[WIP] CNTRLPLANE-3719: Calico/Cilium jobs for release-5.0

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.19__periodics.yaml

@@ -188,26 +188,7 @@ tests:
     env:
       BASE_DOMAIN: qe.devcluster.openshift.com
       TEST_ARGS: --disable-monitor=apiserver-incluster-availability,service-type-load-balancer-availability
-      TEST_SKIPS: Netpol NetworkPolicy between server and client should allow egress
-        access to server in CIDR block \[Feature:NetworkPolicy\] \[Suite:openshift/conformance/parallel\]
-        \[Suite:k8s\]\| Netpol NetworkPolicy between server and client should ensure
-        an IP overlapping both IPBlock.CIDR and IPBlock.Except is allowed \[Feature:NetworkPolicy\]
-        \[Suite:openshift/conformance/parallel\] \[Suite:k8s\]\| Services should serve
-        endpoints on same port and different protocols \[Conformance\] \[Suite:openshift/conformance/parallel/minimal\]
-        \[Suite:k8s\]\| Netpol NetworkPolicy between server and client should enforce
-        except clause while egress access to server in CIDR block \[Feature:NetworkPolicy\]
-        \[Suite:openshift/conformance/parallel\] \[Suite:k8s\]\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with UDP \[Suite:openshift/conformance/parallel\]\| Unidling with
-        Deployments \[apigroup:route.openshift.io\] should work with TCP (when fully
-        idled) \[Suite:openshift/conformance/parallel\]\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled) \[Suite:openshift/conformance/parallel\]\|
-        Unidling with Deployments \[apigroup:route.openshift.io\] should work with
-        UDP \[Suite:openshift/conformance/parallel\]\| DNS should answer queries using
-        the local DNS endpoint \[Suite:openshift/conformance/parallel\]\|Ensure HTTPRoute
-        object is created
-    test:
-    - chain: hypershift-conformance
-    workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift-private-guest-cilium
+    workflow: hypershift-aws-conformance-cilium-private
 - as: e2e-aws-conformance-calico
   minimum_interval: 336h
   steps:
@@ -221,21 +202,7 @@ tests:
       BASE_DOMAIN: qe.devcluster.openshift.com
       HYPERSHIFT_GUEST_INFRA_OCP_ACCOUNT: "true"
       TEST_ARGS: --disable-monitor=apiserver-incluster-availability,service-type-load-balancer-availability
-      TEST_SKIPS: The default cluster RBAC policy should have correct RBAC rules\|
-        Cluster scoped load balancer healthcheck port and path should be 10256/healthz\|
-        Prometheus \[apigroup:image.openshift.io\] when installed on the cluster should
-        provide named network metrics\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with UDP\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with UDP\|pod should not start for sysctls not on whitelist \[apigroup:k8s.cni.cncf.io\]
-        net.ipv4.conf.IFNAME.arp_filter\| pod should not start for sysctls not on
-        whitelist \[apigroup:k8s.cni.cncf.io\] net.ipv4.conf.all.send_redirects\|
-        sysctl allowlist update should start a pod with custom sysctl only when the
-        sysctl is added to whitelist\|Ensure HTTPRoute object is created
-    test:
-    - chain: hypershift-conformance
-    workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift-private-guest-calico
+    workflow: hypershift-aws-conformance-calico-private
 - as: e2e-kubevirt-metal-conformance-calico
   capabilities:
   - intranet

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.20__periodics.yaml

@@ -188,26 +188,7 @@ tests:
     env:
       BASE_DOMAIN: qe.devcluster.openshift.com
       TEST_ARGS: --disable-monitor=apiserver-incluster-availability,service-type-load-balancer-availability
-      TEST_SKIPS: Netpol NetworkPolicy between server and client should allow egress
-        access to server in CIDR block \[Feature:NetworkPolicy\] \[Suite:openshift/conformance/parallel\]
-        \[Suite:k8s\]\| Netpol NetworkPolicy between server and client should ensure
-        an IP overlapping both IPBlock.CIDR and IPBlock.Except is allowed \[Feature:NetworkPolicy\]
-        \[Suite:openshift/conformance/parallel\] \[Suite:k8s\]\| Services should serve
-        endpoints on same port and different protocols \[Conformance\] \[Suite:openshift/conformance/parallel/minimal\]
-        \[Suite:k8s\]\| Netpol NetworkPolicy between server and client should enforce
-        except clause while egress access to server in CIDR block \[Feature:NetworkPolicy\]
-        \[Suite:openshift/conformance/parallel\] \[Suite:k8s\]\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with UDP \[Suite:openshift/conformance/parallel\]\| Unidling with
-        Deployments \[apigroup:route.openshift.io\] should work with TCP (when fully
-        idled) \[Suite:openshift/conformance/parallel\]\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled) \[Suite:openshift/conformance/parallel\]\|
-        Unidling with Deployments \[apigroup:route.openshift.io\] should work with
-        UDP \[Suite:openshift/conformance/parallel\]\| DNS should answer queries using
-        the local DNS endpoint \[Suite:openshift/conformance/parallel\]\|Ensure HTTPRoute
-        object is created
-    test:
-    - chain: hypershift-conformance
-    workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift-private-guest-cilium
+    workflow: hypershift-aws-conformance-cilium-private
 - as: e2e-kubevirt-metal-conformance-cilium
   capabilities:
   - intranet
@@ -233,21 +214,7 @@ tests:
       BASE_DOMAIN: qe.devcluster.openshift.com
       HYPERSHIFT_GUEST_INFRA_OCP_ACCOUNT: "true"
       TEST_ARGS: --disable-monitor=apiserver-incluster-availability,service-type-load-balancer-availability
-      TEST_SKIPS: The default cluster RBAC policy should have correct RBAC rules\|
-        Cluster scoped load balancer healthcheck port and path should be 10256/healthz\|
-        Prometheus \[apigroup:image.openshift.io\] when installed on the cluster should
-        provide named network metrics\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with UDP\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with UDP\|pod should not start for sysctls not on whitelist \[apigroup:k8s.cni.cncf.io\]
-        net.ipv4.conf.IFNAME.arp_filter\| pod should not start for sysctls not on
-        whitelist \[apigroup:k8s.cni.cncf.io\] net.ipv4.conf.all.send_redirects\|
-        sysctl allowlist update should start a pod with custom sysctl only when the
-        sysctl is added to whitelist\|Ensure HTTPRoute object is created
-    test:
-    - chain: hypershift-conformance
-    workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift-private-guest-calico
+    workflow: hypershift-aws-conformance-calico-private
 - as: e2e-kubevirt-metal-conformance-calico
   capabilities:
   - intranet

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.21__periodics.yaml

@@ -196,22 +196,7 @@ tests:
     env:
       BASE_DOMAIN: qe.devcluster.openshift.com
       TEST_ARGS: --disable-monitor=apiserver-incluster-availability,service-type-load-balancer-availability
-      TEST_SKIPS: Netpol NetworkPolicy between server and client should allow egress
-        access to server in CIDR block \[Feature:NetworkPolicy\]\| Netpol NetworkPolicy
-        between server and client should ensure an IP overlapping both IPBlock.CIDR
-        and IPBlock.Except is allowed \[Feature:NetworkPolicy\]\| Services should
-        serve endpoints on same port and different protocols \[Conformance\]\| Netpol
-        NetworkPolicy between server and client should enforce except clause while
-        egress access to server in CIDR block \[Feature:NetworkPolicy\]\| Unidling
-        \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\] should work
-        with UDP\| Unidling with Deployments \[apigroup:route.openshift.io\] should
-        work with TCP (when fully idled)\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with UDP\| DNS should answer queries using the local DNS endpoint\|
-        Ensure HTTPRoute object is created
-    test:
-    - chain: hypershift-conformance
-    workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift-private-guest-cilium
+    workflow: hypershift-aws-conformance-cilium-private
 - as: e2e-kubevirt-metal-conformance-cilium
   capabilities:
   - intranet
@@ -326,21 +311,7 @@ tests:
       BASE_DOMAIN: qe.devcluster.openshift.com
       HYPERSHIFT_GUEST_INFRA_OCP_ACCOUNT: "true"
       TEST_ARGS: --disable-monitor=apiserver-incluster-availability,service-type-load-balancer-availability
-      TEST_SKIPS: The default cluster RBAC policy should have correct RBAC rules\|
-        Cluster scoped load balancer healthcheck port and path should be 10256/healthz\|
-        Prometheus \[apigroup:image.openshift.io\] when installed on the cluster should
-        provide named network metrics\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with UDP\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling \[apigroup:apps.openshift.io\]\[apigroup:route.openshift.io\]
-        should work with TCP (when fully idled)\| Unidling with Deployments \[apigroup:route.openshift.io\]
-        should work with UDP\|pod should not start for sysctls not on whitelist \[apigroup:k8s.cni.cncf.io\]
-        net.ipv4.conf.IFNAME.arp_filter\| pod should not start for sysctls not on
-        whitelist \[apigroup:k8s.cni.cncf.io\] net.ipv4.conf.all.send_redirects\|
-        sysctl allowlist update should start a pod with custom sysctl only when the
-        sysctl is added to whitelist\|Ensure HTTPRoute object is created
-    test:
-    - chain: hypershift-conformance
-    workflow: cucushift-installer-rehearse-aws-ipi-ovn-hypershift-private-guest-calico
+    workflow: hypershift-aws-conformance-calico-private
 - as: e2e-kubevirt-metal-conformance-calico
   capabilities:
   - intranet

ci-operator/config/openshift/hypershift/openshift-hypershift-release-4.22__periodics.yaml

@@ -202,6 +202,32 @@ tests:
   steps:
     cluster_profile: hypershift-aws
     workflow: hypershift-aws-conformance-cilium
+- as: e2e-aws-conformance-cilium-private
+  cron: 0 0 * * 0
+  steps:
+    cluster_profile: aws-qe
+    env:
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      TEST_ARGS: --disable-monitor=apiserver-incluster-availability
+    workflow: hypershift-aws-conformance-cilium-private
+- as: e2e-kubevirt-metal-conformance-cilium
+  capabilities:
+  - intranet
+  cron: 0 0 * * 0
+  steps:
+    cluster_profile: equinix-ocp-hcp
+    env:
+      KONFLUX_DEPLOY_CATALOG_SOURCE: "true"
+      KONFLUX_DEPLOY_OPERATORS: "true"
+      KONFLUX_DEPLOY_SUBSCRIPTION: "false"
+      LOCAL_STORAGE_OPERATOR_SUB_SOURCE: local-storage-konflux
+      LVM_OPERATOR_SUB_CHANNEL: stable-4.22
+      LVM_OPERATOR_SUB_SOURCE: lvm-catalogsource
+      METALLB_OPERATOR_SUB_SOURCE: metallb-konflux
+      ODF_OPERATOR_SUB_CHANNEL: stable-4.21
+      ODF_OPERATOR_SUB_SOURCE: redhat-operators-v4-21
+      REDHAT_OPERATORS_INDEX_TAG: v4.21
+    workflow: hypershift-kubevirt-baremetalds-conformance-cilium
 - as: e2e-aws-external-oidc
   minimum_interval: 12h
   steps:
@@ -249,6 +275,38 @@ tests:
   steps:
     cluster_profile: openshift-org-aws
     workflow: hypershift-kubevirt-csi-e2e
+- as: e2e-aws-conformance-calico
+  minimum_interval: 168h
+  steps:
+    cluster_profile: hypershift-aws
+    workflow: hypershift-aws-conformance-calico
+- as: e2e-aws-conformance-calico-private
+  minimum_interval: 168h
+  steps:
+    cluster_profile: aws-qe
+    env:
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      HYPERSHIFT_GUEST_INFRA_OCP_ACCOUNT: "true"
+      TEST_ARGS: --disable-monitor=apiserver-incluster-availability
+    workflow: hypershift-aws-conformance-calico-private
+- as: e2e-kubevirt-metal-conformance-calico
+  capabilities:
+  - intranet
+  minimum_interval: 168h
+  steps:
+    cluster_profile: equinix-ocp-hcp
+    env:
+      KONFLUX_DEPLOY_CATALOG_SOURCE: "true"
+      KONFLUX_DEPLOY_OPERATORS: "true"
+      KONFLUX_DEPLOY_SUBSCRIPTION: "false"
+      LOCAL_STORAGE_OPERATOR_SUB_SOURCE: local-storage-konflux
+      LVM_OPERATOR_SUB_CHANNEL: stable-4.22
+      LVM_OPERATOR_SUB_SOURCE: lvm-catalogsource
+      METALLB_OPERATOR_SUB_SOURCE: metallb-konflux
+      ODF_OPERATOR_SUB_CHANNEL: stable-4.21
+      ODF_OPERATOR_SUB_SOURCE: redhat-operators-v4-21
+      REDHAT_OPERATORS_INDEX_TAG: v4.21
+    workflow: hypershift-kubevirt-baremetalds-conformance-calico
 - as: e2e-azure-aks-ovn-conformance
   cron: 0 */2 * * *
   steps:

ci-operator/config/openshift/hypershift/openshift-hypershift-release-5.0__periodics.yaml

@@ -238,6 +238,28 @@ tests:
   steps:
     cluster_profile: hypershift-aws
     workflow: hypershift-aws-conformance-cilium
+- as: e2e-aws-conformance-cilium-private
+  cron: 0 0 * * 0
+  steps:
+    cluster_profile: aws-qe
+    env:
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      TEST_ARGS: --disable-monitor=apiserver-incluster-availability
+    workflow: hypershift-aws-conformance-cilium-private
+- as: e2e-aws-conformance-calico
+  minimum_interval: 168h
+  steps:
+    cluster_profile: hypershift-aws
+    workflow: hypershift-aws-conformance-calico
+- as: e2e-aws-conformance-calico-private
+  minimum_interval: 168h
+  steps:
+    cluster_profile: aws-qe
+    env:
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      HYPERSHIFT_GUEST_INFRA_OCP_ACCOUNT: "true"
+      TEST_ARGS: --disable-monitor=apiserver-incluster-availability
+    workflow: hypershift-aws-conformance-calico-private
 - as: e2e-aws-external-oidc
   minimum_interval: 12h
   steps: