[release-4.17] OCPBUGS-42051: Fix integration tests

cmd/openshift-install/internal_integration_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/rogpeppe/go-internal/testscript"
 	"github.com/stretchr/testify/assert"
 	"github.com/vincent-petithory/dataurl"
+	"gopkg.in/yaml.v2"
 
 	"github.com/openshift/installer/pkg/asset/releaseimage"
 )
@@ -103,13 +104,31 @@ func runIntegrationTest(t *testing.T, testFolder string) {
 				}
 			}
 
-			// Let's get the current release version, so that
-			// it could be used within the tests
-			pullspec, err := releaseimage.Default()
-			if err != nil {
-				return err
+			var pullspec string
+			// If set, let's use $OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE to replace test data
+			// and also pass it to the testscript environment. It will be usually set in a CI job
+			// to reference the ephemeral payload release.
+			if releaseImageOverride, ok := os.LookupEnv("OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE"); ok && releaseImageOverride != "" {
+				pullspec = releaseImageOverride
+				e.Vars = append(e.Vars, fmt.Sprintf("OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE=%s", pullspec))
+			} else {
+				// Let's get the current release version, so that
+				// it could be used within the tests
+				pullspec, err = releaseimage.Default()
+				if err != nil {
+					return err
+				}
 			}
 			e.Vars = append(e.Vars, fmt.Sprintf("RELEASE_IMAGE=%s", pullspec))
+			// When AUTH_FILE is set in the CI integration-tests job
+			if authFilePath, ok := os.LookupEnv("AUTH_FILE"); ok && authFilePath != "" {
+				workDir := e.Getenv("WORK")
+				err := updatePullSecret(workDir, authFilePath)
+				if err != nil {
+					return err
+				}
+				t.Log("PullSecret updated successfully")
+			}
 
 			return nil
 		},
@@ -123,6 +142,7 @@ func runIntegrationTest(t *testing.T, testFolder string) {
 			"unconfiguredIgnCmp":      unconfiguredIgnCmp,
 			"expandFile":              expandFile,
 			"isoContains":             isoContains,
+			"existsInIso":             existsInIso,
 		},
 	})
 }
@@ -259,6 +279,7 @@ func ignitionStorageCmp(ts *testscript.TestScript, neg bool, args []string) {
 
 	workDir := ts.Getenv("WORK")
 	ignPath, aFilePath, eFilePath := args[0], args[1], args[2]
+
 	ignPathAbs := filepath.Join(workDir, ignPath)
 
 	config, err := readIgnition(ts, ignPathAbs)
@@ -473,6 +494,25 @@ func isoContains(ts *testscript.TestScript, neg bool, args []string) {
 	ts.Check(err)
 }
 
+// [!] existsInIso `isoPath` `file` check if the specified `file` is stored
+// within the ISO `isoPath` image.
+func existsInIso(ts *testscript.TestScript, neg bool, args []string) {
+	if len(args) != 2 {
+		ts.Fatalf("usage: isoContains isoPath file")
+	}
+
+	workDir := ts.Getenv("WORK")
+	isoPath, filePath := args[0], args[1]
+	isoPathAbs := filepath.Join(workDir, isoPath)
+
+	archiveFile, ignitionFile, err := archiveFileNames(isoPath)
+	if err != nil {
+		ts.Check(err)
+	}
+	_, err = readFileFromISO(isoPathAbs, archiveFile, ignitionFile, filePath)
+	ts.Check(err)
+}
+
 func checkFileFromInitrdImg(isoPath string, fileName string) error {
 	disk, err := diskfs.Open(isoPath, diskfs.WithOpenMode(diskfs.ReadOnly))
 	if err != nil {
@@ -570,3 +610,36 @@ func lookForCpioFiles(r io.Reader) ([]string, error) {
 
 	return files, nil
 }
+
+func updatePullSecret(workDir, authFilePath string) error {
+	authFile, err := os.ReadFile(authFilePath)
+	if err != nil {
+		return err
+	}
+	ciPullSecret := string(authFile)
+	expectedInstallConfigPathAbs := filepath.Join(workDir, "install-config.yaml")
+	_, err = os.Stat(expectedInstallConfigPathAbs)
+	if err == nil {
+		installConfigFile, err := os.ReadFile(expectedInstallConfigPathAbs)
+		if err != nil {
+			return err
+		}
+		var config map[string]interface{}
+		if err := yaml.Unmarshal(installConfigFile, &config); err != nil {
+			return err
+		}
+
+		config["pullSecret"] = ciPullSecret
+
+		updatedConfig, err := yaml.Marshal(&config)
+		if err != nil {
+			return err
+		}
+		if err := os.WriteFile(expectedInstallConfigPathAbs, updatedConfig, 0600); err != nil {
+			return err
+		}
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}

cmd/openshift-install/testdata/agent/configimage/manifests/default_manifests.txt

@@ -6,9 +6,10 @@ exists $WORK/agentconfig.noarch.iso
 
 isocmp agentconfig.noarch.iso /etc/assisted/manifests/agent-cluster-install.yaml expected/agent-cluster-install.yaml
 isocmp agentconfig.noarch.iso /etc/assisted/manifests/cluster-image-set.yaml expected/cluster-image-set.yaml
-isocmp agentconfig.noarch.iso /etc/assisted/manifests/pull-secret.yaml expected/pull-secret.yaml
 isocmp agentconfig.noarch.iso /etc/assisted/manifests/cluster-deployment.yaml expected/cluster-deployment.yaml
 
+existsInIso agentconfig.noarch.iso /etc/assisted/manifests/pull-secret.yaml
+
 -- install-config.yaml --
 apiVersion: v1
 baseDomain: test.metalkube.org
@@ -106,19 +107,3 @@ metadata:
 spec:
   releaseImage: $RELEASE_IMAGE
 status: {}
--- expected/pull-secret.yaml --
-apiVersion: v1
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: ostest-pull-secret
-  namespace: cluster0
-stringData:
-  .dockerconfigjson: |-
-    {
-      "auths": {
-        "quay.io": {
-          "auth": "c3VwZXItc2VjcmV0Cg=="
-        }
-      }
-    }

cmd/openshift-install/testdata/agent/image/manifests/default_manifests.txt

@@ -8,7 +8,8 @@ isocmp agent.x86_64.iso /etc/assisted/manifests/agent-cluster-install.yaml expec
 isocmp agent.x86_64.iso /etc/assisted/manifests/cluster-deployment.yaml expected/cluster-deployment.yaml
 isocmp agent.x86_64.iso /etc/assisted/manifests/cluster-image-set.yaml expected/cluster-image-set.yaml
 isocmp agent.x86_64.iso /etc/assisted/manifests/infraenv.yaml expected/infraenv.yaml
-isocmp agent.x86_64.iso /etc/assisted/manifests/pull-secret.yaml expected/pull-secret.yaml
+
+existsInIso agent.x86_64.iso /etc/assisted/manifests/pull-secret.yaml
 
 -- install-config.yaml --
 apiVersion: v1
@@ -135,19 +136,3 @@ status:
     rootfs: ""
   debugInfo:
     eventsURL: ""
--- expected/pull-secret.yaml --
-apiVersion: v1
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: ostest-pull-secret
-  namespace: cluster0
-stringData:
-  .dockerconfigjson: |-
-    {
-      "auths": {
-        "quay.io": {
-          "auth": "c3VwZXItc2VjcmV0Cg=="
-        }
-      }
-    }

cmd/openshift-install/testdata/agent/unconfigured-ignition/configurations/from-ztp-manifests.txt

@@ -10,11 +10,13 @@ exec openshift-install agent create unconfigured-ignition --dir $WORK
 exists $WORK/unconfigured-agent.ign
 ! exists $WORK/auth/kubeconfig
 ! exists $WORK/auth/kubeadmin-password
+
+unconfiguredIgnContains /etc/assisted/manifests/pull-secret.yaml
 ! unconfiguredIgnContains /etc/assisted/manifests/agent-cluster-install.yaml
 ! unconfiguredIgnContains /etc/assisted/manifests/cluster-deployment.yaml
+
 unconfiguredIgnCmp /etc/assisted/manifests/cluster-image-set.yaml expected/cluster-image-set.yaml
 unconfiguredIgnCmp /etc/assisted/manifests/infraenv.yaml expected/infraenv.yaml
-unconfiguredIgnCmp /etc/assisted/manifests/pull-secret.yaml expected/pull-secret.yaml
 
 -- cluster-manifests/infraenv.yaml --
 apiVersion: agent-install.openshift.io/v1beta1
@@ -85,19 +87,3 @@ status:
     rootfs: ""
   debugInfo:
     eventsURL: ""
--- expected/pull-secret.yaml --
-apiVersion: v1
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: ostest-pull-secret
-  namespace: cluster0
-stringData:
-  .dockerconfigjson: |-
-    {
-      "auths": {
-        "quay.io": {
-          "auth": "c3VwZXItc2VjcmV0Cg=="
-        }
-      }
-    }

cmd/openshift-install/testdata/agent/unconfigured-ignition/manifests/default_manifests.txt

@@ -8,11 +8,12 @@ exists $WORK/unconfigured-agent.ign
 ! exists $WORK/auth/kubeconfig
 ! exists $WORK/auth/kubeadmin-password
 
+unconfiguredIgnContains /etc/assisted/manifests/pull-secret.yaml
 ! unconfiguredIgnContains /etc/assisted/manifests/agent-cluster-install.yaml
 ! unconfiguredIgnContains /etc/assisted/manifests/cluster-deployment.yaml
+
 unconfiguredIgnCmp /etc/assisted/manifests/cluster-image-set.yaml expected/cluster-image-set.yaml
 unconfiguredIgnCmp /etc/assisted/manifests/infraenv.yaml expected/infraenv.yaml
-unconfiguredIgnCmp /etc/assisted/manifests/pull-secret.yaml expected/pull-secret.yaml
 
 -- install-config.yaml --
 apiVersion: v1
@@ -85,19 +86,3 @@ status:
     rootfs: ""
   debugInfo:
     eventsURL: ""
--- expected/pull-secret.yaml --
-apiVersion: v1
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: ostest-pull-secret
-  namespace: cluster0
-stringData:
-  .dockerconfigjson: |-
-    {
-      "auths": {
-        "quay.io": {
-          "auth": "c3VwZXItc2VjcmV0Cg=="
-        }
-      }
-    }

pkg/asset/agent/manifests/clusterimageset.go

@@ -189,7 +189,7 @@ func (a *ClusterImageSet) validateReleaseVersion(ctx context.Context, workflowTy
 	}
 
 	if a.Config.Spec.ReleaseImage != releaseImage.PullSpec {
-		allErrs = append(allErrs, field.Forbidden(fieldPath, fmt.Sprintf("value must be equal to %s", releaseImage.PullSpec)))
+		allErrs = append(allErrs, field.Invalid(fieldPath, a.Config.Spec.ReleaseImage, fmt.Sprintf("value must be equal to %s", releaseImage.PullSpec)))
 	}
 
 	return allErrs

pkg/asset/agent/manifests/clusterimageset_test.go

@@ -62,7 +62,7 @@ func TestClusterImageSet_Generate(t *testing.T) {
 				getValidOptionalInstallConfig(),
 				&releaseimage.Image{},
 			},
-			expectedError: "invalid ClusterImageSet configuration: Spec.ReleaseImage: Forbidden: value must be equal to " + currentRelease,
+			expectedError: "invalid ClusterImageSet configuration: Spec.ReleaseImage: Invalid value: \"\": value must be equal to " + currentRelease,
 		},
 		{
 			name: "valid configuration",
@@ -182,7 +182,7 @@ metadata:
   name: openshift-v4.10.0
 spec:
   releaseImage: 99.999`,
-			expectedError: fmt.Sprintf("invalid ClusterImageSet configuration: Spec.ReleaseImage: Forbidden: value must be equal to %s", currentRelease),
+			expectedError: fmt.Sprintf("invalid ClusterImageSet configuration: Spec.ReleaseImage: Invalid value: \"99.999\": value must be equal to %s", currentRelease),
 		},
 		{
 			name:          "not-yaml",
@@ -192,7 +192,7 @@ spec:
 		{
 			name:          "empty",
 			data:          "",
-			expectedError: fmt.Sprintf("invalid ClusterImageSet configuration: Spec.ReleaseImage: Forbidden: value must be equal to %s", currentRelease),
+			expectedError: fmt.Sprintf("invalid ClusterImageSet configuration: Spec.ReleaseImage: Invalid value: \"\": value must be equal to %s", currentRelease),
 		},
 		{
 			name:       "file-not-found",