# EaaS and Debugging

> How the pipeline uses Konflux Environment as a Service, and how to debug test failures.

---

LLMS index: [llms.txt](https://hummingbird-project.io/llms.txt) | Full content: [llms-full.txt](https://hummingbird-project.io/llms-full.txt)

---

## Environment as a Service (EaaS)

EaaS is a Konflux-managed service that provisions ephemeral OpenShift
namespaces on member clusters for integration testing.

### Provisioning Flow

1. The `provision-namespace` task creates an
   `eaas.konflux-ci.dev/v1alpha1 Namespace` claim, owned by the PipelineRun.
2. The EaaS controller allocates a namespace on a member cluster (currently
   `kflux-prd-es01`) and writes a scoped kubeconfig into a Kubernetes Secret.
3. The `run-tests` step reads the kubeconfig from the Secret to get cluster
   access.
4. When the PipelineRun is deleted, the owner reference triggers garbage
   collection of the claim, namespace, and Secret.

The member cluster may change — it is dynamically assigned by the EaaS
controller.

## Debugging Test Failures

### Using Kubearchive for Historical PLRs

Kubearchive stores historical PipelineRun, TaskRun, and Pod data. The
[containers repo](https://gitlab.com/redhat/hummingbird/containers) includes
a helper script at `ci/internal/k8s_helper.py`.

Example: find PLRs for a specific PR:

```bash
cd /path/to/rprm-containers
python3 -c "
from ci.internal import k8s_helper
h = k8s_helper.K8sHelper('https://konflux-ui.apps.kflux-prd-rh03.nnv1.p1.openshiftapps.com/ns/hummingbird-tenant/')
endpoint = h._tekton_endpoint('pipelineruns')
items = h._fetch_from_both_sources(endpoint, 'pac.test.appstudio.openshift.io/pull-request=421,test.appstudio.openshift.io/scenario=tools-k8s-test')
for plr in items:
    print(plr['metadata']['name'], plr['status']['conditions'][0]['reason'])
"
```

Useful label selectors:

- `test.appstudio.openshift.io/scenario=<scenario-name>` — filter by ITS name
- `pac.test.appstudio.openshift.io/pull-request=<number>` — filter by MR
- `appstudio.openshift.io/component=<component>` — filter by component

### Accessing the EaaS Namespace During a Live PLR

While a PipelineRun is running, you can access the ephemeral namespace:

1. Find the provision secret name from the `provision-namespace` task results
   (visible in the PLR status or Konflux UI).
2. Extract the kubeconfig:

   ```bash
   kubectl get secret <secret-name> -n hummingbird-tenant \
     -o jsonpath='{.data.kubeconfig}' | base64 -d > /tmp/eaas-kubeconfig
   ```

3. Use it to inspect the namespace:

   ```bash
   export KUBECONFIG=/tmp/eaas-kubeconfig
   kubectl get pods
   kubectl get events --sort-by='.lastTimestamp'
   kubectl logs <pod-name>
   ```

### Finding Which Cluster EaaS Uses

To determine the current EaaS member cluster, extract the server URL from a
kubeconfig provisioned by EaaS:

```bash
kubectl get secret <secret-name> -n hummingbird-tenant \
  -o jsonpath='{.data.kubeconfig}' | base64 -d | grep server
```

As of this writing, the EaaS member cluster is
`kflux-prd-es01.1ion.p1.openshiftapps.com`. This may change as the EaaS
controller dynamically assigns clusters.