Skip to content

Add Jetson CI periodic jobs and fix JETSON_HOSTNAME to use direct IP - #83181

Open
ggordaniRed wants to merge 1 commit into
openshift:mainfrom
ggordaniRed:jetson-jobs-combined
Open

Add Jetson CI periodic jobs and fix JETSON_HOSTNAME to use direct IP#83181
ggordaniRed wants to merge 1 commit into
openshift:mainfrom
ggordaniRed:jetson-jobs-combined

Conversation

@ggordaniRed

@ggordaniRed ggordaniRed commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Fix JETSON_HOSTNAME from unresolvable FQDN to direct IP 10.26.2.85 (was causing DNS failures in CI pods on build07)
  • Add qe-rhel-jetson-e2e and qe-rhel-jetson-bootc-e2e step-registry workflows
  • Add JP6/RHEL9 variant config (__jp6-rhel9.yaml) with 4 weekly periodic jobs:
    • Mon: sanity suite, Wed: hardware suite, Fri: peripherals suite, Sat: bootc-e2e
  • Add JP7/RHEL10.2 variant config (__jp7-rhel10.yaml) with 4 weekly periodic jobs (staggered):
    • Tue: sanity suite, Thu: hardware suite, Sun: peripherals suite, Sat 08:00: bootc-e2e
  • Regenerate Prow job YAML (periodics + presubmits)

Combines and replaces #83160 and #83170.

Test plan

  • CI config validation passes (make checkconfig)
  • Step registry validation passes (make validate-step-registry)
  • /test pytest presubmit on rh-ecosystem-edge/qe-rhel-jetson reaches device at 10.26.2.85
  • Periodic jobs appear in Prow with correct cron schedules

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Adds weekly Jetson CI coverage for JP6/RHEL9 and JP7/RHEL10 through sanity, hardware, peripherals, and bootc E2E jobs.
  • Adds workflows for standard and bootc Jetson E2E tests.
  • Staggers periodic job schedules across the Jetson variants.
  • Updates JETSON_HOSTNAME to the direct IP 10.26.2.85.
  • Regenerates the related Prow periodic and presubmit job definitions.

- Fix JETSON_HOSTNAME from unresolvable FQDN to direct IP 10.26.2.85
- Add jp6-rhel9 and jp7-rhel10 variant configs with 4 weekly periodics each:
  - e2e-sanity, e2e-hardware, e2e-peripherals, e2e-bootc test suites
  - Staggered cron schedules to avoid overlap between variants
- Add qe-rhel-jetson-e2e and qe-rhel-jetson-bootc-e2e workflows to step-registry
- Regenerate periodic and presubmit Prow job YAML

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

Adds JP6 RHEL 9 and JP7 RHEL 10 Jetson CI configurations. Adds standard and bootc E2E workflows. Updates the configured Jetson host to 10.26.2.85.

Changes

Jetson CI coverage

Layer / File(s) Summary
Jetson CI variant configurations
ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/*
Adds build settings and scheduled sanity, hardware, peripheral, and bootc jobs for JP6 RHEL 9 and JP7 RHEL 10. Updates the pytest host address.
Jetson E2E workflow wiring
ci-operator/step-registry/qe-rhel-jetson/e2e/*
Adds the E2E workflow, TEST_SUITE selection, device prerequisites, and ownership metadata.
Jetson bootc workflow
ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/*
Adds bootc image installation and pytest execution using BOOTC_IMAGE_BASE and BOOTC_IMAGE_TAG, with ownership metadata.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Scheduler
  participant JetsonCI
  participant E2EWorkflow
  participant JetsonDevice
  Scheduler->>JetsonCI: Start scheduled test job
  JetsonCI->>E2EWorkflow: Invoke suite workflow
  E2EWorkflow->>JetsonDevice: Run pytest tests over SSH
Loading

Possibly related PRs


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (2 errors)

Check name Status Explanation Resolution
Container-Privileges ❌ Error Both new JP6 and JP7 image definitions set USER 0 and never switch to a non-root user; no justification or runtime security override appears. Run test containers as a dedicated non-root user, or document and narrowly scope the root requirement instead of leaving USER 0 as the final image user.
No-Sensitive-Data-In-Logs ❌ Error New bootc periodic jobs invoke a command that prints JETSON_HOSTNAME; this PR sets it to the internal address 10.26.2.85, exposing the device endpoint in CI logs. Mask the target address in connectivity and SSH tunnel messages, or log only a generic device identifier.
✅ Passed checks (13 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the two main changes: adding Jetson CI periodic jobs and changing JETSON_HOSTNAME to a direct IP.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes only CI YAML/JSON/OWNERS and workflow metadata; no Ginkgo test source or It/Describe/Context/When title was added or modified.
Test Structure And Quality ✅ Passed The PR changes only CI YAML/JSON/OWNERS and shell workflow files; the new workflows invoke pytest, and no Ginkgo test code or Ginkgo constructs are changed.
Microshift Test Compatibility ✅ Passed The patch adds only CI YAML, Prow jobs, and Jetson pytest workflows; it adds no Ginkgo e2e tests or Describe/Context/When/It declarations, so this check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR adds CI workflows and generated job/config YAML only; it invokes an external pytest suite and adds no Ginkgo tests or SNO-sensitive assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes CI configs, generated Prow jobs, and step workflows; it adds no deployment manifests, operator/controller code, or topology scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The PR changes only YAML, JSON, and OWNERS files; no OTE/Go entrypoint or suite setup is present, and the workflows invoke pytest rather than openshift-tests.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The patch adds only CI YAML, generated Prow jobs, and pytest workflows; it adds no Ginkgo test source or It/Describe/Context/When declarations.
No-Weak-Crypto ✅ Passed Changed files contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons; workflows only invoke SSH-based test steps.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ggordaniRed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 10, 2026
@openshift-ci
openshift-ci Bot requested review from Urilavi2 and onaim500 August 10, 2026 14:02

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml (1)

1-9: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Define the required workflow phases.

The standard workflow omits pre and post. The bootc workflow omits post after changing the device boot configuration. Define the required phases, or document why the standard workflow qualifies as smoke-only. Run make validate-step-registry.

  • ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml#L1-L9: add pre and post phases, or establish the smoke-only exception.
  • ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/qe-rhel-jetson-bootc-e2e-workflow.yaml#L1-L11: add a post phase for required cleanup or recovery.

As per coding guidelines, new workflows should define pre, test, and post phases. Based on learnings, only smoke-only workflows may omit empty phases.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml`
around lines 1 - 9, The standard workflow at
ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml:1-9
must define the required pre, test, and post phases, or explicitly document and
qualify it as smoke-only if empty phases are intentionally omitted. The bootc
workflow at
ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/qe-rhel-jetson-bootc-e2e-workflow.yaml:1-11
must add a post phase covering cleanup or recovery after changing device boot
configuration. Run make validate-step-registry.

Sources: Coding guidelines, Learnings

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml`:
- Around line 13-22: Update both
ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml:13-22
and
ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp7-rhel10.yaml:13-22
so the final test image runs as a non-root user after the root-only package
installation; ensure that user can execute pytest from /workspace and access the
mounted SSH key.

---

Nitpick comments:
In
`@ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml`:
- Around line 1-9: The standard workflow at
ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml:1-9
must define the required pre, test, and post phases, or explicitly document and
qualify it as smoke-only if empty phases are intentionally omitted. The bootc
workflow at
ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/qe-rhel-jetson-bootc-e2e-workflow.yaml:1-11
must add a post phase covering cleanup or recovery after changing device boot
configuration. Run make validate-step-registry.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 16884916-e2d4-4b07-bd7b-0b67882515ca

📥 Commits

Reviewing files that changed from the base of the PR and between 9be95ee and 68e1ccf.

⛔ Files ignored due to path filters (2)
  • ci-operator/jobs/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main-periodics.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (9)
  • ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main.yaml
  • ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml
  • ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp7-rhel10.yaml
  • ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/OWNERS
  • ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/qe-rhel-jetson-bootc-e2e-workflow.metadata.json
  • ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/qe-rhel-jetson-bootc-e2e-workflow.yaml
  • ci-operator/step-registry/qe-rhel-jetson/e2e/OWNERS
  • ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.metadata.json
  • ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml

Comment on lines +13 to +22
- dockerfile_literal: |
FROM ubi-python
USER 0
RUN dnf install -y git && \
ln -sf /usr/bin/python3.12 /usr/bin/python && \
ln -sf /usr/bin/pip3.12 /usr/bin/pip && \
pip install --no-cache-dir ruff pytest PyYAML requests paramiko && \
dnf clean all
COPY . /workspace/
WORKDIR /workspace

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== target files =="
for f in \
  ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml \
  ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp7-rhel10.yaml \
  ci-operator/step-registry/qe-rhel-jetson/e2e/qe-rhel-jetson-e2e-workflow.yaml \
  ci-operator/step-registry/qe-rhel-jetson/bootc-e2e/qe-rhel-jetson-bootc-e2e-workflow.yaml
do
  if [ -f "$f" ]; then
    echo "--- $f ($(wc -l < "$f") lines) ---"
    sed -n '1,120p' "$f"
  else
    echo "MISSING $f"
  fi
done

echo "== locate generated periodic job metadata if present =="
fd -a 'zz_generated_metadata|_metadata|_*.yaml' ci-operator 2>/dev/null | sed 's#^\./##' | grep -E 'rh-ecosystem-edge-qe-rhel-jetson|zz_generated_metadata' | head -100 || true

echo "== search credential mounting/periodic references =="
rg -n "qp.*ssh|ssh|credential|mount|workflow|dockerfile_literal|periodic|test|workspace" ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson ci-operator/step-registry/qe-rhel-jetson -S || true

Repository: openshift/release

Length of output: 20901


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== pytest command script =="
sed -n '1,120p' ci-operator/step-registry/qe-rhel-jetson/pytest/qe-rhel-jetson-pytest-commands.sh

echo "== generated periodic job sample =="
sed -n '1,220p' ci-operator/jobs/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main-periodics.yaml | rg -n "periodics|qe-rhel-jetson|jetpack|test|command|env|ssh-key|workflow|images|cluster-autoscaler|service-account|periodic" -C 2 || true

echo "== dockerfile USER/WORKDIR directives in target configs =="
python3 - <<'PY'
from pathlib import Path
for path in [
    "ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml",
    "ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp7-rhel10.yaml",
]:
    text = Path(path).read_text()
    block_start = text.find("dockerfile_literal:")
    end = text.find("    from:", block_start)
    dockerfile = text[block_start:end] if end != -1 else text[block_start:]
    lines = dockerfile.splitlines()
    print(f"\n{path}")
    for i,row in enumerate(lines,1):
        stripped=rows.strip()
        if any(stripped.startswith(cmd) for cmd in ["USER","WORKDIR","COPY","RUN","FROM"]):
            print(f"{i}: {row}")
    last_user=None
    for row in lines:
        s=row.strip()
        if s.startswith("USER"):
            last_user=s.split(None,1)[1] if " " in s else None
    print("final USER:", last_user if last_user else "(none)")
PY

Repository: openshift/release

Length of output: 5042


Run the final test image as a non-root user.

USER 0 is required for dnf install, but the image remains root when WORKDIR /workspace runs. The test reference mounts qe-rhel-jetson-jetson-ssh-key and qe-rhel-jetson-pytest-commands.sh reads the private key from /var/run/secrets/jetson-ssh-key/id_rsa before running pytest from /workspace. Add a later non-root USER after package installation or adjust the test command to write/run from a writable temp directory. Apply the same change to both jp6-rhel9 and jp7-rhel10 images.

📍 Affects 2 files
  • ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml#L13-L22 (this comment)
  • ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp7-rhel10.yaml#L13-L22
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml`
around lines 13 - 22, Update both
ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp6-rhel9.yaml:13-22
and
ci-operator/config/rh-ecosystem-edge/qe-rhel-jetson/rh-ecosystem-edge-qe-rhel-jetson-main__jp7-rhel10.yaml:13-22
so the final test image runs as a non-root user after the root-only package
installation; ensure that user can execute pytest from /workspace and access the
mounted SSH key.

Source: Coding guidelines

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@ggordaniRed: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp6-rhel9-images rh-ecosystem-edge/qe-rhel-jetson presubmit Presubmit changed
pull-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp7-rhel10-images rh-ecosystem-edge/qe-rhel-jetson presubmit Presubmit changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp7-rhel10-e2e-peripherals N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp7-rhel10-e2e-hardware N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp6-rhel9-e2e-bootc N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp6-rhel9-e2e-sanity N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp6-rhel9-e2e-peripherals N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp7-rhel10-e2e-sanity N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp7-rhel10-e2e-bootc N/A periodic Periodic changed
periodic-ci-rh-ecosystem-edge-qe-rhel-jetson-main-jp6-rhel9-e2e-hardware N/A periodic Periodic changed

The following jobs are not rehearsable without the network-access-rehearsals-ok, and approved labels present on this PR. This is due to the restrict_network_access field being set to false. The network-access-rehearsals-ok label can be added by any openshift org member other than the PR's author by commenting: /pj-rehearse network-access-allowed:

Test name
pull-ci-rh-ecosystem-edge-qe-rhel-jetson-main-pytest

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@onaim500

Copy link
Copy Markdown

/pj-rehearse network-access-allowed

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@onaim500: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@ggordaniRed

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-rh-ecosystem-edge-qe-rhel-jetson-main-pytest

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@ggordaniRed: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

@ggordaniRed: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/rh-ecosystem-edge/qe-rhel-jetson/main/pytest 68e1ccf link unknown /pj-rehearse pull-ci-rh-ecosystem-edge-qe-rhel-jetson-main-pytest

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. network-access-rehearsals-ok

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants