From d0ba31dc98d72f00f309ce89827b9c24d38ae0d9 Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Wed, 5 Aug 2026 13:04:34 +0300 Subject: [PATCH 1/2] Remove OCPBUGS-67159 workaround and enable openstack_test OCPBUGS-67159 (IP/port collision in CAPO machine network) is fixed upstream and backported to OCP 4.19-4.22. Remove the hardcoded api_vip/ingress_vip workaround from adoption.yaml and the conditional VIP injection block from the IPI install-config template. Also enable the openstack_test stage for the adoption pipeline, previously disabled because tools_cifmw_dnsmasq delegates DNS tasks to the hypervisor which is unreachable from the adoption container. Guard both dnsmasq tasks with "when: hypervisor is defined" so the role gracefully skips DNS configuration in container-only environments while the actual openstack-tests still execute. Closes: OSPRH-25360 Ref: OSPRH-27365 Assisted-By: Claude Code Change-Id: Ie86f127a966d6017da46540defbfc49586b6cd91 Signed-off-by: Itay Matza --- .../roles/install/templates/install-config-ipi.yaml.j2 | 5 ----- collection/stages/roles/openstack_test/tasks/main.yml | 2 ++ jobs_definitions/adoption.yaml | 8 +------- 3 files changed, 3 insertions(+), 12 deletions(-) diff --git a/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 b/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 index fa62c376..d5c4c10c 100644 --- a/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 +++ b/collection/stages/roles/install/templates/install-config-ipi.yaml.j2 @@ -59,11 +59,6 @@ platform: - subnet: name: "{{ installcfg_subnet.name }}" {%- else +%} - {%- if ocp_deployment_topology.api_vip is defined +%} - # Workaround for OCPBUGS-67159 (adoption uses pre-existing VIPs, not FIPs) - apiVIPs: ["{{ ocp_deployment_topology.api_vip }}"] - ingressVIPs: ["{{ ocp_deployment_topology.ingress_vip }}"] - {%- endif +%} externalNetwork: "{{ installcfg_external_network }}" apiFloatingIP: "{{ installcfg_api_floating_ip }}" ingressFloatingIP: "{{ installcfg_ingress_floating_ip }}" diff --git a/collection/stages/roles/openstack_test/tasks/main.yml b/collection/stages/roles/openstack_test/tasks/main.yml index 0eaa57ce..8275f95d 100644 --- a/collection/stages/roles/openstack_test/tasks/main.yml +++ b/collection/stages/roles/openstack_test/tasks/main.yml @@ -31,6 +31,7 @@ - "{{ resources.apps_accessible_ip }}" delegate_to: "{{ hypervisor }}" remote_user: root + when: hypervisor is defined - name: Include Openstack-Test tasks ansible.builtin.include_tasks: run_openstack_test.yml @@ -52,3 +53,4 @@ tasks_from: restore.yml delegate_to: "{{ hypervisor }}" remote_user: root + when: hypervisor is defined diff --git a/jobs_definitions/adoption.yaml b/jobs_definitions/adoption.yaml index feafc385..fab752bd 100644 --- a/jobs_definitions/adoption.yaml +++ b/jobs_definitions/adoption.yaml @@ -8,10 +8,7 @@ stages: - install - post - verification - # openstack_test delegates DNS tasks to the hypervisor via - # tools_cifmw_dnsmasq, which is unreachable from the adoption - # container context. Tracked in OSPRH-27365. - # - openstack_test + - openstack_test # Removed LB tests until Octavia is supported and enabled in adoption jobs # - lb_tests @@ -45,6 +42,3 @@ ocp_deployment_topology: servergroups: master: "soft-anti-affinity" # Required if number of computes < 3, otherwise can be anti-affinity worker: "soft-anti-affinity" # Required if number of computes < 3, otherwise can be anti-affinity - # Workaround for OCPBUGS-67159 - api_vip: "10.196.0.15" - ingress_vip: "10.196.0.17" From 3acf99e49c179e9621bcc261e41fca709dc53a74 Mon Sep 17 00:00:00 2001 From: Itay Matza Date: Mon, 10 Aug 2026 17:23:38 +0300 Subject: [PATCH 2/2] Skip pull secret extraction when pre-populated When the pull-secret file already exists with content (size > 0), skip the kubeconfig-based extraction from the Kubernetes API. This allows adoption CI jobs to pre-populate the pull secret from the hypervisor where the kubeconfig is accessible, instead of requiring the container to reach the OCP API directly. The always-block cleanup is also skipped for pre-populated files since the file lifecycle is managed externally. Assisted-By: Claude Code Change-Id: I66e6f1206a9e5e64d28b56aa2a3b658d57b5ba21 Signed-off-by: Itay Matza --- .../tasks/get_openshift_release_binaries.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml b/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml index fdafb0c5..427a3b63 100644 --- a/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml +++ b/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml @@ -26,7 +26,13 @@ msg: "'openshift_release_pull_spec' must be set by get_openshift_release_build_name.yml" when: openshift_release_pull_spec is not defined or openshift_release_pull_spec == '' + - name: Check if pull secret is pre-populated + ansible.builtin.stat: + path: "{{ pull_secret_file }}" + register: _pull_secret_preexists + - name: Extract pull secret from host cluster via Kubernetes API + when: not (_pull_secret_preexists.stat.exists and _pull_secret_preexists.stat.size > 0) changed_when: true ansible.builtin.shell: | python3 << 'PYEOF' @@ -183,6 +189,7 @@ always: - name: Remove pull secret file + when: not (_pull_secret_preexists.stat.exists | default(false)) ansible.builtin.file: path: "{{ pull_secret_file }}" state: absent