[DEBUG][DO NOT MERGE] Add azure-ipi-peerpods-ga job for candidate422

ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml

@@ -45,10 +45,10 @@ tests:
       ENABLE_MUST_GATHER: "true"
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
-      SLEEP_DURATION: 0h
+      SLEEP_DURATION: 8h
       TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&
       TEST_RELEASE_TYPE: Pre-GA
       TEST_SCENARIOS: sig-kata.*Kata Author
@@ -81,11 +81,11 @@ tests:
       ENABLEPEERPODS: "true"
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
       RUNTIMECLASS: kata-remote
-      SLEEP_DURATION: 0h
+      SLEEP_DURATION: 8h
       TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133&
       TEST_RELEASE_TYPE: Pre-GA
       TEST_SCENARIOS: sig-kata.*Kata Author
@@ -119,7 +119,7 @@ tests:
       ENABLEPEERPODS: "true"
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
       RUNTIMECLASS: kata-remote
@@ -157,7 +157,7 @@ tests:
       HYPERSHIFT_AZURE_LOCATION: eastus
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       LOCATION: eastus
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
@@ -196,7 +196,7 @@ tests:
       HYPERSHIFT_AZURE_LOCATION: eastus
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       LOCATION: eastus
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
@@ -234,7 +234,7 @@ tests:
       ENABLEPEERPODS: "true"
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
       RUNTIMECLASS: kata-remote
@@ -271,7 +271,7 @@ tests:
       ENABLEPEERPODS: "true"
       INITDATA: ""
       INSTALL_KATA_RPM: "true"
-      KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9
+      KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
       RUNTIMECLASS: kata-remote

ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml

@@ -34,7 +34,7 @@ tests:
     report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}}
       {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}}
       <{{.Status.URL}}|View logs>'
-  restrict_network_access: false
+  restrict_network_access: true
   steps:
     cluster_profile: azure-qe
     env:
@@ -48,14 +48,53 @@ tests:
       KATA_RPM_VERSION: 3.31.0-2.rhaos4.22.el9
       MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
       MUST_GATHER_ON_FAILURE_ONLY: "false"
+      OSC_INSTALL: "true"
       SLEEP_DURATION: 0h
       TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&
       TEST_RELEASE_TYPE: Pre-GA
-      TEST_SCENARIOS: sig-kata.*Kata Author
+      TEST_SCENARIOS: C00102
       TEST_TIMEOUT: "90"
       TRUSTEE_URL: ""
     workflow: sandboxed-containers-operator-e2e-azure
   timeout: 24h0m0s
+- as: azure-ipi-peerpods-ga
+  capabilities:
+  - intranet
+  cron: 0 0 31 2 1
+  reporter_config:
+    channel: '#kata-ocp-ci-reports'
+    job_states_to_report:
+    - success
+    - failure
+    - error
+    report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}}
+      {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}}
+      <{{.Status.URL}}|View logs>'
+  restrict_network_access: true
+  steps:
+    cluster_profile: azure-qe
+    env:
+      BASE_DOMAIN: qe.azure.devcluster.openshift.com
+      CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/osc-test-fbc:latest
+      CATALOG_SOURCE_NAME: brew-catalog
+      CUSTOM_AZURE_REGION: eastus
+      ENABLE_MUST_GATHER: "true"
+      ENABLEPEERPODS: "true"
+      INITDATA: ""
+      INSTALL_KATA_RPM: "false"
+      MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
+      MUST_GATHER_ON_FAILURE_ONLY: "false"
+      OSC_INSTALL: "true"
+      RUNTIMECLASS: kata-remote
+      SLEEP_DURATION: 0h
+      TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&
+      TEST_RELEASE_TYPE: Pre-GA
+      TEST_SCENARIOS: C00102
+      TEST_TIMEOUT: "120"
+      TRUSTEE_URL: ""
+      WORKLOAD_TO_TEST: peer-pods
+    workflow: sandboxed-containers-operator-e2e-azure
+  timeout: 24h0m0s
 - as: azure-ipi-peerpods
   capabilities:
   - intranet

ci-operator/jobs/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel-periodics.yaml

@@ -4605,6 +4605,100 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build09
+  cron: 0 0 31 2 1
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+    timeout: 24h0m0s
+  extra_refs:
+  - base_ref: devel
+    org: openshift
+    repo: sandboxed-containers-operator
+  labels:
+    capability/intranet: intranet
+    ci-operator.openshift.io/cloud: azure4
+    ci-operator.openshift.io/cloud-cluster-profile: azure-qe
+    ci-operator.openshift.io/variant: downstream-candidate422
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate422-azure-ipi-peerpods-ga
+  reporter_config:
+    slack:
+      channel: '#kata-ocp-ci-reports'
+      job_states_to_report:
+      - success
+      - failure
+      - error
+      report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}}
+        {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}}
+        <{{.Status.URL}}|View logs>'
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=azure-ipi-peerpods-ga
+      - --variant=downstream-candidate422
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
 - agent: kubernetes
   cluster: build09
   cron: 0 0 31 2 1

ci-operator/step-registry/sandboxed-containers-operator/env-cm/sandboxed-containers-operator-env-cm-commands.sh

@@ -6,140 +6,6 @@ configmap_path="${SHARED_DIR:-$(pwd)}/env-cm.yaml"
 #echo "Giving a 10min stabilization time for AWS fresh 4.18 cluster before applying kataconfig as workaround for KATA-3451"
 #sleep 600
 
-create_catsrc() {
-  local catsrc_name="$1"
-  local catsrc_image="$2"
-  local catsrc_path="${SHARED_DIR:-$(pwd)}/catsrc_${catsrc_name}.yaml"
-
-  echo "Create a custom catalogsource named ${catsrc_name} for internal builds"
-
-  cat<<-EOF | tee "${catsrc_path}"
-  apiVersion: operators.coreos.com/v1alpha1
-  kind: CatalogSource
-  metadata:
-    name: "${catsrc_name}"
-    namespace: openshift-marketplace
-  spec:
-    displayName: QE
-    image: "${catsrc_image}"
-    publisher: QE
-    sourceType: grpc
-EOF
-
-  oc apply -f "${catsrc_path}"
-}
-
-# The "latest" tag does not convey information about the build time, so
-# we search in quay.io for an X.Y.Z-unix_epoch (e.g., 1.11.1-1766149846)
-# the first X.Y.Z-unix_epoch tag we find is the newest one because Quay
-# returns tags sorted by creation time (newest first).and we return it
-# if no tag is found, we return "latest"
-#
-# Optimization: Quay returns tags sorted by creation time (newest first).
-# So the first X.Y.Z-unix_epoch tag we find is the newest one - we can stop immediately.
-latest_catsrc_image_tag() {
-    local api_url="https://quay.io/api/v1/repository/redhat-user-workloads/ose-osc-tenant/osc-test-fbc/tag/"
-    local page=1
-    local max_pages=20 # safety limit, typically exits much earlier
-
-    while [ "$page" -le "$max_pages" ]; do
-        local resp
-        # Query with onlyActiveTags to skip deleted tags
-        resp=$(curl -sf "${api_url}?limit=100&page=${page}&onlyActiveTags=true")
-
-        if [ -z "$resp" ] || ! jq -e '.tags | length > 0' <<< "$resp" >/dev/null 2>&1; then
-            break
-        fi
-
-        # Find the first matching tag on this page (X.Y.Z-unix_epoch pattern)
-        # Since Quay returns newest first, the first match is the latest tag
-        local first_match
-        first_match=$(echo "$resp" | \
-            jq -r '.tags[]? | select(.name | test("^[0-9]+\\.[0-9]+\\.[0-9]+-[0-9]+$")) | .name' | head -1)
-
-        if [ -n "$first_match" ]; then
-            echo "$first_match"
-            return 0
-        fi
-
-        ((page++))
-    done
-
-    # Check if we hit max_pages without finding a tag (potential issue)
-    if [ "$page" -gt "$max_pages" ]; then
-        echo "ERROR: Hit max_pages ($max_pages) limit while searching for tags." >&2
-    fi
-
-    # Fallback to :latest if no matching tag found
-    echo "WARNING: No X.Y.Z-unix_epoch tag found, using :latest" >&2
-    echo "latest"
-}
-
-mirror_konflux() {
-  echo "Create mirror for konflux images"
-  # create the mirror set for the sandboxed-containers-operator and trustee-fbc devel branches
-  oc apply -f "https://raw.githubusercontent.com/openshift/sandboxed-containers-operator/refs/heads/devel/.tekton/images-mirror-set.yaml"
-  oc apply -f "https://raw.githubusercontent.com/openshift/trustee-fbc/refs/heads/main/.tekton/images-mirror-set.yaml"
-}
-
-wait_for_catsrc() {
-  local catsrc_name="$1"
-  local timeout=300
-  echo ">>> Waiting for CatalogSource ${catsrc_name} to be READY..."
-
-  local deadline=$(( SECONDS + timeout ))
-  while (( SECONDS < deadline )); do
-    local state
-    state="$(oc get catalogsource -n openshift-marketplace \
-        "${catsrc_name}" -o jsonpath='{.status.connectionState.lastObservedState}' \
-        2>/dev/null || echo "")"
-    if [[ "${state}" == "READY" ]]; then
-      echo ">>> CatalogSource ${catsrc_name} is READY"
-      return 0
-    fi
-    sleep 10
-  done
-
-  local state
-  state="$(oc get catalogsource -n openshift-marketplace "${catsrc_name}" \
-      -o jsonpath='{.status.connectionState.lastObservedState}' 2>/dev/null || echo "")"
-  if [[ "${state}" != "READY" ]]; then
-    echo "ERROR: CatalogSource ${catsrc_name} not READY after ${timeout}s (state: ${state})" >&2
-    oc get catalogsource -n openshift-marketplace "${catsrc_name}" -o yaml || true
-    exit 1
-  fi
-  echo ">>> CatalogSource ${catsrc_name} is READY"
-  return 0
-}
-
-
-if [[ "$TEST_RELEASE_TYPE" == "Pre-GA" ]]; then
-  mirror_konflux
-
-  default_catsrc_image="quay.io/redhat-user-workloads/ose-osc-tenant/osc-test-fbc"
-  # Only resolve the tag if it's :latest
-  # Other tags (specific versions like 1.11.1-1766149846 or SHAs) are passed through unchanged
-  if [[ "${CATALOG_SOURCE_IMAGE}" = "${default_catsrc_image}:latest" ]]; then
-    catsrc_image_tag=$(latest_catsrc_image_tag)
-    CATALOG_SOURCE_IMAGE="${default_catsrc_image}:${catsrc_image_tag}"
-    echo "Resolved :latest to tag: ${catsrc_image_tag}"
-  else
-    echo "Using provided catalog image: ${CATALOG_SOURCE_IMAGE}"
-  fi
-
-  create_catsrc "${CATALOG_SOURCE_NAME}" "${CATALOG_SOURCE_IMAGE}"
-  wait_for_catsrc "${CATALOG_SOURCE_NAME}"
-
-  # Save resolved CATALOG_SOURCE_IMAGE for subsequent steps
-  echo "CATALOG_SOURCE_IMAGE=${CATALOG_SOURCE_IMAGE}" > "${SHARED_DIR}/catalog-source-image.env"
-  echo "Saved resolved CATALOG_SOURCE_IMAGE to ${SHARED_DIR}/catalog-source-image.env"
-else
-  if [[ -n "$CATALOG_SOURCE_IMAGE" ]]; then
-    echo "CATALOG_SOURCE_IMAGE can only be used when TEST_RELEASE_TYPE==Pre-GA ($CATALOG_SOURCE_IMAGE)"
-    exit 1
-  fi
-fi
-
 cat <<EOF | tee "${configmap_path}"
 apiVersion: v1
 kind: ConfigMap