From bc3571a5c8dafa82e4b379f85812fb2dfba4ae19 Mon Sep 17 00:00:00 2001 From: Wainer dos Santos Moschetta Date: Thu, 20 Aug 2026 16:52:23 -0300 Subject: [PATCH 1/5] sandboxed-containers-operator: install trustee by default Enabled install-trustee-operator step on all CoCo jobs. Because the step handles the trustee URL and initdata, the TRUSTEE_URL and INITDATA parameters are removed. By default it is going to use the latest dev trustee image (quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest). Fixes: rhjira#KATA-5887 Signed-off-by: Wainer dos Santos Moschetta --- ...tainers-operator-devel__downstream-candidate.yaml | 12 ++++-------- ...ners-operator-devel__downstream-candidate417.yaml | 8 ++++---- ...ners-operator-devel__downstream-candidate418.yaml | 8 ++++---- ...ners-operator-devel__downstream-candidate419.yaml | 8 ++++---- ...ners-operator-devel__downstream-candidate420.yaml | 8 ++++---- ...ners-operator-devel__downstream-candidate421.yaml | 8 ++++---- ...ners-operator-devel__downstream-candidate422.yaml | 8 ++++---- 7 files changed, 28 insertions(+), 32 deletions(-) diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml index 66059baf3a48e..f5c703bdd6d5c 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml @@ -53,7 +53,6 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s - as: azure-ipi-peerpods @@ -91,7 +90,6 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" WORKLOAD_TO_TEST: peer-pods workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -118,7 +116,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -130,7 +127,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -170,7 +168,6 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" WORKLOAD_TO_TEST: peer-pods workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s @@ -197,7 +194,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9 LOCATION: eastus @@ -209,7 +205,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s @@ -247,7 +244,6 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" WORKLOAD_TO_TEST: peer-pods workflow: sandboxed-containers-operator-e2e-aws timeout: 24h0m0s diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml index c7f666eb65e79..57438056c82f2 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml @@ -119,7 +119,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "false" KATA_RPM_VERSION: "" MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -131,7 +130,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -198,7 +198,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "false" KATA_RPM_VERSION: "" LOCATION: eastus @@ -211,7 +210,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml index 2afab07fea8b3..0c613c39567a1 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml @@ -119,7 +119,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "false" KATA_RPM_VERSION: "" MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -131,7 +130,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -198,7 +198,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "false" KATA_RPM_VERSION: "" LOCATION: eastus @@ -211,7 +210,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml index 0168b5006823a..ac15864e6546c 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml @@ -119,7 +119,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -131,7 +130,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -198,7 +198,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9 LOCATION: eastus @@ -211,7 +210,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml index 758663f16ed2f..66d06bef9f8e3 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml @@ -119,7 +119,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -131,7 +130,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -198,7 +198,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.19.el9 LOCATION: eastus @@ -211,7 +210,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml index 98e85c05e53ec..f868d46d55f17 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml @@ -119,7 +119,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -131,7 +130,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -198,7 +198,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9 LOCATION: eastus @@ -211,7 +210,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml index 69a04f8ab015f..4d08144ca2d01 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml @@ -119,7 +119,6 @@ tests: CUSTOM_AZURE_REGION: eastus ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.22.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest @@ -131,7 +130,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-azure timeout: 24h0m0s @@ -198,7 +198,6 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" HYPERSHIFT_AZURE_LOCATION: eastus - INITDATA: "" INSTALL_KATA_RPM: "true" KATA_RPM_VERSION: 3.31.0-2.rhaos4.22.el9 LOCATION: eastus @@ -211,7 +210,8 @@ tests: TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author TEST_TIMEOUT: "90" - TRUSTEE_URL: "" + TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest + TRUSTEE_INSTALL: "true" WORKLOAD_TO_TEST: coco workflow: sandboxed-containers-operator-e2e-aro timeout: 24h0m0s From ffa9b9162e0c2fe35370ccd6e90619ff5ab5e293 Mon Sep 17 00:00:00 2001 From: Wainer dos Santos Moschetta Date: Thu, 20 Aug 2026 18:35:58 -0300 Subject: [PATCH 2/5] sandboxed-containers-operator: run signed image test only on CoCo jobs Updated the CoCo jobs to run the signed image test only. Adapted the create-prowjob-commands.sh accordingly. Fixes: rhjira#KATA-5887 Signed-off-by: Wainer dos Santos Moschetta --- ...s-operator-devel__downstream-candidate.yaml | 4 ++-- ...perator-devel__downstream-candidate417.yaml | 4 ++-- ...perator-devel__downstream-candidate418.yaml | 4 ++-- ...perator-devel__downstream-candidate419.yaml | 4 ++-- ...perator-devel__downstream-candidate420.yaml | 4 ++-- ...perator-devel__downstream-candidate421.yaml | 4 ++-- ...perator-devel__downstream-candidate422.yaml | 4 ++-- ...tainers-operator-create-prowjob-commands.sh | 18 +++++++++++++----- 8 files changed, 27 insertions(+), 19 deletions(-) diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml index f5c703bdd6d5c..e4f867807a293 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate.yaml @@ -125,7 +125,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -203,7 +203,7 @@ tests: RUNTIMECLASS: kata-remote SLEEP_DURATION: 0h TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml index 57438056c82f2..b2b9920d1735c 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate417.yaml @@ -128,7 +128,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -208,7 +208,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml index 0c613c39567a1..b3f45ee3fef75 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate418.yaml @@ -128,7 +128,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -208,7 +208,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml index ac15864e6546c..a32ff848041cc 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml @@ -128,7 +128,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -208,7 +208,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml index 66d06bef9f8e3..2dbf2a2bc664b 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate420.yaml @@ -128,7 +128,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -208,7 +208,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml index f868d46d55f17..775dd440e53ea 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml @@ -128,7 +128,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -208,7 +208,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml index 4d08144ca2d01..8e704f8c69afb 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml @@ -128,7 +128,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" @@ -208,7 +208,7 @@ tests: SLEEP_DURATION: 0h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA - TEST_SCENARIOS: sig-kata.*Kata Author + TEST_SCENARIOS: sig-kata.*run and verify cosigned pod TEST_TIMEOUT: "90" TRUSTEE_CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/trustee-test-fbc:latest TRUSTEE_INSTALL: "true" diff --git a/ci-operator/step-registry/sandboxed-containers-operator/create-prowjob/sandboxed-containers-operator-create-prowjob-commands.sh b/ci-operator/step-registry/sandboxed-containers-operator/create-prowjob/sandboxed-containers-operator-create-prowjob-commands.sh index b2a88103d691a..70cdaa86b3a14 100755 --- a/ci-operator/step-registry/sandboxed-containers-operator/create-prowjob/sandboxed-containers-operator-create-prowjob-commands.sh +++ b/ci-operator/step-registry/sandboxed-containers-operator/create-prowjob/sandboxed-containers-operator-create-prowjob-commands.sh @@ -141,9 +141,6 @@ validate_and_set_defaults() { exit 1 fi - # Allow override of test scenarios - TEST_SCENARIOS="${TEST_SCENARIOS:-sig-kata.*Kata Author}" - # exclude C00133 from test by default TEST_FILTERS="${TEST_FILTERS:-~DisconnectedOnly&;~Disruptive&;~C00133&}" local -a _test_filter_segments @@ -238,7 +235,7 @@ show_usage() { echo " INSTALL_KATA_RPM - Install Kata RPM: true or false (default: true)" echo " KATA_RPM_VERSION - Kata RPM version (default: 3.17.0-3.rhaos4.19.el9)" echo " SLEEP_DURATION - Sleep duration after tests (default: 0h)" - echo " TEST_SCENARIOS - Test scenarios filter (default: sig-kata.*Kata Author)" + echo " TEST_SCENARIOS - Test scenarios filter (default: \"sig-kata.*Kata Author\" or \"sig-kata.*run and verify cosigned pod\")" echo " TEST_FILTERS - openshift-extended-test filters (default: ~DisconnectedOnly&;~Disruptive&)" echo " Append ;~Cnnnnn& to skip a Polarion-style id appearing in case lines" echo " TEST_TIMEOUT - Test timeout in minutes (default: 90)" @@ -320,6 +317,17 @@ generate_workflow() { env_vars+=("AWS_REGION_OVERRIDE: ${AWS_REGION_OVERRIDE}") fi + local test_scenarios + if [[ -n "${TEST_SCENARIOS:-}" ]]; then + test_scenarios="$TEST_SCENARIOS" + else + if [[ "$workload" = "coco" ]]; then + test_scenarios="sig-kata.*run and verify cosigned pod" + else + test_scenarios="sig-kata.*Kata Author" + fi + fi + # Common env_vars+=( "CATALOG_SOURCE_IMAGE: ${CATALOG_SOURCE_IMAGE:-\"\"}" @@ -333,7 +341,7 @@ generate_workflow() { "SLEEP_DURATION: ${SLEEP_DURATION}" "TEST_FILTERS: ${TEST_FILTERS}" "TEST_RELEASE_TYPE: ${TEST_RELEASE_TYPE}" - "TEST_SCENARIOS: ${TEST_SCENARIOS}" + "TEST_SCENARIOS: ${test_scenarios}" "TEST_TIMEOUT: \"${TEST_TIMEOUT}\"" "TRUSTEE_URL: ${TRUSTEE_URL:-\"\"}" ) From d8d9d0c89e3db3506663e9ba488f37518e818240 Mon Sep 17 00:00:00 2001 From: Wainer dos Santos Moschetta Date: Thu, 20 Aug 2026 18:44:17 -0300 Subject: [PATCH 3/5] [DO NOT MERGE] TEST ONLY Signed-off-by: Wainer dos Santos Moschetta --- ...ed-containers-operator-devel__downstream-candidate422.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml index 8e704f8c69afb..0f2f43b436425 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml @@ -109,7 +109,7 @@ tests: report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}} {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}} <{{.Status.URL}}|View logs>' - restrict_network_access: false + restrict_network_access: true steps: cluster_profile: azure-qe env: @@ -120,7 +120,7 @@ tests: ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" INSTALL_KATA_RPM: "true" - KATA_RPM_VERSION: 3.31.0-2.rhaos4.22.el9 + KATA_RPM_VERSION: 3.31.0-5.rhaos4.22.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest MUST_GATHER_ON_FAILURE_ONLY: "false" OSC_INSTALL: "true" From f7b4e0366edb0def9b3dda8f56615d623af28cc5 Mon Sep 17 00:00:00 2001 From: Wainer dos Santos Moschetta Date: Fri, 21 Aug 2026 11:01:22 -0300 Subject: [PATCH 4/5] sandboxed-containers-operator: fix kbs-client connectivity test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The install-trustee-operator step will perform a test to check the connectivity with Trustee. It gets an expected resource value from the Trustee configuration and compare with the value retrieved via kbs-client. There is a bug where the expected resource is not determined correctly as seen on the below logs... ``` >>> WARN: Could not determine expected resource value from KbsConfig ConfigMap >>> Testing KBS connectivity: http://kbs-service.trustee-operator-system.svc:8080/default/kbsres1/key1 >>> Expected resource value: >>> Successfully retrieved default/kbsres1/key1 >>> Retrieved resource value: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFV1QwN2VSMUhOSzNEMmlxSG90RTBjMzg5YVNUaApMajBCMzlQWFRCY0p6SnBrWFBPODJsTEdRZGM0N1Y1SFBXYVBaMkZjM0RXeVJvejFvV2JuTGx2UTVRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== >>> ✓ Resource value matches expected value ``` ... but the test still pass. The problem is that when the expected value is empty, the checking is skipped. This provides a fix by bailing out if the expected resource value is not found. Signed-off-by: Wainer dos Santos Moschetta --- ...rs-operator-install-trustee-operator-commands.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh b/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh index 7002a4442afb4..5d91eaa04f1fd 100755 --- a/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh +++ b/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh @@ -847,12 +847,17 @@ function verify_trustee_connectivity() { if [[ -n "${configmap_name}" ]]; then expected_value=$(oc get configmap "${configmap_name}" -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.data.kbsres1}' 2>/dev/null || echo "") + else + echo ">>> WARN: Could not determine the KbsConfig ConfigMap" >&2 fi if [[ -z "${expected_value}" ]]; then - echo ">>> WARN: Could not determine expected resource value from KbsConfig ConfigMap" >&2 - # Fallback: check the KbsConfig resource data directly - expected_value=$(oc get kbsconfig -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.items[0].spec.resourceData.default.kbsres1.key1}' 2>/dev/null || echo "key1") + echo ">>> WARN: Could not determine expected resource value from KbsConfig ConfigMap. Falling back to check the KbsConfig resource data directly" >&2 + expected_value=$(oc get kbsconfig -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.items[0].spec.resourceData.default.kbsres1.key1}' 2>/dev/null || echo "") + if [[ -z "${expected_value}" ]]; then + echo ">>> ERROR: Failed to determine the expected resource value. Cannot proceed with kbs-client connectivity test" >&2 + return 1 + fi fi # Test KBS connectivity using RCA protocol @@ -878,7 +883,7 @@ function verify_trustee_connectivity() { echo ">>> Retrieved resource value: ${resource_value}" # Validate the retrieved value matches what was configured - if [[ -n "${expected_value}" ]] && [[ "${resource_value}" != "${expected_value}" ]]; then + if [[ "${resource_value}" != "${expected_value}" ]]; then echo ">>> ERROR: Resource value mismatch!" echo ">>> Expected: ${expected_value}" echo ">>> Retrieved: ${resource_value}" From f4409323bea52b172985da398f7addee11e6fcb7 Mon Sep 17 00:00:00 2001 From: Wainer dos Santos Moschetta Date: Fri, 21 Aug 2026 17:35:05 -0300 Subject: [PATCH 5/5] sandboxed-containers-operator: fix trustee connectivity test on newer versions In trustee >= 1.13 the expected resources value is found at secrets/kbsres1 secret. Changed the logic to first try to read from that secret and fallback to the kbsconfig approach on older trustee versions. Signed-off-by: Wainer dos Santos Moschetta --- ...rator-install-trustee-operator-commands.sh | 34 ++++++++++++------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh b/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh index 5d91eaa04f1fd..25366922ddf40 100755 --- a/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh +++ b/ci-operator/step-registry/sandboxed-containers-operator/install-trustee-operator/sandboxed-containers-operator-install-trustee-operator-commands.sh @@ -840,23 +840,31 @@ function verify_trustee_connectivity() { return 1 fi - # Get expected resource value from KbsConfig + # Get expected resource value from Secrets local expected_value="" - local configmap_name - configmap_name=$(oc get kbsconfig -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.items[0].spec.kbsConfigMapName}' 2>/dev/null || echo "") - - if [[ -n "${configmap_name}" ]]; then - expected_value=$(oc get configmap "${configmap_name}" -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.data.kbsres1}' 2>/dev/null || echo "") - else - echo ">>> WARN: Could not determine the KbsConfig ConfigMap" >&2 - fi + expected_value=$(oc get secret/kbsres1 -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.data.key1}' 2>/dev/null || echo "") + # TODO: Trustee <= 1.12 has the resources specified in either kbsconfig or + # kbsconfig configmap. This code is kept for backward compatibility and + # should be removed once older versions get supported. if [[ -z "${expected_value}" ]]; then - echo ">>> WARN: Could not determine expected resource value from KbsConfig ConfigMap. Falling back to check the KbsConfig resource data directly" >&2 - expected_value=$(oc get kbsconfig -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.items[0].spec.resourceData.default.kbsres1.key1}' 2>/dev/null || echo "") + echo "WARN: Could not determine expected resource value from kbsres1 secret. Falling back to get from KbsConfig ConfigMap" + local configmap_name + configmap_name=$(oc get kbsconfig -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.items[0].spec.kbsConfigMapName}' 2>/dev/null || echo "") + + if [[ -n "${configmap_name}" ]]; then + expected_value=$(oc get configmap "${configmap_name}" -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.data.kbsres1}' 2>/dev/null || echo "") + else + echo ">>> WARN: Could not determine the KbsConfig ConfigMap" >&2 + fi + if [[ -z "${expected_value}" ]]; then - echo ">>> ERROR: Failed to determine the expected resource value. Cannot proceed with kbs-client connectivity test" >&2 - return 1 + echo ">>> WARN: Could not determine expected resource value from KbsConfig ConfigMap. Falling back to check the KbsConfig resource data directly" >&2 + expected_value=$(oc get kbsconfig -n "${TRUSTEE_NAMESPACE}" -o jsonpath='{.items[0].spec.resourceData.default.kbsres1.key1}' 2>/dev/null || echo "") + if [[ -z "${expected_value}" ]]; then + echo ">>> ERROR: Failed to determine the expected resource value. Cannot proceed with kbs-client connectivity test" >&2 + return 1 + fi fi fi