Skip to content

Commit fde01e8

Browse files
hasbro17hasbro17
authored
ci(installer): Add CI tests for ConfigurablePKI feature (#77043)
The ConfigurablePKI feature gate changes installer-generated signer certificates from RSA-2048 to ECDSA P-384 by default. Add CI coverage to validate both the default ECDSA behavior and explicit RSA-4096 override, using TechPreviewNoUpgrade. A new openshift-installer-pki-verify step checks the 7 cluster-accessible signer CA secrets and PKI CR post-install, running before the e2e suite to fail fast on mismatches. Assisted-by: Claude Code (Opus 4.6)
1 parent bc43c68 commit fde01e8

15 files changed

Lines changed: 1036 additions & 0 deletions

‎ci-operator/config/openshift/installer/openshift-installer-main.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,34 @@ tests:
271271
keyB valueB
272272
keyC valueC
273273
workflow: openshift-e2e-aws
274+
- always_run: false
275+
as: e2e-aws-ovn-pki-default-techpreview
276+
optional: true
277+
steps:
278+
cluster_profile: openshift-org-aws
279+
env:
280+
EXPECTED_ALGORITHM: ECDSA
281+
EXPECTED_KEY_PARAM: secp384r1
282+
FEATURE_SET: TechPreviewNoUpgrade
283+
test:
284+
- ref: openshift-installer-pki-verify
285+
- ref: openshift-e2e-test
286+
workflow: openshift-e2e-aws
287+
- always_run: false
288+
as: e2e-aws-ovn-pki-rsa-techpreview
289+
optional: true
290+
steps:
291+
cluster_profile: openshift-org-aws
292+
env:
293+
EXPECTED_ALGORITHM: RSA
294+
EXPECTED_KEY_PARAM: "4096"
295+
FEATURE_SET: TechPreviewNoUpgrade
296+
PKI_ALGORITHM: RSA
297+
PKI_RSA_KEY_SIZE: "4096"
298+
test:
299+
- ref: openshift-installer-pki-verify
300+
- ref: openshift-e2e-test
301+
workflow: openshift-e2e-aws
274302
- always_run: false
275303
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
276304
optional: true

‎ci-operator/config/openshift/installer/openshift-installer-release-4.22.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,34 @@ tests:
272272
keyB valueB
273273
keyC valueC
274274
workflow: openshift-e2e-aws
275+
- always_run: false
276+
as: e2e-aws-ovn-pki-default-techpreview
277+
optional: true
278+
steps:
279+
cluster_profile: openshift-org-aws
280+
env:
281+
EXPECTED_ALGORITHM: ECDSA
282+
EXPECTED_KEY_PARAM: secp384r1
283+
FEATURE_SET: TechPreviewNoUpgrade
284+
test:
285+
- ref: openshift-installer-pki-verify
286+
- ref: openshift-e2e-test
287+
workflow: openshift-e2e-aws
288+
- always_run: false
289+
as: e2e-aws-ovn-pki-rsa-techpreview
290+
optional: true
291+
steps:
292+
cluster_profile: openshift-org-aws
293+
env:
294+
EXPECTED_ALGORITHM: RSA
295+
EXPECTED_KEY_PARAM: "4096"
296+
FEATURE_SET: TechPreviewNoUpgrade
297+
PKI_ALGORITHM: RSA
298+
PKI_RSA_KEY_SIZE: "4096"
299+
test:
300+
- ref: openshift-installer-pki-verify
301+
- ref: openshift-e2e-test
302+
workflow: openshift-e2e-aws
275303
- always_run: false
276304
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
277305
optional: true

‎ci-operator/config/openshift/installer/openshift-installer-release-4.23.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,34 @@ tests:
271271
keyB valueB
272272
keyC valueC
273273
workflow: openshift-e2e-aws
274+
- always_run: false
275+
as: e2e-aws-ovn-pki-default-techpreview
276+
optional: true
277+
steps:
278+
cluster_profile: openshift-org-aws
279+
env:
280+
EXPECTED_ALGORITHM: ECDSA
281+
EXPECTED_KEY_PARAM: secp384r1
282+
FEATURE_SET: TechPreviewNoUpgrade
283+
test:
284+
- ref: openshift-installer-pki-verify
285+
- ref: openshift-e2e-test
286+
workflow: openshift-e2e-aws
287+
- always_run: false
288+
as: e2e-aws-ovn-pki-rsa-techpreview
289+
optional: true
290+
steps:
291+
cluster_profile: openshift-org-aws
292+
env:
293+
EXPECTED_ALGORITHM: RSA
294+
EXPECTED_KEY_PARAM: "4096"
295+
FEATURE_SET: TechPreviewNoUpgrade
296+
PKI_ALGORITHM: RSA
297+
PKI_RSA_KEY_SIZE: "4096"
298+
test:
299+
- ref: openshift-installer-pki-verify
300+
- ref: openshift-e2e-test
301+
workflow: openshift-e2e-aws
274302
- always_run: false
275303
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
276304
optional: true

‎ci-operator/config/openshift/installer/openshift-installer-release-5.0.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,34 @@ tests:
271271
keyB valueB
272272
keyC valueC
273273
workflow: openshift-e2e-aws
274+
- always_run: false
275+
as: e2e-aws-ovn-pki-default-techpreview
276+
optional: true
277+
steps:
278+
cluster_profile: openshift-org-aws
279+
env:
280+
EXPECTED_ALGORITHM: ECDSA
281+
EXPECTED_KEY_PARAM: secp384r1
282+
FEATURE_SET: TechPreviewNoUpgrade
283+
test:
284+
- ref: openshift-installer-pki-verify
285+
- ref: openshift-e2e-test
286+
workflow: openshift-e2e-aws
287+
- always_run: false
288+
as: e2e-aws-ovn-pki-rsa-techpreview
289+
optional: true
290+
steps:
291+
cluster_profile: openshift-org-aws
292+
env:
293+
EXPECTED_ALGORITHM: RSA
294+
EXPECTED_KEY_PARAM: "4096"
295+
FEATURE_SET: TechPreviewNoUpgrade
296+
PKI_ALGORITHM: RSA
297+
PKI_RSA_KEY_SIZE: "4096"
298+
test:
299+
- ref: openshift-installer-pki-verify
300+
- ref: openshift-e2e-test
301+
workflow: openshift-e2e-aws
274302
- always_run: false
275303
as: e2e-aws-ovn-dualstack-ipv4-primary-techpreview
276304
optional: true

‎ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2435,6 +2435,168 @@ presubmits:
24352435
secret:
24362436
secretName: result-aggregator
24372437
trigger: (?m)^/test( | .* )e2e-aws-ovn-imdsv2,?($|\s.*)
2438+
- agent: kubernetes
2439+
always_run: false
2440+
branches:
2441+
- ^main$
2442+
- ^main-
2443+
cluster: build01
2444+
context: ci/prow/e2e-aws-ovn-pki-default-techpreview
2445+
decorate: true
2446+
labels:
2447+
ci-operator.openshift.io/cloud: aws
2448+
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
2449+
ci.openshift.io/generator: prowgen
2450+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
2451+
name: pull-ci-openshift-installer-main-e2e-aws-ovn-pki-default-techpreview
2452+
optional: true
2453+
rerun_command: /test e2e-aws-ovn-pki-default-techpreview
2454+
spec:
2455+
containers:
2456+
- args:
2457+
- --gcs-upload-secret=/secrets/gcs/service-account.json
2458+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
2459+
- --lease-server-credentials-file=/etc/boskos/credentials
2460+
- --report-credentials-file=/etc/report/credentials
2461+
- --secret-dir=/secrets/ci-pull-credentials
2462+
- --target=e2e-aws-ovn-pki-default-techpreview
2463+
command:
2464+
- ci-operator
2465+
env:
2466+
- name: HTTP_SERVER_IP
2467+
valueFrom:
2468+
fieldRef:
2469+
fieldPath: status.podIP
2470+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
2471+
imagePullPolicy: Always
2472+
name: ""
2473+
ports:
2474+
- containerPort: 8080
2475+
name: http
2476+
resources:
2477+
requests:
2478+
cpu: 10m
2479+
volumeMounts:
2480+
- mountPath: /etc/boskos
2481+
name: boskos
2482+
readOnly: true
2483+
- mountPath: /secrets/ci-pull-credentials
2484+
name: ci-pull-credentials
2485+
readOnly: true
2486+
- mountPath: /secrets/gcs
2487+
name: gcs-credentials
2488+
readOnly: true
2489+
- mountPath: /secrets/manifest-tool
2490+
name: manifest-tool-local-pusher
2491+
readOnly: true
2492+
- mountPath: /etc/pull-secret
2493+
name: pull-secret
2494+
readOnly: true
2495+
- mountPath: /etc/report
2496+
name: result-aggregator
2497+
readOnly: true
2498+
serviceAccountName: ci-operator
2499+
volumes:
2500+
- name: boskos
2501+
secret:
2502+
items:
2503+
- key: credentials
2504+
path: credentials
2505+
secretName: boskos-credentials
2506+
- name: ci-pull-credentials
2507+
secret:
2508+
secretName: ci-pull-credentials
2509+
- name: manifest-tool-local-pusher
2510+
secret:
2511+
secretName: manifest-tool-local-pusher
2512+
- name: pull-secret
2513+
secret:
2514+
secretName: registry-pull-credentials
2515+
- name: result-aggregator
2516+
secret:
2517+
secretName: result-aggregator
2518+
trigger: (?m)^/test( | .* )e2e-aws-ovn-pki-default-techpreview,?($|\s.*)
2519+
- agent: kubernetes
2520+
always_run: false
2521+
branches:
2522+
- ^main$
2523+
- ^main-
2524+
cluster: build01
2525+
context: ci/prow/e2e-aws-ovn-pki-rsa-techpreview
2526+
decorate: true
2527+
labels:
2528+
ci-operator.openshift.io/cloud: aws
2529+
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
2530+
ci.openshift.io/generator: prowgen
2531+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
2532+
name: pull-ci-openshift-installer-main-e2e-aws-ovn-pki-rsa-techpreview
2533+
optional: true
2534+
rerun_command: /test e2e-aws-ovn-pki-rsa-techpreview
2535+
spec:
2536+
containers:
2537+
- args:
2538+
- --gcs-upload-secret=/secrets/gcs/service-account.json
2539+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
2540+
- --lease-server-credentials-file=/etc/boskos/credentials
2541+
- --report-credentials-file=/etc/report/credentials
2542+
- --secret-dir=/secrets/ci-pull-credentials
2543+
- --target=e2e-aws-ovn-pki-rsa-techpreview
2544+
command:
2545+
- ci-operator
2546+
env:
2547+
- name: HTTP_SERVER_IP
2548+
valueFrom:
2549+
fieldRef:
2550+
fieldPath: status.podIP
2551+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
2552+
imagePullPolicy: Always
2553+
name: ""
2554+
ports:
2555+
- containerPort: 8080
2556+
name: http
2557+
resources:
2558+
requests:
2559+
cpu: 10m
2560+
volumeMounts:
2561+
- mountPath: /etc/boskos
2562+
name: boskos
2563+
readOnly: true
2564+
- mountPath: /secrets/ci-pull-credentials
2565+
name: ci-pull-credentials
2566+
readOnly: true
2567+
- mountPath: /secrets/gcs
2568+
name: gcs-credentials
2569+
readOnly: true
2570+
- mountPath: /secrets/manifest-tool
2571+
name: manifest-tool-local-pusher
2572+
readOnly: true
2573+
- mountPath: /etc/pull-secret
2574+
name: pull-secret
2575+
readOnly: true
2576+
- mountPath: /etc/report
2577+
name: result-aggregator
2578+
readOnly: true
2579+
serviceAccountName: ci-operator
2580+
volumes:
2581+
- name: boskos
2582+
secret:
2583+
items:
2584+
- key: credentials
2585+
path: credentials
2586+
secretName: boskos-credentials
2587+
- name: ci-pull-credentials
2588+
secret:
2589+
secretName: ci-pull-credentials
2590+
- name: manifest-tool-local-pusher
2591+
secret:
2592+
secretName: manifest-tool-local-pusher
2593+
- name: pull-secret
2594+
secret:
2595+
secretName: registry-pull-credentials
2596+
- name: result-aggregator
2597+
secret:
2598+
secretName: result-aggregator
2599+
trigger: (?m)^/test( | .* )e2e-aws-ovn-pki-rsa-techpreview,?($|\s.*)
24382600
- agent: kubernetes
24392601
always_run: false
24402602
branches:

0 commit comments

Comments
 (0)