Add CI functionality

.github/workflows/jsonschema.yaml

@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 

.gitignore

@@ -7,6 +7,7 @@ pattern-vault.init
 vault.init
 super-linter.log
 common/pattern-vault.init
+tests/ci/.results/
 
 # Super-linter outputs
 super-linter-output

Makefile-common

@@ -18,7 +18,7 @@ operator-deploy operator-upgrade: ## Installs/updates the pattern on a cluster (
 	@$(ANSIBLE_RUN) rhvp.cluster_utils.operator_deploy
 
 .PHONY: install
-#install: pattern-install  ## Installs the pattern onto a cluster (Loads secrets as well if configured)
+#install: pattern-install ## Installs the pattern onto a cluster (Loads secrets as well if configured)
 install: operator-deploy load-secrets
 
 .PHONY: uninstall ## Prints a notice that patterns cannot currently be uninstalled
@@ -53,3 +53,8 @@ validate-schema: ## validates values files against schema in common/clustergroup
 .PHONY: argo-healthcheck
 argo-healthcheck: ## Checks if all argo applications are synced
 	@$(ANSIBLE_RUN) rhvp.cluster_utils.argo_healthcheck
+
+##@ Testing (CI) Tasks
+.PHONY: run-ci-tests
+run-ci-tests: argo-healthcheck ## To run ci-tests, set any needed env vars
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.run_ci_tests

overrides/values-ci.yaml

@@ -0,0 +1,172 @@
+# These overrides are needed in CI system to test everything
+# The CI will pass these overrides with
+# EXTRA_HELM_OPTS='--set clusterGroup.sharedValueFiles[3]=/overrides/values-ci.yaml'
+global:
+  registry:
+    enabled: true
+    domain: quay-registry-quay-quay-enterprise.apps.{{ .Values.global.clusterDomain }}
+    repository: ztvp/qtodo
+    user: quay-admin
+    vaultPath: "secret/data/hub/infra/quay/quay-users"
+    passwordVaultKey: "quay-admin-password"
+
+clusterGroup:
+  namespaces:
+    openshift-storage:
+      operatorGroup: true
+      targetNamespace: openshift-storage
+      annotations:
+        openshift.io/cluster-monitoring: "true"
+        argocd.argoproj.io/sync-wave: "26"  # Propagated to OperatorGroup by framework
+    quay-enterprise:
+      annotations:
+        argocd.argoproj.io/sync-wave: "32"  # Create before NooBaa and all Quay components
+      labels:
+        openshift.io/cluster-monitoring: "true"
+    trusted-artifact-signer:
+      annotations:
+        argocd.argoproj.io/sync-wave: "32"  # Auto-created by RHTAS operator
+      labels:
+        openshift.io/cluster-monitoring: "true"
+    rhtpa-operator:
+      operatorGroup: true
+      targetNamespace: rhtpa-operator
+      annotations:
+        argocd.argoproj.io/sync-wave: "26"  # Create before operator subscription
+    trusted-profile-analyzer:
+      annotations:
+        argocd.argoproj.io/sync-wave: "32"  # Create before RHTPA components
+      labels:
+        openshift.io/cluster-monitoring: "true"
+    openshift-pipelines:
+  subscriptions:
+    openshift-pipelines:
+      name: openshift-pipelines-operator-rh
+      namespace: openshift-operators
+      channel: pipelines-1.23
+    odf:
+      name: odf-operator
+      namespace: openshift-storage
+      annotations:
+        argocd.argoproj.io/sync-wave: "27"  # Install after OperatorGroup (26)
+    quay-operator:
+      name: quay-operator
+      namespace: openshift-operators
+      annotations:
+        argocd.argoproj.io/sync-wave: "28"  # Install after ODF operator
+    rhtas-operator:
+      name: rhtas-operator
+      namespace: openshift-operators
+      channel: stable-v1.4
+      annotations:
+        argocd.argoproj.io/sync-wave: "29"  # Install after Quay operator, before applications
+      catalogSource: redhat-operators
+    rhtpa-operator:
+      name: rhtpa-operator
+      namespace: rhtpa-operator  # MUST use dedicated namespace (not openshift-operators)
+      catalogSource: redhat-operators
+      annotations:
+        argocd.argoproj.io/sync-wave: "27"  # Install after OperatorGroup (26), before applications
+  applications:
+    noobaa-mcg:
+      name: noobaa-mcg
+      namespace: openshift-storage
+      argoProject: hub
+      path: charts/noobaa-mcg
+      annotations:
+        argocd.argoproj.io/sync-wave: "36"  # Deploy after core services
+    quay-registry:
+      name: quay-registry
+      namespace: quay-enterprise
+      argoProject: hub
+      chart: quay
+      chartVersion: 0.2.*
+      annotations:
+        argocd.argoproj.io/sync-wave: "41"  # Deploy after NooBaa storage backend
+      extraValueFiles:
+      - /overrides/values-quay.yaml
+    trusted-artifact-signer:
+      name: trusted-artifact-signer
+      namespace: trusted-artifact-signer
+      argoProject: hub
+      path: charts/rhtas-operator
+      annotations:
+        argocd.argoproj.io/sync-wave: "46"  # Deploy after dependencies
+      overrides:
+        - name: rhtas.zeroTrust.spire.enabled
+          value: "true"
+        - name: rhtas.zeroTrust.spire.trustDomain
+          value: "apps.{{ $.Values.global.clusterDomain }}"
+        - name: rhtas.zeroTrust.spire.issuer
+          value: "https://spire-spiffe-oidc-discovery-provider.apps.{{ $.Values.global.clusterDomain }}"
+        - name: rhtas.zeroTrust.email.enabled
+          value: "true"
+        - name: rhtas.zeroTrust.email.issuer
+          value: https://keycloak.apps.{{ $.Values.global.clusterDomain }}/realms/ztvp
+    trusted-profile-analyzer:
+      name: trusted-profile-analyzer
+      namespace: trusted-profile-analyzer
+      argoProject: hub
+      path: charts/rhtpa-operator
+      annotations:
+        argocd.argoproj.io/sync-wave: "41"  # Create chart resources (OBC, DB, etc.)
+      ignoreDifferences:
+        - group: batch
+          kind: Job
+          jsonPointers:
+            - /status
+    qtodo:
+      overrides:
+        - name: app.oidc.enabled
+          value: "true"
+        - name: app.spire.enabled
+          value: "true"
+        - name: app.vault.url
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: app.vault.role
+          value: qtodo
+        - name: app.vault.secretPath
+          value: secret/data/apps/qtodo/qtodo-db
+      extraValueFiles:
+        - '/overrides/values-ci.yaml'
+    tekton-chains:
+      name: tekton-chains
+      project: hub
+      path: charts/tekton-chains
+      annotations:
+        argocd.argoproj.io/sync-wave: "47"
+    supply-chain:
+      name: supply-chain
+      argoProject: hub
+      path: charts/supply-chain
+      annotations:
+        argocd.argoproj.io/sync-wave: "48"
+      ignoreDifferences:
+        - kind: ServiceAccount
+          jqPathExpressions:
+            - .imagePullSecrets[]|select(.name | contains("-dockercfg-"))
+        - group: tekton.dev
+          kind: Task
+          jsonPointers:
+            - /spec/steps
+        - group: tekton.dev
+          kind: Pipeline
+          jsonPointers:
+            - /spec/tasks
+      overrides:
+        - name: registry.tlsVerify
+          value: "false"
+        - name: rhtas.enabled
+          value: "true"
+        - name: rhtpa.enabled
+          value: "true"
+        - name: pipelinerun.enabled
+          value: "true"
+      extraValueFiles:
+        - '/overrides/values-ci.yaml'
+    acs-central:
+      overrides:
+        - name: integration.quay.enabled
+          value: "true"
+        - name: integration.quay.url
+          value: "quay-quay-enterprise.apps.{{ .Values.global.domain }}"

pattern-metadata.yaml

@@ -25,7 +25,7 @@ requirements:
           type: Standard_D8s_v3
         aws:
           replicas: 3
-          type: m5.2xlarge
+          type: m5.4xlarge
     controlPlane:
       platform:
         gcp:
@@ -36,7 +36,7 @@ requirements:
           type: Standard_D4s_v3
         aws:
           replicas: 3
-          type: m5.xlarge
+          type: m5.2xlarge
   spoke: # optional - represents the clusters imported into ACM
     compute:
       platform:

pattern.sh

@@ -15,6 +15,19 @@ function version {
     echo "$1" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'
 }
 
+# We need this check mostly for CI testing, we do not want to run container in container
+function is_container() {
+    [ -n "${KUBERNETES_SERVICE_HOST:-}" ] && return 0
+    [ -f /.dockerenv ] && return 0
+    [ -f /run/.containerenv ] && return 0
+    return 1
+}
+
+if is_container; then
+    echo "Already running in a container"
+    exec "$@"
+fi
+
 if [ -z "${PATTERN_UTILITY_CONTAINER:-}" ]; then
 	PATTERN_UTILITY_CONTAINER="quay.io/validatedpatterns/utility-container"
 fi
@@ -120,6 +133,7 @@ podman run -it --rm --pull=newer \
     -e TOKEN_SECRET \
     -e UUID_FILE \
     -e VALUES_SECRET \
+    -e 'VP_*' \
     ${PKI_HOST_MOUNT_ARGS[@]+"${PKI_HOST_MOUNT_ARGS[@]}"} \
     -v "$(pwd -P)":"$(pwd -P)" \
     -v "${HOME}":"${HOME}" \

tests/ci/README.md

@@ -0,0 +1,39 @@
+# The requirements.txt file is just a placeholder to show the installed packages in the utility container
+
+<https://github.com/validatedpatterns/utility-container/blob/main/requirements.txt>
+
+## The ci will run pytest based on file pattern
+
+pytest -lv test_\<TARGET_CLUSTERGROUP\>.py --junit-xml .results/test_\<TARGET_CLUSTERGROUP\>.xml
+
+## To run upstream tests locally
+
+Set the env variables pointing to the clusters needed to run the tests on:
+`HUBCONFIG` (`SPOKECONFIG` if applicable) pointing to the kubconfig of hub (and spoke) clusters
+`TARGET_CLUSTERGROUP` if its different from the default (values-global.yaml main.clusterGroupName)
+Test logs and junit-xml will be saved in ci/.results/
+Run from repository root
+
+```bash
+./pattern.sh make run-ci-tests
+```
+
+## Writing additonal tests
+
+The openshift_dyn_client fixture will return a DynamicClient which can be used inside test functions.
+It requires only an env variable param to use it as a kubeconfig.
+
+```python
+@pytest.mark.parametrize(
+    "openshift_dyn_client",
+    ["HUBCONFIG"],
+    indirect=True,
+)
+```
+
+If your tests requires additional python packages, you might want to either run them fully locally in a venv or similar.
+Or if you want to use the pattern framework (make/Ansible wrappers) you need to use your own util container
+
+```bash
+PATTERN_UTILITY_CONTAINER="your_utility container" ./pattern.sh make run-ci-tests
+```

tests/ci/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

tests/ci/conftest.py

@@ -0,0 +1 @@
+from validatedpatterns_tests.interop.conftest_openshift import *  # noqa: F401, F403

tests/ci/requirements.txt

@@ -0,0 +1,15 @@
+ansible-core==2.18.*
+ansible-runner
+awxkit
+kubernetes
+openshift
+boto3>=1.21
+botocore>=1.24
+awscli>=1.22
+azure-cli>=2.34
+gcloud
+humanize
+pytz
+pytest
+junitparser
+vp-qe-test-common @ git+https://github.com/darkdoc/vp-qe-test-common.git@v1