aws only public subnets coverage

Author: jianlinliu

ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly-4.18-upgrade-from-stable-4.18.yaml

@@ -294,16 +294,17 @@ tests:
     test:
     - chain: openshift-upgrade-qe-test
     workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-cco-manual-security-token-service
-- as: aws-ipi-workers-marketplace-mini-perm-f60
+- as: aws-ipi-workers-marketplace-public-subnets-mini-perm-f60
   cron: 11 5 11 2,4,6,8,10,12 *
   steps:
     cluster_profile: aws-qe
     env:
       AWS_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
       BASE_DOMAIN: qe.devcluster.openshift.com
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
     test:
     - chain: openshift-upgrade-qe-test
-    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace
+    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace-byo-subnets
 - as: aws-sc2s-ipi-disc-priv-fips-f60
   cron: 55 15 13 2,4,6,8,10,12 *
   steps:

ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18__amd64-nightly.yaml

@@ -1033,16 +1033,17 @@ tests:
     test:
     - chain: openshift-e2e-test-qe-destructive
     workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-cco-manual-security-token-service
-- as: aws-ipi-workers-marketplace-mini-perm-f7
+- as: aws-ipi-workers-marketplace-public-subnets-mini-perm-f7
   cron: 1 19 5,12,19,28 * *
   steps:
     cluster_profile: aws-qe
     env:
       AWS_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
       BASE_DOMAIN: qe.devcluster.openshift.com
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
     test:
     - chain: openshift-e2e-test-qe
-    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace
+    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace-byo-subnets
 - as: aws-ipi-workers-marketplace-mini-perm-f28-destructive
   cron: 59 15 16 * *
   steps:

ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly-4.19-upgrade-from-stable-4.18.yaml

@@ -295,15 +295,17 @@ tests:
     test:
     - chain: openshift-upgrade-qe-test
     workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-cco-manual-security-token-service
-- as: aws-ipi-workers-marketplace-f28
+- as: aws-ipi-workers-marketplace-public-subnets-mini-perm-f28
   cron: 12 6 26 * *
   steps:
     cluster_profile: aws-qe
     env:
+      AWS_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
       BASE_DOMAIN: qe.devcluster.openshift.com
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
     test:
     - chain: openshift-upgrade-qe-test
-    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace
+    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace-byo-subnets
 - as: aws-sc2s-ipi-disc-priv-fips-f28
   cron: 51 1 14 * *
   steps:

ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly-4.19-upgrade-from-stable-4.19.yaml

@@ -310,16 +310,17 @@ tests:
     test:
     - chain: openshift-upgrade-qe-test
     workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-cco-manual-security-token-service
-- as: aws-ipi-workers-marketplace-mini-perm-f60
+- as: aws-ipi-workers-marketplace-public-subnets-mini-perm-f60
   cron: 53 18 15 2,4,6,8,10,12 *
   steps:
     cluster_profile: aws-qe
     env:
       AWS_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
       BASE_DOMAIN: qe.devcluster.openshift.com
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
     test:
     - chain: openshift-upgrade-qe-test
-    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace
+    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace-byo-subnets
 - as: aws-sc2s-ipi-disc-priv-fips-f60
   cron: 52 7 15 1,3,5,7,9,11 *
   steps:

ci-operator/config/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19__amd64-nightly.yaml

@@ -1068,16 +1068,17 @@ tests:
     test:
     - chain: openshift-e2e-test-qe-destructive
     workflow: cucushift-installer-rehearse-aws-ipi-edge-zone-cco-manual-security-token-service
-- as: aws-ipi-workers-marketplace-mini-perm-f7
+- as: aws-ipi-workers-marketplace-public-subnets-mini-perm-f7
   cron: 30 5 6,13,20,29 * *
   steps:
     cluster_profile: aws-qe
     env:
       AWS_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
       BASE_DOMAIN: qe.devcluster.openshift.com
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
     test:
     - chain: openshift-e2e-test-qe
-    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace
+    workflow: cucushift-installer-rehearse-aws-ipi-workers-marketplace-byo-subnets
 - as: aws-ipi-workers-marketplace-mini-perm-f28-destructive
   cron: 35 2 14 * *
   steps:

ci-operator/config/openshift/verification-tests/openshift-verification-tests-master__installation-nightly-4.18.yaml

@@ -121,6 +121,19 @@ tests:
       ENABLE_BYO_IAM_ROLE_DEFAULT_MACHINE: "false"
       OCP_ARCH: arm64
     workflow: cucushift-installer-rehearse-aws-ipi-byo-iam-role
+- as: aws-ipi-byo-subnets-only-public-arm-f14
+  cron: 34 18 1,17 * *
+  steps:
+    cluster_profile: aws-qe
+    dependencies:
+      OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest
+    env:
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      COMPUTE_NODE_TYPE: m6g.xlarge
+      CONTROL_PLANE_INSTANCE_TYPE: m6g.xlarge
+      OCP_ARCH: arm64
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
+    workflow: cucushift-installer-rehearse-aws-ipi-byo-subnets
 - as: aws-ipi-default-mini-perm-arm-f7
   cron: 56 23 6,15,22,29 * *
   steps:

ci-operator/config/openshift/verification-tests/openshift-verification-tests-master__installation-nightly-4.19.yaml

@@ -121,6 +121,19 @@ tests:
       ENABLE_BYO_IAM_ROLE_DEFAULT_MACHINE: "false"
       OCP_ARCH: arm64
     workflow: cucushift-installer-rehearse-aws-ipi-byo-iam-role
+- as: aws-ipi-byo-subnets-only-public-arm-f14
+  cron: 32 8 8,24 * *
+  steps:
+    cluster_profile: aws-qe
+    dependencies:
+      OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE: release:arm64-latest
+    env:
+      BASE_DOMAIN: qe.devcluster.openshift.com
+      COMPUTE_NODE_TYPE: m6g.xlarge
+      CONTROL_PLANE_INSTANCE_TYPE: m6g.xlarge
+      OCP_ARCH: arm64
+      OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY: "true"
+    workflow: cucushift-installer-rehearse-aws-ipi-byo-subnets
 - as: aws-ipi-default-mini-perm-arm-f7
   cron: 7 21 4,11,20,27 * *
   steps:

ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.18-periodics.yaml

@@ -11623,7 +11623,7 @@ periodics:
     ci-operator.openshift.io/variant: amd64-nightly-4.18-upgrade-from-stable-4.18
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-openshift-tests-private-release-4.18-amd64-nightly-4.18-upgrade-from-stable-4.18-aws-ipi-workers-marketplace-mini-perm-f60
+  name: periodic-ci-openshift-openshift-tests-private-release-4.18-amd64-nightly-4.18-upgrade-from-stable-4.18-aws-ipi-workers-marketplace-public-subnets-mini-perm-f60
   spec:
     containers:
     - args:
@@ -11633,7 +11633,7 @@ periodics:
       - --oauth-token-path=/usr/local/github-credentials/oauth
       - --report-credentials-file=/etc/report/credentials
       - --secret-dir=/secrets/ci-pull-credentials
-      - --target=aws-ipi-workers-marketplace-mini-perm-f60
+      - --target=aws-ipi-workers-marketplace-public-subnets-mini-perm-f60
       - --variant=amd64-nightly-4.18-upgrade-from-stable-4.18
       command:
       - ci-operator
@@ -24240,7 +24240,7 @@ periodics:
     ci.openshift.io/generator: prowgen
     job-release: "4.18"
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-openshift-tests-private-release-4.18-amd64-nightly-aws-ipi-workers-marketplace-mini-perm-f7
+  name: periodic-ci-openshift-openshift-tests-private-release-4.18-amd64-nightly-aws-ipi-workers-marketplace-public-subnets-mini-perm-f7
   spec:
     containers:
     - args:
@@ -24250,7 +24250,7 @@ periodics:
       - --oauth-token-path=/usr/local/github-credentials/oauth
       - --report-credentials-file=/etc/report/credentials
       - --secret-dir=/secrets/ci-pull-credentials
-      - --target=aws-ipi-workers-marketplace-mini-perm-f7
+      - --target=aws-ipi-workers-marketplace-public-subnets-mini-perm-f7
       - --variant=amd64-nightly
       command:
       - ci-operator

ci-operator/jobs/openshift/openshift-tests-private/openshift-openshift-tests-private-release-4.19-periodics.yaml

@@ -2367,7 +2367,7 @@ periodics:
     ci-operator.openshift.io/variant: amd64-nightly-4.19-upgrade-from-stable-4.18
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-4.19-upgrade-from-stable-4.18-aws-ipi-workers-marketplace-f28
+  name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-4.19-upgrade-from-stable-4.18-aws-ipi-workers-marketplace-public-subnets-mini-perm-f28
   spec:
     containers:
     - args:
@@ -2377,7 +2377,7 @@ periodics:
       - --oauth-token-path=/usr/local/github-credentials/oauth
       - --report-credentials-file=/etc/report/credentials
       - --secret-dir=/secrets/ci-pull-credentials
-      - --target=aws-ipi-workers-marketplace-f28
+      - --target=aws-ipi-workers-marketplace-public-subnets-mini-perm-f28
       - --variant=amd64-nightly-4.19-upgrade-from-stable-4.18
       command:
       - ci-operator
@@ -10240,7 +10240,7 @@ periodics:
     ci-operator.openshift.io/variant: amd64-nightly-4.19-upgrade-from-stable-4.19
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-4.19-upgrade-from-stable-4.19-aws-ipi-workers-marketplace-mini-perm-f60
+  name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-4.19-upgrade-from-stable-4.19-aws-ipi-workers-marketplace-public-subnets-mini-perm-f60
   spec:
     containers:
     - args:
@@ -10250,7 +10250,7 @@ periodics:
       - --oauth-token-path=/usr/local/github-credentials/oauth
       - --report-credentials-file=/etc/report/credentials
       - --secret-dir=/secrets/ci-pull-credentials
-      - --target=aws-ipi-workers-marketplace-mini-perm-f60
+      - --target=aws-ipi-workers-marketplace-public-subnets-mini-perm-f60
       - --variant=amd64-nightly-4.19-upgrade-from-stable-4.19
       command:
       - ci-operator
@@ -22470,7 +22470,7 @@ periodics:
     ci.openshift.io/generator: prowgen
     job-release: "4.19"
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-workers-marketplace-mini-perm-f7
+  name: periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-workers-marketplace-public-subnets-mini-perm-f7
   spec:
     containers:
     - args:
@@ -22480,7 +22480,7 @@ periodics:
       - --oauth-token-path=/usr/local/github-credentials/oauth
       - --report-credentials-file=/etc/report/credentials
       - --secret-dir=/secrets/ci-pull-credentials
-      - --target=aws-ipi-workers-marketplace-mini-perm-f7
+      - --target=aws-ipi-workers-marketplace-public-subnets-mini-perm-f7
       - --variant=amd64-nightly
       command:
       - ci-operator

ci-operator/jobs/openshift/verification-tests/openshift-verification-tests-master-periodics.yaml

@@ -12529,6 +12529,81 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build03
+  cron: 34 18 1,17 * *
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+  extra_refs:
+  - base_ref: master
+    org: openshift
+    repo: verification-tests
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: aws-qe
+    ci-operator.openshift.io/variant: installation-nightly-4.18
+    ci.openshift.io/generator: prowgen
+    job-release: "4.18"
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-verification-tests-master-installation-nightly-4.18-aws-ipi-byo-subnets-only-public-arm-f14
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=aws-ipi-byo-subnets-only-public-arm-f14
+      - --variant=installation-nightly-4.18
+      command:
+      - ci-operator
+      image: ci-operator:latest
+      imagePullPolicy: Always
+      name: ""
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
 - agent: kubernetes
   cluster: build03
   cron: 56 23 6,15,22,29 * *
@@ -17556,6 +17631,81 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build03
+  cron: 32 8 8,24 * *
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+  extra_refs:
+  - base_ref: master
+    org: openshift
+    repo: verification-tests
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: aws-qe
+    ci-operator.openshift.io/variant: installation-nightly-4.19
+    ci.openshift.io/generator: prowgen
+    job-release: "4.19"
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-verification-tests-master-installation-nightly-4.19-aws-ipi-byo-subnets-only-public-arm-f14
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=aws-ipi-byo-subnets-only-public-arm-f14
+      - --variant=installation-nightly-4.19
+      command:
+      - ci-operator
+      image: ci-operator:latest
+      imagePullPolicy: Always
+      name: ""
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
 - agent: kubernetes
   cluster: build03
   cron: 7 21 4,11,20,27 * *