From 8581163c1bc6491a04797d88951a18a3789bdff4 Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Mon, 31 Aug 2026 12:14:39 +0300 Subject: [PATCH 1/5] Fix Swift registry check using wrong separator in object name search The JSON-output migration in commit 1540a56 changed the Swift object search from grep (where '.' matches any character including '/') to jq contains() (where '.' is a literal dot). This caused the search target 'swift-check-NNNN.fooapp' to never match the actual Swift object paths which use '/' as separator: files/docker/registry/v2/repositories/swift-check-NNNN/fooapp/... Change the target separator from '.' to '/' to match the actual object name structure in Swift. Verified on live environment: old pattern matched 0 objects, new pattern correctly matches 7 objects. Fixes regression from 1540a56 (Harden verification OpenStack CLI calls to use JSON output). Assisted-By: Claude Code Signed-off-by: Itay Matza --- collection/stages/roles/verification/tasks/check_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/collection/stages/roles/verification/tasks/check_registry.yml b/collection/stages/roles/verification/tasks/check_registry.yml index f1f32f4a..f223c51d 100644 --- a/collection/stages/roles/verification/tasks/check_registry.yml +++ b/collection/stages/roles/verification/tasks/check_registry.yml @@ -111,7 +111,7 @@ - name: Get the images objects in swift for the {{ swift_check_ns }} namespace from the containers ansible.builtin.shell: | set -o pipefail - target="{{ swift_check_ns }}.{{ swift_check_image }}" + target="{{ swift_check_ns }}/{{ swift_check_image }}" openstack container list -f json \ | jq -r '.[] | (.Name // .name // empty)' \ | while read -r container; do From 60ae7e276b720d10447f1ec8e8ecaa1e73275d3e Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Sat, 5 Sep 2026 19:25:44 +0300 Subject: [PATCH 2/5] Skip Manila verification when catalog JSON is empty. OSPRH-34580 openstack catalog show manila -f json exits 0 with "{}" when the service is absent, so checking rc alone still runs check_manila.yml on 17.1 clouds without share. Co-authored-by: Cursor Change-Id: I7c013aa3ac8eca9045468d792d24ac2feed878a6 --- collection/stages/roles/verification/tasks/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/collection/stages/roles/verification/tasks/main.yml b/collection/stages/roles/verification/tasks/main.yml index 052e61f9..ad4905b2 100644 --- a/collection/stages/roles/verification/tasks/main.yml +++ b/collection/stages/roles/verification/tasks/main.yml @@ -139,7 +139,9 @@ when: - not _skip_health - installation_type != 'upi' - - manila_enabled.rc == 0 + # catalog show -f json returns rc=0 and "{}" when the service is missing + # (PR #32). Ansible when lists are not short-circuit; default empty JSON. + - manila_enabled.rc == 0 and ((manila_enabled.stdout | default('{}', true) | from_json | length) > 0) - ceph_nfs_ready|default(true)|bool - edge_nova_az is not defined # Skip due to Openstack Manila is not supported at the Edge - not openshift_proxy_installation|default(false)|bool From 0a289e44459b13ea77d5fdde414fbf5664e36d84 Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Wed, 5 Aug 2026 13:04:34 +0300 Subject: [PATCH 3/5] Remove OCPBUGS-67159 workaround and enable openstack_test OCPBUGS-67159 (IP/port collision in CAPO machine network) is fixed upstream and backported to OCP 4.19-4.22. Remove the hardcoded api_vip/ingress_vip workaround from adoption.yaml and the conditional VIP injection block from the IPI install-config template. Also enable the openstack_test stage for the adoption pipeline, previously disabled because tools_cifmw_dnsmasq delegates DNS tasks to the hypervisor which is unreachable from the adoption container. Guard both dnsmasq tasks with "when: hypervisor is defined" so the role gracefully skips DNS configuration in container-only environments while the actual openstack-tests still execute. Closes: OSPRH-25360 Ref: OSPRH-27365 Assisted-By: Claude Code Change-Id: Ie86f127a966d6017da46540defbfc49586b6cd91 Signed-off-by: Itay Matza --- .../roles/install/templates/install-config-ipi.yaml.j2 | 5 ----- collection/stages/roles/openstack_test/tasks/main.yml | 2 ++ jobs_definitions/adoption.yaml | 8 +------- 3 files changed, 3 insertions(+), 12 deletions(-) diff --git a/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 b/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 index eb1e97c4..2cf914a6 100644 --- a/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 +++ b/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 @@ -91,11 +91,6 @@ platform: - subnet: name: "{{ installcfg_subnet.name }}" {%- else +%} - {%- if ocp_deployment_topology.api_vip is defined +%} - # Workaround for OCPBUGS-67159 (adoption uses pre-existing VIPs, not FIPs) - apiVIPs: ["{{ ocp_deployment_topology.api_vip }}"] - ingressVIPs: ["{{ ocp_deployment_topology.ingress_vip }}"] - {%- endif +%} externalNetwork: "{{ installcfg_external_network }}" apiFloatingIP: "{{ installcfg_api_floating_ip }}" ingressFloatingIP: "{{ installcfg_ingress_floating_ip }}" diff --git a/collection/stages/roles/openstack_test/tasks/main.yml b/collection/stages/roles/openstack_test/tasks/main.yml index 0eaa57ce..8275f95d 100644 --- a/collection/stages/roles/openstack_test/tasks/main.yml +++ b/collection/stages/roles/openstack_test/tasks/main.yml @@ -31,6 +31,7 @@ - "{{ resources.apps_accessible_ip }}" delegate_to: "{{ hypervisor }}" remote_user: root + when: hypervisor is defined - name: Include Openstack-Test tasks ansible.builtin.include_tasks: run_openstack_test.yml @@ -52,3 +53,4 @@ tasks_from: restore.yml delegate_to: "{{ hypervisor }}" remote_user: root + when: hypervisor is defined diff --git a/jobs_definitions/adoption.yaml b/jobs_definitions/adoption.yaml index feafc385..fab752bd 100644 --- a/jobs_definitions/adoption.yaml +++ b/jobs_definitions/adoption.yaml @@ -8,10 +8,7 @@ stages: - install - post - verification - # openstack_test delegates DNS tasks to the hypervisor via - # tools_cifmw_dnsmasq, which is unreachable from the adoption - # container context. Tracked in OSPRH-27365. - # - openstack_test + - openstack_test # Removed LB tests until Octavia is supported and enabled in adoption jobs # - lb_tests @@ -45,6 +42,3 @@ ocp_deployment_topology: servergroups: master: "soft-anti-affinity" # Required if number of computes < 3, otherwise can be anti-affinity worker: "soft-anti-affinity" # Required if number of computes < 3, otherwise can be anti-affinity - # Workaround for OCPBUGS-67159 - api_vip: "10.196.0.15" - ingress_vip: "10.196.0.17" From 48fe0b88fd2c3f915392b531581b4dfdc98989b3 Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Mon, 10 Aug 2026 17:23:38 +0300 Subject: [PATCH 4/5] Skip pull secret extraction when pre-populated When the pull-secret file already exists with content (size > 0), skip the kubeconfig-based extraction from the Kubernetes API. This allows adoption CI jobs to pre-populate the pull secret from the hypervisor where the kubeconfig is accessible, instead of requiring the container to reach the OCP API directly. The always-block cleanup is also skipped for pre-populated files since the file lifecycle is managed externally. Assisted-By: Claude Code Change-Id: I66e6f1206a9e5e64d28b56aa2a3b658d57b5ba21 Signed-off-by: Itay Matza --- .../tasks/get_openshift_release_binaries.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml b/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml index fdafb0c5..427a3b63 100644 --- a/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml +++ b/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml @@ -26,7 +26,13 @@ msg: "'openshift_release_pull_spec' must be set by get_openshift_release_build_name.yml" when: openshift_release_pull_spec is not defined or openshift_release_pull_spec == '' + - name: Check if pull secret is pre-populated + ansible.builtin.stat: + path: "{{ pull_secret_file }}" + register: _pull_secret_preexists + - name: Extract pull secret from host cluster via Kubernetes API + when: not (_pull_secret_preexists.stat.exists and _pull_secret_preexists.stat.size > 0) changed_when: true ansible.builtin.shell: | python3 << 'PYEOF' @@ -183,6 +189,7 @@ always: - name: Remove pull secret file + when: not (_pull_secret_preexists.stat.exists | default(false)) ansible.builtin.file: path: "{{ pull_secret_file }}" state: absent From 9b4ef435299637427a067b1d0580ee2695c333a6 Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Tue, 8 Sep 2026 16:26:30 +0300 Subject: [PATCH 5/5] Run openstack_test after adoption verification OSPRH-27365 enables openstack_test for adoption CI, but it should run after the adoption flow instead of during install-shiftstack-before. Keep adoption.yaml to the pre-adoption stages and run openstack_test from adoption_verification.yaml. Signed-off-by: Itay Matza --- jobs_definitions/adoption.yaml | 1 - jobs_definitions/adoption_verification.yaml | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/jobs_definitions/adoption.yaml b/jobs_definitions/adoption.yaml index fab752bd..3936c11e 100644 --- a/jobs_definitions/adoption.yaml +++ b/jobs_definitions/adoption.yaml @@ -8,7 +8,6 @@ stages: - install - post - verification - - openstack_test # Removed LB tests until Octavia is supported and enabled in adoption jobs # - lb_tests diff --git a/jobs_definitions/adoption_verification.yaml b/jobs_definitions/adoption_verification.yaml index 493fd7ab..6a8430cb 100644 --- a/jobs_definitions/adoption_verification.yaml +++ b/jobs_definitions/adoption_verification.yaml @@ -11,6 +11,7 @@ installation_type: ipi stages: - verification + - openstack_test # After adoption, OpenStack-dependent operators (OCCM, CSI, # image-registry) may be degraded because cloud-provider-config # still points at the dead pre-adoption endpoint (OSPRH-26025).