From c306198be025abbb33451f35a0b81110bab3283f Mon Sep 17 00:00:00 2001 From: Jean Chen Date: Tue, 4 Aug 2026 21:15:48 -0400 Subject: [PATCH 1/3] ci: add metal BGP dual-stack serial presubmit with dedicated workflow Add optional presubmit e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial for openshift/ovn-kubernetes on main, release-4.22, release-4.23, and release-5.0. Use a dedicated baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial workflow so the shared local-gw workflow is unchanged. The serial workflow runs openshift/conformance/serial with extra workers, serial-specific TEST_SKIPS, and ADVERTISE_DEFAULT_NETWORK=false for extranet VRF-Lite coverage only. Enable TEST_SKIPS filtering for the serial conformance suite in baremetalds-e2e-test. Signed-off-by: Jean Chen Co-authored-by: Cursor --- .../openshift-ovn-kubernetes-main.yaml | 9 ++ ...openshift-ovn-kubernetes-release-4.22.yaml | 9 ++ ...openshift-ovn-kubernetes-release-4.23.yaml | 9 ++ .../openshift-ovn-kubernetes-release-5.0.yaml | 9 ++ ...nshift-ovn-kubernetes-main-presubmits.yaml | 89 +++++++++++++++++++ ...vn-kubernetes-release-4.22-presubmits.yaml | 89 +++++++++++++++++++ ...vn-kubernetes-release-4.23-presubmits.yaml | 89 +++++++++++++++++++ ...ovn-kubernetes-release-5.0-presubmits.yaml | 89 +++++++++++++++++++ .../ovn/bgp/dualstack-local-gw-serial/OWNERS | 1 + ...ack-local-gw-serial-workflow.metadata.json | 11 +++ ...gp-dualstack-local-gw-serial-workflow.yaml | 42 +++++++++ .../e2e/test/baremetalds-e2e-test-commands.sh | 2 +- 12 files changed, 447 insertions(+), 1 deletion(-) create mode 120000 ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/OWNERS create mode 100644 ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.metadata.json create mode 100644 ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml diff --git a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main.yaml b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main.yaml index 07e49dfbd1c9b..904e8b668053a 100644 --- a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main.yaml +++ b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main.yaml @@ -347,6 +347,15 @@ tests: steps: cluster_profile: equinix-ocp-metal workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw +- always_run: false + as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + capabilities: + - intranet + optional: true + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + steps: + cluster_profile: equinix-ocp-metal + workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial - always_run: false as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-techpreview capabilities: diff --git a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22.yaml b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22.yaml index 3e0e11b63cbb2..d55c900736476 100644 --- a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22.yaml +++ b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22.yaml @@ -347,6 +347,15 @@ tests: steps: cluster_profile: equinix-ocp-metal workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw +- always_run: false + as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + capabilities: + - intranet + optional: true + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + steps: + cluster_profile: equinix-ocp-metal + workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial - always_run: false as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-techpreview capabilities: diff --git a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23.yaml b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23.yaml index 73cfe1805b104..a83ac42855687 100644 --- a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23.yaml +++ b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23.yaml @@ -322,6 +322,15 @@ tests: steps: cluster_profile: equinix-ocp-metal workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw +- always_run: false + as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + capabilities: + - intranet + optional: true + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + steps: + cluster_profile: equinix-ocp-metal + workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial - always_run: false as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-techpreview capabilities: diff --git a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0.yaml b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0.yaml index 37c517a100be6..6e0c79dbb3a73 100644 --- a/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0.yaml +++ b/ci-operator/config/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0.yaml @@ -322,6 +322,15 @@ tests: steps: cluster_profile: equinix-ocp-metal workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw +- always_run: false + as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + capabilities: + - intranet + optional: true + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + steps: + cluster_profile: equinix-ocp-metal + workflow: baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial - always_run: false as: e2e-metal-ipi-ovn-dualstack-bgp-local-gw-techpreview capabilities: diff --git a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main-presubmits.yaml b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main-presubmits.yaml index afe54a1532261..d058e53e7f73f 100644 --- a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-main-presubmits.yaml @@ -3134,6 +3134,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.base + - Dockerfile.microshift + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ovn-kubernetes-main-e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + optional: true + rerun_command: /test e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22-presubmits.yaml b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22-presubmits.yaml index b8ab946e99e3a..5eceb37567865 100644 --- a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22-presubmits.yaml +++ b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.22-presubmits.yaml @@ -2875,6 +2875,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.22$ + - ^release-4\.22- + cluster: build10 + context: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.base + - Dockerfile.microshift + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ovn-kubernetes-release-4.22-e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + optional: true + rerun_command: /test e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23-presubmits.yaml index ef5be522a0847..d4a993a10e395 100644 --- a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-4.23-presubmits.yaml @@ -2806,6 +2806,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build10 + context: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.base + - Dockerfile.microshift + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ovn-kubernetes-release-4.23-e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + optional: true + rerun_command: /test e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0-presubmits.yaml index 62d1cf3903c90..07e888def10f7 100644 --- a/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/ovn-kubernetes/openshift-ovn-kubernetes-release-5.0-presubmits.yaml @@ -3134,6 +3134,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build09 + context: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.base + - Dockerfile.microshift + labels: + capability/intranet: intranet + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ovn-kubernetes-release-5.0-e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + optional: true + rerun_command: /test e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + skip_if_only_changed: ^(docs|\.github|contrib|etc|helm)/|\.md$|^(\.gitignore|OWNERS|LICENSE|CODEOWNERS|\.coderabbit\.yml|crd-docs-config\.yaml|mkdocs\.yml|requirements\.txt)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-metal-ipi-ovn-dualstack-bgp-local-gw-serial,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/OWNERS b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.metadata.json b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.metadata.json new file mode 100644 index 0000000000000..ea3e9c0f49378 --- /dev/null +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.metadata.json @@ -0,0 +1,11 @@ +{ + "path": "baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml", + "owners": { + "approvers": [ + "core-networking-approvers" + ], + "reviewers": [ + "core-networking-reviewers" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml new file mode 100644 index 0000000000000..d295a69840adb --- /dev/null +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml @@ -0,0 +1,42 @@ +workflow: + as: baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4v6 + # https://issues.redhat.com/browse/OCPBUGS-52194 + DHCP_LEASE_EXPIRY=0 + NUM_EXTRA_WORKERS=1 + APPLY_EXTRA_WORKERS=true + EXTRA_MG_ARGS: --host-network + EXTRA_NETWORK_CONFIG: | + EXTRA_NETWORK_NAMES="extranet" + EXTRANET_NETWORK_SUBNET_V4='192.168.221.0/24' + EXTRANET_NETWORK_SUBNET_V6='fd2e:6f44:5dd8:ca56::/120' + ADVERTISE_DEFAULT_NETWORK: "false" + KONFLUX_TARGET_OPERATORS: nmstate + TEST_SUITE: openshift/conformance/serial + TEST_SKIPS: Services should fallback to local terminating endpoints when there + are no ready endpoints with externalTrafficPolicy=Local\|CPU Partitioning + cluster platform workloads should be annotated correctly for Deployments\|should + validate the communication matrix ports match the node's listening ports\|Managed + cluster should grow and decrease when scaling different machineSets simultaneously + pre: + - ref: baremetalds-devscripts-conf-featureset + - ref: baremetalds-devscripts-conf-extranetwork + - chain: baremetalds-ofcir-pre + - ref: ovn-shared-to-local-gateway-mode-migration + - ref: deploy-konflux-operator + - ref: baremetalds-e2e-ovn-bgp-pre + - ref: baremetalds-e2e-ovn-debug-enable-console + test: + - chain: baremetalds-ipi-test + post: + - ref: baremetalds-e2e-ovn-debug-console-gather + - chain: baremetalds-ofcir-post + documentation: |- + Like baremetalds-e2e-ovn-bgp-dualstack-local-gw, but runs openshift/conformance/serial + with extra workers and serial-specific TEST_SKIPS. Default-network BGP advertisements are + disabled (ADVERTISE_DEFAULT_NETWORK=false); only the additional machine/extranet network is + advertised for VRF-Lite. Local gateway mode and nmstate are still configured. diff --git a/ci-operator/step-registry/baremetalds/e2e/test/baremetalds-e2e-test-commands.sh b/ci-operator/step-registry/baremetalds/e2e/test/baremetalds-e2e-test-commands.sh index db97d81b8daa4..1e7886af19394 100644 --- a/ci-operator/step-registry/baremetalds/e2e/test/baremetalds-e2e-test-commands.sh +++ b/ci-operator/step-registry/baremetalds/e2e/test/baremetalds-e2e-test-commands.sh @@ -319,7 +319,7 @@ function suite() { HYPERVISOR_ARGS=("--with-hypervisor-json={\"hypervisorIP\":\"${HYPERVISOR_IP}\", \"sshUser\":\"${HYPERVISOR_SSH_USER}\", \"privateKeyPath\":\"${HYPERVISOR_SSH_KEY}\"}") fi - if [[ -n "${TEST_SKIPS}" && ("${TEST_SUITE}" == "openshift/conformance/parallel" || "${TEST_SUITE}" == "openshift/auth/external-oidc" || "${TEST_SUITE}" == "openshift/two-node") ]]; then + if [[ -n "${TEST_SKIPS}" && ("${TEST_SUITE}" == "openshift/conformance/parallel" || "${TEST_SUITE}" == "openshift/conformance/serial" || "${TEST_SUITE}" == "openshift/auth/external-oidc" || "${TEST_SUITE}" == "openshift/two-node") ]]; then TESTS="$(openshift-tests run "${TEST_SUITE}" --dry-run --provider "${TEST_PROVIDER}" "${HYPERVISOR_ARGS[@]}")" && echo "${TESTS}" | grep -v "${TEST_SKIPS}" >/tmp/tests && echo "Tests to be skipped:" && From b07d7806d3e93cd4eb604111d9814476975386ec Mon Sep 17 00:00:00 2001 From: Jean Chen Date: Tue, 4 Aug 2026 21:15:51 -0400 Subject: [PATCH 2/3] fix: harden baremetalds BGP pre-step for serial metal e2e - Wait for MachineConfigPools Updated before BGP setup so pending MCO reboots from prior steps do not overlap with the test window. - Include spare baremetal hosts from ostestbm in external FRR neighbor config for dynamically provisioned nodes. - Patch FRRConfiguration CRD ASN fields to format int64 for K8s 1.36+. - Add ADVERTISE_DEFAULT_NETWORK (default true) so the serial workflow can disable default/pod network BGP peering while keeping extranet ads. Signed-off-by: Jean Chen Co-authored-by: Cursor --- .../baremetalds-e2e-ovn-bgp-pre-commands.sh | 70 +++++++++++++++---- .../pre/baremetalds-e2e-ovn-bgp-pre-ref.yaml | 6 ++ 2 files changed, 63 insertions(+), 13 deletions(-) diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh index 8a7095f6cace3..f81c3f5ee3047 100644 --- a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh @@ -5,7 +5,7 @@ set -o pipefail # Fetch packet basic configuration source "${SHARED_DIR}/packet-conf.sh" -ssh "${SSHOPTS[@]}" "root@${IP}" "FRR_IMAGE='$FRR_IMAGE'" bash -x - << 'EOFTOP' +ssh "${SSHOPTS[@]}" "root@${IP}" "FRR_IMAGE='$FRR_IMAGE' ADVERTISE_DEFAULT_NETWORK='${ADVERTISE_DEFAULT_NETWORK:-true}'" bash -x - << 'EOFTOP' #!/bin/bash set -o nounset set -o errexit @@ -236,11 +236,26 @@ if [ "$local_gateway_mode" = "true" ]; then sleep 10 done fi + echo "Waiting for all MachineConfigPools to finish updating (ensures all pending node reboots complete, including those from prior steps)..." + oc wait mcp master worker --for condition=Updated --timeout=25m fi # we will potentially deploy multiple networks, each on its own VRF declare -A vrf_neighbors -vrf_neighbors["default"]=$($KCLI get nodes -o jsonpath={.items[*].status.addresses[?\(@.type==\"InternalIP\"\)].address}) + +# Optionally advertise the default/pod network. When disabled, only extra networks (e.g. extranet) +# get external FRR peering, FRRConfiguration, and RouteAdvertisements. +if [ "${ADVERTISE_DEFAULT_NETWORK:-true}" = "true" ]; then + # Collect IPs for the default VRF from both current cluster nodes and any spare baremetal hosts + # pre-configured in the ostestbm network (via virsh DHCP entries). This ensures nodes provisioned + # dynamically during tests (e.g. via MachineSet scaling) are already known to the external FRR, + # preventing BGP session rejections that cause frr-status container crashes on new nodes. + node_ips=$($KCLI get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}') + spare_ips=$(sudo virsh net-dumpxml ostestbm | xmllint --xpath '/network//host/@ip' - | cut -d '=' -f2 | tr -d \" | xargs 2>/dev/null || true) + vrf_neighbors["default"]=$(echo "$node_ips $spare_ips" | tr ' ' '\n' | sort -u | xargs) +else + echo "ADVERTISE_DEFAULT_NETWORK=false: skipping default network BGP peering and RouteAdvertisements" +fi # deploy an agnhost container isolated on a macvlan network deploy_agnhost_container agnhost @@ -303,6 +318,32 @@ until oc wait -n openshift-frr-k8s deployment --all --for condition=Available -- sleep 5 done +# Workaround: Kubernetes >=1.36 rejects CRDs that declare format:int32 with +# maximum:4294967295 (above signed int32 max). That makes *any* FRRConfiguration +# apply fail with "Maximum boundary value must be of type integer with format int32" +# even when the ASN value itself is valid. Upstream fix uses format:int64: +# https://github.com/metallb/frr-k8s/commit/7c71d152be3b2383350f475b951ceab0a4323624 +# https://github.com/metallb/metallb/issues/3034 +echo "Patching FRRConfiguration CRD ASN fields to format int64 (K8s 1.36+ validation)..." +oc get crd frrconfigurations.frrk8s.metallb.io -o json | python3 -c ' +import json, sys +crd = json.load(sys.stdin) +for v in crd.get("spec", {}).get("versions", []): + schema = v.get("schema", {}).get("openAPIV3Schema", {}) + try: + routers = schema["properties"]["spec"]["properties"]["bgp"]["properties"]["routers"]["items"]["properties"] + except KeyError: + continue + if "asn" in routers: + routers["asn"]["format"] = "int64" + neighbors = routers.get("neighbors", {}).get("items", {}).get("properties", {}) + if "asn" in neighbors: + neighbors["asn"]["format"] = "int64" + if "localASN" in neighbors: + neighbors["localASN"]["format"] = "int64" +json.dump(crd, sys.stdout) +' | oc replace -f - + # Override FRR-K8s frr and reloader containers only (CNO uses one image for all containers; # upstream FRR image works only for frr/reloader). Make CNO Unmanaged and set those images. # This is used while waiting for OCP builds with FRR 10. @@ -409,15 +450,18 @@ ${network_selector} EOF done -CLUSTER_NETWORK_V4="10.128.0.0/14" -$IP route add $CLUSTER_NETWORK_V4 via 192.168.111.3 dev ostestbm || true -$IPTABLES -t filter -I FORWARD -s ${CLUSTER_NETWORK_V4} -i ostestbm -j ACCEPT -$IPTABLES -t filter -I FORWARD -d ${CLUSTER_NETWORK_V4} -o ostestbm -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -$IPTABLES -t nat -I POSTROUTING -s ${CLUSTER_NETWORK_V4} ! -d 192.168.111.1/24 -j MASQUERADE - -CLUSTER_NETWORK_V6="fd01::/48" -$IP -6 route add $CLUSTER_NETWORK_V6 via fd2e:6f44:5dd8:c956::3 dev ostestbm || true -$IP6TABLES -t filter -I FORWARD -s ${CLUSTER_NETWORK_V6} -i ostestbm -j ACCEPT -$IP6TABLES -t filter -I FORWARD -d ${CLUSTER_NETWORK_V6} -o ostestbm -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -$IP6TABLES -t nat -I POSTROUTING -s ${CLUSTER_NETWORK_V6} ! -d fd2e:6f44:5dd8:c956::1 -j MASQUERADE +# Host routes for the advertised default pod network via the external FRR container. +if [ "${ADVERTISE_DEFAULT_NETWORK:-true}" = "true" ]; then + CLUSTER_NETWORK_V4="10.128.0.0/14" + $IP route add $CLUSTER_NETWORK_V4 via 192.168.111.3 dev ostestbm || true + $IPTABLES -t filter -I FORWARD -s ${CLUSTER_NETWORK_V4} -i ostestbm -j ACCEPT + $IPTABLES -t filter -I FORWARD -d ${CLUSTER_NETWORK_V4} -o ostestbm -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + $IPTABLES -t nat -I POSTROUTING -s ${CLUSTER_NETWORK_V4} ! -d 192.168.111.1/24 -j MASQUERADE + + CLUSTER_NETWORK_V6="fd01::/48" + $IP -6 route add $CLUSTER_NETWORK_V6 via fd2e:6f44:5dd8:c956::3 dev ostestbm || true + $IP6TABLES -t filter -I FORWARD -s ${CLUSTER_NETWORK_V6} -i ostestbm -j ACCEPT + $IP6TABLES -t filter -I FORWARD -d ${CLUSTER_NETWORK_V6} -o ostestbm -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + $IP6TABLES -t nat -I POSTROUTING -s ${CLUSTER_NETWORK_V6} ! -d fd2e:6f44:5dd8:c956::1 -j MASQUERADE +fi EOFTOP diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-ref.yaml b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-ref.yaml index e5e7a407a1b0e..33f534a75367d 100644 --- a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-ref.yaml +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-ref.yaml @@ -14,5 +14,11 @@ ref: When set, overrides only the frr and reloader containers in the FRR-K8s daemonset with the specified FRR image (e.g. quay.io/frrouting/frr:10.4.1). CNO is set Unmanaged first. Used for EVPN while waiting for OCP builds with FRR 10. + - name: ADVERTISE_DEFAULT_NETWORK + default: "true" + documentation: |- + When true (default), configure external FRR peering, FRRConfiguration, and RouteAdvertisements + for the cluster default/pod network. Set to false to advertise only extra networks (e.g. extranet + VRF-Lite) without default-network BGP. Other BGP jobs should leave this at the default. documentation: |- The Baremetald IPI setup chain contains all steps that enable FRR and route advertisements From 30071c8e5bffa80857d2c4dcf8755245e962b4d1 Mon Sep 17 00:00:00 2001 From: Jean Chen Date: Wed, 19 Aug 2026 11:17:49 -0400 Subject: [PATCH 3/3] Address review feedback for serial BGP metal e2e - Remove FRRConfiguration CRD int64 patch (fixed in openshift/cluster-network-operator#3070) - Document MCP wait before BGP setup in local gateway mode - Enable default-network BGP in serial workflow; spare_ips pre-seeds FRR peers for scaled workers - Unskip "Managed cluster should grow and decrease when scaling different machineSets simultaneously" - Update serial workflow documentation Signed-off-by: Jean Chen Co-authored-by: Cursor --- ...gp-dualstack-local-gw-serial-workflow.yaml | 11 +++---- .../baremetalds-e2e-ovn-bgp-pre-commands.sh | 31 +++---------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml index d295a69840adb..cbf483af15fea 100644 --- a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/dualstack-local-gw-serial/baremetalds-e2e-ovn-bgp-dualstack-local-gw-serial-workflow.yaml @@ -14,14 +14,12 @@ workflow: EXTRA_NETWORK_NAMES="extranet" EXTRANET_NETWORK_SUBNET_V4='192.168.221.0/24' EXTRANET_NETWORK_SUBNET_V6='fd2e:6f44:5dd8:ca56::/120' - ADVERTISE_DEFAULT_NETWORK: "false" KONFLUX_TARGET_OPERATORS: nmstate TEST_SUITE: openshift/conformance/serial TEST_SKIPS: Services should fallback to local terminating endpoints when there are no ready endpoints with externalTrafficPolicy=Local\|CPU Partitioning cluster platform workloads should be annotated correctly for Deployments\|should - validate the communication matrix ports match the node's listening ports\|Managed - cluster should grow and decrease when scaling different machineSets simultaneously + validate the communication matrix ports match the node's listening ports pre: - ref: baremetalds-devscripts-conf-featureset - ref: baremetalds-devscripts-conf-extranetwork @@ -37,6 +35,7 @@ workflow: - chain: baremetalds-ofcir-post documentation: |- Like baremetalds-e2e-ovn-bgp-dualstack-local-gw, but runs openshift/conformance/serial - with extra workers and serial-specific TEST_SKIPS. Default-network BGP advertisements are - disabled (ADVERTISE_DEFAULT_NETWORK=false); only the additional machine/extranet network is - advertised for VRF-Lite. Local gateway mode and nmstate are still configured. + with extra workers (NUM_EXTRA_WORKERS=1, APPLY_EXTRA_WORKERS=true) and serial-specific + TEST_SKIPS. Default-network BGP advertisements are enabled; spare baremetal hosts in the + ostestbm pool are pre-seeded as external FRR neighbors so scaled-up workers have peering + from the start. diff --git a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh index f81c3f5ee3047..526da7d6d39cd 100644 --- a/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh +++ b/ci-operator/step-registry/baremetalds/e2e/ovn/bgp/pre/baremetalds-e2e-ovn-bgp-pre-commands.sh @@ -236,7 +236,10 @@ if [ "$local_gateway_mode" = "true" ]; then sleep 10 done fi - echo "Waiting for all MachineConfigPools to finish updating (ensures all pending node reboots complete, including those from prior steps)..." + # LGW ipForwarding=Global (and prior steps such as shared-to-local gateway migration) trigger + # MachineConfig rollouts that can reboot nodes. Wait for MCP Updated before BGP/FRR setup so + # we do not configure external peering while nodes are still draining/rebooting from MCO. + echo "Waiting for all MachineConfigPools to finish updating..." oc wait mcp master worker --for condition=Updated --timeout=25m fi @@ -318,32 +321,6 @@ until oc wait -n openshift-frr-k8s deployment --all --for condition=Available -- sleep 5 done -# Workaround: Kubernetes >=1.36 rejects CRDs that declare format:int32 with -# maximum:4294967295 (above signed int32 max). That makes *any* FRRConfiguration -# apply fail with "Maximum boundary value must be of type integer with format int32" -# even when the ASN value itself is valid. Upstream fix uses format:int64: -# https://github.com/metallb/frr-k8s/commit/7c71d152be3b2383350f475b951ceab0a4323624 -# https://github.com/metallb/metallb/issues/3034 -echo "Patching FRRConfiguration CRD ASN fields to format int64 (K8s 1.36+ validation)..." -oc get crd frrconfigurations.frrk8s.metallb.io -o json | python3 -c ' -import json, sys -crd = json.load(sys.stdin) -for v in crd.get("spec", {}).get("versions", []): - schema = v.get("schema", {}).get("openAPIV3Schema", {}) - try: - routers = schema["properties"]["spec"]["properties"]["bgp"]["properties"]["routers"]["items"]["properties"] - except KeyError: - continue - if "asn" in routers: - routers["asn"]["format"] = "int64" - neighbors = routers.get("neighbors", {}).get("items", {}).get("properties", {}) - if "asn" in neighbors: - neighbors["asn"]["format"] = "int64" - if "localASN" in neighbors: - neighbors["localASN"]["format"] = "int64" -json.dump(crd, sys.stdout) -' | oc replace -f - - # Override FRR-K8s frr and reloader containers only (CNO uses one image for all containers; # upstream FRR image works only for frr/reloader). Make CNO Unmanaged and set those images. # This is used while waiting for OCP builds with FRR 10.