diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml index 55e3f96fa156f..e86800edce8a0 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate421.yaml @@ -238,23 +238,23 @@ tests: report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}} {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}} <{{.Status.URL}}|View logs>' - restrict_network_access: false + restrict_network_access: true steps: cluster_profile: aws-sandboxed-containers-operator env: AWS_REGION_OVERRIDE: us-east-2 - CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/osc-test-fbc:latest - CATALOG_SOURCE_NAME: brew-catalog + CATALOG_SOURCE_IMAGE: "" + CATALOG_SOURCE_NAME: redhat-operators ENABLE_MUST_GATHER: "true" ENABLEPEERPODS: "true" INITDATA: "" - INSTALL_KATA_RPM: "true" + INSTALL_KATA_RPM: "false" KATA_RPM_VERSION: 3.31.0-4.rhaos4.19.el9 MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest MUST_GATHER_ON_FAILURE_ONLY: "false" OSC_INSTALL: "true" RUNTIMECLASS: kata-remote - SLEEP_DURATION: 0h + SLEEP_DURATION: 6h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author.*C00102 diff --git a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml index d2a7b9f4c0236..752a05c7c0f85 100644 --- a/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml +++ b/ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate422.yaml @@ -78,7 +78,7 @@ tests: report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}} {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}} <{{.Status.URL}}|View logs>' - restrict_network_access: false + restrict_network_access: true steps: cluster_profile: azure-qe env: @@ -95,7 +95,7 @@ tests: MUST_GATHER_ON_FAILURE_ONLY: "false" OSC_INSTALL: "true" RUNTIMECLASS: kata-remote - SLEEP_DURATION: 0h + SLEEP_DURATION: 6h TEST_FILTERS: ~DisconnectedOnly&;~Disruptive&;~C00133& TEST_RELEASE_TYPE: Pre-GA TEST_SCENARIOS: sig-kata.*Kata Author.*C00102 diff --git a/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/README.md b/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/README.md index 5126321c61712..c444f2dbb5fea 100644 --- a/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/README.md +++ b/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/README.md @@ -41,3 +41,27 @@ This step expects the following to be available (created by earlier steps in the - `osc-config` ConfigMap in default namespace (created by `env-cm` step) - `peerpods-param-cm` ConfigMap in default namespace (created by `peerpods-param-cm` step, when peer-pods enabled) - `peerpods-param-secret` Secret in default namespace (created by `peerpods-param-cm` step, when peer-pods enabled) + +## AWS Peer-Pods: Credentials Are Intentionally Not Created Here + +Unlike Azure, this step does **not** create `peer-pods-secret` for AWS. The +OSC operator has its own built-in credential automation for AWS (see +`docs/credentials-handling.md` in the [openshift/sandboxed-containers-operator](https://github.com/openshift/sandboxed-containers-operator) +repo), with this priority order: user-created secret → STS (IRSA) → CCO +(Cloud Credential Operator). That automation only runs when no +`peer-pods-secret` already exists in the operator namespace +(`credentials_controller.go`'s `setupPeerPodsCredentials()`), and it's also +what makes podvm AMI creation work: the operator's image-build script +(`aws-podvm-image-handler.sh`) only auto-provisions the required S3 bucket and +`vmimport` IAM role when it detects STS env vars or a `peer-pods-secret` +created via the CCO flow (labeled +`kataconfiguration.openshift.io/credentials-request-based=true`). + +If this step (or anything else) pre-creates `peer-pods-secret` for AWS with +static keys, the operator falls into "manual credentials" mode instead, which +requires that S3 bucket/IAM role to already exist in the target AWS account +and hard-fails otherwise — this is what caused the original AWS peer-pods +failures this step was built to fix. Simply not creating the secret lets the +operator's own CCO automation provision everything it needs automatically, +using narrowly-scoped, temporary credentials rather than the cluster's +long-lived admin AWS credentials. diff --git a/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh b/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh index 7870c3206b1d5..76652b45fee5a 100755 --- a/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh +++ b/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-commands.sh @@ -585,6 +585,43 @@ function create_peer_pods_secret() { return 0 fi + local provider + provider=$(get_cloud_provider) + + # AWS: always defer to the operator's own built-in credential automation + # (STS, then CCO) instead of manually creating a static-key secret here. + # + # confirmed against openshift/sandboxed-containers-operator source + # (aws-podvm-image-handler.sh prepare_for_prebuilt_artifact()): the + # image-build job only auto-provisions the required S3 bucket + vmimport + # IAM role when it detects AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE (STS) + # or a peer-pods-secret created via the CCO flow (labeled + # kataconfiguration.openshift.io/credentials-request-based=true). ANY + # other pre-existing peer-pods-secret - including one manually created + # here - forces "manual credentials" mode, which requires the bucket/role + # to already exist in the AWS account and hard-fails if not (see + # docs/credentials-handling.md and ami-helper.sh in the operator repo). + # + # credentials_controller.go's setupPeerPodsCredentials() only attempts + # STS/CCO when NO peer-pods-secret exists yet, so simply not creating one + # here lets the operator fall through to CCO automatically, which + # provisions the bucket/role itself using narrowly-scoped, temporary + # CCO-minted credentials (more secure than reusing the cluster's + # long-lived admin-level AWS credentials for this). + if [[ "${provider}" == "aws" ]]; then + echo ">>> AWS: skipping manual peer-pods-secret creation; deferring to the operator's built-in STS/CCO credential automation" + return 0 + fi + + # TEMPORARY (testing): skip manual peer-pods-secret creation for Azure too, + # to validate whether the operator's built-in CCO automation also works + # here. Simple skip only - to be reworked (or reverted) after rehearsal + # results are in. See AWS comment above for the underlying reasoning. + if [[ "${provider}" == "azure" ]]; then + echo ">>> AZURE (testing): skipping manual peer-pods-secret creation; deferring to the operator's built-in STS/CCO credential automation" + return 0 + fi + # Detect identity mode from osc-config or default to manual local identity_mode identity_mode=$(oc get configmap osc-config -n default -o jsonpath='{.data.identityMode}' 2>/dev/null || echo "manual") @@ -609,9 +646,6 @@ function create_peer_pods_secret() { return 0 fi - local provider - provider=$(get_cloud_provider) - case "${provider}" in azure) # Extract Azure service principal credentials @@ -644,21 +678,9 @@ function create_peer_pods_secret() { echo ">>> WARNING: Could not extract Azure credentials from peerpods-param-secret" fi ;; - aws) - # Extract AWS credentials - local auth_json - auth_json=$(oc get secret peerpods-param-secret -n default -o jsonpath='{.data.auth\.json}' 2>/dev/null || echo "") - if [[ -n "${auth_json}" ]]; then - echo "${auth_json}" | base64 -d > "${SCRATCH}/auth.json" - oc_with_retry oc create secret generic peer-pods-secret \ - -n "${OSC_NAMESPACE}" \ - --from-file="${SCRATCH}/auth.json" - rm -f "${SCRATCH}/auth.json" - else - echo ">>> WARNING: Could not extract AWS credentials from peerpods-param-secret" - fi - ;; *) + # aws is handled earlier in this function (always deferred to the + # operator's built-in STS/CCO automation) and never reaches here. echo ">>> WARNING: peer-pods-secret creation not implemented for provider: ${provider}" ;; esac diff --git a/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml b/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml index 7ccf732e84536..126fdad1ce9af 100644 --- a/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml +++ b/ci-operator/step-registry/sandboxed-containers-operator/install-osc-operator/sandboxed-containers-operator-install-osc-operator-ref.yaml @@ -67,6 +67,16 @@ ref: creates peer-pods-secret in the operator namespace. For coco, enables confidential mode in osc-feature-gates. + For AWS, peer-pods-secret is intentionally NOT created by this step. The OSC + operator has its own built-in credential automation for AWS (STS, then CCO + as documented in docs/credentials-handling.md in the operator repo), which + only activates when no peer-pods-secret already exists. That automation also + handles provisioning the S3 bucket and "vmimport" IAM role required for podvm + AMI creation using narrowly-scoped, temporary CCO-minted credentials. Manually + pre-creating peer-pods-secret for AWS (as this step does for Azure) would force + the operator into "manual credentials" mode, which instead requires that + bucket/role to already exist in the AWS account and fails hard if not. + When complete, patches osc-config ConfigMap so tests can detect the pre-installed operator. The 2h timeout covers KataConfig readiness (typically ~1h for node reboots)