INTEROP-9236: Add ACS SMOKE test pipeline for OPP interop - #83102
INTEROP-9236: Add ACS SMOKE test pipeline for OPP interop#83102amp-rh wants to merge 14 commits into
Conversation
Add stackrox-opp-readiness and stackrox-opp-smoke step-registry components for running ACS SMOKE tests as part of the OPP interop pipeline. Phase 1a: stackrox-opp-readiness step - Polling loop with 30s interval / 5min timeout - Namespace discovery via Central and SecuredCluster CRs - Central route, API health, cluster connectivity checks - Sensor pod status with OOMKilled detection - Default policy count validation (>80) - Credential extraction with xtrace protection - Writes ROX_ADMIN_PASSWORD, CENTRAL_URL, CENTRAL_NS, SC_NS to SHARED_DIR Phase 1b: stackrox-opp-smoke step - Sparse-clones stackrox/stackrox and stackrox/scanner repos - Runs ./gradlew testSMOKE from qa-tests-backend/ - Copies JUnit XML results to ARTIFACT_DIR - Uses acs-smoke-runner image (UBI9 + OpenJDK 17) Phase 1c: OPP 4.22 config update - Adds dockerfile_literal image build for acs-smoke-runner - Inserts readiness and smoke refs into interop-opp-aws test chain after cucushift-installer-check-cluster-health Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The generate-registry-metadata tool rewrites metadata.json files to canonical format with path and owners (derived from OWNERS files), replacing the manual labels/description fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove sensitive URL/namespace values from CI logs - Remove incorrect set -x re-enablement (tracing was never on) - Increase readiness step timeout from 10m to 40m - Add non-root USER 1001 to acs-smoke-runner Dockerfile Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Make stackrox/scanner clone refs overridable via env vars - Pin ubi9/openjdk-17 base image to tag 1.21 - Add SHA-256 checksum verification for oc client download Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Pre-initialize TEST_EXIT=0 before the Gradle invocation so that the exit code is deterministic regardless of environment state.
Download the OC client with its original filename (-O) so sha256sum -c can find it. Previously the file was saved as oc-client.tar.gz but the sha256sum.txt referenced openshift-client-linux.tar.gz, causing all three rehearsal jobs to fail at the image build step.
Increase per-check TIMEOUT from 300s to 600s in the readiness gate. The Central API health check timed out at 300s in rehearsal runs because Central can take 5-10 minutes to become responsive after deployment. Add rm -rf of clone target directories in the smoke runner before git clone to prevent failures from stale partial clones.
openshift-ci-robot
added
the
jira/valid-reference
|
@amp-rh: This pull request references INTEROP-8003 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@amp-rh, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds ACS OPP readiness validation and smoke testing to the OCP 4.22 AWS interop workflow. The changes add a runner image, readiness checks, shared credentials, test execution, and report collection. ChangesACS OPP testing
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant AWSInterop
participant ReadinessStep
participant OpenShift
participant Central
participant SharedDir
participant SmokeStep
participant ArtifactDir
AWSInterop->>ReadinessStep: Run ACS readiness
ReadinessStep->>OpenShift: Discover namespaces and check sensors
ReadinessStep->>Central: Validate API, clusters, and policies
ReadinessStep->>SharedDir: Write credentials and connection details
AWSInterop->>SmokeStep: Run ACS smoke tests
SmokeStep->>SharedDir: Load readiness outputs
SmokeStep->>Central: Execute testSMOKE
SmokeStep->>ArtifactDir: Publish test reports
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 2 warnings)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: amp-rh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22.yaml`:
- Around line 56-58: Pin all externally executed artifacts to immutable
revisions: in
ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22.yaml
lines 56-58, replace the stable OpenShift client URL with a release-specific URL
and validate it against a fixed expected checksum; in
ci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-commands.sh
lines 31-32, replace mutable StackRox and Scanner main-branch references with
immutable revisions and verify each checked-out commit before running Gradle.
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`:
- Around line 87-90: Enable TLS certificate verification for all Central
requests by removing curl’s -k option in
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh
at lines 87-90 (health request), 101-105 (authenticated cluster request), and
165-171 (authenticated policy request); rely on the system trust bundle or
provide the ingress CA via --cacert.
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.yaml`:
- Line 9: Align the readiness gate’s total timeout with its retry budget: in
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.yaml
at lines 9-9, increase the step timeout if each wait_for check retains its
independent budget; alternatively, in
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh
at lines 30-30, replace the per-check ELAPSED reset with one deadline covering
all seven checks.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 9bf41049-e10a-4671-acca-4f75e94c5a38
📒 Files selected for processing (9)
ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22.yamlci-operator/step-registry/stackrox/opp-readiness/OWNERSci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.shci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.metadata.jsonci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.yamlci-operator/step-registry/stackrox/opp-smoke/OWNERSci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-commands.shci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-ref.metadata.jsonci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-ref.yaml
Increase stackrox-opp-readiness step timeout from 40m to 50m. With TIMEOUT=600 per check across 7 sequential checks, a slow staged deployment could exceed 40m. The 50m budget provides adequate headroom while the individual check timeouts prevent infinite hangs.
|
/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
amp-rh
changed the title
|
@amp-rh: This pull request references INTEROP-9236 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
- shell options: set -eux -o pipefail (openshift/release convention) - function naming: function PascalCase () with typeset locals - xtrace discipline: set +x / set -x pairs around sensitive ops - replace || true with find -exec for artifact copy - step timeout 50m -> 1h15m to cover worst-case polling budget
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh (1)
30-43: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winUse one deadline for the readiness sequence.
Line 30 resets
ELAPSEDfor everyWaitForcall. The seven calls at Lines 66, 69, 79, 94, 125, 159, and 175 can each consumeTIMEOUT. The full sequence can run for approximately7 * TIMEOUT, not the single polling budget stated for this step.Set one deadline before the first wait. Calculate each retry budget from that deadline.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh` around lines 30 - 43, Use a single readiness deadline initialized before the sequence of WaitFor calls instead of resetting ELAPSED inside each WaitFor invocation. Update WaitFor and its retry/timeout checks to calculate remaining time from that shared deadline, so all readiness checks collectively remain within one TIMEOUT budget.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`:
- Around line 151-156: Update the sensor pod readiness check that builds
notRunning from podJson to require both status.phase == "Running" and a pod
status.conditions entry with type "Ready" and status "True" for every pod.
Preserve the existing name-and-phase reporting for pods that fail either
requirement and the final empty-result readiness check.
- Line 2: Update the shell options near CheckCentralApi so the script starts
without xtrace enabled, while retaining errexit and pipefail. Enable tracing
only in a narrowly scoped region that cannot expand or log the Central URL, and
disable it before the URL-consuming commands.
---
Outside diff comments:
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`:
- Around line 30-43: Use a single readiness deadline initialized before the
sequence of WaitFor calls instead of resetting ELAPSED inside each WaitFor
invocation. Update WaitFor and its retry/timeout checks to calculate remaining
time from that shared deadline, so all readiness checks collectively remain
within one TIMEOUT budget.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 4afc50ba-93ee-42f1-942c-3bfde202dcdf
📒 Files selected for processing (3)
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.shci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.yamlci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-commands.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- ci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-commands.sh
|
/pj-rehearse |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
- Wrap CENTRAL_URL expansion and curl calls with set +x/set -x to prevent internal hostnames from leaking to CI xtrace output - Change sensor pod check from phase-based (Running) to condition-based (Ready=True) to prevent flaky smoke runs when pods are Running but containers are not yet ready - Add missing trailing newlines to metadata.json files
|
/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws |
ACS Central now requires authentication for /v1/metadata. Move ROX_ADMIN_PASSWORD extraction before the API health check and pass credentials to the curl request.
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh (1)
103-129: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winRetry the
central-htpasswdlookup.The admin-password extraction runs once outside
WaitFor. Withset -euo pipefail, a transientoc,jq, orbase64failure can terminate readiness before later checks retry.Move the lookup and non-empty validation into a
WaitForcheck function. Keep xtrace disabled for the complete secret-handling scope.Proposed fix
+function CheckAdminPassword () { + # Disable xtrace while reading the admin password. + set +x + typeset password="" + password="$(oc get secret -n "${CENTRAL_NS}" central-htpasswd \ + -o json | jq -r '.data.password' | base64 -d)" || { + set -x + return 1 + } + [[ -n "${password}" ]] || { + set -x + return 1 + } + ROX_ADMIN_PASSWORD="${password}" + set -x +} + +WaitFor "admin password extraction" CheckAdminPassword🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh` around lines 103 - 129, Move the central-htpasswd lookup and empty-password validation into a dedicated WaitFor-compatible check function, preserving the existing ROX_ADMIN_PASSWORD assignment and fatal validation behavior. Ensure the function returns failure when oc, jq, base64, or the resulting password is unavailable so WaitFor retries transient failures. Keep xtrace disabled throughout the complete secret-handling operation, and invoke this check before CheckClustersConnected.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`:
- Around line 81-83: Keep xtrace disabled through every command that writes or
expands CENTRAL_URL, including the corresponding scopes at the referenced
credential and later URL blocks; move each set -x until after the protected
command completes. Add a comment immediately before each set +x documenting
whether the scope protects the Central URL or a credential, while preserving
tracing for all unrelated commands.
---
Outside diff comments:
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`:
- Around line 103-129: Move the central-htpasswd lookup and empty-password
validation into a dedicated WaitFor-compatible check function, preserving the
existing ROX_ADMIN_PASSWORD assignment and fatal validation behavior. Ensure the
function returns failure when oc, jq, base64, or the resulting password is
unavailable so WaitFor retries transient failures. Keep xtrace disabled
throughout the complete secret-handling operation, and invoke this check before
CheckClustersConnected.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: cebc18db-28f2-461b-b7f6-6ead74fe3c00
📒 Files selected for processing (4)
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.shci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.metadata.jsonci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-commands.shci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-ref.metadata.json
🚧 Files skipped from review as they are similar to previous changes (3)
- ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.metadata.json
- ci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-ref.metadata.json
- ci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-commands.sh
|
@amp-rh: |
|
/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The `cli` base image does not include jq. Replace all jq calls: - Secret extraction: oc jsonpath instead of jq - Cluster/policy counts: python3 JsonLength helper - Sensor pod checks: oc jsonpath + python3 for OOMKilled detection
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`:
- Around line 162-171: Update the notReady assignment in the Sensor readiness
check to preserve and propagate failures from the oc get pods pipeline instead
of masking them with || true. Ensure the surrounding readiness condition returns
failure when the query fails, allowing WaitFor to retry, while retaining the
existing notReady handling for successful queries.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 41b4439a-0b9a-4062-93f7-068421398bc3
📒 Files selected for processing (3)
ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.shci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.metadata.jsonci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-ref.metadata.json
🚧 Files skipped from review as they are similar to previous changes (2)
- ci-operator/step-registry/stackrox/opp-smoke/stackrox-opp-smoke-ref.metadata.json
- ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-ref.metadata.json
| typeset notReady="" | ||
| notReady="$(oc get pods -n "${SC_NS}" -l app=sensor \ | ||
| -o jsonpath='{range .items[*]}{.metadata.name}{" "}{range .status.conditions[*]}{.type}={.status}{" "}{end}{"\n"}{end}' 2>/dev/null \ | ||
| | while IFS= read -r line; do | ||
| [[ -z "${line}" ]] && continue | ||
| if ! echo "${line}" | grep -q 'Ready=True'; then | ||
| echo "${line%% *}:NotReady" | ||
| fi | ||
| done)" || true | ||
| [[ -z "${notReady}" ]] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Do not treat a failed Sensor query as ready.
|| true converts an oc get pods failure into an empty notReady value. Line 171 then returns success. A transient API or authorization failure can start the smoke step without verifying Sensor readiness.
Return failure from this pipeline so WaitFor retries it.
Proposed fix
- done)" || true
+ done)" || return 1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| typeset notReady="" | |
| notReady="$(oc get pods -n "${SC_NS}" -l app=sensor \ | |
| -o jsonpath='{range .items[*]}{.metadata.name}{" "}{range .status.conditions[*]}{.type}={.status}{" "}{end}{"\n"}{end}' 2>/dev/null \ | |
| | while IFS= read -r line; do | |
| [[ -z "${line}" ]] && continue | |
| if ! echo "${line}" | grep -q 'Ready=True'; then | |
| echo "${line%% *}:NotReady" | |
| fi | |
| done)" || true | |
| [[ -z "${notReady}" ]] | |
| typeset notReady="" | |
| notReady="$(oc get pods -n "${SC_NS}" -l app=sensor \ | |
| -o jsonpath='{range .items[*]}{.metadata.name}{" "}{range .status.conditions[*]}{.type}={.status}{" "}{end}{"\n"}{end}' 2>/dev/null \ | |
| | while IFS= read -r line; do | |
| [[ -z "${line}" ]] && continue | |
| if ! echo "${line}" | grep -q 'Ready=True'; then | |
| echo "${line%% *}:NotReady" | |
| fi | |
| done)" || return 1 | |
| [[ -z "${notReady}" ]] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/stackrox/opp-readiness/stackrox-opp-readiness-commands.sh`
around lines 162 - 171, Update the notReady assignment in the Sensor readiness
check to preserve and propagate failures from the oc get pods pipeline instead
of masking them with || true. Ensure the surrounding readiness condition returns
failure when the query fails, allowing WaitFor to retry, while retaining the
existing notReady handling for successful queries.
|
/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
stackrox/stackrox and stackrox/scanner use master as their default branch, not main.
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@amp-rh: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-interop-opp-aws |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
3 participants
Summary
Adds ACS (StackRox) SMOKE test integration to the OPP interop test suite,
as part of the INTEROP-8003 epic. This implements Phase 1 (step-registry
refs and OPP config wiring) using the existing stackrox qa-tests-backend
Gradle test suite.
Changes
Phase 1a: Readiness gate (
stackrox-opp-readiness)dynamically via Central/SecuredCluster CRs (
--all-namespaces)/v1/metadata), securedcluster connected (
/v1/clusters), sensor pods Running (withOOMKilled detection), default policies loaded (>80)
ROX_ADMIN_PASSWORDfromcentral-htpasswdsecret(xtrace disabled during credential handling)
$SHARED_DIRPhase 1b: SMOKE test runner (
stackrox-opp-smoke)acs-smoke-runnerimage (UBI9/openjdk-17 + git + oc)stackrox/scanner (proto/scanner)
./gradlew testSMOKE -i --no-daemon$ARTIFACT_DIRregardless oftest exit code
Phase 1c: OPP config wiring
acs-smoke-runnerdockerfile_literal image to the OPP 4.22ci-operator config
interop-opp-awstest chain aftercucushift-installer-check-cluster-health, beforeacm-tests-clc-createJira
INTEROP-8003
/cc @cspi-qe-ocp-lp
Summary by CodeRabbit
Adds ACS (StackRox) OPP smoke-test integration to the OpenShift CI interop suite for OPP 4.22.
$SHARED_DIR.qa-tests-backendSMOKE tests and publishes JUnit and HTML reports.acs-smoke-runnerimage and wires both steps into theinterop-opp-awstest chain./v1/metadatarequests and removes thejqdependency.Ready=Truecondition.