From c814e59458fe1af905c11f2624aa6bab2964ad37 Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Thu, 8 Oct 2026 11:19:33 -0400 Subject: [PATCH 1/7] ci: add e2e-v2-aws-kms-reencryption job for etcd key rotation tests Wires CI for the etcd data re-encryption e2e tests added in openshift/hypershift#9227 (CNTRLPLANE-4377). Changes: - New `e2e-v2-aws-kms-reencryption` presubmit (optional, rehearsable) that creates a single KMS-encrypted hosted cluster and runs only the `etcd-encryption-reencryption` label-filtered tests. - `hypershift-aws-create-guests-ref.yaml`: add `HYPERSHIFT_ETCD_KMS_KEY_ALIAS` env var so callers can pass an alias without hardcoding an ARN. - `hypershift-aws-create-guests-commands.sh`: forward the alias as `HYPERSHIFT_ETCD_KMS_KEY_ARN` before invoking create-guests; the AWS KMS SDK accepts both full ARNs and alias identifiers. - `hypershift-aws-run-e2e-v2-chain.yaml`: declare `E2E_AWS_KMS_KEY_ARN_ALTERNATE` so the alternate key flows to the test binary for the rotation tests. The primary key (`alias/hypershift-ci`) already exists in the CI AWS account and is used by the v1 e2e suite. The alternate key (`alias/hypershift-ci-alternate`) must be created in the same account with the kms-provider IAM role added as a key user on its key policy. Signed-off-by: Jie Zhao Co-Authored-By: Claude Sonnet 4.6 --- .../hypershift/openshift-hypershift-main.yaml | 20 ++++ .../openshift-hypershift-main-presubmits.yaml | 107 ++++++++++++++++++ .../hypershift-aws-create-guests-commands.sh | 8 ++ .../hypershift-aws-create-guests-ref.yaml | 3 + .../hypershift-aws-run-e2e-v2-chain.yaml | 3 + 5 files changed, 141 insertions(+) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index a8a6d58e165b..62f1adc3f729 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -287,6 +287,26 @@ tests: NODEPOOL_N1_VERSION: "5.0" TECH_PREVIEW_NO_UPGRADE: "true" workflow: hypershift-aws-e2e-v2 +- always_run: false + as: e2e-v2-aws-kms-reencryption + capabilities: + - arm64 + optional: true + steps: + cluster_profile: hypershift-aws + env: + HYPERSHIFT_ETCD_KMS_KEY_ALIAS: alias/hypershift-ci + E2E_AWS_KMS_KEY_ARN_ALTERNATE: alias/hypershift-ci-alternate + TECH_PREVIEW_NO_UPGRADE: "true" + TEST_PLAN: | + name: aws-kms-reencryption + platform: aws + testMatrix: + parallel: + - name: kms-reencryption + variant: kms-reencryption + labelFilter: etcd-encryption-reencryption + workflow: hypershift-aws-e2e-v2 - always_run: false as: e2e-v2-aws-techpreview-osimagestream capabilities: diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index 862c5d45d80b..b29072d303d4 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -4075,6 +4075,113 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-aws-backuprestore,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/e2e-v2-aws-kms-reencryption + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + capability/arm64: arm64 + ci-operator.openshift.io/cloud: hypershift-aws + ci-operator.openshift.io/cloud-cluster-profile: hypershift-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-main-e2e-v2-aws-kms-reencryption + optional: true + rerun_command: /test e2e-v2-aws-kms-reencryption + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-aws-kms-reencryption + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-aws-kms-reencryption,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-commands.sh b/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-commands.sh index 52ecf9d24c17..d837287a5332 100644 --- a/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-commands.sh +++ b/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-commands.sh @@ -31,4 +31,12 @@ if [[ -n "${HYPERSHIFT_STORAGE_KMS_KEY_ALIAS:-}" ]]; then fi fi +# Etcd KMS encryption: forward the key alias as HYPERSHIFT_ETCD_KMS_KEY_ARN so +# that the kms-reencryption ClusterSpec variant can pass it as --kms-key-arn. +# The AWS KMS SDK accepts both full ARNs and alias identifiers (alias/). +if [[ -n "${HYPERSHIFT_ETCD_KMS_KEY_ALIAS:-}" ]]; then + echo "Forwarding HYPERSHIFT_ETCD_KMS_KEY_ALIAS=${HYPERSHIFT_ETCD_KMS_KEY_ALIAS} as HYPERSHIFT_ETCD_KMS_KEY_ARN" + export HYPERSHIFT_ETCD_KMS_KEY_ARN="${HYPERSHIFT_ETCD_KMS_KEY_ALIAS}" +fi + /hypershift/bin/create-guests diff --git a/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-ref.yaml b/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-ref.yaml index 931a6e56f203..f3b763a4b2ff 100644 --- a/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-ref.yaml +++ b/ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-ref.yaml @@ -39,6 +39,9 @@ ref: - name: HYPERSHIFT_STORAGE_KMS_KEY_ALIAS default: "" documentation: "AWS KMS key alias (e.g. alias/hypershift-ci) used to encrypt the default StorageClass volumes on the public cluster. When set and supported by the hypershift binary, the alias is resolved to an ARN and passed as --initial-storage-volumes-kms-key at cluster creation. Leave empty to skip." + - name: HYPERSHIFT_ETCD_KMS_KEY_ALIAS + default: "" + documentation: "AWS KMS key alias or identifier (e.g. alias/hypershift-ci) used for etcd data-at-rest encryption. When set, it is forwarded as HYPERSHIFT_ETCD_KMS_KEY_ARN so that the kms-reencryption ClusterSpec variant can pass it as --kms-key-arn at cluster creation. Leave empty to skip etcd KMS encryption." from: hypershift-tests grace_period: 5m0s resources: diff --git a/ci-operator/step-registry/hypershift/aws/run-e2e-v2/hypershift-aws-run-e2e-v2-chain.yaml b/ci-operator/step-registry/hypershift/aws/run-e2e-v2/hypershift-aws-run-e2e-v2-chain.yaml index fb5f9b57520c..24e576e6d05d 100644 --- a/ci-operator/step-registry/hypershift/aws/run-e2e-v2/hypershift-aws-run-e2e-v2-chain.yaml +++ b/ci-operator/step-registry/hypershift/aws/run-e2e-v2/hypershift-aws-run-e2e-v2-chain.yaml @@ -7,6 +7,9 @@ chain: - name: HYPERSHIFT_PLATFORM default: "" documentation: "The cloud platform for the clusters (e.g. aws). Set in the workflow env block." + - name: E2E_AWS_KMS_KEY_ARN_ALTERNATE + default: "" + documentation: "Alternate AWS KMS key alias or ARN for etcd key-rotation re-encryption tests (AWSKMSKeyRotationTest, AzureKMSConsecutiveKeyRotationTest). Must be a different key than the one used at cluster creation. Leave empty to skip AWS KMS re-encryption tests." commands: |- set -xuo pipefail export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig" From a869a30db50bf689f35c95bf523981a05861412f Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Tue, 13 Oct 2026 17:13:17 -0400 Subject: [PATCH 2/7] ci: add e2e-v2-aws-aescbc-reencryption presubmit for etcd AESCBC key rotation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds an optional presubmit that creates a standard public AWS hosted cluster (which uses AESCBC encryption by default) and runs the etcd-encryption-reencryption label-filtered v2 tests. No new env vars or KMS infrastructure needed — the test generates its own key material at runtime. Co-Authored-By: Claude Sonnet 4.6 --- .../hypershift/openshift-hypershift-main.yaml | 17 +++ .../openshift-hypershift-main-presubmits.yaml | 107 ++++++++++++++++++ 2 files changed, 124 insertions(+) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index 62f1adc3f729..6b45ade99996 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -307,6 +307,23 @@ tests: variant: kms-reencryption labelFilter: etcd-encryption-reencryption workflow: hypershift-aws-e2e-v2 +- always_run: false + as: e2e-v2-aws-aescbc-reencryption + capabilities: + - arm64 + optional: true + steps: + cluster_profile: hypershift-aws + env: + TEST_PLAN: | + name: aws-aescbc-reencryption + platform: aws + testMatrix: + parallel: + - name: public + variant: public + labelFilter: etcd-encryption-reencryption + workflow: hypershift-aws-e2e-v2 - always_run: false as: e2e-v2-aws-techpreview-osimagestream capabilities: diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index b29072d303d4..879292e83216 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -3968,6 +3968,113 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-aws,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/e2e-v2-aws-aescbc-reencryption + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + capability/arm64: arm64 + ci-operator.openshift.io/cloud: hypershift-aws + ci-operator.openshift.io/cloud-cluster-profile: hypershift-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-main-e2e-v2-aws-aescbc-reencryption + optional: true + rerun_command: /test e2e-v2-aws-aescbc-reencryption + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-aws-aescbc-reencryption + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-aws-aescbc-reencryption,?($|\s.*) - agent: kubernetes always_run: false branches: From a4efe36b3650d72f7492cac39cde3f4c87fd290e Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Tue, 13 Oct 2026 17:47:46 -0400 Subject: [PATCH 3/7] ci: add e2e-v2-azure-self-managed-kms-reencryption presubmit for etcd Azure KMS key rotation Wires up CI for AzureKMSKeyRotationTest and AzureKMSConsecutiveKeyRotationTest from the etcd-encryption-reencryption v2 test suite against the self-managed Azure public cluster variant (which already uses --encryption-key-id). Changes: - Add hypershift-write-test-plan to the self-managed Azure workflow pre steps so TEST_PLAN flows to both create-guests and run-tests - Add TEST_PLAN support to create-selfmanaged-guests-commands.sh - Declare E2E_AZURE_KMS_KEY_VERSION_ALTERNATE and TEST_PLAN env vars in the run-e2e-v2-selfmanaged chain and read test-plan.yaml in commands - Add optional presubmit e2e-v2-azure-self-managed-kms-reencryption Co-Authored-By: Claude Sonnet 4.6 --- .../hypershift/openshift-hypershift-main.yaml | 19 ++++ .../openshift-hypershift-main-presubmits.yaml | 107 ++++++++++++++++++ ...zure-create-selfmanaged-guests-commands.sh | 4 + ...ft-azure-e2e-v2-self-managed-workflow.yaml | 1 + ...ft-azure-run-e2e-v2-selfmanaged-chain.yaml | 6 + 5 files changed, 137 insertions(+) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index 6b45ade99996..e4040a23eedb 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -402,6 +402,25 @@ tests: HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "5.0" workflow: hypershift-azure-e2e-v2-self-managed +- always_run: false + as: e2e-v2-azure-self-managed-kms-reencryption + capabilities: + - arm64 + optional: true + steps: + cluster_profile: hypershift-azure + env: + HYPERSHIFT_AZURE_LOCATION: centralus + E2E_AZURE_KMS_KEY_VERSION_ALTERNATE: "" + TEST_PLAN: | + name: azure-kms-reencryption + platform: azure + testMatrix: + parallel: + - name: public + variant: public + labelFilter: etcd-encryption-reencryption + workflow: hypershift-azure-e2e-v2-self-managed - always_run: false as: e2e-aws-minimal capabilities: diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index 879292e83216..c5224e49b532 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -4504,6 +4504,113 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/e2e-v2-azure-self-managed-kms-reencryption + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.control-plane + - Dockerfile.e2e + labels: + capability/arm64: arm64 + ci-operator.openshift.io/cloud: hypershift-azure + ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-hypershift-main-e2e-v2-azure-self-managed-kms-reencryption + optional: true + rerun_command: /test e2e-v2-azure-self-managed-kms-reencryption + spec: + containers: + - args: + - --enable-secrets-store-csi-driver=true + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --gsm-config=/etc/gsm-config/gsm-config.yaml + - --gsm-credentials-file=/etc/gsm-credentials/key.json + - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-v2-azure-self-managed-kms-reencryption + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /etc/gsm-config + name: gsm-config + readOnly: true + - mountPath: /etc/gsm-credentials + name: gsm-sa-key + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - configMap: + name: gsm-config + name: gsm-config + - csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: ci-operator-sa-key-spc + name: gsm-sa-key + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-kms-reencryption,?($|\s.*) - agent: kubernetes always_run: false annotations: diff --git a/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh b/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh index 0341fb58a9d5..732a916bb1cc 100644 --- a/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh +++ b/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh @@ -10,4 +10,8 @@ if [[ -f "${SHARED_DIR}/nodepool_release_images" ]]; then source "${SHARED_DIR}/nodepool_release_images" fi +if [[ -f "${SHARED_DIR}/test-plan.yaml" ]]; then + export TEST_PLAN="${SHARED_DIR}/test-plan.yaml" +fi + /hypershift/bin/create-guests diff --git a/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml b/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml index bad47d829cea..64f7e08c167e 100644 --- a/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml +++ b/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml @@ -25,6 +25,7 @@ workflow: - ref: hypershift-azure-setup-private-link - ref: hypershift-install - ref: hypershift-resolve-nodepool-releases + - ref: hypershift-write-test-plan - chain: hypershift-azure-create-selfmanaged-guests test: - chain: hypershift-azure-run-e2e-v2-selfmanaged diff --git a/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml b/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml index c10066ef0dc3..79509cbb7a97 100644 --- a/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml +++ b/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml @@ -14,9 +14,15 @@ chain: - name: HYPERSHIFT_PLATFORM default: "" documentation: "The cloud platform for the self-managed clusters (e.g. azure). Set in the workflow env block." + - name: E2E_AZURE_KMS_KEY_VERSION_ALTERNATE + default: "" + documentation: "Alternate Azure Key Vault key version for etcd KMS key-rotation re-encryption tests (AzureKMSKeyRotationTest, AzureKMSConsecutiveKeyRotationTest). Must be a different version than the one used at cluster creation. Leave empty to skip Azure KMS re-encryption tests." commands: |- set -xuo pipefail export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig" + if [[ -f "${SHARED_DIR}/test-plan.yaml" ]]; then + export TEST_PLAN="${SHARED_DIR}/test-plan.yaml" + fi /hypershift/bin/run-tests timeout: 150m grace_period: 5m From 0881f65f2d0508dd020bb7834428aeff56992eac Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Wed, 14 Oct 2026 10:36:17 -0400 Subject: [PATCH 4/7] ci: fold AESCBC and Azure KMS re-encryption tests into existing jobs (CNTRLPLANE-4377) AESCBC and Azure KMS rotation tests run against the same public cluster that existing jobs already provision. Drop the dedicated optional jobs for each and instead let the tests run via the etcd-encryption-reencryption label added to the public cluster's TestMatrix in hypershift#9227. Add E2E_AZURE_KMS_KEY_VERSION_ALTERNATE to the existing e2e-v2-azure-self-managed job so the alternate key version flows through to the test binary via the run chain's env declaration. Co-Authored-By: Claude Sonnet 4.6 --- .../hypershift/openshift-hypershift-main.yaml | 35 --- .../openshift-hypershift-main-presubmits.yaml | 214 ------------------ 2 files changed, 249 deletions(-) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index e4040a23eedb..e080a0df972c 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -307,23 +307,6 @@ tests: variant: kms-reencryption labelFilter: etcd-encryption-reencryption workflow: hypershift-aws-e2e-v2 -- always_run: false - as: e2e-v2-aws-aescbc-reencryption - capabilities: - - arm64 - optional: true - steps: - cluster_profile: hypershift-aws - env: - TEST_PLAN: | - name: aws-aescbc-reencryption - platform: aws - testMatrix: - parallel: - - name: public - variant: public - labelFilter: etcd-encryption-reencryption - workflow: hypershift-aws-e2e-v2 - always_run: false as: e2e-v2-aws-techpreview-osimagestream capabilities: @@ -401,25 +384,7 @@ tests: ENABLE_HYPERSHIFT_CERT_ROTATION_SCALE: "true" HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "5.0" - workflow: hypershift-azure-e2e-v2-self-managed -- always_run: false - as: e2e-v2-azure-self-managed-kms-reencryption - capabilities: - - arm64 - optional: true - steps: - cluster_profile: hypershift-azure - env: - HYPERSHIFT_AZURE_LOCATION: centralus E2E_AZURE_KMS_KEY_VERSION_ALTERNATE: "" - TEST_PLAN: | - name: azure-kms-reencryption - platform: azure - testMatrix: - parallel: - - name: public - variant: public - labelFilter: etcd-encryption-reencryption workflow: hypershift-azure-e2e-v2-self-managed - always_run: false as: e2e-aws-minimal diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index c5224e49b532..b29072d303d4 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -3968,113 +3968,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-aws,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^main$ - - ^main- - cluster: build09 - context: ci/prow/e2e-v2-aws-aescbc-reencryption - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - - Dockerfile.control-plane - - Dockerfile.e2e - labels: - capability/arm64: arm64 - ci-operator.openshift.io/cloud: hypershift-aws - ci-operator.openshift.io/cloud-cluster-profile: hypershift-aws - ci.openshift.io/generator: prowgen - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-hypershift-main-e2e-v2-aws-aescbc-reencryption - optional: true - rerun_command: /test e2e-v2-aws-aescbc-reencryption - spec: - containers: - - args: - - --enable-secrets-store-csi-driver=true - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --gsm-config=/etc/gsm-config/gsm-config.yaml - - --gsm-credentials-file=/etc/gsm-credentials/key.json - - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=e2e-v2-aws-aescbc-reencryption - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /etc/gsm-config - name: gsm-config - readOnly: true - - mountPath: /etc/gsm-credentials - name: gsm-sa-key - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - configMap: - name: gsm-config - name: gsm-config - - csi: - driver: secrets-store.csi.k8s.io - readOnly: true - volumeAttributes: - secretProviderClass: ci-operator-sa-key-spc - name: gsm-sa-key - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )e2e-v2-aws-aescbc-reencryption,?($|\s.*) - agent: kubernetes always_run: false branches: @@ -4504,113 +4397,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^main$ - - ^main- - cluster: build09 - context: ci/prow/e2e-v2-azure-self-managed-kms-reencryption - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - - Dockerfile.control-plane - - Dockerfile.e2e - labels: - capability/arm64: arm64 - ci-operator.openshift.io/cloud: hypershift-azure - ci-operator.openshift.io/cloud-cluster-profile: hypershift-azure - ci.openshift.io/generator: prowgen - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-hypershift-main-e2e-v2-azure-self-managed-kms-reencryption - optional: true - rerun_command: /test e2e-v2-azure-self-managed-kms-reencryption - spec: - containers: - - args: - - --enable-secrets-store-csi-driver=true - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --gsm-config=/etc/gsm-config/gsm-config.yaml - - --gsm-credentials-file=/etc/gsm-credentials/key.json - - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=e2e-v2-azure-self-managed-kms-reencryption - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /etc/gsm-config - name: gsm-config - readOnly: true - - mountPath: /etc/gsm-credentials - name: gsm-sa-key - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - configMap: - name: gsm-config - name: gsm-config - - csi: - driver: secrets-store.csi.k8s.io - readOnly: true - volumeAttributes: - secretProviderClass: ci-operator-sa-key-spc - name: gsm-sa-key - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )e2e-v2-azure-self-managed-kms-reencryption,?($|\s.*) - agent: kubernetes always_run: false annotations: From 0abcb91f52fb6937e8ee2532da33b67c485209a3 Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Wed, 14 Oct 2026 10:44:50 -0400 Subject: [PATCH 5/7] ci: revert unused TEST_PLAN plumbing from Azure self-managed steps Azure KMS rotation tests now run via the existing e2e-v2-azure-self-managed job's default test matrix (etcd-encryption-reencryption label added to the public cluster in hypershift#9227). No custom TEST_PLAN override is needed, so remove the hypershift-write-test-plan step from the workflow and the test-plan.yaml reading from create-guests and run-tests commands. Keep E2E_AZURE_KMS_KEY_VERSION_ALTERNATE declared in the run chain so the alternate key version flows from the job env to the test binary. Co-Authored-By: Claude Sonnet 4.6 --- .../hypershift-azure-create-selfmanaged-guests-commands.sh | 4 ---- .../hypershift-azure-e2e-v2-self-managed-workflow.yaml | 1 - .../hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml | 3 --- 3 files changed, 8 deletions(-) diff --git a/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh b/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh index 732a916bb1cc..0341fb58a9d5 100644 --- a/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh +++ b/ci-operator/step-registry/hypershift/azure/create-selfmanaged-guests/hypershift-azure-create-selfmanaged-guests-commands.sh @@ -10,8 +10,4 @@ if [[ -f "${SHARED_DIR}/nodepool_release_images" ]]; then source "${SHARED_DIR}/nodepool_release_images" fi -if [[ -f "${SHARED_DIR}/test-plan.yaml" ]]; then - export TEST_PLAN="${SHARED_DIR}/test-plan.yaml" -fi - /hypershift/bin/create-guests diff --git a/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml b/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml index 64f7e08c167e..bad47d829cea 100644 --- a/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml +++ b/ci-operator/step-registry/hypershift/azure/e2e/v2-self-managed/hypershift-azure-e2e-v2-self-managed-workflow.yaml @@ -25,7 +25,6 @@ workflow: - ref: hypershift-azure-setup-private-link - ref: hypershift-install - ref: hypershift-resolve-nodepool-releases - - ref: hypershift-write-test-plan - chain: hypershift-azure-create-selfmanaged-guests test: - chain: hypershift-azure-run-e2e-v2-selfmanaged diff --git a/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml b/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml index 79509cbb7a97..44409a49dc97 100644 --- a/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml +++ b/ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml @@ -20,9 +20,6 @@ chain: commands: |- set -xuo pipefail export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig" - if [[ -f "${SHARED_DIR}/test-plan.yaml" ]]; then - export TEST_PLAN="${SHARED_DIR}/test-plan.yaml" - fi /hypershift/bin/run-tests timeout: 150m grace_period: 5m From 41aaad0b42e4ad259dfebd83389a3e0ba98f371b Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Mon, 19 Oct 2026 15:50:58 -0400 Subject: [PATCH 6/7] ci: move kms-reencryption into existing e2e-v2-aws job (CNTRLPLANE-4377) Drop the dedicated e2e-v2-aws-kms-reencryption optional job and instead add HYPERSHIFT_ETCD_KMS_KEY_ALIAS and E2E_AWS_KMS_KEY_ARN_ALTERNATE to the existing e2e-v2-aws job. The kms-reencryption cluster variant is now part of the regular AWS TestMatrix in hypershift#9227, following the same pattern as TestCreateCustomCluster in v1 e2e. Co-Authored-By: Claude Sonnet 4.6 --- .../hypershift/openshift-hypershift-main.yaml | 18 --- .../openshift-hypershift-main-presubmits.yaml | 107 ------------------ 2 files changed, 125 deletions(-) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index e080a0df972c..d6a9e6bcd93b 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -286,26 +286,8 @@ tests: env: NODEPOOL_N1_VERSION: "5.0" TECH_PREVIEW_NO_UPGRADE: "true" - workflow: hypershift-aws-e2e-v2 -- always_run: false - as: e2e-v2-aws-kms-reencryption - capabilities: - - arm64 - optional: true - steps: - cluster_profile: hypershift-aws - env: HYPERSHIFT_ETCD_KMS_KEY_ALIAS: alias/hypershift-ci E2E_AWS_KMS_KEY_ARN_ALTERNATE: alias/hypershift-ci-alternate - TECH_PREVIEW_NO_UPGRADE: "true" - TEST_PLAN: | - name: aws-kms-reencryption - platform: aws - testMatrix: - parallel: - - name: kms-reencryption - variant: kms-reencryption - labelFilter: etcd-encryption-reencryption workflow: hypershift-aws-e2e-v2 - always_run: false as: e2e-v2-aws-techpreview-osimagestream diff --git a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml index b29072d303d4..862c5d45d80b 100644 --- a/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/hypershift/openshift-hypershift-main-presubmits.yaml @@ -4075,113 +4075,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-v2-aws-backuprestore,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^main$ - - ^main- - cluster: build09 - context: ci/prow/e2e-v2-aws-kms-reencryption - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - - Dockerfile.control-plane - - Dockerfile.e2e - labels: - capability/arm64: arm64 - ci-operator.openshift.io/cloud: hypershift-aws - ci-operator.openshift.io/cloud-cluster-profile: hypershift-aws - ci.openshift.io/generator: prowgen - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-hypershift-main-e2e-v2-aws-kms-reencryption - optional: true - rerun_command: /test e2e-v2-aws-kms-reencryption - spec: - containers: - - args: - - --enable-secrets-store-csi-driver=true - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --gsm-config=/etc/gsm-config/gsm-config.yaml - - --gsm-credentials-file=/etc/gsm-credentials/key.json - - --gsm-project-config=/etc/gsm-config/gsm-project-config.yaml - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=e2e-v2-aws-kms-reencryption - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /etc/gsm-config - name: gsm-config - readOnly: true - - mountPath: /etc/gsm-credentials - name: gsm-sa-key - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - configMap: - name: gsm-config - name: gsm-config - - csi: - driver: secrets-store.csi.k8s.io - readOnly: true - volumeAttributes: - secretProviderClass: ci-operator-sa-key-spc - name: gsm-sa-key - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )e2e-v2-aws-kms-reencryption,?($|\s.*) - agent: kubernetes always_run: false branches: From 19ab48521057dbbe8e1e8df5f2892c47329016b6 Mon Sep 17 00:00:00 2001 From: jiezhao16 Date: Mon, 19 Oct 2026 16:32:12 -0400 Subject: [PATCH 7/7] ci: set E2E_AZURE_KMS_KEY_VERSION_ALTERNATE for Azure KMS rotation tests (CNTRLPLANE-4377) Co-Authored-By: Claude Sonnet 4.6 --- .../config/openshift/hypershift/openshift-hypershift-main.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml index d6a9e6bcd93b..878f623722a3 100644 --- a/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml +++ b/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml @@ -366,7 +366,7 @@ tests: ENABLE_HYPERSHIFT_CERT_ROTATION_SCALE: "true" HYPERSHIFT_AZURE_LOCATION: centralus NODEPOOL_N1_VERSION: "5.0" - E2E_AZURE_KMS_KEY_VERSION_ALTERNATE: "" + E2E_AZURE_KMS_KEY_VERSION_ALTERNATE: "6079dbc6ff6549328bc90e85e06bfe05" workflow: hypershift-azure-e2e-v2-self-managed - always_run: false as: e2e-aws-minimal