diff --git a/deploy/docker/Dockerfile.konflux.e2e-odh b/deploy/docker/Dockerfile.konflux.e2e-odh index ba5e71ab0b..cf9122f4b4 100644 --- a/deploy/docker/Dockerfile.konflux.e2e-odh +++ b/deploy/docker/Dockerfile.konflux.e2e-odh @@ -106,24 +106,26 @@ RUN OC_ARCH=$(case "${TARGETARCH}" in amd64) echo amd64;; arm64) echo arm64;; *) install -m 0555 "/tmp/uv-${UV_ARCH}-unknown-linux-gnu/uv" /usr/local/bin/uv WORKDIR /home/odh/openshell-e2e-odh -COPY --chown=1000:1000 Cargo.toml Cargo.lock ./ -COPY --chown=1000:1000 pyproject.toml uv.lock ./ -COPY --chown=1000:1000 .cargo/ .cargo/ -COPY --chown=1000:1000 .config/ .config/ -COPY --chown=1000:1000 crates/ crates/ -COPY --chown=1000:1000 proto/ proto/ -COPY --from=builder --chown=1000:1000 /home/odh/openshell-e2e-odh/python/ python/ -COPY --chown=1000:1000 providers/ providers/ -COPY --chown=1000:1000 examples/ examples/ -COPY --chown=1000:1000 e2e/ e2e/ -COPY --chown=1000:1000 scripts/ scripts/ -COPY --chown=1000:1000 tasks/ tasks/ -COPY --chown=1000:1000 odh/ odh/ -COPY --chown=1000:1000 deploy/helm/openshell/ deploy/helm/openshell/ -COPY --chown=1000:1000 deploy/helm/openshell-workspace/ deploy/helm/openshell-workspace/ - -RUN install -d -o 1000 -g 1000 results .kube /home/odh/.config/openshell && \ - chown 1000:1000 /home/odh /home/odh/openshell-e2e-odh +# Shift-Left runs with --userns=keep-id --user 1001:1001. Keep the home and +# test workspace writable for that identity, including CLI mTLS storage. +COPY --chown=1001:1001 Cargo.toml Cargo.lock ./ +COPY --chown=1001:1001 pyproject.toml uv.lock ./ +COPY --chown=1001:1001 .cargo/ .cargo/ +COPY --chown=1001:1001 .config/ .config/ +COPY --chown=1001:1001 crates/ crates/ +COPY --chown=1001:1001 proto/ proto/ +COPY --from=builder --chown=1001:1001 /home/odh/openshell-e2e-odh/python/ python/ +COPY --chown=1001:1001 providers/ providers/ +COPY --chown=1001:1001 examples/ examples/ +COPY --chown=1001:1001 e2e/ e2e/ +COPY --chown=1001:1001 scripts/ scripts/ +COPY --chown=1001:1001 tasks/ tasks/ +COPY --chown=1001:1001 odh/ odh/ +COPY --chown=1001:1001 deploy/helm/openshell/ deploy/helm/openshell/ +COPY --chown=1001:1001 deploy/helm/openshell-workspace/ deploy/helm/openshell-workspace/ + +RUN install -d -o 1001 -g 1001 results .kube /home/odh/.config /home/odh/.config/openshell && \ + chown 1001:1001 /home/odh /home/odh/openshell-e2e-odh # Fail the build if an expected test runtime tool is absent. In particular, # sandbox connection uses ssh, and future repository tests need git. cargo @@ -153,6 +155,6 @@ LABEL com.redhat.component="odh-openshell-e2e-container" \ io.k8s.display-name="odh-openshell-e2e" \ io.k8s.description="odh-openshell-e2e" -USER 1000:1000 +USER 1001:1001 ENTRYPOINT ["/home/odh/openshell-e2e-odh/odh/scripts/e2e-odh-entrypoint.sh"] CMD ["smoke"] diff --git a/deploy/konflux/e2e-odh/README.md b/deploy/konflux/e2e-odh/README.md index 2b092abc6e..e4c063edc2 100644 --- a/deploy/konflux/e2e-odh/README.md +++ b/deploy/konflux/e2e-odh/README.md @@ -19,7 +19,9 @@ merges the ordered JUnit files into one `e2e-odh-.xml` plus its HTML companion. Phase reports remain available as `e2e-odh--.xml`. The no-deploy option is supported only for single-phase tiers. Extracted client mTLS material is stored in a mode `0700` -directory with mode `0600` files. +directory with mode `0600` files. The runtime image owns its home and workspace +as UID/GID `1001:1001`, matching the Shift-Left pipeline's +`podman run --userns=keep-id --user 1001:1001`. Each deployed invocation has a DNS-safe run ID. During the temporary upstream managed-test compatibility period, the default namespace and Helm release are diff --git a/deploy/konflux/sandbox/rpms.lock.yaml b/deploy/konflux/sandbox/rpms.lock.yaml index fec0f95960..a143e9d7d9 100644 --- a/deploy/konflux/sandbox/rpms.lock.yaml +++ b/deploy/konflux/sandbox/rpms.lock.yaml @@ -176,13 +176,13 @@ arches: name: glibc-headers evr: 2.34-283.el9_8 sourcerpm: glibc-2.34-283.el9_8.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/k/kernel-headers-5.14.0-687.57.1.el9_8.x86_64.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/k/kernel-headers-5.14.0-687.58.1.el9_8.x86_64.rpm repoid: ubi-9-for-x86_64-appstream-rpms - size: 2979225 - checksum: sha256:c5766b2f8e4531f824575546028de7d8eb9fa95d7246dfafd4883c58312a2ef2 + size: 2982193 + checksum: sha256:2c29113a9f860f0e2a14c89ec3a399b3e3d0f9ff699d7f5b565ca5e73b0314a9 name: kernel-headers - evr: 5.14.0-687.57.1.el9_8 - sourcerpm: kernel-5.14.0-687.57.1.el9_8.src.rpm + evr: 5.14.0-687.58.1.el9_8 + sourcerpm: kernel-5.14.0-687.58.1.el9_8.src.rpm - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/l/libxcrypt-devel-4.4.18-3.el9.x86_64.rpm repoid: ubi-9-for-x86_64-appstream-rpms size: 33101 diff --git a/e2e/rust/tests/odh/README.md b/e2e/rust/tests/odh/README.md index 8804c1a5f8..07eb382032 100644 --- a/e2e/rust/tests/odh/README.md +++ b/e2e/rust/tests/odh/README.md @@ -338,12 +338,17 @@ oc login --token=XXXXXX \ # Run the e2e tests podman run --rm \ + --userns=keep-id --user 1001:1001 \ -v /path/to/reports:/home/odh/openshell-e2e-odh/results:Z,U \ -v /path/to/kubeconfig:/home/odh/openshell-e2e-odh/.kube/config:ro,Z \ --env-file containerEnvFile \ quay.io/opendatahub/odh-openshell-e2e:odh-stable smoke ``` +The image runs as UID/GID `1001:1001` and owns `/home/odh`, including the +OpenShell CLI configuration directory. Keep the pipeline's `--user` setting +at `1001:1001` so gateway registration and client mTLS material can be written. + The entrypoint assigns each invocation a DNS-safe run ID. For compatibility with managed-workspace tests, the namespace and release default to `openshell` across both shared and managed phases; the gateway name and Route host are