CORS-4212

ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21__multi-nightly.yaml

@@ -211,6 +211,40 @@ tests:
     test:
     - chain: openshift-e2e-test-qe-destructive
     workflow: cucushift-installer-rehearse-aws-ipi-byo-kms-etcd-encryption
+- as: aws-ipi-localzone-rootvolume-f7
+  cron: 52 7 3,10,17,24 * *
+  steps:
+    cluster_profile: aws-1-qe
+    env:
+      AWS_DEFAULT_GP3_THROUGHPUT: "500"
+      AWS_DEFAULT_MACHINE_VOLUME_SIZE: "120"
+      AWS_DEFAULT_MACHINE_VOLUME_TYPE: gp3
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      EDGE_ZONES_LIST: us-east-1-dfw-2a
+      ENABLE_AWS_EDGE_ZONE: "yes"
+    test:
+    - chain: openshift-e2e-test-qe
+    workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-rootvolume
+- as: aws-ipi-localzone-rootvolume-f28-destructive
+  cron: 16 9 15 * *
+  steps:
+    cluster_profile: aws-1-qe
+    env:
+      AWS_COMPUTE_GP3_THROUGHPUT: "1000"
+      AWS_COMPUTE_VOLUME_SIZE: "120"
+      AWS_COMPUTE_VOLUME_TYPE: gp3
+      AWS_CONTROL_PLANE_GP3_THROUGHPUT: "1200"
+      AWS_CONTROL_PLANE_VOLUME_SIZE: "150"
+      AWS_CONTROL_PLANE_VOLUME_TYPE: gp3
+      AWS_EDGE_GP3_THROUGHPUT: "1000"
+      AWS_EDGE_VOLUME_SIZE: "120"
+      AWS_EDGE_VOLUME_TYPE: gp3
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      EDGE_ZONES_LIST: us-east-1-dfw-2a
+      ENABLE_AWS_EDGE_ZONE: "yes"
+    test:
+    - chain: openshift-e2e-test-qe-destructive
+    workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-rootvolume
 - as: aws-ipi-byo-route53-compact-cloudfront-amd-f28-destructive
   cron: 32 20 19 * *
   steps:

ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.21-periodics.yaml

@@ -70410,6 +70410,170 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build09
+  cron: 16 9 15 * *
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+  extra_refs:
+  - base_ref: release-4.21
+    org: openshift
+    repo: openshift-tests-private
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: aws-1-qe
+    ci-operator.openshift.io/variant: multi-nightly
+    ci.openshift.io/generator: prowgen
+    job-release: "4.21"
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-openshift-tests-private-release-4.21-multi-nightly-aws-ipi-localzone-rootvolume-f28-destructive
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --oauth-token-path=/usr/local/github-credentials/oauth
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=aws-ipi-localzone-rootvolume-f28-destructive
+      - --variant=multi-nightly
+      command:
+      - ci-operator
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /usr/local/github-credentials
+        name: github-credentials-openshift-ci-robot-private-git-cloner
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: github-credentials-openshift-ci-robot-private-git-cloner
+      secret:
+        secretName: github-credentials-openshift-ci-robot-private-git-cloner
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
+- agent: kubernetes
+  cluster: build09
+  cron: 52 7 3,10,17,24 * *
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+  extra_refs:
+  - base_ref: release-4.21
+    org: openshift
+    repo: openshift-tests-private
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: aws-1-qe
+    ci-operator.openshift.io/variant: multi-nightly
+    ci.openshift.io/generator: prowgen
+    job-release: "4.21"
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-openshift-tests-private-release-4.21-multi-nightly-aws-ipi-localzone-rootvolume-f7
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --oauth-token-path=/usr/local/github-credentials/oauth
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=aws-ipi-localzone-rootvolume-f7
+      - --variant=multi-nightly
+      command:
+      - ci-operator
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /usr/local/github-credentials
+        name: github-credentials-openshift-ci-robot-private-git-cloner
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: github-credentials-openshift-ci-robot-private-git-cloner
+      secret:
+        secretName: github-credentials-openshift-ci-robot-private-git-cloner
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
 - agent: kubernetes
   cluster: build09
   cron: 29 21 5,12,21,28 * *

ci-operator/step-registry/cucushift/installer/check/aws/rootvolume/OWNERS

@@ -0,0 +1,8 @@
+approvers:
+- yunjiang29
+- gpei
+- liweinan
+reviewers:
+- yunjiang29
+- gpei
+- liweinan

ci-operator/step-registry/cucushift/installer/check/aws/rootvolume/cucushift-installer-check-aws-rootvolume-commands.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+
+set -o nounset
+set -o errexit
+set -o pipefail
+
+# save the exit code for junit xml file generated in step gather-must-gather
+# pre configuration steps before running installation, exit code 100 if failed,
+# save to install-pre-config-status.txt
+# post check steps after cluster installation, exit code 101 if failed,
+# save to install-post-check-status.txt
+EXIT_CODE=101
+trap 'if [[ "$?" == 0 ]]; then EXIT_CODE=0; fi; echo "${EXIT_CODE}" > "${SHARED_DIR}/install-post-check-status.txt"' EXIT TERM
+
+export AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred"
+
+if [ -f "${SHARED_DIR}/kubeconfig" ] ; then
+  export KUBECONFIG="${SHARED_DIR}/kubeconfig"
+else
+  echo "No KUBECONFIG found, exit now"
+  exit 1
+fi
+
+# Get cluster infrastructure details
+INFRA_ID=$(jq -r '.infraID' "${SHARED_DIR}/metadata.json")
+CLUSTER_ID="${INFRA_ID}"
+REGION=$(oc get infrastructure cluster -o jsonpath='{.status.platformStatus.aws.region}')
+
+echo "Cluster ID: ${CLUSTER_ID}"
+echo "Region: ${REGION}"
+
+CONFIG="${SHARED_DIR}/install-config.yaml"
+
+if [ ! -f "${CONFIG}" ]; then
+  echo "No install-config found, exit now"
+  exit 1
+fi
+
+function read_install_config() {
+  local query="$1"
+  yq-go r "${CONFIG}" "${query}" 2>/dev/null || true
+}
+
+# Read all root volume type/throughput/iops configurations from install-config.yaml
+# worker pool is at compute[0], edge pool is at compute[1]
+DEFAULT_TYPE=$(read_install_config 'platform.aws.defaultMachinePlatform.rootVolume.type')
+DEFAULT_THROUGHPUT=$(read_install_config 'platform.aws.defaultMachinePlatform.rootVolume.throughput')
+DEFAULT_IOPS=$(read_install_config 'platform.aws.defaultMachinePlatform.rootVolume.iops')
+
+CONTROL_PLANE_TYPE=$(read_install_config 'controlPlane.platform.aws.rootVolume.type')
+CONTROL_PLANE_THROUGHPUT=$(read_install_config 'controlPlane.platform.aws.rootVolume.throughput')
+CONTROL_PLANE_IOPS=$(read_install_config 'controlPlane.platform.aws.rootVolume.iops')
+
+COMPUTE_TYPE=$(read_install_config "compute[0].platform.aws.rootVolume.type")
+COMPUTE_THROUGHPUT=$(read_install_config "compute[0].platform.aws.rootVolume.throughput")
+COMPUTE_IOPS=$(read_install_config "compute[0].platform.aws.rootVolume.iops")
+
+CONTROL_PLANE_COUNT=$(read_install_config "controlPlane.replicas")
+COMPUTE_COUNT=$(read_install_config "compute[0].replicas")
+
+ret=0
+
+VOLS_JSON="${ARTIFACT_DIR}/vols.json"
+aws --region "${REGION}" ec2 describe-volumes --filters "Name=tag:kubernetes.io/cluster/${INFRA_ID},Values=owned" > "${VOLS_JSON}"
+
+function volume_check() {
+  local role=$1
+  local expect_type=$2
+  local expect_throughput=$3
+  local expect_iops=$4
+  local expect_count=$5
+
+  echo "Checking ${role} volumes: type=${expect_type}, throughput=${expect_throughput}, iops=${expect_iops}, count=${expect_count}"
+
+  local matched
+  matched=$(jq -r --arg r "-${role}-" --arg t "${expect_type}" --argjson tp "${expect_throughput}" --argjson i "${expect_iops}" \
+    '[.Volumes[] | select((.Tags[] | (.Key == "Name" and (.Value | contains($r)))) and .Iops == $i and .VolumeType == $t and .Throughput == $tp)] | length' "${VOLS_JSON}")
+
+  if [ "${matched}" != "${expect_count}" ]; then
+    echo "ERROR: ${role} volumes mismatch (expected ${expect_count}, got ${matched}). See $(basename "${VOLS_JSON}")"
+    ret=$((ret+1))
+  else
+    echo "PASS: ${role} volumes match expected configuration."
+  fi
+}
+
+echo "-------------------------------------------------------------"
+echo "Checking root volumes (gp3: type/throughput/iops/count)"
+echo "-------------------------------------------------------------"
+
+# control-plane (always expected)
+EXPECTED_CONTROL_PLANE_TYPE="${CONTROL_PLANE_TYPE:-${DEFAULT_TYPE}}"
+EXPECTED_CONTROL_PLANE_THROUGHPUT="${CONTROL_PLANE_THROUGHPUT:-${DEFAULT_THROUGHPUT}}"
+EXPECTED_CONTROL_PLANE_IOPS="${CONTROL_PLANE_IOPS:-${DEFAULT_IOPS}}"
+
+if [[ "${EXPECTED_CONTROL_PLANE_TYPE}" == "gp3" && -n "${EXPECTED_CONTROL_PLANE_THROUGHPUT}" && -n "${EXPECTED_CONTROL_PLANE_IOPS}" && -n "${CONTROL_PLANE_COUNT}" ]]; then
+  volume_check "master" "${EXPECTED_CONTROL_PLANE_TYPE}" "${EXPECTED_CONTROL_PLANE_THROUGHPUT}" "${EXPECTED_CONTROL_PLANE_IOPS}" "${CONTROL_PLANE_COUNT}"
+else
+  echo "SKIP: control-plane volumes not fully specified."
+fi
+
+# worker pool (compute[0])
+EXPECTED_COMPUTE_TYPE="${COMPUTE_TYPE:-${DEFAULT_TYPE}}"
+EXPECTED_COMPUTE_THROUGHPUT="${COMPUTE_THROUGHPUT:-${DEFAULT_THROUGHPUT}}"
+EXPECTED_COMPUTE_IOPS="${COMPUTE_IOPS:-${DEFAULT_IOPS}}"
+
+if [[ "${EXPECTED_COMPUTE_TYPE}" == "gp3" && -n "${EXPECTED_COMPUTE_THROUGHPUT}" && -n "${EXPECTED_COMPUTE_IOPS}" && -n "${COMPUTE_COUNT}" ]]; then
+  volume_check "worker" "${EXPECTED_COMPUTE_TYPE}" "${EXPECTED_COMPUTE_THROUGHPUT}" "${EXPECTED_COMPUTE_IOPS}" "${COMPUTE_COUNT}"
+else
+  echo "SKIP: worker volumes not fully specified."
+fi
+
+# edge pool (compute[1]) only when edge zone is enabled
+if [[ "${ENABLE_AWS_EDGE_ZONE}" == "yes" ]]; then
+  EDGE_TYPE=$(read_install_config "compute[1].platform.aws.rootVolume.type")
+  EDGE_THROUGHPUT=$(read_install_config "compute[1].platform.aws.rootVolume.throughput")
+  EDGE_IOPS=$(read_install_config "compute[1].platform.aws.rootVolume.iops")
+  EDGE_COUNT=$(read_install_config "compute[1].replicas")
+
+  EXPECTED_EDGE_TYPE="${EDGE_TYPE:-${DEFAULT_TYPE}}"
+  EXPECTED_EDGE_THROUGHPUT="${EDGE_THROUGHPUT:-${DEFAULT_THROUGHPUT}}"
+  EXPECTED_EDGE_IOPS="${EDGE_IOPS:-${DEFAULT_IOPS}}"
+
+  if [[ "${EXPECTED_EDGE_TYPE}" == "gp3" && -n "${EXPECTED_EDGE_THROUGHPUT}" && -n "${EXPECTED_EDGE_IOPS}" && -n "${EDGE_COUNT}" ]]; then
+    volume_check "edge" "${EXPECTED_EDGE_TYPE}" "${EXPECTED_EDGE_THROUGHPUT}" "${EXPECTED_EDGE_IOPS}" "${EDGE_COUNT}"
+  else
+    echo "SKIP: edge volumes not fully specified or edge zone disabled."
+  fi
+fi
+
+echo "-------------------------------------------------------------"
+echo "Test Summary"
+echo "-------------------------------------------------------------"
+if [ ${ret} -eq 0 ]; then
+  echo "All root volume checks passed."
+else
+  echo "Some root volume checks failed. See $(basename "${VOLS_JSON}") for details."
+fi
+
+exit ${ret}

ci-operator/step-registry/cucushift/installer/check/aws/rootvolume/cucushift-installer-check-aws-rootvolume-ref.metadata.json

@@ -0,0 +1,15 @@
+{
+	"path": "cucushift/installer/check/aws/rootvolume/cucushift-installer-check-aws-rootvolume-ref.yaml",
+	"owners": {
+		"approvers": [
+			"yunjiang29",
+			"gpei",
+			"liweinan"
+		],
+		"reviewers": [
+			"yunjiang29",
+			"gpei",
+			"liweinan"
+		]
+	}
+}