Repository navigation
CNTRLPLANE-4795: Add etcd-density event-storm step #87729
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
openshift-merge-bot
merged 1 commit into
openshift:main
from
mehabhalodiya:etcd-density-event-storm
Oct 29, 2026
+187
−0
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
1 change: 1 addition & 0 deletions
1
ci-operator/step-registry/openshift-qe/etcd-density-event-storm/OWNERS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| ../OWNERS |
61 changes: 61 additions & 0 deletions
61
...y/openshift-qe/etcd-density-event-storm/openshift-qe-etcd-density-event-storm-commands.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| #!/bin/bash | ||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
| # Do not enable `set -x`: these scripts read and export Elasticsearch | ||
| # credentials (ES_USERNAME/ES_PASSWORD) and construct an authenticated | ||
| # ES_SERVER URL; tracing would leak them into the CI logs. | ||
| oc projects | ||
| oc version | ||
| pushd /tmp | ||
|
|
||
| ES_SECRETS_PATH=${ES_SECRETS_PATH:-/secret} | ||
| ES_HOST="search-ocp-qe-perf-scale-test-elk-hcm7wtsqpxy7xogbu72bor4uve.us-east-1.es.amazonaws.com" | ||
| ES_PASSWORD=$(cat "${ES_SECRETS_PATH}/password") | ||
| ES_USERNAME=$(cat "${ES_SECRETS_PATH}/username") | ||
| if [ -e "${ES_SECRETS_PATH}/host" ]; then | ||
| ES_HOST=$(cat "${ES_SECRETS_PATH}/host") | ||
| fi | ||
| UUID=$(uuidgen) | ||
|
|
||
| REPO_URL="https://github.com/cloud-bulldozer/e2e-benchmarking" | ||
| LATEST_TAG=$(git ls-remote --tags "${REPO_URL}.git" | awk -F'refs/tags/' '{print $2}' | grep -v '\^{}' | sort -V | tail -n1) | ||
| TAG_OPTION="--branch $(if [ "$E2E_VERSION" == "default" ]; then echo "$LATEST_TAG"; else echo "$E2E_VERSION"; fi)" | ||
| git clone $REPO_URL $TAG_OPTION --depth 1 | ||
| pushd e2e-benchmarking/workloads/kube-burner-ocp-wrapper | ||
|
|
||
| export WORKLOAD="etcd-density event-storm" | ||
| # Patch the indexing call in run.sh so the fingerprint records "event-storm" | ||
| sed -i '/index\.sh/s|WORKLOAD="$WORKLOAD"|WORKLOAD="event-storm"|' run.sh | ||
|
|
||
| # Variant-specific flags. --iterations sizes the victim workload, the event-* | ||
| # and storm-* flags size the background storm it has to survive. | ||
| EXTRA_FLAGS="--iterations=${EVENT_STORM_ITERATIONS} --pod-replicas=${EVENT_STORM_POD_REPLICAS}" | ||
| EXTRA_FLAGS+=" --event-iterations=${EVENT_ITERATIONS} --event-replicas=${EVENT_REPLICAS}" | ||
| EXTRA_FLAGS+=" --storm-workers=${STORM_WORKERS} --storm-delay=${STORM_DELAY}" | ||
| # Flags not handled by run.sh | ||
| EXTRA_FLAGS+=" --gc-metrics=${GC_METRICS} --profile-type=${PROFILE_TYPE}" | ||
| EXTRA_FLAGS+=" --metrics-profile=${METRICS_PROFILES}" | ||
| if [[ "${ENABLE_LOCAL_INDEX}" == "true" ]]; then | ||
| EXTRA_FLAGS+=" --local-indexing" | ||
| fi | ||
| if [[ -n "${USER_METADATA}" ]]; then | ||
| echo "${USER_METADATA}" > user-metadata.yaml | ||
| EXTRA_FLAGS+=" --user-metadata=user-metadata.yaml" | ||
| fi | ||
| EXTRA_FLAGS+=" ${KB_FLAGS}" | ||
|
|
||
| export ES_SERVER="https://$ES_USERNAME:$ES_PASSWORD@$ES_HOST" | ||
| export EXTRA_FLAGS UUID ADDITIONAL_PARAMS | ||
|
|
||
| set +o errexit | ||
| ./run.sh | ||
| RUN_EXIT_CODE=$? | ||
| set -o errexit | ||
|
|
||
| METRICS_FOLDER="collected-metrics-${UUID}" | ||
| if [[ -d ${METRICS_FOLDER} ]]; then | ||
| cp -r ${METRICS_FOLDER} "${ARTIFACT_DIR}/" | ||
| fi | ||
|
|
||
| exit ${RUN_EXIT_CODE} | ||
11 changes: 11 additions & 0 deletions
11
...shift-qe/etcd-density-event-storm/openshift-qe-etcd-density-event-storm-ref.metadata.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "path": "openshift-qe/etcd-density-event-storm/openshift-qe-etcd-density-event-storm-ref.yaml", | ||
| "owners": { | ||
| "approvers": [ | ||
| "perfscale-ocp-approvers" | ||
| ], | ||
| "reviewers": [ | ||
| "perfscale-ocp-reviewers" | ||
| ] | ||
| } | ||
| } |
114 changes: 114 additions & 0 deletions
114
...stry/openshift-qe/etcd-density-event-storm/openshift-qe-etcd-density-event-storm-ref.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| ref: | ||
| as: openshift-qe-etcd-density-event-storm | ||
| from_image: | ||
| namespace: ci | ||
| name: ocp-qe-perfscale-ci | ||
| tag: latest | ||
| cli: latest | ||
| env: | ||
| - name: E2E_VERSION | ||
| default: "default" | ||
| documentation: |- | ||
| Override the e2e version | ||
| - name: KUBE_BURNER_VERSION | ||
| default: "default" | ||
| documentation: |- | ||
| Override the kube burner version | ||
| - name: EVENT_STORM_ITERATIONS | ||
| default: "100" | ||
| documentation: |- | ||
| Victim workload iterations. The victim workload is what measures the | ||
| impact of the storm, so this sizes the measurement, not the storm. | ||
| Prefixed so it only applies to this step and does not collide with the | ||
| ITERATIONS consumed by other kube-burner workloads (e.g. crd-scale) that | ||
| may be co-scheduled in the same job. | ||
| - name: EVENT_STORM_POD_REPLICAS | ||
| default: "3" | ||
| documentation: |- | ||
| Pod replicas per victim deployment. Prefixed for the same reason as | ||
| EVENT_STORM_ITERATIONS. | ||
| - name: EVENT_ITERATIONS | ||
| default: "2000" | ||
| documentation: |- | ||
| Event creation iterations for the background storm. Total synthetic | ||
| events is roughly EVENT_ITERATIONS * EVENT_REPLICAS. | ||
| - name: EVENT_REPLICAS | ||
| default: "100" | ||
| documentation: |- | ||
| Event replicas per iteration. Each synthetic Event is about 1 KiB. | ||
| - name: STORM_WORKERS | ||
| default: "20" | ||
| documentation: |- | ||
| Parallel workers creating the storm, via kube-burner's background hook. | ||
| - name: STORM_DELAY | ||
| default: "15" | ||
| documentation: |- | ||
| Seconds to let the storm build pressure before the victim workload | ||
| starts, so the victim is created into an already flooded cluster rather | ||
| than racing the flood. | ||
| - name: KB_FLAGS | ||
| default: "" | ||
| documentation: |- | ||
| Additional flags for the kube-burner command. Reused across other kube-burner based workloads | ||
| - name: GC | ||
| default: "true" | ||
| documentation: |- | ||
| Default is true, which means clean up the pod/resource that kube-burner ocp created, you can set it to false to keep the resource | ||
| - name: GC_METRICS | ||
| default: "false" | ||
| documentation: |- | ||
| Default is false, which means skip collecting metrics, you can set it to true to collect metrics. | ||
| - name: PROFILE_TYPE | ||
| default: "regular" | ||
| documentation: |- | ||
| Metrics profile type: regular, reporting, or both | ||
| - name: METRICS_PROFILES | ||
| default: "metrics.yml,etcd-density-metrics.yml" | ||
| documentation: |- | ||
| Comma separated list of metrics profiles to use | ||
| - name: ENABLE_LOCAL_INDEX | ||
| default: "false" | ||
| documentation: |- | ||
| Trigger to enable local indexing | ||
| - name: ES_SECRETS_PATH | ||
| default: "" | ||
| documentation: |- | ||
| Override elasticsearch secrets path. | ||
| - name: USER_METADATA | ||
| default: "" | ||
| documentation: |- | ||
| Arbitrary metadata provided to the kube-burner workload in YAML format | ||
| - name: ADDITIONAL_PARAMS | ||
| default: '{}' | ||
| documentation: |- | ||
| JSON value to upload additonal metadata to the fingerprint | ||
| commands: openshift-qe-etcd-density-event-storm-commands.sh | ||
| timeout: 13h | ||
| credentials: | ||
| - collection: ocp-perfscale-cpt | ||
| group: ocp-qe-perfscale-es-creds | ||
| mount_path: /secret | ||
| - collection: stackrox-perfscale-elasticsearch | ||
| group: credentials | ||
| mount_path: /secret_stackrox | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| memory: 100Mi | ||
| documentation: >- | ||
| This step runs the etcd-density event-storm workload to stress etcd with a | ||
| sustained flood of synthetic Event objects. | ||
|
|
||
|
|
||
| A background job creates the storm while a concurrent victim workload runs | ||
| against the same cluster, so what is measured is the impact of the flood on | ||
| ordinary cluster operations rather than the flood itself. This is the | ||
| create-heavy counterpart to crashloop-flood, which drives the same pressure | ||
| through the PATCH path instead. | ||
|
|
||
|
|
||
| Defaults are kube-burner-ocp's own. The OpenShift Performance and Scale | ||
| team characterised standard against sharded etcd with | ||
| EVENT_STORM_ITERATIONS=900 and EVENT_STORM_POD_REPLICAS=2, giving 200K | ||
| synthetic events against a victim workload of 900 iterations, on a 24 | ||
| worker cluster. |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔎 Supported by static analysis
Script executed:
Repository: openshift/release
Length of output: 5135
Keep Elasticsearch credentials out of wrapper traces on HCP runs.
The step passes a credential-bearing
ES_SERVERURL to the upstream wrapper. On the HCP path, the wrapper enables shell tracing and then runscurlwith that URL. The trace prints the expanded URL, so the Elasticsearch username and password appear in CI logs. Disabling tracing in this script does not prevent this. The child process enables tracing on its own.The leak requires both
MC_KUBECONFIGandES_SERVERto be set. This step setsES_SERVERwhen the credentials are present. Do not run this step for HCP until the wrapper stops tracing around the credential-bearing request. Track the fix in the upstreamkube-burner-ocp-wrapper, or confirm that the pinned version does not trace this request.I checked the default tag,
v2.10.5. It has the same behavior. Other tags, selected throughE2E_VERSION, were not checked.