CNTRLPLANE-3364: adding the clusterbot workflow. Its optional.#79066
CNTRLPLANE-3364: adding the clusterbot workflow. Its optional.#79066sandeepknd wants to merge 1 commit intoopenshift:mainfrom
Conversation
|
@sandeepknd: This pull request references CNTRLPLANE-3364 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sandeepknd The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughAdds three new etcd-encryption workflows (AWS, Azure, GCP) that provision IPI clusters and install/configure HashiCorp Vault for KMS-based encryption testing; introduces a reusable vault setup chain; and adds corresponding OWNERS, workflow metadata, and CI chat-bot workflow registrations. Changesetcd-encryption with HashiCorp Vault (AWS / Azure / GCP) + Vault Setup Chain
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer/Trigger
participant CI as CI Operator
participant Chat as CI Chat-Bot
participant Prov as Cluster Provisioner (IPI)
participant Vault as HashiCorp Vault (vault-kms)
participant Test as clusterbot-wait / Test Harness
Dev->>CI: push / trigger workflow (etcd-encryption-hashicorp-vault-<platform>)
CI->>Chat: query workflows-config (platform metadata)
CI->>Prov: run pre-chain (ipi-*-pre, etcd-encryption-vault-setup)
Prov->>Vault: deploy Vault Enterprise, enable Transit, create KMS key, configure AppRole
Vault->>CI: store credentials in secret `vault-credentials`
CI->>Test: run `clusterbot-wait` (cluster readiness)
Test->>CI: signal readiness
CI->>CI: run post-chains (gather-core-dump, ipi-*-post) — best-effort
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-merge-bot
Bot
added
the
rehearsals-ack
sandeepknd
force-pushed
the
clusterbot_vault
branch
from
949420f to
4fe153f
Compare
|
/assign @tjungblu |
|
I think before this PR, it would be better to define the chain that is composed of vault-install and vault-configuration. |
sandeepknd
force-pushed
the
clusterbot_vault
branch
from
4fe153f to
380456e
Compare
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
Wrapped the two steps into a chain, per openshift CI best practices. |
|
@sandeepknd: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Once this lands. I will raise a separate follow-up PR to invoke this chain in the CI test. (PR - #78947) |
4 participants
Introduces three new clusterbot workflows that enable users to launch OpenShift clusters with HashiCorp Vault Enterprise pre-installed and configured for KMS encryption testing via Slack
Basic Commands:
Launch a cluster with Vault on AWS:
Launch a cluster with Vault on GCP:
Launch a cluster with Vault on Azure:
Summary
Adds three optional clusterbot workflows and supporting step-registry chains to OpenShift CI that let operators provision IPI clusters with HashiCorp Vault Enterprise pre-installed and configured for KMS-based etcd encryption testing. The changes register the workflows with the CI chat-bot (Slack) and add ownership/metadata so the workflow and its constituent chains can be reviewed and landed.
Affected areas: core-services/ci-chat-bot (workflow registration), ci-operator step-registry (new workflows, a new vault-setup chain and supporting metadata), and OWNERS files under the etcd-encryption step-registry.
What changed (practical impact)
New clusterbot workflows (ci-operator step-registry)
Each workflow provisions an IPI cluster on the specified cloud, installs Vault Enterprise into namespace vault-kms (Helm, dev mode described in docs), enables the Transit engine, creates a KMS key, configures AppRole auth, stores credentials in a vault-credentials secret, exposes Vault endpoints (service/pod/namespace), waits for cluster readiness via clusterbot-wait, and runs platform-specific post/cleanup chains (gather-core-dump, ipi-*-post). Each workflow includes documentation and default environment variables (CLUSTER_DURATION, VAULT_VERSION, VAULT_NAMESPACE, VAULT_KMS_KEY_NAME).
New reusable chain: etcd-encryption-vault-setup
Chat-bot registration
Ownership and metadata
Notes for reviewers / operators