OSAC-853: add AAP presubmit e2e-vmaas job

ci-operator/config/osac-project/osac-aap/osac-project-osac-aap-main.yaml

@@ -1,3 +1,22 @@
+base_images:
+  dev-scripts:
+    name: test
+    namespace: ocp-kni
+    tag: dev-scripts
+  origin-cli:
+    name: "4.20"
+    namespace: ocp
+    tag: cli
+  osac-installer:
+    name: latest
+    namespace: osac-project
+    tag: osac-installer
+  osac-test-infra:
+    name: latest
+    namespace: osac-project
+    tag: osac-test-infra
+binary_build_commands: git rev-parse HEAD^2 > /tmp/source-sha 2>/dev/null || git rev-parse
+  HEAD > /tmp/source-sha
 build_root:
   image_stream_tag:
     name: release
@@ -9,17 +28,69 @@ images:
       FROM src
     from: src
     to: osac-aap
+  - dockerfile_literal: |
+      FROM quay.io/centos/centos:stream9
+      RUN dnf install -y python3.12 python3.12-pip python3.12-devel \
+          systemd-libs systemd-devel gcc git-core bind-utils krb5-devel \
+          && dnf clean all
+      COPY execution-environment/requirements.txt /tmp/requirements.txt
+      RUN python3.12 -m pip install --no-cache-dir -r /tmp/requirements.txt
+      COPY collections/ /usr/share/ansible/collections/
+      COPY vendor/ /usr/share/ansible/collections/
+      COPY oc /usr/local/bin/oc
+      RUN ln -s /usr/local/bin/oc /usr/local/bin/kubectl
+    from: src
+    inputs:
+      origin-cli:
+        paths:
+        - destination_dir: .
+          source_path: /usr/bin/oc
+    to: osac-aap-pr
+  - dockerfile_literal: |
+      FROM osac-installer
+      COPY config/ /installer/base/osac-aap/config/
+      COPY source-sha /installer/.aap-source-sha
+    inputs:
+      bin:
+        paths:
+        - destination_dir: .
+          source_path: /tmp/source-sha
+      osac-installer:
+        as:
+        - osac-installer
+    to: osac-installer-with-pr
 promotion:
   to:
-  - name: latest
+  - excluded_images:
+    - osac-aap-pr
+    - osac-installer-with-pr
+    name: latest
     namespace: osac-project
+releases:
+  latest:
+    candidate:
+      product: ocp
+      stream: nightly
+      version: "4.20"
 resources:
   '*':
     limits:
       memory: 4Gi
     requests:
       cpu: 100m
       memory: 200Mi
+tests:
+- as: e2e-vmaas
+  capabilities:
+  - intranet
+  steps:
+    dependencies:
+      COMPONENT_IMAGE: osac-aap-pr
+      OSAC_INSTALLER_IMAGE: osac-installer-with-pr
+      OSAC_TEST_IMAGE: osac-test-infra
+    env:
+      COMPONENT_IMAGE_NAME: osac-aap
+    workflow: osac-project-cluster-tool-vmaas
 zz_generated_metadata:
   branch: main
   org: osac-project

ci-operator/jobs/osac-project/osac-aap/osac-project-osac-aap-main-postsubmits.yaml

@@ -11,6 +11,7 @@ postsubmits:
     labels:
       ci-operator.openshift.io/is-promotion: "true"
       ci.openshift.io/generator: prowgen
+      job-release: "4.20"
     max_concurrency: 1
     name: branch-ci-osac-project-osac-aap-main-images
     spec:

ci-operator/jobs/osac-project/osac-aap/osac-project-osac-aap-main-presubmits.yaml

@@ -5,13 +5,96 @@ presubmits:
     branches:
     - ^main$
     - ^main-
-    cluster: build04
+    cluster: build06
+    context: ci/prow/e2e-vmaas
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      capability/intranet: intranet
+      ci.openshift.io/generator: prowgen
+      job-release: "4.20"
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-osac-project-osac-aap-main-e2e-vmaas
+    rerun_command: /test e2e-vmaas
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-vmaas
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-vmaas,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build08
     context: ci/prow/images
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
       ci.openshift.io/generator: prowgen
+      job-release: "4.20"
       pj-rehearse.openshift.io/can-be-rehearsed: "true"
     name: pull-ci-osac-project-osac-aap-main-images
     rerun_command: /test images

ci-operator/step-registry/osac-project/cluster-tool/boot/osac-project-cluster-tool-boot-commands.sh

@@ -167,6 +167,21 @@ if [[ -n "${COMPONENT_IMAGE}" ]] && [[ -n "${COMPONENT_IMAGE_NAME}" ]]; then
     COMPONENT_OVERRIDE_CMD="curl -fsSL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.6.0/kustomize_v5.6.0_linux_amd64.tar.gz | tar xzf - -C /usr/local/bin && cd /installer/base && kustomize edit set image ${COMPONENT_IMAGE_NAME}=${COMPONENT_IMAGE} && cd /installer && "
 fi
 
+# When testing an osac-aap PR, the installer-with-pr image contains
+# .aap-source-sha with the PR's head commit SHA. Override both
+# AAP_PROJECT_GIT_BRANCH (playbook sync) and AAP_EE_IMAGE (execution
+# environment) so AAP uses the PR's code instead of the pinned versions.
+AAP_OVERRIDE_CMD=""
+AAP_SOURCE_SHA=$(podman run --authfile /root/pull-secret --rm "${INSTALLER_IMAGE}" cat /installer/.aap-source-sha 2>/dev/null || true)
+if [[ -n "${AAP_SOURCE_SHA}" ]]; then
+    echo "=== AAP project git ref override: ${AAP_SOURCE_SHA} ==="
+    AAP_OVERRIDE_CMD="sed -i 's|AAP_PROJECT_GIT_BRANCH=.*|AAP_PROJECT_GIT_BRANCH=${AAP_SOURCE_SHA}|' /installer/overlays/${KUSTOMIZE_OVERLAY}/kustomization.yaml && grep -q 'AAP_PROJECT_GIT_BRANCH=${AAP_SOURCE_SHA}' /installer/overlays/${KUSTOMIZE_OVERLAY}/kustomization.yaml || { echo 'ERROR: AAP_PROJECT_GIT_BRANCH override failed'; exit 1; } && "
+    if [[ -n "${COMPONENT_IMAGE}" ]]; then
+        echo "=== AAP EE image override: ${COMPONENT_IMAGE} ==="
+        AAP_OVERRIDE_CMD="${AAP_OVERRIDE_CMD}sed -i 's|AAP_EE_IMAGE=.*|AAP_EE_IMAGE=${COMPONENT_IMAGE}|' /installer/overlays/${KUSTOMIZE_OVERLAY}/kustomization.yaml && grep -q 'AAP_EE_IMAGE=${COMPONENT_IMAGE}' /installer/overlays/${KUSTOMIZE_OVERLAY}/kustomization.yaml || { echo 'ERROR: AAP_EE_IMAGE override failed'; exit 1; } && "
+    fi
+fi
+
 # --- Phase 5: refresh ---
 echo "=== Running refresh ==="
 podman run --authfile /root/pull-secret --rm --network=host \
@@ -178,7 +193,7 @@ podman run --authfile /root/pull-secret --rm --network=host \
     -e INSTALLER_VM_TEMPLATE="${VM_TEMPLATE}" \
     -e INSTALLER_NAMESPACE="${NAMESPACE}" \
     "${INSTALLER_IMAGE}" \
-    bash -c "${COMPONENT_OVERRIDE_CMD}cd /installer && sh scripts/refresh-after-snapshot.sh"
+    bash -c "${COMPONENT_OVERRIDE_CMD}${AAP_OVERRIDE_CMD}cd /installer && sh scripts/refresh-after-snapshot.sh"
 
 echo "=== Boot + refresh complete ==="
 REMOTE_SCRIPT