From 69095c99589fd4645987acdd8223ff68fb11665d Mon Sep 17 00:00:00 2001 From: Sri Vignesh Date: Mon, 27 Jul 2026 13:02:43 +0530 Subject: [PATCH 1/2] Add setup-testing-accounts task for Konflux CI Signed-off-by: Sri Vignesh --- .konflux/tekton/release-test-pipeline.yaml | 40 ++++- .../tekton/task-setup-testing-accounts.yaml | 158 ++++++++++++++++++ 2 files changed, 189 insertions(+), 9 deletions(-) create mode 100644 .konflux/tekton/task-setup-testing-accounts.yaml diff --git a/.konflux/tekton/release-test-pipeline.yaml b/.konflux/tekton/release-test-pipeline.yaml index f7ac41c5fa6..30161f83295 100644 --- a/.konflux/tekton/release-test-pipeline.yaml +++ b/.konflux/tekton/release-test-pipeline.yaml @@ -258,6 +258,28 @@ spec: value: "$(tasks.create-catalog-source.results.channel)" runAfter: - create-catalog-source + + # Setup test user accounts + - name: setup-testing-accounts + taskRef: + resolver: git + params: + - name: url + value: $(params.RELEASE_TEST_TASKS_REPO) + - name: revision + value: $(params.RELEASE_TEST_TASKS_BRANCH) + - name: pathInRepo + value: .konflux/tekton/task-setup-testing-accounts.yaml + params: + - name: EAAS_SPACE_SECRET_REF + value: $(tasks.provision-eaas-space.results.secretRef) + - name: CLUSTER_NAME + value: $(tasks.provision-cluster.results.clusterName) + - name: IMAGE + value: $(params.IMAGE) + runAfter: + - install-pipelines-operator + #Release Tests - Chains - name: release-tests-chains onError: continue @@ -286,7 +308,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Manual Approval Gate - name: release-tests-manual-approval @@ -316,7 +338,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Metrics - name: release-tests-metrics @@ -346,7 +368,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Pipelines as Code - name: release-tests-pac @@ -376,7 +398,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Versions - name: release-tests-versions @@ -406,7 +428,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Pipelines - name: release-tests-pipelines @@ -436,7 +458,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Triggers - name: release-tests-triggers @@ -468,7 +490,7 @@ spec: - name: OCP_VERSION value: "$(tasks.provision-cluster.results.ocpVersion)" runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Results - name: release-tests-results @@ -498,7 +520,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts #Release Tests - Triggers TLS - name: release-tests-triggers-tls @@ -528,7 +550,7 @@ spec: - name: GIT_RELEASE_TESTS_BRANCH value: $(params.GIT_RELEASE_TESTS_BRANCH) runAfter: - - install-pipelines-operator + - setup-testing-accounts finally: # Verify aggregate status and fail pipeline if any e2e task failed diff --git a/.konflux/tekton/task-setup-testing-accounts.yaml b/.konflux/tekton/task-setup-testing-accounts.yaml new file mode 100644 index 00000000000..1fe879a9359 --- /dev/null +++ b/.konflux/tekton/task-setup-testing-accounts.yaml @@ -0,0 +1,158 @@ +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: setup-testing-accounts +spec: + description: | + Configures HTPasswd identity provider with standard test user accounts on an + ephemeral EaaS cluster. Adapted from the plumbing repo task for Konflux, + where credentials come from the EaaS space secret rather than per-cluster + Kubernetes secrets. + params: + - name: EAAS_SPACE_SECRET_REF + type: string + - name: CLUSTER_NAME + type: string + description: Name of the ephemeral EaaS cluster + - name: IMAGE + description: CI image that contains the oc client + default: quay.io/openshift-pipeline/ci:latest + volumes: + - name: credentials + emptyDir: {} + stepTemplate: + image: $(params.IMAGE) + volumeMounts: + - name: credentials + mountPath: /credentials + steps: + - name: get-kubeconfig + ref: + resolver: git + params: + - name: url + value: https://github.com/konflux-ci/build-definitions.git + - name: revision + value: main + - name: pathInRepo + value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml + params: + - name: eaasSpaceSecretRef + value: "$(params.EAAS_SPACE_SECRET_REF)" + - name: clusterName + value: "$(params.CLUSTER_NAME)" + - name: credentials + value: credentials + - name: setup-testing-accounts + env: + - name: KUBECONFIG + value: "/credentials/$(steps.get-kubeconfig.results.kubeconfig)" + script: | + #!/usr/bin/env bash + set -e -u -o pipefail + + echo "Setting up testing accounts on ephemeral EaaS cluster..." + echo "Cluster: $(oc whoami --show-server)" + + # Build htpasswd file + USERS=( + "consoledeveloper:developer" + "pipelinesdeveloper:developer" + "user:user" + ) + for i in $(seq 1 9); do + USERS+=("user${i}:user${i}") + done + + HTPASSWD_FILE=$(mktemp) + for entry in "${USERS[@]}"; do + username="${entry%%:*}" + password="${entry#*:}" + if command -v htpasswd &>/dev/null; then + if [ ! -s "$HTPASSWD_FILE" ]; then + htpasswd -cbB "$HTPASSWD_FILE" "$username" "$password" + else + htpasswd -bB "$HTPASSWD_FILE" "$username" "$password" + fi + elif command -v openssl &>/dev/null; then + echo "${username}:$(openssl passwd -apr1 "$password")" >> "$HTPASSWD_FILE" + else + echo "ERROR: neither htpasswd nor openssl found in image" >&2 + exit 1 + fi + done + + echo "Created htpasswd file with $(wc -l < "$HTPASSWD_FILE") user(s)" + + # Create htpasswd secret + oc create secret generic htpass-secret \ + --from-file=htpasswd="$HTPASSWD_FILE" \ + -n openshift-config \ + --dry-run=client -o yaml | oc apply -f- + + # Configure OAuth identity provider + cat <<'EOF' | oc apply -f- + apiVersion: config.openshift.io/v1 + kind: OAuth + metadata: + name: cluster + spec: + identityProviders: + - name: htpasswd-provider + mappingMethod: claim + type: HTPasswd + htpasswd: + fileData: + name: htpass-secret + EOF + + # Wait for OAuth rollout + echo "Waiting for OAuth server to reconcile new configuration..." + sleep 10 + oc wait co/authentication --for=condition=Progressing=False --timeout=300s || true + oc wait co/authentication --for=condition=Available=True --timeout=300s + + # Assign cluster roles + echo "Assigning cluster roles..." + oc adm policy add-cluster-role-to-user self-provisioner consoledeveloper + oc adm policy add-cluster-role-to-user view consoledeveloper + oc adm policy add-cluster-role-to-user basic-user pipelinesdeveloper + + # ── 6. Verify a test user can authenticate ────────────────────── + echo "Verifying user authentication (may take a few minutes)..." + VERIFY_KUBECONFIG=$(mktemp) + API_SERVER=$(oc whoami --show-server) + VERIFIED=false + for attempt in $(seq 1 30); do + if KUBECONFIG="$VERIFY_KUBECONFIG" oc login -u user -p user \ + "$API_SERVER" --insecure-skip-tls-verify=true &>/dev/null; then + echo "User authentication verified on attempt $attempt" + VERIFIED=true + break + fi + echo "Attempt $attempt/30: OAuth not ready yet, retrying in 10s..." + sleep 10 + done + rm -f "$VERIFY_KUBECONFIG" + + if [ "$VERIFIED" = "false" ]; then + echo "ERROR: user authentication verification failed after 5 minutes" >&2 + exit 1 + fi + + # Summary + echo "" + echo "Testing accounts configured successfully!" + echo "" + echo "Username | Password | Cluster roles" + echo "-------------------|-----------------------------------------" + echo "consoledeveloper | developer | self-provisioner, view" + echo "pipelinesdeveloper | developer | basic-user" + echo "user | user | default" + for i in $(seq 1 9); do + printf "user%-14s | user%-20s | default\n" "$i" "$i" + done + echo "-------------------------------------------------------------" + + rm -f "$HTPASSWD_FILE" From a2367841cd13ef2c597043f02d0d740aa034aa80 Mon Sep 17 00:00:00 2001 From: Sri Vignesh Date: Mon, 27 Jul 2026 14:54:03 +0530 Subject: [PATCH 2/2] remove mirror Signed-off-by: Sri Vignesh --- .konflux/tekton/release-test-pipeline.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.konflux/tekton/release-test-pipeline.yaml b/.konflux/tekton/release-test-pipeline.yaml index 30161f83295..245f08c0c2d 100644 --- a/.konflux/tekton/release-test-pipeline.yaml +++ b/.konflux/tekton/release-test-pipeline.yaml @@ -154,8 +154,6 @@ spec: - name: imageContentSources value: | - source: registry.redhat.io/openshift-pipelines/ - mirrors: - - quay.io/redhat-user-workloads/tekton-ecosystem-tenant # Create Catalog Source to install Operator - name: create-catalog-source runAfter: