NE-2788: drop TechPreview from haproxy28 presubmits and add FIPS and perf variants - #83065
NE-2788: drop TechPreview from haproxy28 presubmits and add FIPS and perf variants#83065gcs278 wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@gcs278: This pull request references NE-2788 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe CI configuration renames HAProxy 2.8 jobs, removes their TechPreview settings, and adds optional AWS FIPS and perfscale jobs. ChangesHAProxy 2.8 CI configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
a39a2e5 to
7babd7c
Compare
gcs278
changed the title
openshift-merge-bot
Bot
added
the
rehearsals-ack
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml`:
- Line 165: Run make update to regenerate the CI jobs from the renamed source
tests, replacing old *-haproxy28-techpreview references and adding generated
coverage for e2e-aws-ovn-fips-haproxy28. Apply the generated updates at
ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml
ranges 165-165, 184-184, 317-317, and 359-373, and
ci-operator/config/openshift/router/openshift-router-master.yaml ranges 119-132
and 148-148, then commit the regenerated files.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 63093a4b-d586-4661-9bd1-a25c1fbf35b2
📒 Files selected for processing (4)
ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yamlci-operator/config/openshift/release/openshift-release-main__nightly-5.0-upgrade-from-stable-4.22.yamlci-operator/config/openshift/release/openshift-release-main__nightly-5.0.yamlci-operator/config/openshift/router/openshift-router-master.yaml
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
7babd7c to
4269f59
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
/pj-rehearse pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-haproxy28 |
|
@gcs278: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/test config |
|
@gcs278: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
2 similar comments
|
@gcs278: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
|
@gcs278: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
|
Good timing. Looks solid. /lgtm |
|
/pj-rehearse pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-upgrade-haproxy28 |
|
@gcs278: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-fips-haproxy28 |
|
/pj-rehearse pull-ci-openshift-router-master-e2e-agnostic-haproxy28 |
|
@gcs278: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@gcs278: your |
…perf variants With the IngressControllerMultipleHAProxyVersions feature gate promoted to GA, drop FEATURE_SET: TechPreviewNoUpgrade from all haproxy28 presubmits in CIO and router repos and rename from *-techpreview to *-haproxy28. This fixes the upgrade presubmits which could never work on TechPreviewNoUpgrade clusters. Add FIPS haproxy28 presubmits to CIO and router since HAProxy 2.8 and 3.2 use different OpenSSL/pcre versions which may behave differently in FIPS mode. Add a perfscale-aws-ingress-perf-haproxy28 presubmit to router for comparing HAProxy 2.8 vs 3.2 performance on the same cluster profile. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
4269f59 to
0d314ce
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
gcs278
changed the title
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/lgtm |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ci-operator/config/openshift/router/openshift-router-master.yaml (1)
119-146: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRun
fips-checkafteripi-install.
fips-checkchecks all cluster nodes, but this job runs it before the cluster exists. Move the step afteripi-installine2e-aws-fips-haproxy28.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/openshift/router/openshift-router-master.yaml` around lines 119 - 146, Move the fips-check step in the e2e-aws-fips-haproxy28 job to run after the ipi-install chain, preserving the existing step and job configuration.Sources: Coding guidelines, Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/config/openshift/router/openshift-router-master.yaml`:
- Around line 174-178: Reorder the pre steps so the fips-check ref runs after
the ipi-install chain; keep ipi-conf-aws first and ingress-conf-haproxy-version
in its existing relative position unless required by the ordering change.
---
Outside diff comments:
In `@ci-operator/config/openshift/router/openshift-router-master.yaml`:
- Around line 119-146: Move the fips-check step in the e2e-aws-fips-haproxy28
job to run after the ipi-install chain, preserving the existing step and job
configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 366aef12-556b-4de8-9231-25fc4d8fbbdd
⛔ Files ignored due to path filters (2)
ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/router/openshift-router-master-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (2)
ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yamlci-operator/config/openshift/router/openshift-router-master.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml
| pre: | ||
| - chain: ipi-conf-aws | ||
| - ref: fips-check | ||
| - chain: ipi-install | ||
| - ref: ingress-conf-haproxy-version |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Move fips-check after ipi-install.
fips-check runs oc get nodes and oc debug node/... for every cluster node. The registered AWS pre chain places ipi-conf-aws before ipi-install. At Line [176], this job runs fips-check before installation, so the node check cannot pass. (github.com)
Proposed ordering
- chain: ipi-conf-aws
- - ref: fips-check
- chain: ipi-install
+ - ref: fips-check
- ref: ingress-conf-haproxy-version📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| pre: | |
| - chain: ipi-conf-aws | |
| - ref: fips-check | |
| - chain: ipi-install | |
| - ref: ingress-conf-haproxy-version | |
| pre: | |
| - chain: ipi-conf-aws | |
| - chain: ipi-install | |
| - ref: fips-check | |
| - ref: ingress-conf-haproxy-version |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/config/openshift/router/openshift-router-master.yaml` around
lines 174 - 178, Reorder the pre steps so the fips-check ref runs after the
ipi-install chain; keep ipi-conf-aws first and ingress-conf-haproxy-version in
its existing relative position unless required by the ordering change.
Source: MCP tools
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gcs278, jcmoraisjr The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse |
|
@gcs278: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@gcs278: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Summary
FEATURE_SET: TechPreviewNoUpgradefrom all haproxy28 presubmits in CIO and router repos (FG is now GA)*-haproxy28-techpreview→*-haproxy28across all presubmitse2e-aws-ovn-fips-haproxy28presubmit to CIOe2e-aws-fips-haproxy28presubmit to routerperfscale-aws-ingress-perf-haproxy28presubmit to router for 2.8 vs 3.2 perf comparisonWhy
The haproxy28 presubmits were using
TechPreviewNoUpgrade, which meant upgrade jobs could never work (TP clusters can't upgrade). With the feature gate promoted to GA, we can drop the TP requirement and the upgrade jobs now function correctly.HAProxy 2.8 uses OpenSSL 1.1/pcre1 while 3.2 uses OpenSSL 3.x/pcre2. FIPS variants are added to both repos since the crypto paths differ.
A perfscale variant is added to router to enable direct performance comparison between HAProxy 2.8 and 3.2 on the same cluster profile.
Test plan
/test🤖 Generated with Claude Code
Summary by CodeRabbit
TechPreviewNoUpgradeand the-techpreviewjob suffix after GA promotion.