refactor: align CSPR deployment with topology - #83061
Conversation
|
Warning Review limit reached
Next review available in: 2 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
WalkthroughChangesCSPR deployment consolidation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CSPRDeploy
participant Azure
participant Topology
participant Pipelines
CSPRDeploy->>Azure: Authenticate and select subscription
CSPRDeploy->>CSPRDeploy: Generate shared image override
CSPRDeploy->>Topology: Validate and resolve child pipelines
CSPRDeploy->>Pipelines: Run deployment pipelines in topology order
CSPRDeploy->>Pipelines: Create Cluster Service namespace and bindings
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
roivaz
changed the title
Consolidate the legacy CSPR infrastructure and service steps into one topology-ordered deployment. Build one shared override for CI-built images so Service.Infra deploys the current exporter digest, while Cluster Service remains intentionally excluded. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
4db8d7e to
49c61dd
Compare
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: miguelsorianod, roivaz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@roivaz: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
Replace the three disconnected CSPR deployment steps with one deployment step that:
hack/ci/build-config-override.shhelper to calculate one override for all CI-built images;Why
The CSPR postsubmit permanently fails in
Service.Infrabecause the old workflow provides the CI-built exporter image only to the later SVC services step.make svchas already deployed the exporter from the stale static config digest by then, and the old binary crashes on newer chart arguments such as--cluster-types.The split workflow also duplicated image parsing and registry-login handling across three pods, obscured deployment ordering, and drifted from the regional topology as new pipelines were added. For example, Fleet and KubeApplier images were supplied as dependencies but their pipelines were not invoked.
The consolidated step now supplies every image override before the first owning pipeline runs, including
customExporterbeforeService.Infra. It follows:Region → Service.Infra → selected SVC children → Management.Infra → MGMT children → MonitoringCluster Service remains intentionally excluded because CSPR supplies it separately, but its PR-environment dependencies are still created with
svc-deploy.sh.The
pipeline:*dependencies are the images ci-operator builds from theARO-HCP checkout for this postsubmit commit. Each owning pipeline mirrors
that digest from the CI registry into the service ACR before deployment.
The consolidated setup also removes two obsolete operations:
DETECT_DIRTY_GIT_WORKTREEonly affects locally generated image tags, whilethis job deploys digest-based ci-operator images.
/usr/local/bin, so runningaz bicep installagain in every postsubmit is redundant.SKIP_CONFIRMremains required by the CSPR MSI ARM deployment,PERSIST=truepreserves the persistent resource-group tag, andPRINCIPAL_IDis used when granting the CI service principal AKS admin access.Reviewer note: first-run effect on CSPR
The deployment sequence changes as follows:
The first revamped run reconciles the existing persistent environment in
place; it does not delete or recreate the SVC or management clusters.
PERSIST=trueand the configured CSPR node-pool sizing remain unchanged.The notable runtime effects are:
Service.Inframirrors and deploys the exporter built from the currentARO-HCP commit instead of the stale static digest.
they are part of the Region topology but were omitted by the legacy job.
They will be installed if absent or upgraded/reconciled if already present.
images built from the current ARO-HCP checkout.
MSI, and Key Vault dependencies are prepared.
The primary first-run behavioral expansion is therefore activating or
reconciling Fleet, KubeApplier, Velero, and Fleet Registration.
Failure: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/branch-ci-Azure-ARO-HCP-main-cspr-pipeline-postsubmit/2085429479684968448
Same stale-exporter failure class: #83021
Validation
bash -nandshellcheckon the consolidated command scripttopology.yamlmake registry-metadatagit diff --checkThe CSPR postsubmit cannot be rehearsed by PJ-Rehearse; it reports that no rehearsable tests are affected.
make validate-step-registryis currently blocked because the publishedci-operator-configresolverimage no longer accepts the Makefile's-prow-configflag.AI-generated. Review for accuracy.