K8s Test Pipeline on Project Hummingbird

Pipeline Design

Mon, 01 Jan 0001 00:00:00 +0000

Task/Step Overview

Task	Type	Steps	Results	Retries	Timeout
`check-for-tests`	Inline `taskSpec`	write-snapshot, resolve-component, fetch-source, check-for-tests, write-results	`HAS_TESTS`, `TEST_OUTPUT`	2	10m
`provision-namespace`	External bundle (`task-eaas-provision-space`)	(managed by task)	`secretRef`	2	10m
`run-tests`	Inline `taskSpec`	write-snapshot, resolve-component, fetch-source, run-tests, write-results	`TEST_OUTPUT`	2	24h
`fail-pipeline-on-test-failure`	Inline `taskSpec` (finally)	check-results	—	0	10m

Both check-for-tests and run-tests independently fetch source — each task gets its own emptyDir volume, so no state carries across tasks.

Test Format

Mon, 01 Jan 0001 00:00:00 +0000

Test Discovery

The pipeline locates tests-k8s.yml using source.git.context from the Konflux Snapshot. For example, if source.git.context is images/curl, the pipeline looks for images/curl/tests-k8s.yml in the source tree.

When source.git.context is not populated (currently the case for the triggering component in PR-triggered pipelines, tracked as KONFLUX-12674), a heuristic fallback derives the context from the component name: it tries images/<base> and then <base>.

The actual tests-k8s.yml format is opaque to the pipeline — it is passed to the repository’s test runner script, which defines the structure and semantics. See the respective repository documentation for the YAML format.

EaaS and Debugging

Mon, 01 Jan 0001 00:00:00 +0000

Environment as a Service (EaaS)

EaaS is a Konflux-managed service that provisions ephemeral OpenShift namespaces on member clusters for integration testing.

Provisioning Flow

The provision-namespace task creates an eaas.konflux-ci.dev/v1alpha1 Namespace claim, owned by the PipelineRun.
The EaaS controller allocates a namespace on a member cluster (currently kflux-prd-es01) and writes a scoped kubeconfig into a Kubernetes Secret.
The run-tests step reads the kubeconfig from the Secret to get cluster access.
When the PipelineRun is deleted, the owner reference triggers garbage collection of the claim, namespace, and Secret.

The member cluster may change — it is dynamically assigned by the EaaS controller.