Merge remote-tracking branch 'upstream/main'

Author: moulalis

.github/workflows/rhai-on-xks-chart-test.yaml

@@ -14,12 +14,8 @@ permissions:
   contents: read
 
 jobs:
-  e2e-test:
+  authorize:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        cloud_provider: [azure, coreweave, aws]
     steps:
       - name: Check authorization
         env:
@@ -57,10 +53,19 @@ jobs:
           echo "::error::xKS e2e tests required. A maintainer must add the 'run-xks-e2e' label after reviewing the code."
           exit 1
 
+  e2e-test:
+    needs: authorize
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cloud_provider: [azure, coreweave, aws]
+    steps:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Setup Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -98,3 +103,55 @@ jobs:
             echo "=== AWSKubernetesEngine CR ==="
             kubectl get awskubernetesengines.infrastructure.opendatahub.io -A -o yaml 2>/dev/null || echo "No AWSKubernetesEngine CRs found"
           fi
+
+  upgrade-test:
+    needs: authorize
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cloud_provider: [azure, coreweave, aws]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Setup Helm
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+
+      - name: Create kind cluster
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
+
+      - name: Upgrade test
+        timeout-minutes: 30
+        env:
+          RHAI_PULL_SECRET: ${{ secrets.RHAI_PULL_SECRET }}
+        run: |
+          set -euo pipefail
+          PULL_SECRET_FILE="$(mktemp)"
+          trap 'rm -f "${PULL_SECRET_FILE}"' EXIT
+          chmod 600 "${PULL_SECRET_FILE}"
+          printf '%s' "${RHAI_PULL_SECRET}" > "${PULL_SECRET_FILE}"
+          HELM_REGISTRY_CONFIG="${PULL_SECRET_FILE}" \
+          make helm-upgrade-verify-xks \
+            XKS_CLOUD_PROVIDER=${{ matrix.cloud_provider }} \
+            XKS_PULL_SECRET="${PULL_SECRET_FILE}"
+
+      - name: Dump custom resources on failure
+        if: failure()
+        run: |
+          echo "=== KServe CR ==="
+          kubectl get kserves.components.platform.opendatahub.io -A -o yaml 2>/dev/null || echo "No KServe CRs found"
+          echo ""
+          if [ "${{ matrix.cloud_provider }}" = "azure" ]; then
+            echo "=== AzureKubernetesEngine CR ==="
+            kubectl get azurekubernetesengines.infrastructure.opendatahub.io -A -o yaml 2>/dev/null || echo "No AzureKubernetesEngine CRs found"
+          elif [ "${{ matrix.cloud_provider }}" = "coreweave" ]; then
+            echo "=== CoreWeaveKubernetesEngine CR ==="
+            kubectl get coreweavekubernetesengines.infrastructure.opendatahub.io -A -o yaml 2>/dev/null || echo "No CoreWeaveKubernetesEngine CRs found"
+          elif [ "${{ matrix.cloud_provider }}" = "aws" ]; then
+            echo "=== AWSKubernetesEngine CR ==="
+            kubectl get awskubernetesengines.infrastructure.opendatahub.io -A -o yaml 2>/dev/null || echo "No AWSKubernetesEngine CRs found"
+          fi

Makefile

@@ -55,7 +55,7 @@ YQ ?= $(LOCALBIN)/yq
 
 ## Application Versions
 # RHOAI version to use for bundle updates - update this when new catalog folder appears in RHOAI-Build-Config
-RHOAI_VERSION ?= 3.5.0-ea.2
+RHOAI_VERSION ?= 3.5.0
 
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v5.8.0
@@ -298,6 +298,8 @@ XKS_NAMESPACE ?= rhai-on-xks
 XKS_CLOUD_PROVIDER ?= azure
 XKS_PULL_SECRET ?=
 XKS_VALUES_FILE ?=
+XKS_UPGRADE_FROM_CHART ?= oci://registry.redhat.io/rhai/rhai-on-xks-chart
+XKS_UPGRADE_FROM_VERSION ?= v3.4.2
 
 .PHONY: helm-verify-xks
 helm-verify-xks: ## Verify rhai-on-xks-chart installation and lifecycle. Use XKS_TEST=<num> for specific test
@@ -308,6 +310,10 @@ helm-install-verify-xks: ## Install and verify rhai-on-xks-chart
 	# TODO(RHOAIENG-63729): remove -f values-e2e.yaml once a runner with sufficient resources is available
 	VALUES_FILE=$(or $(XKS_VALUES_FILE),$(XKS_CHART_PATH)/test/values-e2e.yaml) $(MAKE) helm-verify-xks
 
+.PHONY: helm-upgrade-verify-xks
+helm-upgrade-verify-xks: ## Upgrade test: install previous version, upgrade to current, verify
+	RELEASE_NAME="$(XKS_RELEASE_NAME)" NAMESPACE="$(XKS_NAMESPACE)" CLOUD_PROVIDER="$(XKS_CLOUD_PROVIDER)" PULL_SECRET="$(XKS_PULL_SECRET)" HELM_EXTRA_ARGS="$(HELM_EXTRA_ARGS)" UPGRADE_FROM_CHART="$(XKS_UPGRADE_FROM_CHART)" UPGRADE_FROM_VERSION="$(XKS_UPGRADE_FROM_VERSION)" VALUES_FILE="$(or $(XKS_VALUES_FILE),$(XKS_CHART_PATH)/test/values-e2e.yaml)" bash ./charts/rhai-on-xks-chart/scripts/verify-upgrade.sh
+
 .PHONY: helm-uninstall
 helm-uninstall: ## Uninstall helm chart and all dependencies
 	./scripts/uninstall-helm-chart.sh

charts/rhai-on-xks-chart/scripts/helmtemplate-config-cloudmanager.yaml

@@ -23,6 +23,14 @@ rules:
     changes:
       - path: .metadata.name
         value: '{{ .Values.CLOUD_NAME.cloudManager.namespace }}'
+      - action: delete
+        path: .metadata.labels
+      - path: .metadata.labels
+        replaceWith: |
+          labels:
+            {{- include "rhai-on-xks-chart.labels" . | nindent 4 }}
+      - path: .metadata.annotations["helm.sh/resource-policy"]
+        value: keep
 
   # Replace namespace in RoleBinding/ClusterRoleBinding subjects
   - match:

charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml

@@ -24,6 +24,12 @@ rules:
         value: '{{ .Values.rhaiOperator.namespace }}'
       - action: delete
         path: .metadata.labels
+      - path: .metadata.labels
+        replaceWith: |
+          labels:
+            {{- include "rhai-on-xks-chart.labels" . | nindent 4 }}
+      - path: .metadata.annotations["helm.sh/resource-policy"]
+        value: keep
 
   - match:
       kinds:
@@ -34,6 +40,14 @@ rules:
     changes:
       - path: .metadata.name
         value: '{{ .Values.rhaiOperator.applicationsNamespace }}'
+      - action: delete
+        path: .metadata.labels
+      - path: .metadata.labels
+        replaceWith: |
+          labels:
+            {{- include "rhai-on-xks-chart.labels" . | nindent 4 }}
+      - path: .metadata.annotations["helm.sh/resource-policy"]
+        value: keep
 
   # Replace namespace in RoleBinding/ClusterRoleBinding subjects
   - match: