From fb1c4b45ccae5a91d8cd920ea03cdaf3b70fea8c Mon Sep 17 00:00:00 2001 From: Sally O'Malley Date: Fri, 13 Mar 2020 17:03:27 -0400 Subject: [PATCH 1/3] installer-e2e template: remove the -insecure-skip-tls-verify, cleanup fips check --- .../cluster-launch-installer-e2e.yaml | 37 ++++++++++++++----- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/ci-operator/templates/openshift/installer/cluster-launch-installer-e2e.yaml b/ci-operator/templates/openshift/installer/cluster-launch-installer-e2e.yaml index ebdd7da8f631..5e2921ce1a6d 100644 --- a/ci-operator/templates/openshift/installer/cluster-launch-installer-e2e.yaml +++ b/ci-operator/templates/openshift/installer/cluster-launch-installer-e2e.yaml @@ -159,23 +159,40 @@ objects: trap 'jobs -p | xargs -r kill || true; exit 0' TERM function fips_check() { - oc --insecure-skip-tls-verify --request-timeout=60s get nodes -o jsonpath --template '{range .items[*]}{.metadata.name}{"\n"}{end}' > /tmp/nodelist - while IFS= read -r i; do - oc -n default --insecure-skip-tls-verify --request-timeout=60s debug --image centos:7 node/$i -- cat /proc/sys/crypto/fips_enabled > /tmp/enabled + get_nodes=$(oc --request-timeout=60s get nodes -o jsonpath --template '{range .items[*]}{.metadata.name}{"\n"}{end}') + nodes=( $get_nodes ) + # bash doesn't handle '.' in array elements easily + for i in {0..5}; do + attempt=0 + while true; do + out=$(oc --request-timeout=60s -n default debug node/"${nodes[i]}" -- cat /proc/sys/crypto/fips_enabled || true) + if [[ ! -z "${out}" ]]; then + break + fi + attempt=$(( attempt + 1 )) + if [[ $attempt -gt 3 ]]; then + break + fi + echo "command failed, $(( 4 - $attempt )) retries left" + sleep 5 + done + + if [[ -z "${out}" ]]; then + echo "oc debug node/${nodes[i]} failed" + exit 1 + fi if [[ "${CLUSTER_VARIANT}" =~ "fips" ]]; then - if [[ $(< /tmp/enabled) == "0" ]]; then - echo fips not enabled in node "$i" but should be, exiting + if [[ "${out}" -ne 1 ]]; then + echo "fips not enabled in node ${nodes[i]} but should be, exiting" exit 1 fi else - if [[ $(< /tmp/enabled) == "1" ]]; then - echo fips is enabled in node "$i" but should not be, exiting + if [[ "${out}" -ne 0 ]]; then + echo "fips is enabled in node ${nodes[i]} but should not be, exiting" exit 1 fi fi - done Date: Sun, 26 Apr 2020 19:57:13 -0400 Subject: [PATCH 2/3] make e2e-aws-fips blocking for origin prs --- .../openshift/origin/openshift-origin-master-presubmits.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml b/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml index 3cd0f53be0eb..c1e3268958bf 100644 --- a/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml @@ -317,7 +317,6 @@ presubmits: labels: pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-openshift-origin-master-e2e-aws-fips - optional: true rerun_command: /test e2e-aws-fips spec: containers: From 8b6b3626e961b5ff54bee49650c6bf51b24aa6b3 Mon Sep 17 00:00:00 2001 From: Sally O'Malley Date: Tue, 12 May 2020 12:31:36 -0400 Subject: [PATCH 3/3] remove e2e-aws now that e2e-aws-fips is blocking --- .../origin/openshift-origin-master.yaml | 4 - .../openshift-origin-master-presubmits.yaml | 75 ------------------- 2 files changed, 79 deletions(-) diff --git a/ci-operator/config/openshift/origin/openshift-origin-master.yaml b/ci-operator/config/openshift/origin/openshift-origin-master.yaml index dd9bfd9f57d4..47edfcb4c5dc 100644 --- a/ci-operator/config/openshift/origin/openshift-origin-master.yaml +++ b/ci-operator/config/openshift/origin/openshift-origin-master.yaml @@ -194,10 +194,6 @@ tests: commands: TEST_SUITE=openshift/conformance/parallel run-tests openshift_installer: cluster_profile: gcp -- as: e2e-aws - steps: - cluster_profile: aws - workflow: origin-e2e-aws-loki - as: e2e-aws-ovn steps: cluster_profile: aws diff --git a/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml b/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml index c1e3268958bf..6ca6a1acac44 100644 --- a/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/origin/openshift-origin-master-presubmits.yaml @@ -48,81 +48,6 @@ presubmits: secret: secretName: regcred trigger: (?m)^/test( | .* )artifacts,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - master - cluster: api.ci - context: ci/prow/e2e-aws - decorate: true - decoration_config: - skip_cloning: true - labels: - ci-operator.openshift.io/prowgen-controlled: "true" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-origin-master-e2e-aws - rerun_command: /test e2e-aws - spec: - containers: - - args: - - --artifact-dir=$(ARTIFACTS) - - --give-pr-author-access-to-namespace=true - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --kubeconfig=/etc/apici/kubeconfig - - --lease-server-password-file=/etc/boskos/password - - --report-password-file=/etc/report/password.txt - - --report-username=ci - - --secret-dir=/usr/local/e2e-aws-cluster-profile - - --target=e2e-aws - command: - - ci-operator - image: ci-operator:latest - imagePullPolicy: Always - name: "" - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/apici - name: apici-ci-operator-credentials - readOnly: true - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /usr/local/e2e-aws-cluster-profile - name: cluster-profile - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: apici-ci-operator-credentials - secret: - items: - - key: sa.ci-operator.apici.config - path: kubeconfig - secretName: apici-ci-operator-credentials - - name: boskos - secret: - items: - - key: password - path: password - secretName: boskos-credentials - - name: cluster-profile - projected: - sources: - - secret: - name: cluster-secrets-aws - - name: pull-secret - secret: - secretName: regcred - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )e2e-aws,?($|\s.*) - agent: kubernetes always_run: true branches: