Skip to content

SPLAT-2668: hypershift/aws/ccm: enable optional managed security group conformance job#77567

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
mtulio:splat-2587-hypershift-conformance-nlb
May 14, 2026
Merged

SPLAT-2668: hypershift/aws/ccm: enable optional managed security group conformance job#77567
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
mtulio:splat-2587-hypershift-conformance-nlb

Conversation

@mtulio
Copy link
Copy Markdown
Contributor

@mtulio mtulio commented Apr 9, 2026 •
edited
Loading

Summary

Add monthly periodic jobs to validate the AWS CCM managed security group feature
(AWSServiceLBNetworkSecurityGroup) on HyperShift for 4.23 and 5.0.

Changes

  • Periodics (release-4.23 and release-5.0): Two monthly jobs each:
    • e2e-aws-ovn-conformance-ccm — conformance with managed SG enabled
    • e2e-aws-ovn-conformance-ccm-techpreview — same with TechPreviewNoUpgrade
    • Both use hypershift-aws-conformance workflow with TEST_SKIPS adjusted
      to include NLB security group tests
  • Slack alerts: Failure/error notifications to #forum-ocp-splat-alerts-aws

Context

Dedicated jobs to validate CCM managed SG on HyperShift without disrupting
existing monitoring. Once the feature is stable, these will be removed and the
AWSServiceLBNetworkSecurityGroup skip reverted from baseline conformance.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 9, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 9, 2026 •
edited by atlassian Bot
Loading

@mtulio: This pull request references SPLAT-2587 which is a valid jira issue.

Details

In response to this:

Create a dedicated conformance job enabling managed security group feature of CCM for NLB, so that we can validate the feature on hypershift at PR
openshift/hypershift#7460

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot requested review from devguyio and enxebre April 9, 2026 02:19
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 9, 2026 •
edited by atlassian Bot
Loading

@mtulio: This pull request references SPLAT-2587 which is a valid jira issue.

Details

In response to this:

Create a dedicated conformance job enabling managed security group feature of CCM for NLB, so that we can validate the feature on hypershift at PR
openshift/hypershift#7460

The new job presubmit job for hypershift project, overrides the TESTS_SKIPS from conformance workflow. A dedicated job has been created to prevent disruption in existing monitoring, while we can validate the PR individually. Once the tests are validated on Hypershift, and feature deliverable and stable, we will remove this one, and the TEST_SKIPS for AWSServiceLBNetworkSecurityGroup

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 9, 2026

This is expected to fail as the feature is not merged on hypershift:

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-conformance-aws-ccm-nlb-sg

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 9, 2026

@mtulio: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 9, 2026

/assign enxebre

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 9, 2026 •
edited by atlassian Bot
Loading

@mtulio: This pull request references SPLAT-2587 which is a valid jira issue.

Details

In response to this:

Create a dedicated conformance job enabling managed security group feature of CCM for NLB, so that we can validate the feature on hypershift at PR
openshift/hypershift#7460

The new job presubmit job for hypershift project, overrides the TESTS_SKIPS from conformance workflow. A dedicated job has been created to prevent disruption in existing monitoring, while we can validate the PR individually. Once the tests are validated on Hypershift, and feature deliverable and stable, we will remove this one, and the TEST_SKIPS for AWSServiceLBNetworkSecurityGroup

https://redhat.atlassian.net/browse/SPLAT-2668

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@mtulio mtulio changed the title SPLAT-2587: hypershift/aws/ccm: enable managed security group tests to conformance SPLAT-2668: hypershift/aws/ccm: enable managed security group tests to conformance Apr 9, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 9, 2026 •
edited by atlassian Bot
Loading

@mtulio: This pull request references SPLAT-2668 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Create a dedicated conformance job enabling managed security group feature of CCM for NLB, so that we can validate the feature on hypershift at PR
openshift/hypershift#7460

The new job presubmit job for hypershift project, overrides the TESTS_SKIPS from conformance workflow. A dedicated job has been created to prevent disruption in existing monitoring, while we can validate the PR individually. Once the tests are validated on Hypershift, and feature deliverable and stable, we will remove this one, and the TEST_SKIPS for AWSServiceLBNetworkSecurityGroup

https://redhat.atlassian.net/browse/SPLAT-2668

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 9, 2026 •
edited by atlassian Bot
Loading

@mtulio: This pull request references SPLAT-2668 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Create a dedicated conformance job enabling managed security group feature of CCM for NLB, so that we can validate the feature on hypershift at PR
openshift/hypershift#7460

The new job presubmit job for hypershift project, overrides the TESTS_SKIPS from conformance workflow. A dedicated job has been created to prevent disruption in existing monitoring, while we can validate the PR individually. Once the tests are validated on Hypershift, and feature deliverable and stable, we will remove this one, and the TEST_SKIPS for AWSServiceLBNetworkSecurityGroup

https://redhat.atlassian.net/browse/SPLAT-2587
https://redhat.atlassian.net/browse/SPLAT-2668

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@mtulio mtulio force-pushed the splat-2587-hypershift-conformance-nlb branch from 2110c4c to ddf4d3a Compare April 9, 2026 12:59
@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 9, 2026

job is passing: rehearse-77567-pull-ci-openshift-hypershift-main-e2e-conformance-aws-ccm-nlb-sg #2042066510754615296

I just fixed the "ci metadata" with EOL fixes (nit):

/pj-rehearse ack

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented Apr 9, 2026

@mtulio: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added rehearsals-ack Signifies that rehearsal jobs have been acknowledged and removed rehearsals-ack Signifies that rehearsal jobs have been acknowledged labels Apr 9, 2026
@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 9, 2026

/assign @muraee

@mtulio mtulio changed the title SPLAT-2668: hypershift/aws/ccm: enable managed security group tests to conformance SPLAT-2668: hypershift/aws/ccm: enable optional managed security group conformance job Apr 9, 2026
@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 9, 2026

/assign @enxebre

@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 9, 2026

@enxebre @muraee WDYT to create a periodic and an alert to Slack (my teams channel) to this job, so i can monitor it closely. Are you ok to add one more job for that purpose? I will remove it as part of getting complete the task https://redhat.atlassian.net/browse/SPLAT-2668

@vr4manta
Copy link
Copy Markdown
Contributor

vr4manta commented Apr 9, 2026

/lgtm

@openshift-ci openshift-ci Bot added lgtm Indicates that a PR is ready to be merged. and removed lgtm Indicates that a PR is ready to be merged. labels Apr 9, 2026
@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented Apr 10, 2026

Adding the periiodic with alerts to SPLAT channel to monitor closely the progress of NLB+SG feature

@mtulio mtulio force-pushed the splat-2587-hypershift-conformance-nlb branch from 4294b2f to f1a1529 Compare April 10, 2026 04:30
@mtulio mtulio force-pushed the splat-2587-hypershift-conformance-nlb branch from 690c8f5 to b6636f4 Compare May 12, 2026 14:14
@openshift-merge-bot openshift-merge-bot Bot removed the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label May 12, 2026
mtulio
mtulio commented May 12, 2026
View reviewed changes
Comment thread ci-operator/config/openshift/hypershift/.config.prowgen Outdated
@mtulio mtulio force-pushed the splat-2587-hypershift-conformance-nlb branch from b6636f4 to 43d8f31 Compare May 12, 2026 14:23
@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented May 12, 2026 •
edited by atlassian Bot
Loading

As described in the comment #77567 (comment), the new job is expected to fail as it blocked by OCPBUGS-85414, and we need this job to validate the fix on the PR, currently WIP on openshift/cluster-cloud-controller-manager-operator#462

/pj-rehearse ack

/pj-rehearse ack

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented May 12, 2026

@mtulio: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label May 12, 2026
@jcpowermac
Copy link
Copy Markdown
Contributor

jcpowermac commented May 12, 2026

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label May 12, 2026
@enxebre
Copy link
Copy Markdown
Member

enxebre commented May 14, 2026

/approve

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 14, 2026
@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented May 14, 2026

/retest-required

Remaining retests: 0 against base HEAD e4bba04 and 2 for PR HEAD 43d8f31 in total

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 14, 2026 •
edited
Loading

@mtulio: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/periodic-ci-openshift-release-main-hypershift-4.22-hypershift-conformance-aws-ccm-nlb-sg f1a1529 link unknown /pj-rehearse periodic-ci-openshift-release-main-hypershift-4.22-hypershift-conformance-aws-ccm-nlb-sg
ci/rehearse/periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-aws-ovn-conformance-ccm-techpreview f5086a5 link unknown /pj-rehearse periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-aws-ovn-conformance-ccm-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@mtulio
hypershift/aws/ccm: enable managed security group tests to conformance
e37e369 
Create a dedicated conformance job enabling managed security group
feature of CCM for NLB, so that we can validate the feature on
hypershift at PR
openshift/hypershift#7460
@mtulio mtulio force-pushed the splat-2587-hypershift-conformance-nlb branch from 43d8f31 to e37e369 Compare May 14, 2026 14:43
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label May 14, 2026
@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented May 14, 2026

I needed to rebase to resolve the job generated-config. Applying the required labels again:

/pj-rehearsal ack

@jcpowermac
Copy link
Copy Markdown
Contributor

jcpowermac commented May 14, 2026

/lgtm

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 14, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, jcpowermac, mtulio, vr4manta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented May 14, 2026

/retest-required

Remaining retests: 0 against base HEAD 54c0523 and 1 for PR HEAD 43d8f31 in total

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label May 14, 2026
@openshift-merge-bot openshift-merge-bot Bot removed the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label May 14, 2026
@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented May 14, 2026

[REHEARSALNOTIFIER]
@mtulio: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-hypershift-release-5.0-e2e-aws-ovn-conformance-ccm-techpreview N/A periodic Periodic changed
periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-aws-ovn-conformance-ccm N/A periodic Periodic changed
periodic-ci-openshift-hypershift-release-5.0-e2e-aws-ovn-conformance-ccm N/A periodic Periodic changed
periodic-ci-openshift-hypershift-release-4.23-periodics-e2e-aws-ovn-conformance-ccm-techpreview N/A periodic Periodic changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented May 14, 2026 •
edited by atlassian Bot
Loading

As described in the comment #77567 (comment), the new job is expected to fail as it blocked by OCPBUGS-85414, and we need this job to validate the fix on the PR, currently WIP on openshift/cluster-cloud-controller-manager-operator#462
/pj-rehearse ack

/pj-rehearse ack

Re-adding, no reason to spend infra resource w/ expected jobs to fail. fyi openshift/cluster-cloud-controller-manager-operator#462 openshift/api#2838

/pj-rehearsal ack

@mtulio
Copy link
Copy Markdown
Contributor Author

mtulio commented May 14, 2026

/pj-rehearse ack

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented May 14, 2026

@mtulio: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label May 14, 2026
@openshift-merge-bot openshift-merge-bot Bot merged commit d010ade into openshift:main May 14, 2026
16 checks passed
@mtulio mtulio deleted the splat-2587-hypershift-conformance-nlb branch May 14, 2026 16:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

@devguyio devguyio Awaiting requested review from devguyio

@enxebre enxebre Awaiting requested review from enxebre

Assignees

@enxebre enxebre

@jcpowermac jcpowermac

@muraee muraee

@vr4manta vr4manta

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@mtulio @openshift-ci-robot @vr4manta @jcpowermac @enxebre @muraee