[DO NOT MERGE] sandboxed-containers-operator: add Azure disconnected workflow

ci-operator/config/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel__downstream-candidate419.yaml

@@ -210,6 +210,42 @@ tests:
       WORKLOAD_TO_TEST: coco
     workflow: sandboxed-containers-operator-e2e-aro
   timeout: 24h0m0s
+- as: aro-ipi-kata-disconnected
+  capabilities:
+  - intranet
+  cron: 0 0 31 2 1
+  reporter_config:
+    channel: '#kata-ocp-ci-reports'
+    job_states_to_report:
+    - success
+    - failure
+    - error
+    report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}}
+      {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}}
+      <{{.Status.URL}}|View logs>'
+  steps:
+    cluster_profile: azure-qe
+    env:
+      ARO_CLUSTER_VERSION: "4.17"
+      CATALOG_SOURCE_IMAGE: quay.io/redhat-user-workloads/ose-osc-tenant/osc-test-fbc:latest
+      CATALOG_SOURCE_NAME: brew-catalog
+      ENABLE_MUST_GATHER: "false"
+      HYPERSHIFT_AZURE_LOCATION: eastus
+      INITDATA: ""
+      INSTALL_KATA_RPM: "false"
+      KATA_RPM_VERSION: ""
+      LOCATION: eastus
+      MUST_GATHER_IMAGE: registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest
+      MUST_GATHER_ON_FAILURE_ONLY: "true"
+      SLEEP_DURATION: 3h
+      TEST_FILTERS: ~Disruptive&
+      TEST_PARALLEL: "1"
+      TEST_RELEASE_TYPE: Pre-GA
+      TEST_SCENARIOS: sig-kata.*Kata Author
+      TEST_TIMEOUT: "90"
+      TRUSTEE_URL: ""
+    workflow: sandboxed-containers-operator-e2e-aro-disconnected
+  timeout: 24h0m0s
 - as: aws-ipi-peerpods
   capabilities:
   - intranet

ci-operator/jobs/openshift/sandboxed-containers-operator/openshift-sandboxed-containers-operator-devel-periodics.yaml

@@ -2067,6 +2067,100 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build09
+  cron: 0 0 31 2 1
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+    timeout: 24h0m0s
+  extra_refs:
+  - base_ref: devel
+    org: openshift
+    repo: sandboxed-containers-operator
+  labels:
+    capability/intranet: intranet
+    ci-operator.openshift.io/cloud: azure4
+    ci-operator.openshift.io/cloud-cluster-profile: azure-qe
+    ci-operator.openshift.io/variant: downstream-candidate419
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-sandboxed-containers-operator-devel-downstream-candidate419-aro-ipi-kata-disconnected
+  reporter_config:
+    slack:
+      channel: '#kata-ocp-ci-reports'
+      job_states_to_report:
+      - success
+      - failure
+      - error
+      report_template: '{{if eq .Status.State "success"}}SUCCESS{{else}}ERROR{{end}}
+        {{trimPrefix "periodic-ci-openshift-sandboxed-containers-operator-" .Spec.Job}}
+        <{{.Status.URL}}|View logs>'
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=aro-ipi-kata-disconnected
+      - --variant=downstream-candidate419
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
 - agent: kubernetes
   cluster: build09
   cron: 0 0 31 2 1

ci-operator/step-registry/sandboxed-containers-operator/e2e/aro-disconnected/OWNERS

@@ -0,0 +1,10 @@
+reviewers:
+  - ldoktor
+  - tbuskey
+  - vvoronko
+  - wainersm
+approvers:
+  - ldoktor
+  - tbuskey
+  - vvoronko
+  - wainersm

ci-operator/step-registry/sandboxed-containers-operator/e2e/aro-disconnected/sandboxed-containers-operator-e2e-aro-disconnected-workflow.metadata.json

@@ -0,0 +1,17 @@
+{
+	"path": "sandboxed-containers-operator/e2e/aro-disconnected/sandboxed-containers-operator-e2e-aro-disconnected-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"ldoktor",
+			"tbuskey",
+			"vvoronko",
+			"wainersm"
+		],
+		"reviewers": [
+			"ldoktor",
+			"tbuskey",
+			"vvoronko",
+			"wainersm"
+		]
+	}
+}

ci-operator/step-registry/sandboxed-containers-operator/e2e/aro-disconnected/sandboxed-containers-operator-e2e-aro-disconnected-workflow.yaml

@@ -0,0 +1,50 @@
+workflow:
+  as: sandboxed-containers-operator-e2e-aro-disconnected
+  steps:
+    env:
+      ARO_API_SERVER_VISIBILITY: Private
+      ARO_INGRESS_VISIBILITY: Private
+      ARO_OUTBOUND_TYPE: UserDefinedRouting
+      ARO_BYO_NSG: "true"
+      ARO_WORKER_COUNT: "3"
+      ARO_WORKER_VM_SIZE: Standard_D8s_v3
+      REGISTER_MIRROR_REGISTRY_DNS: "yes"
+      BASTION_BOOT_IMAGE: "azureopenshift:aro4:aro_417:417.94.20240701"
+      BASTION_VM_SIZE: "Standard_D4s_v3"
+      ENALBE_DNSMASQ_METHOD: "NetworkManager"
+      OPERTORS_TO_MIRROR: "sandboxed-containers-operator"
+      SLEEP_DURATION: 3h
+      TEST_PARALLEL: 1
+      FORCE_SUCCESS_EXIT: "no"
+      MUST_GATHER_IMAGE: "registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9:latest"
+      MUST_GATHER_TIMEOUT: "35m"
+      ENABLE_MUST_GATHER: "false"
+      MUST_GATHER_ON_FAILURE_ONLY: "true"
+      TEST_FILTERS: ~Disruptive&
+    pre:
+    - ref: azure-provision-resourcegroup
+    - ref: aro-provision-vnet
+    - chain: azure-provision-bastionhost
+    - ref: proxy-config-generate
+    - ref: openshift-cluster-bot-rbac
+    - chain: mirror-images-by-oc-adm
+    - ref: sandboxed-containers-operator-mirror-operator
+    - ref: bastion-dnsmasq
+    - ref: aro-provision-nsg
+    - ref: aro-provision-cluster
+    - chain: sandboxed-containers-operator-pre
+    test:
+    - ref: openshift-extended-test
+    post:
+    - ref: cucushift-installer-wait
+      timeout: 12h10m0s
+      best_effort: true
+      optional_on_success: true
+    - ref: sandboxed-containers-operator-gather-must-gather
+    - ref: sandboxed-containers-operator-post
+    - ref: aro-deprovision
+  documentation: |-
+    Run openshift-extended-test on a disconnected ARO cluster
+    with sandboxed containers deployed. Uses ARO provisioning steps
+    with private/disconnected configuration and the OSC pre chain for
+    operator setup.

ci-operator/step-registry/sandboxed-containers-operator/env-cm/sandboxed-containers-operator-env-cm-commands.sh

@@ -1,7 +1,16 @@
 #!/bin/bash
 
+if test -s "${SHARED_DIR}/proxy-conf.sh"; then
+    source "${SHARED_DIR}/proxy-conf.sh"
+fi
+
 configmap_path="${SHARED_DIR:-$(pwd)}/env-cm.yaml"
 
+if [[ -f "${SHARED_DIR}/disconnected_catalog_source_name" ]]; then
+    CATALOG_SOURCE_NAME=$(cat "${SHARED_DIR}/disconnected_catalog_source_name")
+    echo "Using disconnected CatalogSource: ${CATALOG_SOURCE_NAME}"
+fi
+
 # TODO: still needed? 600 seconds will cause the step timeout?
 #echo "Giving a 10min stabilization time for AWS fresh 4.18 cluster before applying kataconfig as workaround for KATA-3451"
 #sleep 600

ci-operator/step-registry/sandboxed-containers-operator/gather-must-gather/sandboxed-containers-operator-gather-must-gather-commands.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
 
+if test -s "${SHARED_DIR}/proxy-conf.sh"; then
+    source "${SHARED_DIR}/proxy-conf.sh"
+fi
+
 set -o nounset
 set -o errexit
 set -o pipefail

ci-operator/step-registry/sandboxed-containers-operator/get-kata-rpm/sandboxed-containers-operator-get-kata-rpm-commands.sh

@@ -3,6 +3,10 @@
 # Download and copy the kata containers RPM to /host/var/local/kata-containers.rpm
 # on each worker node. The RPM is going to be installed by the test automation code.
 
+if test -s "${SHARED_DIR}/proxy-conf.sh"; then
+    source "${SHARED_DIR}/proxy-conf.sh"
+fi
+
 set -o nounset
 set -o errexit
 set -o pipefail

ci-operator/step-registry/sandboxed-containers-operator/mirror-operator/OWNERS

@@ -0,0 +1,10 @@
+reviewers:
+  - ldoktor
+  - tbuskey
+  - vvoronko
+  - wainersm
+approvers:
+  - ldoktor
+  - tbuskey
+  - vvoronko
+  - wainersm