Skip to content

CM-716: Add baremetal e2e CI job for cert-manager-operator - #81902

Open
sebrandon1 wants to merge 2 commits into
openshift:mainfrom
sebrandon1:cert-manager-baremetal-ci
Open

CM-716: Add baremetal e2e CI job for cert-manager-operator#81902
sebrandon1 wants to merge 2 commits into
openshift:mainfrom
sebrandon1:cert-manager-baremetal-ci

Conversation

@sebrandon1

@sebrandon1 sebrandon1 commented Jul 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds an optional e2e-operator-metal-ipi pre-submit job for openshift/cert-manager-operator
  • Provisions a baremetal cluster via OFCIR/dev-scripts (baremetalds-e2e workflow, equinix-ocp-metal profile)
  • Installs the operator via operator-sdk run bundle and runs Platform:Generic e2e tests
  • always_run: false + optional: true — triggered on-demand via /test e2e-operator-metal-ipi
  • Companion to cert-manager-operator#459 which adds the HTTP01 proxy via nftables MachineConfig for baremetal clusters

Related PRs

PR Title Status
openshift/cert-manager-operator#459 CM-716: HTTP01 Proxy with nftables MachineConfig Open
openshift/release#81900 OCPBUGS-85579: Add consoleless e2e CI job for cert-manager-operator Merged
openshift/release#82100 CNF-25921: Add periodic testing for cert-manager-operator Closed
openshift/cert-manager-operator#464 CNF-26150: Fix flaky e2e ConditionMatcher.Matches early-return Open
openshift/cert-manager-operator#461 CNF-26153: Add unit tests across codebase to close coverage gaps Open

Jira

  • CM-716 — Enable HTTP01 challenges for the API Server on OCP Baremetal (Code Review)

Upstream References

Test Plan

  • CI rehearsal job passes on this PR
  • Trigger e2e-operator-metal-ipi rehearsal to validate baremetal provisioning and operator install
  • Verify operator-sdk run bundle completes and controller-manager reaches Available
  • Platform:Generic e2e tests pass on baremetal cluster

Summary by CodeRabbit

Adds optional CI coverage for openshift/cert-manager-operator.

The e2e-operator-metal-ipi pre-submit job provisions an Equinix bare-metal cluster with baremetalds-e2e, installs the operator bundle, verifies controller-manager availability, and runs filtered Platform:Generic end-to-end tests. Developers can trigger it with /test e2e-operator-metal-ipi.

The configuration also adds an optional tls-scanner job that enables TrustManager, validates a TrustManager resource, and scans TLS 1.3 adherence.

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Adds an optional e2e-operator-metal-ipi job for cert-manager-operator. The job uses Equinix bare metal, installs the operator bundle, verifies controller readiness, and runs filtered Generic non-TechPreview e2e tests.

Changes

Cert-manager operator e2e coverage

Layer / File(s) Summary
Bare-metal IPI e2e workflow
ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
Adds an optional e2e-operator-metal-ipi job with IPv4, OVNKubernetes, intranet access, operator installation, controller readiness checks, filtered e2e tests, CPU requests, and the baremetalds-e2e workflow.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • openshift/release#83156: Adds a similar Equinix bare-metal operator e2e lane with readiness verification and a dedicated workflow.

Suggested reviewers: swghosh, trilokgeer, arun717


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❓ Inconclusive Investigation is still in progress; no verdict submitted yet. Need inspect workflow and comparable jobs before deciding whether added verbose output can expose sensitive data.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely identifies the addition of a bare-metal end-to-end CI job for cert-manager-operator.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only Prow configuration and generated job metadata; added identifiers are static, and no Ginkgo title constructs or dynamic test titles were introduced.
Test Structure And Quality ✅ Passed The commit changes only two CI YAML files; it adds no Ginkgo test source or It, BeforeEach, AfterEach, Eventually, or assertion blocks, so these criteria are not applicable.
Microshift Test Compatibility ✅ Passed The commit adds only CI YAML and presubmit configuration; it adds no Ginkgo test declarations or test files, so this MicroShift compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The commit changes only two YAML CI configuration files; it adds no Ginkgo It/Describe/Context/When tests or multi-node test logic, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility ✅ Passed The commit adds only a Prow CI job and generated presubmit entry; it adds no deployment manifest, controller code, replicas, affinity, topology spread, node selector, toleration, or PDB.
Ote Binary Stdout Contract ✅ Passed The commit changes only two YAML CI configurations; added commands invoke operator-sdk and make test-e2e, with no OTE source or process-level stdout writes added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The commit changes only CI YAML and generated presubmit metadata; it adds no Ginkgo test, IP parsing, URL construction, hardcoded endpoint, or external download.
No-Weak-Crypto ✅ Passed The PR adds only CI YAML; all 126 added lines contain no MD5, SHA-1, DES, 3DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed The added CI job declares no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings; operator installation explicitly uses --security-context-config=restricted.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from TrilokGeer and swghosh July 14, 2026 20:40

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml`:
- Around line 326-327: Add an explicit 10-minute timeout to the oc wait
invocation for deployment cert-manager-operator-controller-manager, preserving
its existing Available condition and namespace arguments.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 935b2875-6109-4ceb-a71d-b76de8fa422a

📥 Commits

Reviewing files that changed from the base of the PR and between 4c81ad4 and c06cce0.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (1)
  • ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml

@openshift-ci-robot

openshift-ci-robot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

@sebrandon1: This pull request references CM-716 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Adds an optional e2e-operator-metal-ipi pre-submit job for openshift/cert-manager-operator
  • Provisions a baremetal cluster via OFCIR/dev-scripts (baremetalds-e2e workflow, equinix-ocp-metal profile)
  • Installs the operator via operator-sdk run bundle and runs Platform:Generic e2e tests
  • always_run: false + optional: true — triggered on-demand via /test e2e-operator-metal-ipi
  • Companion to cert-manager-operator#459 which adds the HTTP01 proxy via nftables MachineConfig for baremetal clusters

Test plan

  • CI rehearsal job passes on this PR
  • Trigger e2e-operator-metal-ipi rehearsal to validate baremetal provisioning and operator install

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 16, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@sebrandon1, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto 854204afa775152479410f4e032d8f810bfc30d0 due to conflicts
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from ec01eea to 4a38041 Compare July 16, 2026 20:39
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 16, 2026
@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from 4a38041 to 25081ab Compare July 17, 2026 15:18
@sebrandon1

Copy link
Copy Markdown
Member Author

/rebase

@bharath-b-rh bharath-b-rh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 29, 2026
@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bharath-b-rh, sebrandon1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 29, 2026
@bharath-b-rh

Copy link
Copy Markdown
Contributor

/pj-rehearse auto-ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@bharath-b-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from 25081ab to da6fe8c Compare August 10, 2026 12:57
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 10, 2026
@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

New changes are detected. LGTM label has been removed.

@sebrandon1

Copy link
Copy Markdown
Member Author

Rebased against upstream/main. Resolved a merge conflict in ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml: upstream added a new tls-scanner test at the same location where this PR adds the e2e-operator-metal-ipi test. Both tests were preserved -- the upstream tls-scanner test appears first, followed by the PR's e2e-operator-metal-ipi test.

@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from da6fe8c to b291501 Compare August 10, 2026 13:41
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 10, 2026
@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@sebrandon1, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto 9be95eec3139a2af7022da80441faa9a86c4a504 due to conflicts
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from b291501 to adb2d56 Compare August 10, 2026 14:15
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 10, 2026
@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from adb2d56 to f2999b1 Compare August 10, 2026 14:22
@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

@sebrandon1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/openshift/cert-manager-operator/master/e2e-operator-metal-ipi 25081ab link unknown /pj-rehearse pull-ci-openshift-cert-manager-operator-master-e2e-operator-metal-ipi

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@sebrandon1
sebrandon1 force-pushed the cert-manager-baremetal-ci branch from f2999b1 to a019316 Compare August 11, 2026 13:04
The oc wait command for the cert-manager-operator deployment was using
the default 30s timeout, which can be too short for operator startup.
Add --timeout=5m consistent with other oc wait calls in the file.
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@sebrandon1: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@sebrandon1: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-cert-manager-operator-master-e2e-operator-metal-ipi openshift/cert-manager-operator presubmit Presubmit changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants