: openshift-e2e-test
287+
workflow: openshift-e2e-aws
288+
- always_run: false
289+
as: e2e-aws-ovn-pki-rsa-techpreview
290+
optional: true
291+
steps:
292+
cluster_profile: openshift-org-aws
293+
env:
294+
EXPECTED_ALGORITHM: RSA
295+
EXPECTED_KEY_PARAM: "4096"
296+
FEATURE_SET: TechPreviewNoUpgrade
297+
PKI_ALGORITHM: RSA
298+
PKI_RSA_KEY_SIZE: "4096"
299+
test:
300+
- ref: openshift-installer-pki-verify
301+
- ref: openshift-e2e-test
302+
workflow: openshift-e2e-aws
275303
- always_run: false
276304
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
277305
optional: true

‎ci-operator/config/openshift/installer/openshift-installer-release-4.23.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,34 @@ tests:
271271
keyB valueB
272272
keyC valueC
273273
workflow: openshift-e2e-aws
274+
- always_run: false
275+
as: e2e-aws-ovn-pki-default-techpreview
276+
optional: true
277+
steps:
278+
cluster_profile: openshift-org-aws
279+
env:
280+
EXPECTED_ALGORITHM: ECDSA
281+
EXPECTED_KEY_PARAM: secp384r1
282+
FEATURE_SET: TechPreviewNoUpgrade
283+
test:
284+
- ref: openshift-installer-pki-verify
285+
- ref: openshift-e2e-test
286+
workflow: openshift-e2e-aws
287+
- always_run: false
288+
as: e2e-aws-ovn-pki-rsa-techpreview
289+
optional: true
290+
steps:
291+
cluster_profile: openshift-org-aws
292+
env:
293+
EXPECTED_ALGORITHM: RSA
294+
EXPECTED_KEY_PARAM: "4096"
295+
FEATURE_SET: TechPreviewNoUpgrade
296+
PKI_ALGORITHM: RSA
297+
PKI_RSA_KEY_SIZE: "4096"
298+
test:
299+
- ref: openshift-installer-pki-verify
300+
- ref: openshift-e2e-test
301+
workflow: openshift-e2e-aws
274302
- always_run: false
275303
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
276304
optional: true

‎ci-operator/config/openshift/installer/openshift-installer-release-5.0.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,34 @@ tests:
271271
keyB valueB
272272
keyC valueC
273273
workflow: openshift-e2e-aws
274+
- always_run: false
275+
as: e2e-aws-ovn-pki-default-techpreview
276+
optional: true
277+
steps:
278+
cluster_profile: openshift-org-aws
279+
env:
280+
EXPECTED_ALGORITHM: ECDSA
281+
EXPECTED_KEY_PARAM: secp384r1
282+
FEATURE_SET: TechPreviewNoUpgrade
283+
test:
284+
- ref: openshift-installer-pki-verify
285+
- ref: openshift-e2e-test
286+
workflow: openshift-e2e-aws
287+
- always_run: false
288+
as: e2e-aws-ovn-pki-rsa-techpreview
289+
optional: true
290+
steps:
291+
cluster_profile: openshift-org-aws
292+
env:
293+
EXPECTED_ALGORITHM: RSA
294+
EXPECTED_KEY_PARAM: "4096"
295+
FEATURE_SET: TechPreviewNoUpgrade
296+
PKI_ALGORITHM: RSA
297+
PKI_RSA_KEY_SIZE: "4096"
298+
test:
299+
- ref: openshift-installer-pki-verify
300+
- ref: openshift-e2e-test
301+
workflow: openshift-e2e-aws
274302
- always_run: false
275303
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
276304
optional: true

‎ci-operator/jobs/openshift/installer/openshift-installer-main-periodics.yaml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
periodics:
2+
- agent: kubernetes
3+
cluster: build11
4+
decorate: true
5+
extra_refs:
6+
- base_ref: main
7+
org: openshift
8+
repo: installer
9+
interval: 72h
10+
labels:
11+
ci-operator.openshift.io/cloud: aws
12+
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
13+
ci.openshift.io/generator: prowgen
14+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
15+
name: periodic-ci-openshift-installer-main-periodic-e2e-aws-ovn-pki-default-techpreview
16+
spec:
17+
containers:
18+
- args:
19+
- --gcs-upload-secret=/secrets/gcs/service-account.json
20+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
21+
- --lease-server-credentials-file=/etc/boskos/credentials
22+
- --report-credentials-file=/etc/report/credentials
23+
- --secret-dir=/secrets/ci-pull-credentials
24+
- --target=periodic-e2e-aws-ovn-pki-default-techpreview
25+
command:
26+
- ci-operator
27+
env:
28+
- name: HTTP_SERVER_IP
29+
valueFrom:
30+
fieldRef:
31+
fieldPath: status.podIP
32+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
33+
imagePullPolicy: Always
34+
name: ""
35+
ports:
36+
- containerPort: 8080
37+
name: http
38+
resources:
39+
requests:
40+
cpu: 10m
41+
volumeMounts:
42+
- mountPath: /etc/boskos
43+
name: boskos
44+
readOnly: true
45+
- mountPath: /secrets/ci-pull-credentials
46+
name: ci-pull-credentials
47+
readOnly: true
48+
- mountPath: /secrets/gcs
49+
name: gcs-credentials
50+
readOnly: true
51+
- mountPath: /secrets/manifest-tool
52+
name: manifest-tool-local-pusher
53+
readOnly: true
54+
- mountPath: /etc/pull-secret
55+
name: pull-secret
56+
readOnly: true
57+
- mountPath: /etc/report
58+
name: result-aggregator
59+
readOnly: true
60+
serviceAccountName: ci-operator
61+
volumes:
62+
- name: boskos
63+
secret:
64+
items:
65+
- key: credentials
66+
path: credentials
67+
secretName: boskos-credentials
68+
- name: ci-pull-credentials
69+
secret:
70+
secretName: ci-pull-credentials
71+
- name: manifest-tool-local-pusher
72+
secret:
73+
secretName: manifest-tool-local-pusher
74+
- name: pull-secret
75+
secret:
76+
secretName: registry-pull-credentials
77+
- name: result-aggregator
78+
secret:
79+
secretName: result-aggregator
80+
- agent: kubernetes
81+
cluster: build11
82+
decorate: true
83+
extra_refs:
84+
- base_ref: main
85+
org: openshift
86+
repo: installer
87+
interval: 72h
88+
labels:
89+
ci-operator.openshift.io/cloud: aws
90+
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
91+
ci.openshift.io/generator: prowgen
92+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
93+
name: periodic-ci-openshift-installer-main-periodic-e2e-aws-ovn-pki-rsa-techpreview
94+
spec:
95+
containers:
96+
- args:
97+
- --gcs-upload-secret=/secrets/gcs/service-account.json
98+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
99+
- --lease-server-credentials-file=/etc/boskos/credentials
100+
- --report-credentials-file=/etc/report/credentials
101+
- --secret-dir=/secrets/ci-pull-credentials
102+
- --target=periodic-e2e-aws-ovn-pki-rsa-techpreview
103+
command:
104+
- ci-operator
105+
env:
106+
- name: HTTP_SERVER_IP
107+
valueFrom:
108+
fieldRef:
109+
fieldPath: status.podIP
110+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
111+
imagePullPolicy: Always
112+
name: ""
113+
ports:
114+
- containerPort: 8080
115+
name: http
116+
resources:
117+
requests:
118+
cpu: 10m
119+
volumeMounts:
120+
- mountPath: /etc/boskos
121+
name: boskos
122+
readOnly: true
123+
- mountPath: /secrets/ci-pull-credentials
124+
name: ci-pull-credentials
125+
readOnly: true
126+
- mountPath: /secrets/gcs
127+
name: gcs-credentials
128+
readOnly: true
129+
- mountPath: /secrets/manifest-tool
130+
name: manifest-tool-local-pusher
131+
readOnly: true
132+
- mountPath: /etc/pull-secret
133+
name: pull-secret
134+
readOnly: true
135+
- mountPath: /etc/report
136+
name: result-aggregator
137+
readOnly: true
138+
serviceAccountName: ci-operator
139+
volumes:
140+
- name: boskos
141+
secret:
142+
items:
143+
- key: credentials
144+
path: credentials
145+
secretName: boskos-credentials
146+
- name: ci-pull-credentials
147+
secret:
148+
secretName: ci-pull-credentials
149+
- name: manifest-tool-local-pusher
150+
secret:
151+
secretName: manifest-tool-local-pusher
152+
- name: pull-secret
153+
secret:
154+
secretName: registry-pull-credentials
155+
- name: result-aggregator
156+
secret:
157+
secretName: result-aggregator

0 commit comments

Comments
 (0)