Skip to content

Adding PQC to perfscale #81040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jtaleric wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Adding PQC to perfscale #81040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions ...g/openshift-eng/ocp-perfscale/openshift-eng-ocp-perfscale-main__aws-4.22-nightly-x86.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,45 @@ tests:
- ref: openshift-qe-workers-scale
- chain: openshift-qe-netpol-v2
workflow: openshift-qe-installer-aws
- as: control-plane-6nodes-pqc
cron: 0 5 * * 2,5
reporter_config:
channel: '#ocp-qe-scale-ci-results'
job_states_to_report:
- success
- failure
- error
report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}*
ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> :white_check_mark:
{{else}} :warning: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
logs> :warning: {{end}}'
steps:
cluster_profile: aws-perfscale-qe
env:
ADDITIONAL_WORKER_NODES: "3"
BASE_DOMAIN: qe.devcluster.openshift.com
CD_V2_EXTRA_FLAGS: --churn-duration=20m --pod-ready-threshold=20s --service-latency
CDV2_ITERATION_MULTIPLIER: "15"
ENABLE_LAYER_3: "false"
ES_TYPE: qe
FEATURE: TLSCurvePreferences
IGNORE_JOB_ITERATIONS: "true"
KB_FLAGS: --local-indexing
ND_CNI_EXTRA_FLAGS: --churn-mode=objects --churn-delay=1m --churn-percent=50
--churn-cycles=2
ND_EXTRA_FLAGS: --churn-mode=objects --churn-delay=1m --churn-percent=50 --churn-cycles=2
OUTPUT_FORMAT: JUNIT
RUN_ORION: deferred
UDN_ITERATION_MULTIPLIER: "12"
VERSION: "4.22"
ZONES_COUNT: "3"
test:
- chain: openshift-qe-installer-featuregate
- chain: openshift-qe-pqc
- ref: openshift-qe-workers-scale
- chain: openshift-qe-control-plane
- chain: openshift-qe-orion-consolidated
workflow: openshift-qe-installer-aws
- as: payload-control-plane-6nodes
cron: '@yearly'
reporter_config:
Expand Down
39 changes: 39 additions & 0 deletions ...ig/openshift-eng/ocp-perfscale/openshift-eng-ocp-perfscale-main__aws-5.0-nightly-x86.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,45 @@ tests:
- chain: openshift-qe-control-plane
- chain: openshift-qe-orion-consolidated
workflow: openshift-qe-installer-aws
- as: control-plane-6nodes-pqc
cron: 0 5 * * 2,5
reporter_config:
channel: '#ocp-qe-scale-ci-results'
job_states_to_report:
- success
- failure
- error
report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}*
ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> :white_check_mark:
{{else}} :warning: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
logs> :warning: {{end}}'
steps:
cluster_profile: aws-perfscale-qe
env:
ADDITIONAL_WORKER_NODES: "3"
BASE_DOMAIN: qe.devcluster.openshift.com
CD_V2_EXTRA_FLAGS: --churn-duration=20m --pod-ready-threshold=20s --service-latency
CDV2_ITERATION_MULTIPLIER: "15"
ENABLE_LAYER_3: "false"
ES_TYPE: qe
FEATURE: TLSCurvePreferences
IGNORE_JOB_ITERATIONS: "true"
KB_FLAGS: --local-indexing
ND_CNI_EXTRA_FLAGS: --churn-mode=objects --churn-delay=1m --churn-percent=50
--churn-cycles=2
ND_EXTRA_FLAGS: --churn-mode=objects --churn-delay=1m --churn-percent=50 --churn-cycles=2
OUTPUT_FORMAT: JUNIT
RUN_ORION: deferred
UDN_ITERATION_MULTIPLIER: "12"
VERSION: "5.0"
ZONES_COUNT: "3"
test:
- chain: openshift-qe-installer-featuregate
- chain: openshift-qe-pqc
- ref: openshift-qe-workers-scale
- chain: openshift-qe-control-plane
- chain: openshift-qe-orion-consolidated
workflow: openshift-qe-installer-aws
- as: control-plane-120nodes
cron: 0 6 * * 0,2,4,6
reporter_config:
Expand Down
188 changes: 188 additions & 0 deletions ci-operator/jobs/openshift-eng/ocp-perfscale/openshift-eng-ocp-perfscale-main-periodics.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,100 @@ periodics:
- name: result-aggregator
secret:
secretName: result-aggregator
- agent: kubernetes
cluster: build11
cron: 0 5 * * 2,5
decorate: true
decoration_config:
skip_cloning: true
extra_refs:
- base_ref: main
org: openshift-eng
repo: ocp-perfscale
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: aws-perfscale-qe
ci-operator.openshift.io/variant: aws-4.22-nightly-x86
ci.openshift.io/generator: prowgen
job-release: "4.22"
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: periodic-ci-openshift-eng-ocp-perfscale-main-aws-4.22-nightly-x86-control-plane-6nodes-pqc
reporter_config:
slack:
channel: '#ocp-qe-scale-ci-results'
job_states_to_report:
- success
- failure
- error
report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}*
ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> :white_check_mark:
{{else}} :warning: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
logs> :warning: {{end}}'
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=control-plane-6nodes-pqc
- --variant=aws-4.22-nightly-x86
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
- agent: kubernetes
cluster: build11
cron: 17 7 * * *
Expand Down Expand Up @@ -2287,6 +2381,100 @@ periodics:
- name: result-aggregator
secret:
secretName: result-aggregator
- agent: kubernetes
cluster: build11
cron: 0 5 * * 2,5
decorate: true
decoration_config:
skip_cloning: true
extra_refs:
- base_ref: main
org: openshift-eng
repo: ocp-perfscale
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: aws-perfscale-qe
ci-operator.openshift.io/variant: aws-5.0-nightly-x86
ci.openshift.io/generator: prowgen
job-release: "5.0"
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: periodic-ci-openshift-eng-ocp-perfscale-main-aws-5.0-nightly-x86-control-plane-6nodes-pqc
reporter_config:
slack:
channel: '#ocp-qe-scale-ci-results'
job_states_to_report:
- success
- failure
- error
report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}*
ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> :white_check_mark:
{{else}} :warning: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
logs> :warning: {{end}}'
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=control-plane-6nodes-pqc
- --variant=aws-5.0-nightly-x86
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
- agent: kubernetes
cluster: build11
cron: 0 3 * * 3
Expand Down
1 change: 1 addition & 0 deletions ci-operator/step-registry/openshift-qe/pqc/OWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../OWNERS
11 changes: 11 additions & 0 deletions ci-operator/step-registry/openshift-qe/pqc/openshift-qe-pqc-chain.metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"path": "openshift-qe/pqc/openshift-qe-pqc-chain.yaml",
"owners": {
"approvers": [
"perfscale-ocp-approvers"
],
"reviewers": [
"perfscale-ocp-reviewers"
]
}
}
7 changes: 7 additions & 0 deletions ci-operator/step-registry/openshift-qe/pqc/openshift-qe-pqc-chain.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@

chain:
as: openshift-qe-pqc
steps:
- ref: openshift-qe-pqc
documentation: |-
This chain executes pqc setup
Comment on lines +1 to +7

@coderabbitai coderabbitai Bot Jun 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Confirm the duplicate registry name and inspect existing chains for required `steps:`.
fd -t f 'openshift-qe-pqc' ci-operator/step-registry/openshift-qe/pqc
echo "=== elements named openshift-qe-pqc ==="
rg -nP '^\s*as:\s*openshift-qe-pqc\s*$' ci-operator/step-registry
echo "=== sample chains: do they all have steps? ==="
fd -t f -e yaml -g '*-chain.yaml' ci-operator/step-registry/openshift-qe | head -5 | while read -r f; do echo "--- $f"; rg -n 'steps:' "$f" || echo "NO steps in $f"; done

Repository: openshift/release

Length of output: 1334

Duplicate as name and missing steps in PQC chain

Two blocking issues prevent the PQC workflow from building or running:

  1. Name Collision: Both openshift-qe-pqc-ref.yaml and openshift-qe-pqc-chain.yaml declare as: openshift-qe-pqc. The step registry namespace is shared across refs, chains, and workflows, causing make validate-step-registry to fail.
  2. Empty Chain Execution: The openshift-qe-pqc chain definition lacks a steps list. Without steps, the chain executes nothing, so the PQC TLS setup will not run.

Rename the ref to resolve the collision and add the step reference to the chain:

🐛 Proposed fix 
# ci-operator/step-registry/openshift-qe/pqc/openshift-qe-pqc-ref.yaml
 change: Rename file to openshift-qe-pqc-setup-ref.yaml and update 'as' key
-  as: openshift-qe-pqc
+  as: openshift-qe-pqc-setup

# ci-operator/step-registry/openshift-qe/pqc/openshift-qe-pqc-chain.yaml
 chain:
   as: openshift-qe-pqc
+  steps:
+  - ref: openshift-qe-pqc-setup
   documentation: |-
     This chain executes pqc setup

Alternatively, remove chain.yaml and reference the ref directly in CI configs as - ref: openshift-qe-pqc.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ci-operator/step-registry/openshift-qe/pqc/openshift-qe-pqc-chain.yaml`
around lines 1 - 5, The PQC chain definition is incomplete and collides with
another registry entry: update the `openshift-qe-pqc` chain in
`openshift-qe-pqc-chain.yaml` so it no longer shares the same `as` name as
`openshift-qe-pqc-ref.yaml`, and add the missing `steps` list so the chain
actually runs the PQC TLS/setup step. Use the existing `chain` definition as the
locator, then either rename the chain or ref entry to a unique `as` value and
wire the appropriate step reference into `steps` so validation passes and the
workflow executes.

Loading