Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI: workload-identity native #4765

Open
wants to merge 27 commits into
base: main
Choose a base branch
from
Open

CI: workload-identity native #4765

wants to merge 27 commits into from
+507 −696

Conversation

jackfrancis
Copy link
Contributor

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR updates E2E CI automation and underlying cluster templates to use workload-identity, with the required Azure infra installed on-demand as part of CI automation.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

  • cherry-pick candidate

TODOs:

  • squashed commits
  • includes documentation
  • adds unit tests

Release note:

CI: workload-identity native

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 23, 2024
@k8s-ci-robot k8s-ci-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Apr 23, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jackfrancis. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jackfrancis
Copy link
Contributor Author

@aramase @nilekhc @sozercan this PR borrows heavily from this azure-workload-identity project-approved script:

https://github.com/Azure/azure-workload-identity/blob/main/scripts/wi-kind-setup.sh

Could you do a high level sanity check of the approach here to automate kind + azwi?

Thank you!

@codecov Codecov
Copy link

codecov bot commented Apr 23, 2024 •
edited

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 62.04%. Comparing base (2df965a) to head (ceebc0b).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #4765   +/-   ##
=======================================
  Coverage   62.04%   62.04%           
=======================================
  Files         201      201           
  Lines       16878    16878           
=======================================
  Hits        10472    10472           
  Misses       5623     5623           
  Partials      783      783

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Apr 23, 2024
@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e

3 similar comments
@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e

@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e

@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e

@jackfrancis jackfrancis force-pushed the capz-e2e-workload-identity branch 5 times, most recently from fb14c3f to a47b364 Compare April 25, 2024 17:37
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 25, 2024
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Apr 25, 2024
@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e

@jackfrancis
remove key access
569b608 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
Add user-assigned ID to Windows template nodes
6bd3a3f 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
add back-compat
49dd2cf 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
UserAssignedMSI for custom-builds template
75f9ca2 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
use sp for custom-builds template
1fb9971 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
generate flavors
7fbce9c 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
back-compat just for CI_RG and USER_IDENTITY
b9442c2 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
focus on sp and user-assigned id, not back-compat
e01eff8 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
try back-compat just for kind
26e4d9e 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
explicit back-compat user-assigned id for windows custom builds templ…
baec48f 
…ate only

Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
remove CI_RG and USER_IDENTITY override
c9b405e 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
trigger on CONFORMANCE_FLAVOR
720cd0e 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
address unbound variable
8d2dc50 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
typo
63cfb80 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
prow-ci-versions using pre-existing user-assigned
2f8a107 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
Copy link
Contributor Author

/retest

1 similar comment
@jackfrancis
Copy link
Contributor Author

/retest

@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-capi-e2e
/test pull-cluster-api-provider-azure-e2e-workload-upgrade

@jackfrancis
revert self-hosted template
cd8cbb2 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-capi-e2e
/test pull-cluster-api-provider-azure-e2e-workload-upgrade

@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e-workload-upgrade

@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-conformance-dual-stack-with-ci-artifacts

@jackfrancis
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e-optional

@jackfrancis jackfrancis force-pushed the capz-e2e-workload-identity branch 2 times, most recently from 4f980d5 to 363324a Compare May 31, 2024 22:32
@jackfrancis
use static web hosting
f122687 
Signed-off-by: Jack Francis <[email protected]>
@jackfrancis
Copy link
Contributor Author

/retest

@k8s-ci-robot
Copy link
Contributor

@jackfrancis: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-cluster-api-provider-azure-windows-containerd-upstream-with-ci-artifacts-serial-slow ccd17cf link false /test pull-cluster-api-provider-azure-windows-containerd-upstream-with-ci-artifacts-serial-slow
pull-cluster-api-provider-azure-e2e-optional cd8cbb2 link false /test pull-cluster-api-provider-azure-e2e-optional
pull-cluster-api-provider-azure-conformance-custom-builds f122687 link false /test pull-cluster-api-provider-azure-conformance-custom-builds
pull-cluster-api-provider-azure-windows-custom-builds f122687 link false /test pull-cluster-api-provider-azure-windows-custom-builds

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mboersma mboersma mboersma left review comments

@jsturtevant jsturtevant jsturtevant left review comments

@dtzar dtzar dtzar left review comments

@aramase aramase aramase left review comments

@nojnhuh nojnhuh nojnhuh left review comments

@Jont828 Jont828 Jont828 left review comments

@willie-yao willie-yao willie-yao left review comments

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
CAPZ Planning
Status: In Progress
Milestone
v1.16
Development

Successfully merging this pull request may close these issues.

Automate kind + workload identity
10 participants
@jackfrancis @k8s-ci-robot @nojnhuh @willie-yao @Jont828 @mboersma @codecov-commenter @jsturtevant @dtzar @aramase