Merge branch 'master' into rds-core

ci-operator/config/kata-containers/kata-containers/kata-containers-kata-containers-main.yaml

@@ -1,6 +1,6 @@
 base_images:
   tests-base:
-    name: "4.16"
+    name: "4.19"
     namespace: ocp
     tag: tests
 binary_build_commands: |
@@ -29,12 +29,12 @@ images:
 releases:
   initial:
     integration:
-      name: "4.16"
+      name: "4.19"
       namespace: ocp
   latest:
     integration:
       include_built_images: true
-      name: "4.16"
+      name: "4.19"
       namespace: ocp
 resources:
   '*':
@@ -59,11 +59,13 @@ tests:
         Pods Extended Pod Container lifecycle evicted pods should be terminal\|\[sig-node\]
         PodOSRejection \[NodeConformance\] Kubelet should reject pod when the node
         OS doesn't match pod's OS\|\[sig-network\].*for evicted pods\|\[sig-network\].*HAProxy
-        router should override the route\|\[sig-network\].*HAProxy router should serve
-        a route\|\[sig-network\].*HAProxy router should serve the correct\|\[sig-network\].*HAProxy
-        router should run\|\[sig-network\].*when FIPS.*the HAProxy router\|\[sig-network\].*bond\|\[sig-network\].*all
+        router should override the route\|\[sig-network\].*HAProxy\|\[sig-network\].*all
         sysctl on whitelist\|\[sig-network\].*sysctls should not affect\|\[sig-network\]
-        pods should successfully create sandboxes by adding pod to network
+        pods should successfully create sandboxes by adding pod to network\|\[sig-network\].*should
+        create pingable pods with vlan interface on an in-container master\|\[sig-network\].*should
+        create a pod with bond interface\|\[sig-node\] Variable Expansion should succeed
+        create a pod with bond interface\|\[sig-node\] Variable Expansion should succeed
+        in writing subpaths in container
     pre:
     - chain: ipi-azure-pre
     - as: kata-containers-e2e-pre

ci-operator/config/kata-containers/kata-containers/kata-containers-kata-containers-main__minus1.yaml

@@ -1,6 +1,6 @@
 base_images:
   tests-base:
-    name: "4.15"
+    name: "4.18"
     namespace: ocp
     tag: tests
 binary_build_commands: |
@@ -29,12 +29,12 @@ images:
 releases:
   initial:
     integration:
-      name: "4.15"
+      name: "4.18"
       namespace: ocp
   latest:
     integration:
       include_built_images: true
-      name: "4.15"
+      name: "4.18"
       namespace: ocp
 resources:
   '*':
@@ -50,18 +50,20 @@ tests:
     cluster_profile: azure4
     env:
       TEST_ARGS: ' --max-parallel-tests 5 --cluster-stability Disruptive --run ^\[sig-node\].*|^\[sig-network\] '
-      TEST_SKIPS: \[sig-node\] Sysctls.*should support sysctls\|\[sig-node\] Security
+      TEST_SKIPS: \[sig-node\] Pods Extended Pod Container Status should never report\|\[sig-node\]
+        Sysctls.*should support sysctls\|\[sig-node\] Pods Extended Pod Container
+        Status should never report success for a pending container\|\[sig-node\] Security
         Context should support seccomp runtime/default\|\[sig-node\] Variable Expansion
         should allow substituting values in a volume subpath\|\[k8s.io\] Probing container
         should be restarted with a docker exec liveness probe with timeout\|\[sig-node\]
         Pods Extended Pod Container lifecycle evicted pods should be terminal\|\[sig-node\]
         PodOSRejection \[NodeConformance\] Kubelet should reject pod when the node
         OS doesn't match pod's OS\|\[sig-network\].*for evicted pods\|\[sig-network\].*HAProxy
-        router should override the route\|\[sig-network\].*HAProxy router should serve
-        a route\|\[sig-network\].*HAProxy router should serve the correct\|\[sig-network\].*HAProxy
-        router should run\|\[sig-network\].*when FIPS.*the HAProxy router\|\[sig-network\].*bond\|\[sig-network\].*all
+        router should override the route\|\[sig-network\].*HAProxy\|\[sig-network\].*all
         sysctl on whitelist\|\[sig-network\].*sysctls should not affect\|\[sig-network\]
-        pods should successfully create sandboxes by adding pod to network
+        pods should successfully create sandboxes by adding pod to network\|\[sig-network\].*should
+        create pingable pods with vlan interface on an in-container master\|\[sig-network\].*should
+        create a pod with bond interface
     pre:
     - chain: ipi-azure-pre
     - as: kata-containers-e2e-pre

ci-operator/config/kata-containers/kata-containers/kata-containers-kata-containers-main__minus2.yaml

@@ -1,6 +1,6 @@
 base_images:
   tests-base:
-    name: "4.14"
+    name: "4.17"
     namespace: ocp
     tag: tests
 binary_build_commands: |
@@ -29,12 +29,12 @@ images:
 releases:
   initial:
     integration:
-      name: "4.14"
+      name: "4.17"
       namespace: ocp
   latest:
     integration:
       include_built_images: true
-      name: "4.14"
+      name: "4.17"
       namespace: ocp
 resources:
   '*':
@@ -50,18 +50,21 @@ tests:
     cluster_profile: azure4
     env:
       TEST_ARGS: ' --max-parallel-tests 5 --cluster-stability Disruptive --run ^\[sig-node\].*|^\[sig-network\] '
-      TEST_SKIPS: \[sig-node\] Sysctls.*should support sysctls\|\[sig-node\] Security
+      TEST_SKIPS: \[sig-node\] Pods Extended Pod Container Status should never report\|\[sig-node\]
+        Sysctls.*should support sysctls\|\[sig-node\] Pods Extended Pod Container
+        Status should never report success for a pending container\|\[sig-node\] Security
         Context should support seccomp runtime/default\|\[sig-node\] Variable Expansion
         should allow substituting values in a volume subpath\|\[k8s.io\] Probing container
         should be restarted with a docker exec liveness probe with timeout\|\[sig-node\]
         Pods Extended Pod Container lifecycle evicted pods should be terminal\|\[sig-node\]
         PodOSRejection \[NodeConformance\] Kubelet should reject pod when the node
         OS doesn't match pod's OS\|\[sig-network\].*for evicted pods\|\[sig-network\].*HAProxy
-        router should override the route\|\[sig-network\].*HAProxy router should serve
-        a route\|\[sig-network\].*HAProxy router should serve the correct\|\[sig-network\].*HAProxy
-        router should run\|\[sig-network\].*when FIPS.*the HAProxy router\|\[sig-network\].*bond\|\[sig-network\].*all
+        router should override the route\|\[sig-network\].*HAProxy\|\[sig-network\].*all
         sysctl on whitelist\|\[sig-network\].*sysctls should not affect\|\[sig-network\]
-        pods should successfully create sandboxes by adding pod to network
+        pods should successfully create sandboxes by adding pod to network\|\[sig-network\].*should
+        create pingable pods with vlan interface on an in-container master\|\[sig-network\].*should
+        create a pod with bond interface\|\[sig-node\] Variable Expansion should succeed
+        in writing subpaths in container
     pre:
     - chain: ipi-azure-pre
     - as: kata-containers-e2e-pre

ci-operator/config/kata-containers/kata-containers/kata-containers-kata-containers-main__minus3.yaml

@@ -1,3 +1,8 @@
+base_images:
+  tests-base:
+    name: "4.16"
+    namespace: ocp
+    tag: tests
 binary_build_commands: |
   # The CentOS 8 build root does not have golang package installed so that we
   # use the golang installed by Kata Containers setup script. Here it is
@@ -13,15 +18,23 @@ images:
     RUN dnf install -y --nobest gettext jq
   from: bin
   to: with-deps
+- dockerfile_literal: |
+    FROM tests-base
+    RUN mv /usr/bin/openshift-tests /usr/bin/openshift-tests-original
+    ADD https://raw.githubusercontent.com/openshift/release/master/ci-operator/config/kata-containers/kata-containers/wrapped-openshift-tests.sh /
+    RUN cat /wrapped-openshift-tests.sh | tr -d '\r' > /usr/bin/openshift-tests
+    RUN chmod +x /usr/bin/openshift-tests
+  from: tests-base
+  to: tests
 releases:
   initial:
     integration:
-      name: "4.13"
+      name: "4.16"
       namespace: ocp
   latest:
     integration:
       include_built_images: true
-      name: "4.13"
+      name: "4.16"
       namespace: ocp
 resources:
   '*':
@@ -36,13 +49,22 @@ tests:
     allow_skip_on_success: true
     cluster_profile: azure4
     env:
-      TEST_ARGS: ' --max-parallel-tests 10 --run ^\[sig-node\].* '
-      TEST_SKIPS: \[sig-node\] Sysctls.*should support sysctls\|\[sig-node\] Security
+      TEST_ARGS: ' --max-parallel-tests 5 --cluster-stability Disruptive --run ^\[sig-node\].*|^\[sig-network\] '
+      TEST_SKIPS: \[sig-node\] Pods Extended Pod Container Status should never report\|\[sig-node\]
+        Sysctls.*should support sysctls\|\[sig-node\] Pods Extended Pod Container
+        Status should never report success for a pending container\|\[sig-node\] Security
         Context should support seccomp runtime/default\|\[sig-node\] Variable Expansion
-        should allow substituting values in a volume subpath\|\[sig-node\] Pods Extended
-        Pod Container lifecycle evicted pods should be terminal\|\[sig-node\] PodOSRejection
-        \[NodeConformance\] Kubelet should reject pod when the node OS doesn't match
-        pod's OS
+        should allow substituting values in a volume subpath\|\[k8s.io\] Probing container
+        should be restarted with a docker exec liveness probe with timeout\|\[sig-node\]
+        Pods Extended Pod Container lifecycle evicted pods should be terminal\|\[sig-node\]
+        PodOSRejection \[NodeConformance\] Kubelet should reject pod when the node
+        OS doesn't match pod's OS\|\[sig-network\].*for evicted pods\|\[sig-network\].*HAProxy
+        router should override the route\|\[sig-network\].*HAProxy\|\[sig-network\].*all
+        sysctl on whitelist\|\[sig-network\].*sysctls should not affect\|\[sig-network\]
+        pods should successfully create sandboxes by adding pod to network\|\[sig-network\].*should
+        create pingable pods with vlan interface on an in-container master\|\[sig-network\].*should
+        create a pod with bond interface\|\[sig-node\] Variable Expansion should succeed
+        in writing subpaths in container
     pre:
     - chain: ipi-azure-pre
     - as: kata-containers-e2e-pre
@@ -66,9 +88,11 @@ tests:
         export KATA_DEPLOY_IMAGE="quay.io/kata-containers/kata-deploy-ci:$(echo "$TAGS" | jq -r '.tags[] | select(.manifest_digest | contains("'"$DIGEST"'")) | .name' | grep -v "kata-containers-latest-amd64")"
         echo "KATA_DEPLOY_IMAGE=$KATA_DEPLOY_IMAGE"
 
-        # Set environment variables for the ci test.sh script
+        # The installer is instructed to configure kata containers to use
+        # QEMU from the RHCOS extension and host's kernel.
+        export KATA_WITH_SYSTEM_QEMU="yes"
+        export KATA_WITH_HOST_KERNEL="yes"
         export KATA_RUNTIME="kata-qemu"
-        export WORKAROUND_9206_CRIO=yes
         # Install Kata Containers and run a smoke test.
         ci/openshift-ci/test.sh
 

ci-operator/config/openshift-eng/rebasebot/openshift-eng-rebasebot-main.yaml

@@ -67,7 +67,7 @@ tests:
       commands: |
         export BRANCH_NAME=$(curl --silent --header "X-GitHub-Api-Version:2022-11-28" "https://api.github.com/repos/IBM-Cloud/cloud-provider-ibm/branches" | grep -E '"name": "release-[0-9]+\.[0-9]+"' | awk -F'"' '{print $4}' | sort -V | tail -n 1)
         rebasebot --source https://github.com/IBM-Cloud/cloud-provider-ibm:${BRANCH_NAME} \
-                  --dest openshift/cloud-provider-ibm:master \
+                  --dest openshift/cloud-provider-ibm:main \
                   --rebase openshift-cloud-team/cloud-provider-ibm:rebase-bot-master \
                   --update-go-modules \
                   --slack-webhook /secrets/rebasebot/slack-webhook \

ci-operator/config/openshift-pipelines/release-tests/openshift-pipelines-release-tests-release-v1.17__openshift-pipelines-ocp4.17-lp-rosa-hypershift.yaml

@@ -0,0 +1,72 @@
+base_images:
+  cli:
+    name: "4.17"
+    namespace: ocp
+    tag: cli
+  cli-ocm:
+    name: cli-ocm
+    namespace: ci
+    tag: latest
+  rosa-aws-cli:
+    name: rosa-aws-cli
+    namespace: ci
+    tag: latest
+  upi-installer:
+    name: "4.17"
+    namespace: ocp
+    tag: upi-installer
+build_root:
+  image_stream_tag:
+    name: release
+    namespace: openshift
+    tag: golang-1.22
+images:
+- context_dir: .
+  dockerfile_path: Dockerfile
+  to: openshift-pipelines-runner
+releases:
+  latest:
+    candidate:
+      product: ocp
+      stream: nightly
+      version: "4.17"
+resources:
+  '*':
+    limits:
+      memory: 8Gi
+    requests:
+      cpu: "1"
+      memory: 4Gi
+tests:
+- as: openshift-pipelines-rosa-hypershift
+  cron: 0 23 31 2 *
+  steps:
+    cluster_profile: aws-cspi-qe
+    env:
+      FIREWATCH_CONFIG: |
+        {
+          "failure_rules":
+              [
+                {"step": "openshift-pipelines-install", "failure_type": "all", "classification": "Operator Installation Failure", "jira_project": "LPINTEROP", "group": {"name": "lp-tests", "priority": 1},"jira_additional_labels": ["!default"]},
+                {"step": "openshift-pipelines-tests", "failure_type": "all", "classification": "Test Failure", "jira_project": "SRVKP", "group": {"name": "lp-tests", "priority": 1}, "jira_additional_labels": ["!default"]}
+              ]
+        }
+      FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/main/firewatch-base-configs/rosa/lp-interop.json
+      FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.17-lp","rosa-hypershift-lp","pipelines-lp"]'
+      FIREWATCH_DEFAULT_JIRA_ASSIGNEE: [email protected]
+      FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP
+      FIREWATCH_FAIL_WITH_TEST_FAILURES: "true"
+      FIREWATCH_JIRA_SERVER: https://issues.redhat.com
+      OCM_LOGIN_ENV: staging
+      OPENSHIFT_VERSION: "4.17"
+      REGION: us-west-2
+    test:
+    - ref: cucushift-hypershift-extended-health-check
+    - ref: openshift-pipelines-install
+    - ref: openshift-pipelines-tests
+    workflow: firewatch-rosa-aws-sts-hypershift
+zz_generated_metadata:
+  branch: release-v1.17
+  org: openshift-pipelines
+  repo: release-tests
+  variant: openshift-pipelines-ocp4.17-lp-rosa-hypershift

ci-operator/config/openshift-pipelines/release-tests/openshift-pipelines-release-tests-release-v1.18__openshift-pipelines-ocp4.19-lp-interop.yaml

@@ -0,0 +1,86 @@
+base_images:
+  cli:
+    name: "4.19"
+    namespace: ocp
+    tag: cli
+build_root:
+  image_stream_tag:
+    name: release
+    namespace: openshift
+    tag: golang-1.22
+images:
+- context_dir: .
+  dockerfile_path: Dockerfile
+  to: openshift-pipelines-runner
+releases:
+  latest:
+    candidate:
+      product: ocp
+      stream: nightly
+      version: "4.19"
+resources:
+  '*':
+    limits:
+      memory: 4Gi
+    requests:
+      cpu: 100m
+      memory: 200Mi
+tests:
+- as: openshift-pipelines-interop-aws
+  cron: 0 23 31 2 *
+  steps:
+    cluster_profile: aws-cspi-qe
+    env:
+      BASE_DOMAIN: cspilp.interop.ccitredhat.com
+      FIREWATCH_CONFIG: |
+        {
+          "failure_rules":
+            [
+              {"step": "openshift-cluster-bot-rbac", "failure_type": "all", "classification": "Other", "jira_additional_labels": ["!default"]},
+              {"step": "openshift-pipelines-install", "failure_type": "all", "classification": "Operator Installation Failure", "jira_additional_labels": ["!default","interop-tests"]},
+              {"step": "openshift-pipelines-tests", "failure_type": "all", "classification": "Test Failure", "jira_project": "SRVKP", "jira_component": ["QA"], "jira_additional_labels": ["!default","interop-tests"]}
+            ]
+        }
+      FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/main/firewatch-base-configs/aws-ipi/lp-interop.json
+      FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.19-lp","self-managed-lp","pipelines-lp"]'
+      FIREWATCH_DEFAULT_JIRA_ASSIGNEE: [email protected]
+      FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP
+      FIREWATCH_FAIL_WITH_TEST_FAILURES: "true"
+      USER_TAGS: |
+        scenario pipelines
+    test:
+    - ref: openshift-pipelines-install
+    - ref: openshift-pipelines-tests
+    workflow: firewatch-ipi-aws
+- as: openshift-pipelines-interop-aws-fips
+  cron: 0 23 31 2 *
+  steps:
+    cluster_profile: aws-cspi-qe
+    env:
+      BASE_DOMAIN: cspilp.interop.ccitredhat.com
+      FIPS_ENABLED: "true"
+      FIREWATCH_CONFIG: |
+        {
+          "failure_rules":
+            [
+              {"step": "openshift-cluster-bot-rbac", "failure_type": "all", "classification": "Other", "jira_additional_labels": ["!default"]},
+              {"step": "openshift-pipelines-install", "failure_type": "all", "classification": "Operator Installation Failure", "jira_additional_labels": ["!default","interop-tests"]},
+              {"step": "openshift-pipelines-tests", "failure_type": "all", "classification": "Test Failure", "jira_project": "SRVKP", "jira_component": ["QA"], "jira_additional_labels": ["!default","interop-tests"]}
+            ]
+        }
+      FIREWATCH_CONFIG_FILE_PATH: https://raw.githubusercontent.com/CSPI-QE/cspi-utils/main/firewatch-base-configs/aws-ipi/lp-interop.json
+      FIREWATCH_DEFAULT_JIRA_ADDITIONAL_LABELS: '["4.19-lp","self-managed-lp","pipelines-lp","fips"]'
+      FIREWATCH_DEFAULT_JIRA_ASSIGNEE: [email protected]
+      FIREWATCH_DEFAULT_JIRA_PROJECT: LPINTEROP
+      FIREWATCH_FAIL_WITH_TEST_FAILURES: "true"
+      USER_TAGS: |
+        scenario pipelines
+    test:
+    - ref: openshift-pipelines-install
+    - ref: openshift-pipelines-tests
+    workflow: firewatch-ipi-aws
+zz_generated_metadata:
+  branch: release-v1.18
+  org: openshift-pipelines
+  repo: release-tests
+  variant: openshift-pipelines-ocp4.19-lp-interop

ci-operator/config/openshift-priv/kube-compare/openshift-priv-kube-compare-main.yaml

@@ -2,7 +2,7 @@ base_images:
   golangci-lint:
     name: golangci-lint
     namespace: ci
-    tag: v1.59.0
+    tag: v1.63.4
   ocp_4.19_cli:
     name: 4.19-priv
     namespace: ocp-private