OSAC-854: add nightly vmaas snapshot build job #79377
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - osac-cicd | ||
| reviewers: | ||
| - osac-cicd |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "path": "osac-project/cluster-tool/snapshot-vmaas/osac-project-cluster-tool-snapshot-vmaas-workflow.yaml", | ||
| "owners": { | ||
| "approvers": [ | ||
| "osac-cicd" | ||
| ], | ||
| "reviewers": [ | ||
| "osac-cicd" | ||
| ] | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| workflow: | ||
| as: osac-project-cluster-tool-snapshot-vmaas | ||
| steps: | ||
| cluster_profile: packet-assisted | ||
| allow_best_effort_post_steps: true | ||
| pre: | ||
| - ref: ofcir-acquire | ||
| - ref: assisted-ofcir-setup | ||
| - chain: assisted-common-pre | ||
| - ref: osac-project-installer | ||
| test: | ||
| - ref: osac-project-cluster-tool-snapshot | ||
| post: | ||
| - ref: osac-project-gather | ||
| - ref: ofcir-gather | ||
| - ref: ofcir-release | ||
| env: | ||
| CLUSTERTYPE: "assisted_large_el9" | ||
| documentation: |- | ||
| Provisions a baremetal cluster via assisted-installer, installs OSAC, | ||
| then snapshots the cluster using cluster-tool and pushes the snapshot | ||
| OCI image to a container registry. Used as a nightly job to keep the | ||
| snapshot current for presubmit cluster-tool boot jobs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - osac-cicd | ||
| reviewers: | ||
| - osac-cicd |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -o nounset | ||
| set -o errexit | ||
| set -o pipefail | ||
|
|
||
| echo "************ cluster-tool snapshot ************" | ||
| echo "CLUSTER_TOOL_COMMIT: ${CLUSTER_TOOL_COMMIT}" | ||
| echo "SNAPSHOT_REGISTRY: ${SNAPSHOT_REGISTRY}" | ||
| echo "-------------------------------------------" | ||
|
|
||
| FLAVOR_NAME="osac-vmaas" | ||
| QUAY_USER=$(cat /var/run/vault/osac-quay-creds/user) | ||
|
|
||
| set +x | ||
| QUAY_PASS=$(cat /var/run/vault/osac-quay-creds/password) | ||
| set -x | ||
|
|
||
| timeout -s 9 90m ssh -F "${SHARED_DIR}/ssh_config" ci_machine bash -s \ | ||
| "${CLUSTER_TOOL_COMMIT}" \ | ||
| "${SNAPSHOT_REGISTRY}" \ | ||
| "${FLAVOR_NAME}" \ | ||
| "${QUAY_USER}" \ | ||
| "${QUAY_PASS}" \ | ||
| <<'REMOTE_EOF' | ||
| set -euo pipefail | ||
|
|
||
| COMMIT="$1" | ||
| REGISTRY="$2" | ||
| FLAVOR="$3" | ||
| QUAY_USER="$4" | ||
| QUAY_PASS="$5" | ||
|
|
||
| echo "=== Installing cluster-tool ===" | ||
| curl -fsSL "https://raw.githubusercontent.com/omer-vishlitzky/cluster-tool/${COMMIT}/cluster-tool" \ | ||
| -o /usr/local/bin/cluster-tool | ||
| chmod +x /usr/local/bin/cluster-tool | ||
|
Comment on lines
+35
to
+37
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# First, find the file
find . -name "osac-project-cluster-tool-snapshot-commands.sh" -type fRepository: openshift/release Length of output: 171 🏁 Script executed: #!/bin/bash
# Read the file to verify the exact content at lines 35-37
if [ -f "ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.sh" ]; then
echo "=== File content (full) ==="
wc -l ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.sh
echo ""
echo "=== Lines 30-45 for context ==="
sed -n '30,45p' ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.sh
fiRepository: openshift/release Length of output: 899 🏁 Script executed: #!/bin/bash
# Check for any environment variable definitions or setup related to CLUSTER_TOOL_SHA256
# Search across the directory structure for related references
rg -i "cluster_tool_sha256|CLUSTER_TOOL_SHA256" --type shRepository: openshift/release Length of output: 43 🏁 Script executed: #!/bin/bash
# Search for the COMMIT variable definition and usage context
rg -i "COMMIT" ci-operator/step-registry/osac-project/cluster-tool/snapshot/ -A 2 -B 2Repository: openshift/release Length of output: 3880 🏁 Script executed: #!/bin/bash
# Check the ref.yaml file to see what env variables are defined
cat ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-ref.yamlRepository: openshift/release Length of output: 976 🏁 Script executed: #!/bin/bash
# Check if there are any related steps that might define CLUSTER_TOOL_SHA256 or similar patterns
rg "SHA256|sha256|checksum" ci-operator/step-registry/osac-project/cluster-tool/ --type shRepository: openshift/release Length of output: 43 🏁 Script executed: #!/bin/bash
# Look at the full context of the commands.sh file to understand the overall flow
cat -n ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.shRepository: openshift/release Length of output: 2382 Add integrity verification for downloaded Lines [35-37] download and execute a binary from a mutable GitHub ref ( Add SHA256 verification before execution: Suggested hardening curl -fsSL "https://raw.githubusercontent.com/omer-vishlitzky/cluster-tool/${COMMIT}/cluster-tool" \
-o /usr/local/bin/cluster-tool
+echo "${CLUSTER_TOOL_SHA256} /usr/local/bin/cluster-tool" | sha256sum -c -
chmod +x /usr/local/bin/cluster-toolNote: Requires defining 🤖 Prompt for AI AgentsThere was a problem hiding this comment. Is there a plan to move cluster-tool to the |
||
|
|
||
| echo "=== Setting up cluster-tool ===" | ||
| python3 /usr/local/bin/cluster-tool connect ci --host local --data-path /home/cluster-tool | ||
|
|
||
| echo "=== Discovering cluster ID ===" | ||
| CLUSTER_ID=$(virsh list --name | grep test-infra-cluster | sed 's/test-infra-cluster-//;s/-master-0//' | head -1) | ||
| [[ -z "${CLUSTER_ID}" ]] && echo "ERROR: No running test-infra cluster found" && exit 1 | ||
| echo "Found cluster ID: ${CLUSTER_ID}" | ||
|
There was a problem hiding this comment. nit: This cluster ID discovery depends on the assisted-installer VM naming convention ( |
||
|
|
||
| echo "=== Creating snapshot ===" | ||
| python3 /usr/local/bin/cluster-tool snapshot --name "${FLAVOR}" --source "${CLUSTER_ID}" | ||
|
|
||
| echo "=== Authenticating to registry ===" | ||
| set +x | ||
| podman login "$(echo ${REGISTRY} | cut -d/ -f1)" \ | ||
| -u "${QUAY_USER}" -p "${QUAY_PASS}" | ||
| set -x | ||
|
Comment on lines
+50
to
+54
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: # Check if the file exists and examine lines around 50-55
if [ -f "ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.sh" ]; then
echo "=== File exists, showing lines 40-65 for context ==="
sed -n '40,65p' "ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.sh"
else
echo "File not found, checking what exists in the directory"
find . -path "*/osac-project/cluster-tool/snapshot/*-commands.sh" 2>/dev/null || echo "No matching files found"
fiRepository: openshift/release Length of output: 1022 🌐 Web query:
💡 Result: The --password-stdin option for the podman login command is used to provide a registry password via standard input (STDIN) rather than through command-line arguments or interactive prompts [1][2]. This approach is commonly used in automated scripts and CI/CD pipelines to enhance security by avoiding the exposure of passwords in process lists or shell history [1][3]. Usage Examples: 1. Using a pipe: echo Citations:
🏁 Script executed: # Check if printf is available and test the approach
which printf
echo "Testing printf syntax for password piping:"
QUAY_PASS="test_password"
# Verify the printf syntax doesn't add newline
printf '%s' "${QUAY_PASS}" | wc -c
echo "Password length:"
echo -n "${QUAY_PASS}" | wc -cRepository: openshift/release Length of output: 189 Use The current approach on line 54 exposes the password in the process list, which can be accessed via process inspection. Use stdin-based authentication as per the coding guidelines requiring sensitive data to bypass process visibility. Suggested fix set +x
-podman login --root /home/cluster-tool/containers/storage \
- "$(echo ${REGISTRY} | cut -d/ -f1)" \
- -u "${QUAY_USER}" -p "${QUAY_PASS}"
+printf '%s' "${QUAY_PASS}" | podman login --root /home/cluster-tool/containers/storage \
+ "$(echo "${REGISTRY}" | cut -d/ -f1)" \
+ -u "${QUAY_USER}" --password-stdin
set -x🤖 Prompt for AI Agents |
||
|
|
||
| echo "=== Pushing snapshot ===" | ||
| python3 /usr/local/bin/cluster-tool push --flavor "${FLAVOR}" --registry "${REGISTRY}" | ||
|
|
||
| echo "=== Snapshot push complete ===" | ||
| REMOTE_EOF | ||
|
|
||
| echo "Snapshot step finished successfully." | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "path": "osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-ref.yaml", | ||
| "owners": { | ||
| "approvers": [ | ||
| "osac-cicd" | ||
| ], | ||
| "reviewers": [ | ||
| "osac-cicd" | ||
| ] | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| ref: | ||
| as: osac-project-cluster-tool-snapshot | ||
| from: dev-scripts | ||
| grace_period: 10m | ||
| timeout: 2h0m0s | ||
| commands: osac-project-cluster-tool-snapshot-commands.sh | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| memory: 200Mi | ||
| credentials: | ||
| - namespace: test-credentials | ||
| name: osac-quay-creds | ||
| mount_path: /var/run/vault/osac-quay-creds | ||
| env: | ||
| - name: CLUSTER_TOOL_COMMIT | ||
| default: "main" | ||
| documentation: cluster-tool git ref to download (branch, tag, or commit) | ||
| - name: SNAPSHOT_REGISTRY | ||
| default: "quay.io/rh-ee-ovishlit/cluster-flavors:osac-vmaas-pruned" | ||
|
There was a problem hiding this comment. Same question for the snapshot registry: should this move to an org-level quay namespace? |
||
| documentation: OCI image ref to push the snapshot to | ||
| documentation: |- | ||
| Snapshots a running OSAC cluster using cluster-tool and pushes the | ||
| resulting OCI image to a container registry. Expects the cluster to | ||
| have been provisioned by assisted-installer and OSAC installed via | ||
| osac-project-installer in a prior step. | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/release
Length of output: 1570
🏁 Script executed:
Repository: openshift/release
Length of output: 1221
🏁 Script executed:
# Let me verify the exact line numbers and check the context around the credential handling wc -l ci-operator/step-registry/osac-project/cluster-tool/snapshot/osac-project-cluster-tool-snapshot-commands.shRepository: openshift/release
Length of output: 172
🏁 Script executed:
Repository: openshift/release
Length of output: 2382
🏁 Script executed:
Repository: openshift/release
Length of output: 272
Prevent Quay password leakage through xtrace during SSH invocation.
Line 17 enables xtrace, and the ssh command on lines 19–24 passes
QUAY_PASSas an argument. With xtrace enabled, bash expands and outputs the full command including the password to CI logs before execution. Save the xtrace state before disabling it for credential operations, then restore it afterward, rather than always re-enabling.Suggested fix
Per coding guidelines, step registry command scripts should avoid accidental disclosure of passwords, tokens, API keys, and cluster URLs via xtrace. Apply the same pattern to the
podman logininvocation at lines 51–55.🤖 Prompt for AI Agents