adding cluster claim #2023
Conversation
📝 WalkthroughWalkthroughThe Tekton integration pipeline was refactored to replace static cluster provisioning with ephemeral cluster provisioning. A new task sourced from Konflux tasks provisions AWS/FIPS clusters on demand, and the e2e test task receives cluster credentials via a parameter mapped from provisioning task results rather than extracting them locally. ChangesEphemeral cluster provisioning migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.tekton/integration-tests/lightspeed-console-pre-commit.yaml (1)
233-243:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winCritical:
occommand used before it's downloaded.Line 234 executes
oc --kubeconfigto computeBASE_URL, but theocclient isn't downloaded until lines 240-243. The Playwright image does not include the OpenShift CLI. This will fail with "command not found".Move the
ocdownload before computingBASE_URL, or move theBASE_URLcomputation after the download.Proposed fix: move BASE_URL computation after oc download
echo "$KUBECONFIG_VALUE" > /credentials/kubeconfig - export BASE_URL=https://$(oc --kubeconfig "$KUBECONFIG_PATH" get route console -n openshift-console -o go-template --template="{{.spec.host}}") echo "COMMIT_SHA: ${COMMIT_SHA}" - echo "BASE_URL: ${BASE_URL}" echo "CONSOLE_IMAGE: ${CONSOLE_IMAGE}" echo "KUBECONFIG_PATH: ${KUBECONFIG_PATH}" echo "---------------------------------------------" wget --no-verbose -O oc.tar.gz https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/latest/openshift-client-linux.tar.gz \ && tar -xvzf oc.tar.gz \ && chmod +x kubectl oc \ && mv oc kubectl /usr/local/bin/ echo "---------------------------------------------" + export BASE_URL=https://$(oc --kubeconfig "$KUBECONFIG_PATH" get route console -n openshift-console -o go-template --template="{{.spec.host}}") + echo "BASE_URL: ${BASE_URL}" + echo "---------------------------------------------"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.tekton/integration-tests/lightspeed-console-pre-commit.yaml around lines 233 - 243, The script computes BASE_URL using the oc binary (oc --kubeconfig "$KUBECONFIG_PATH") before downloading/installing oc, causing a "command not found" error; fix by moving the oc download/install block (the wget/tar/chmod/mv sequence that installs kubectl and oc) to run before the export BASE_URL line (or alternatively defer the export BASE_URL until after installation), ensuring the oc client is available when computing BASE_URL using KUBECONFIG_PATH/KUBECONFIG_VALUE.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/integration-tests/lightspeed-console-pre-commit.yaml:
- Around line 271-273: The LOGIN_PASSWORD is hardcoded to "placeholder" causing
auth failures; update the pipeline to read the real password from the secret
output exposed by the debug-secret-keys step and assign it to LOGIN_PASSWORD
(use the PASSWORD_VALUE variable referenced in the TODO) instead of the
placeholder. Locate the environment export for LOGIN_PASSWORD in the pre-commit
task and wire it to the secret output (or the pipeline/step result named by
debug-secret-keys) so LOGIN_PASSWORD is set from PASSWORD_VALUE at runtime
rather than a hardcoded string.
- Around line 40-49: The pipeline task block for provision-ephemeral-cluster is
using the wrong key; replace the top-level ref: block with taskRef: (keeping the
same resolver and params) so the task declaration matches how
eaas-provision-space is referenced; specifically update the
provision-ephemeral-cluster task block to use taskRef (with resolver: git and
the same url/revision/pathInRepo params) instead of ref.
---
Outside diff comments:
In @.tekton/integration-tests/lightspeed-console-pre-commit.yaml:
- Around line 233-243: The script computes BASE_URL using the oc binary (oc
--kubeconfig "$KUBECONFIG_PATH") before downloading/installing oc, causing a
"command not found" error; fix by moving the oc download/install block (the
wget/tar/chmod/mv sequence that installs kubectl and oc) to run before the
export BASE_URL line (or alternatively defer the export BASE_URL until after
installation), ensuring the oc client is available when computing BASE_URL using
KUBECONFIG_PATH/KUBECONFIG_VALUE.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9fbf07ee-9043-4c22-b2fa-b20e46bbefcb
📒 Files selected for processing (1)
.tekton/integration-tests/lightspeed-console-pre-commit.yaml
| - name: provision-ephemeral-cluster | ||
| ref: | ||
| resolver: git | ||
| params: | ||
| - name: url | ||
| value: https://github.com/openshift/konflux-tasks | ||
| - name: revision | ||
| value: main | ||
| - name: pathInRepo | ||
| value: tasks/provision-ephemeral-cluster/0.1/provision-ephemeral-cluster.yaml |
There was a problem hiding this comment.
Critical: Use taskRef instead of ref for pipeline tasks.
In Tekton v1beta1 Pipelines, tasks must be referenced using taskRef, not ref. The ref field is used for StepActions within steps (as correctly used at line 286), not for tasks at the pipeline level. This inconsistency with eaas-provision-space (line 24) will cause the pipeline to fail.
Proposed fix
- name: provision-ephemeral-cluster
- ref:
+ taskRef:
resolver: git
params:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: provision-ephemeral-cluster | |
| ref: | |
| resolver: git | |
| params: | |
| - name: url | |
| value: https://github.com/openshift/konflux-tasks | |
| - name: revision | |
| value: main | |
| - name: pathInRepo | |
| value: tasks/provision-ephemeral-cluster/0.1/provision-ephemeral-cluster.yaml | |
| - name: provision-ephemeral-cluster | |
| taskRef: | |
| resolver: git | |
| params: | |
| - name: url | |
| value: https://github.com/openshift/konflux-tasks | |
| - name: revision | |
| value: main | |
| - name: pathInRepo | |
| value: tasks/provision-ephemeral-cluster/0.1/provision-ephemeral-cluster.yaml |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/integration-tests/lightspeed-console-pre-commit.yaml around lines 40
- 49, The pipeline task block for provision-ephemeral-cluster is using the wrong
key; replace the top-level ref: block with taskRef: (keeping the same resolver
and params) so the task declaration matches how eaas-provision-space is
referenced; specifically update the provision-ephemeral-cluster task block to
use taskRef (with resolver: git and the same url/revision/pathInRepo params)
instead of ref.
| # TODO: set LOGIN_PASSWORD once the correct secret key is known | ||
| # export LOGIN_PASSWORD="$PASSWORD_VALUE" | ||
| export LOGIN_PASSWORD="placeholder" |
There was a problem hiding this comment.
Hardcoded placeholder password will cause authentication failures.
LOGIN_PASSWORD is set to "placeholder" which will cause any test requiring cluster authentication to fail. The TODO indicates the correct secret key is unknown.
Once the debug-secret-keys step output reveals the correct key name, wire PASSWORD_VALUE from the secret and use it here. Until then, e2e tests requiring login will not pass.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/integration-tests/lightspeed-console-pre-commit.yaml around lines
271 - 273, The LOGIN_PASSWORD is hardcoded to "placeholder" causing auth
failures; update the pipeline to read the real password from the secret output
exposed by the debug-secret-keys step and assign it to LOGIN_PASSWORD (use the
PASSWORD_VALUE variable referenced in the TODO) instead of the placeholder.
Locate the environment export for LOGIN_PASSWORD in the pre-commit task and wire
it to the secret output (or the pipeline/step result named by debug-secret-keys)
so LOGIN_PASSWORD is set from PASSWORD_VALUE at runtime rather than a hardcoded
string.
1 participant
and changing getting kubeconfig, base url and password
Summary by CodeRabbit