PS-10640: add PS pillar image certification smoke pipeline - #4103
Draft
nogueiraanderson wants to merge 3 commits into
Draft
PS-10640: add PS pillar image certification smoke pipeline#4103nogueiraanderson wants to merge 3 commits into
nogueiraanderson wants to merge 3 commits into
Conversation
- New cloud/jenkins/ps_image_certification.groovy for PS-10640 smoke test - Modeled after pso_image_certification.groovy with operator-bundle plumbing (prepareSources, release_versions) stripped - DRY_RUN default true; PYXIS_PROJECT_ID and REGISTRY_CREDS_ID are placeholders pending RHPC admin handoff - Requires --no-submit flag added to cloud/scripts/certify_images.py before any DRY_RUN execution actually works (follow-up commit)
- New optional --no-submit argparse flag (action=store_true) - Conditionally drops --submit from preflight cmd when set - Default behavior unchanged: existing operator cert pipelines keep submitting to Pyxis as before - Enables PS-10640 ps_image_certification.groovy DRY_RUN mode to run preflight without uploading to a real Red Hat ISV project
Per codex review of the initial PS-10640 smoke pipeline: - certify_images.py: when --no-submit is set, skip docker_login + the prepare_image registry push, and run preflight against the source image (not the would-be dest). Token and component id are also dropped from the preflight cmd in this mode. dest_image and component become optional args. - ps_image_certification.groovy: split into two paths. DRY_RUN=true needs no credentials (no PYXIS_TOKEN, no registry creds, no PID). DRY_RUN=false fails fast if PYXIS_PROJECT_ID or REGISTRY_CREDS_ID are empty or still placeholders; replaces credentials placeholder with a more obvious REPLACE_WITH_REAL_REGISTRY_CREDS_ID sentinel. Existing operator cert pipelines (pso/pgo/psmdbo/pxco) keep working unchanged since they never pass --no-submit and always pass dest_image + component. Validated locally on percona/percona-server:8.0.45-36: preflight ran end-to-end against the source image with no Pyxis contact and no registry pushes; result PASSED 10/10 on both amd64 and arm64.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase-1 scaffolding for PS-10640. This proves the cert path; release wiring and all-pillar rollout are follow-up, not in this PR.
The new pipeline
cloud/jenkins/ps_image_certification.groovyruns in safe DRY_RUN mode by default: no credentials, no registry push, no Pyxis contact. It runsopenshift-preflightdirectly against the source image. When DRY_RUN is false it fails fast while PID and credential IDs are still placeholders.The supporting Python change adds
--no-submittocloud/scripts/certify_images.py. With the flag set, the script skips docker login, skips the registry push, drops the Pyxis token and component args, and points preflight at the source image. The four existing operator pipelines never pass--no-submit, so their behavior is unchanged.Locally verified on
percona/percona-server:8.0.45-36: preflight pulls the multi-arch image, runs all 10 checks per arch, exits 0, makes zero Pyxis or registry contact.Production follow-up tracked on the ticket: pin the preflight version, extend the common
imageCertification.groovyhelper rather than duplicating its pattern, wire cert as a downstream stage ofps_containers_docker_build.groovyand analogues for PXC/PSMDB/PXB/PBM/PG/PT, implement publish-stage automation, and register per-PID Jenkins credentials once strategy is confirmed.