OCPNODE-3187: Promote SigstoreVerificatoin to Default #2340

QiWang19 · 2025-05-22T16:51:05Z

No description provided.

openshift-ci · 2025-05-22T16:51:10Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2025-05-22T16:51:12Z

Hello @QiWang19! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

QiWang19 · 2025-05-22T16:52:43Z

/test verify-feature-promotion

QiWang19 · 2025-05-22T17:33:09Z

/test e2e-aws-ovn-techpreview-serial
/test e2e-gcp-ovn-techpreview-serial
/test e2e-aws-ovn-single-node-techpreview-serial

openshift-ci · 2025-05-22T17:33:55Z

@QiWang19: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test build

/test e2e-aws-ovn

/test e2e-aws-ovn-hypershift

/test e2e-aws-ovn-hypershift-conformance

/test e2e-aws-ovn-techpreview

/test e2e-aws-serial-1of2

/test e2e-aws-serial-2of2

/test e2e-aws-serial-techpreview-1of2

/test e2e-aws-serial-techpreview-2of2

/test e2e-upgrade

/test e2e-upgrade-out-of-change

/test images

/test integration

/test lint

/test minor-e2e-upgrade-minor

/test minor-images

/test unit

/test verify

/test verify-client-go

/test verify-crd-schema

/test verify-deps

/test verify-feature-promotion

The following commands are available to trigger optional jobs:

/test e2e-azure

/test e2e-gcp

/test okd-scos-e2e-aws-ovn

/test okd-scos-images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-api-master-build

pull-ci-openshift-api-master-e2e-aws-ovn

pull-ci-openshift-api-master-e2e-aws-ovn-hypershift

pull-ci-openshift-api-master-e2e-aws-ovn-hypershift-conformance

pull-ci-openshift-api-master-e2e-aws-ovn-techpreview

pull-ci-openshift-api-master-e2e-aws-serial-1of2

pull-ci-openshift-api-master-e2e-aws-serial-2of2

pull-ci-openshift-api-master-e2e-aws-serial-techpreview-1of2

pull-ci-openshift-api-master-e2e-aws-serial-techpreview-2of2

pull-ci-openshift-api-master-e2e-azure

pull-ci-openshift-api-master-e2e-gcp

pull-ci-openshift-api-master-e2e-upgrade

pull-ci-openshift-api-master-e2e-upgrade-out-of-change

pull-ci-openshift-api-master-images

pull-ci-openshift-api-master-integration

pull-ci-openshift-api-master-lint

pull-ci-openshift-api-master-minor-e2e-upgrade-minor

pull-ci-openshift-api-master-minor-images

pull-ci-openshift-api-master-okd-scos-e2e-aws-ovn

pull-ci-openshift-api-master-unit

pull-ci-openshift-api-master-verify

pull-ci-openshift-api-master-verify-client-go

pull-ci-openshift-api-master-verify-crd-schema

pull-ci-openshift-api-master-verify-deps

pull-ci-openshift-api-master-verify-feature-promotion

In response to this:

/test e2e-aws-ovn-techpreview-serial
/test e2e-gcp-ovn-techpreview-serial
/test e2e-aws-ovn-single-node-techpreview-serial

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

QiWang19 · 2025-05-22T17:41:02Z

/payload-job periodic-ci-openshift-release-master-ci-4.19-e2e-aws-ovn-techpreview-serial

openshift-ci · 2025-05-22T17:41:07Z

@QiWang19: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.19-e2e-aws-ovn-techpreview-serial

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/ee5d5840-3733-11f0-9df1-5c867339a323-0

QiWang19 · 2025-05-22T17:50:28Z

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw-techpreview

/test e2e-metal-ipi-ovn-dualstack-bgp-techpreview

openshift-ci · 2025-05-22T17:50:31Z

@QiWang19: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test build

/test e2e-aws-ovn

/test e2e-aws-ovn-hypershift

/test e2e-aws-ovn-hypershift-conformance

/test e2e-aws-ovn-techpreview

/test e2e-aws-serial-1of2

/test e2e-aws-serial-2of2

/test e2e-aws-serial-techpreview-1of2

/test e2e-aws-serial-techpreview-2of2

/test e2e-upgrade

/test e2e-upgrade-out-of-change

/test images

/test integration

/test lint

/test minor-e2e-upgrade-minor

/test minor-images

/test unit

/test verify

/test verify-client-go

/test verify-crd-schema

/test verify-deps

/test verify-feature-promotion

The following commands are available to trigger optional jobs:

/test e2e-azure

/test e2e-gcp

/test okd-scos-e2e-aws-ovn

/test okd-scos-images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-api-master-build

pull-ci-openshift-api-master-e2e-aws-ovn

pull-ci-openshift-api-master-e2e-aws-ovn-hypershift

pull-ci-openshift-api-master-e2e-aws-ovn-hypershift-conformance

pull-ci-openshift-api-master-e2e-aws-ovn-techpreview

pull-ci-openshift-api-master-e2e-aws-serial-1of2

pull-ci-openshift-api-master-e2e-aws-serial-2of2

pull-ci-openshift-api-master-e2e-aws-serial-techpreview-1of2

pull-ci-openshift-api-master-e2e-aws-serial-techpreview-2of2

pull-ci-openshift-api-master-e2e-azure

pull-ci-openshift-api-master-e2e-gcp

pull-ci-openshift-api-master-e2e-upgrade

pull-ci-openshift-api-master-e2e-upgrade-out-of-change

pull-ci-openshift-api-master-images

pull-ci-openshift-api-master-integration

pull-ci-openshift-api-master-lint

pull-ci-openshift-api-master-minor-e2e-upgrade-minor

pull-ci-openshift-api-master-minor-images

pull-ci-openshift-api-master-okd-scos-e2e-aws-ovn

pull-ci-openshift-api-master-unit

pull-ci-openshift-api-master-verify

pull-ci-openshift-api-master-verify-client-go

pull-ci-openshift-api-master-verify-crd-schema

pull-ci-openshift-api-master-verify-deps

pull-ci-openshift-api-master-verify-feature-promotion

In response to this:

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw-techpreview

/test e2e-metal-ipi-ovn-dualstack-bgp-techpreview

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

QiWang19 · 2025-05-22T17:51:10Z

/test e2e-aws-serial-techpreview-1of2

/test e2e-aws-serial-techpreview-2of2

/test e2e-aws-ovn-techpreview

QiWang19 · 2025-05-27T13:30:10Z

/test verify-feature-promotion

QiWang19 · 2025-06-11T15:01:01Z

/test verify-feature-promotion

QiWang19 · 2025-06-13T17:11:16Z

/test verify-feature-promotion

QiWang19 · 2025-06-16T15:36:12Z

/test verify-feature-promotion

QiWang19 · 2025-07-02T18:45:46Z

/test verify-feature-promotion

QiWang19 · 2025-07-07T20:40:41Z

/test verify-feature-promotion

QiWang19 · 2025-07-16T23:06:07Z

/test verify-feature-promotion

openshift-ci-robot · 2025-07-30T19:09:15Z

@QiWang19: This pull request references OCPNODE-3187 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

QiWang19 · 2025-08-07T13:57:46Z

/test verify-feature-promotion

QiWang19 · 2025-08-11T22:02:55Z

/test verify-feature-promotion

JoelSpeed · 2025-08-12T10:10:09Z

@QiWang19 At the moment there appears to be no metal or SNO testing for this feature, is it not applicable to those platforms?

Signed-off-by: Qi Wang <[email protected]>

QiWang19 · 2025-08-12T17:23:16Z

@JoelSpeed I rebased. The test result now shows it runs on SNO {aws amd64 single }.
We have to skip test on metal, in order to run on metal disconnected we need to mirror the signatures before running the test, that is not implemented on current ci configuration.

JoelSpeed · 2025-08-13T11:17:11Z

@QiWang19 Yep, can see all of those tests now, you're down on runs per the requirements so it looks like you'll have to use gangway to trigger some runs to build up the correct number you'll need (unless you think the number will improve naturally between now and branching)

Have you used gangway before for this purpose?

QiWang19 · 2025-08-13T19:30:42Z

@JoelSpeed I did not know that we can use gangway to trigger runs, how to do that?
I found https://github.com/openshift-eng/gangway-cli

I triggered some tests, will /test verify-feature-promotion count these test?

./gangway-cli \
--api-url="https://gangway-ci.apps.ci.l2s4.p1.openshiftapps.com" \
--initial "registry.ci.openshift.org/ocp/release:4.20.0-0.nightly-2025-08-12-153542" \
--latest "registry.ci.openshift.org/ocp/release:4.20.0-0.nightly-2025-08-12-153542" \
--job-name periodic-ci-openshift-release-master-ci-4.20-e2e-aws-ovn-techpreview-serial \
--num-jobs 14

JoelSpeed · 2025-08-14T11:43:32Z

I triggered some tests, will /test verify-feature-promotion count these test?

Yep, the verify includes any tests that report into component readiness. So provided the job you triggered already reports into component readiness, this would count towards the verify

JoelSpeed · 2025-08-14T11:44:02Z

/test verify-feature-promotion

JoelSpeed · 2025-08-14T11:52:11Z

@QiWang19 You can see that the AWS result is now showing 22 runs which includes the 14 you triggered

QiWang19 · 2025-08-15T01:39:06Z

/test verify-feature-promotion

QiWang19 · 2025-08-15T04:52:39Z

regarding the result of /test verify-feature-promotion https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_api/2340/pull-ci-openshift-api-master-verify-feature-promotion/1956168752001191936

only passed 66%, need at least 95% for "SigstoreImageVerification" on {aws amd64 single }

I worked with MCO team help take a look at the aws single-node test failure, it is caused by flawed test logic (a false-positive in pool-completion checks), not the feature itself. PR openshift/origin#30115 proposed to fix the test's waiting logic. I think this is a test infrastructure problem, not a regression in the actual feature. GA isn’t blocked by this test bugs.

error: only 0 tests found, need at least 5 for "SigstoreImageVerification" on {metal amd64 ha ipv6}
error: only 0 tests found, need at least 5 for "SigstoreImageVerification" on {metal amd64 ha dual}

On metal CI only runs IPv4 since mirroring Sigstore attachments for IPv6 is unsupported by ci right now. QE has manually verified IPv6 disconnected environments

only has 5 runs, need at least 14 runs for "SigstoreImageVerification" on {metal amd64 ha ipv4}

will trigger more test runs on metal with IPv4. (https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_api/2340/pull-ci-openshift-api-master-verify-feature-promotion/1956354241832423424)

QiWang19 · 2025-08-15T13:56:09Z

/test verify-feature-promotion

QiWang19 · 2025-08-17T03:12:09Z

/test verify-feature-promotion

JoelSpeed · 2025-08-18T15:48:22Z

/test verify-feature-promotion

JoelSpeed · 2025-08-18T16:05:04Z

/lgtm
/override ci/prow/verify-feature-promotion

This feature does not work with our ipv6/dual stack based CI environements, so we are ignoring those columns

The only failing block on the grid otherwise is a single SNO test, which has been fixed in openshift/origin#30115 and since has passed 37 times in a row, we are confident that this would go green naturally but adding the LGTM now to give a bit more breathing space before the branch date

openshift-ci · 2025-08-18T16:06:52Z

@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-feature-promotion

In response to this:

/lgtm
/override ci/prow/verify-feature-promotion

This feature does not work with our ipv6/dual stack based CI environements, so we are ignoring those columns

The only failing block on the grid otherwise is a single SNO test, which has been fixed in openshift/origin#30115 and since has passed 37 times in a row, we are confident that this would go green naturally but adding the LGTM now to give a bit more breathing space before the branch date

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2025-08-18T16:06:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed, QiWang19

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2025-08-18T16:25:00Z

/retest-required

Remaining retests: 0 against base HEAD 88b2b21 and 2 for PR HEAD bc9a3d5 in total

openshift-ci · 2025-08-18T23:16:43Z

@QiWang19: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp	`bc9a3d5`	link	false	`/test e2e-gcp`
ci/prow/okd-scos-e2e-aws-ovn	`bc9a3d5`	link	false	`/test okd-scos-e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2025-08-18T23:38:59Z

/retest-required

Remaining retests: 0 against base HEAD 88b2b21 and 2 for PR HEAD bc9a3d5 in total

openshift-bot · 2025-08-19T04:06:21Z

[ART PR BUILD NOTIFIER]

Distgit: ose-cluster-config-api
This PR has been included in build ose-cluster-config-api-container-v4.20.0-202508190344.p0.g2d02a45.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 22, 2025

openshift-ci bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label May 22, 2025

QiWang19 changed the title ~~promote sigstoreverificatoin Default~~ Promote SigstoreVerificatoin to Default May 22, 2025

QiWang19 mentioned this pull request Jun 6, 2025

OCPNODE-3008: Add v1 type ClusterImagePolicy and ImagePolicy #2310

Merged

QiWang19 mentioned this pull request Jul 14, 2025

OCPNODE-3006:Add clusterimgepolicy/imagepolicy to payload #2384

Merged

QiWang19 changed the title ~~Promote SigstoreVerificatoin to Default~~ OCPNODE-3187: Promote SigstoreVerificatoin to Default Jul 30, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 30, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 30, 2025

QiWang19 force-pushed the default-v1alpha1-fg-sigstore branch from 8d721a1 to 227dcf7 Compare August 6, 2025 03:17

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 6, 2025

QiWang19 marked this pull request as ready for review August 6, 2025 03:18

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 6, 2025

openshift-ci bot requested review from JoelSpeed and everettraven August 6, 2025 03:19

promote sigstoreverificatoin Default

bc9a3d5

Signed-off-by: Qi Wang <[email protected]>

QiWang19 force-pushed the default-v1alpha1-fg-sigstore branch from 227dcf7 to bc9a3d5 Compare August 12, 2025 17:03

openshift-ci bot assigned JoelSpeed Aug 18, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 18, 2025

openshift-merge-bot bot merged commit 2d02a45 into openshift:master Aug 19, 2025
25 of 27 checks passed

JoelSpeed mentioned this pull request Sep 8, 2025

CORS-4096: Add DNS Record Type for IPv6 Domain mapping #2361

Open

OCPNODE-3187: Promote SigstoreVerificatoin to Default #2340

OCPNODE-3187: Promote SigstoreVerificatoin to Default #2340

Uh oh!

Conversation

QiWang19 commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

QiWang19 commented May 22, 2025

Uh oh!

QiWang19 commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

QiWang19 commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

QiWang19 commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

QiWang19 commented May 22, 2025

Uh oh!

QiWang19 commented May 27, 2025

Uh oh!

QiWang19 commented Jun 11, 2025

Uh oh!

QiWang19 commented Jun 13, 2025

Uh oh!

QiWang19 commented Jun 16, 2025

Uh oh!

QiWang19 commented Jul 2, 2025

Uh oh!

QiWang19 commented Jul 7, 2025

Uh oh!

QiWang19 commented Jul 16, 2025

Uh oh!

openshift-ci-robot commented Jul 30, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

QiWang19 commented Aug 7, 2025

Uh oh!

QiWang19 commented Aug 11, 2025

Uh oh!

JoelSpeed commented Aug 12, 2025

Uh oh!

QiWang19 commented Aug 12, 2025

Uh oh!

JoelSpeed commented Aug 13, 2025

Uh oh!

QiWang19 commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JoelSpeed commented Aug 14, 2025

Uh oh!

JoelSpeed commented Aug 14, 2025

Uh oh!

JoelSpeed commented Aug 14, 2025

Uh oh!

QiWang19 commented Aug 15, 2025

Uh oh!

QiWang19 commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

QiWang19 commented Aug 15, 2025

Uh oh!

QiWang19 commented Aug 17, 2025

Uh oh!

JoelSpeed commented Aug 18, 2025

Uh oh!

JoelSpeed commented Aug 18, 2025

Uh oh!

openshift-ci bot commented Aug 18, 2025

Uh oh!

openshift-ci bot commented Aug 18, 2025

Uh oh!

openshift-ci-robot commented Aug 18, 2025

openshift-ci-robot commented Jul 30, 2025 •

edited by openshift-ci bot

Loading

QiWang19 commented Aug 13, 2025 •

edited

Loading

QiWang19 commented Aug 15, 2025 •

edited

Loading

openshift-ci bot commented Aug 18, 2025 •

edited

Loading