Update to make it work with Forge

README.md

@@ -165,13 +165,13 @@ oc create secret generic ${CLUSTER_NAME}-kubeconfig \
 The secret name must match the `FOURNOS_KUBECONFIG_SECRET_PATTERN` (default
 `{cluster}-kubeconfig`).
 
-2. **Add a ResourceFlavor and quota** in `manifests/kueue-config.yaml`. Add a
+2. **Add a ResourceFlavor and quota** in `config/kueue-config.yaml`. Add a
    new `ResourceFlavor` with a matching `fournos.dev/cluster` nodeLabel, and
    list it under the `fournos-queue` ClusterQueue with the appropriate GPU/CPU
    quotas. Then apply:
 
 ```bash
-oc apply -f manifests/kueue-config.yaml
+oc apply -f config/kueue-config.yaml
 ```
 
 3. **Verify connectivity** by submitting a lightweight validate-only
@@ -196,7 +196,12 @@ details.
 Deploy the cluster configuration (Builds + Tekton):
 
 ```bash
-oc apply -n $FOURNOS_NAMESPACE -f config/forge/images
+oc apply -n $FOURNOS_NAMESPACE -f config/forge/images/is_forge.yaml
+cat config/forge/images/build_forge-main.yaml \
+   | sed 's/psap-automation/'$FOURNOS_NAMESPACE'/g' \
+   | oc apply -n $FOURNOS_NAMESPACE
+oc create -n $FOURNOS_NAMESPACE  -f config/forge/images/buildrun_forge-main.yaml
+
 oc apply -n $FOURNOS_NAMESPACE -f config/forge/workflows
 ```
 

config/forge/workflows/tasks.yaml

@@ -39,8 +39,10 @@ spec:
       script: |
         #!/usr/bin/env bash
 
-        set -euo pipefail
-        set -x
+        set -o pipefail
+        set -o errexit
+        set -o nounset
+        set -o errtrace
 
         cat > forge_config.yaml <<< "$FORGE_CONFIG"
         echo "--- forge_config.yaml:"
@@ -52,16 +54,27 @@ spec:
         cat forge_config.env
         echo "---"
 
-        set -a; source forge_config.env; set +a;
-
+        if grep -q '^PULL_PULL_SHA=' forge_config.env; then
+          PULL_PULL_SHA=$(cat forge_config.env | grep '^PULL_PULL_SHA=' | cut -d'=' -f2)
+        fi
+
         if [[ "${PULL_PULL_SHA:-}" ]]; then
+        echo
+          echo "Updating to PULL_PULL_SHA=$PULL_PULL_SHA ..."
+
           git -C "$FORGE_HOME" fetch --quiet origin "$PULL_PULL_SHA"
           git -C "$FORGE_HOME" reset --hard FETCH_HEAD
         else
           echo "No PULL_PULL_SHA, using the image commit"
-          git show --quiet
         fi
 
+        git show --quiet
+
+        export ARTIFACT_DIR=/tmp/artifacts
+        mkdir -p "${ARTIFACT_DIR}"
+
+        export FOURNOS_CI=true
+
         exec bin/run_ci "$(params.forge-project)" ci "$FOURNOS_STEP"
 
   volumes:

hacks/copy-kubeconfig-secrets-to-ns.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -o pipefail
+set -o errexit
+set -o nounset
+set -o errtrace
+
+# Use the first argument if provided, otherwise use the current project name
+TARGET_NS=${1:-$(oc project -q)}
+SOURCE_NS="psap-automation"
+
+echo "Copying *-kubeconfig secrets from $SOURCE_NS to $TARGET_NS..."
+
+# Loop through filtered secrets
+for SECRET_NAME in $(oc get secrets -n $SOURCE_NS -o name | grep "\-kubeconfig"); do
+    # Extract from source and create in target
+    # 1. Fetch the secret in JSON
+    # 2. Use jq to delete all the "junk" metadata
+    # 3. Create it in the new namespace
+    oc get "$SECRET_NAME" -n "$SOURCE_NS" -o json | jq '
+        del(
+            .metadata.namespace, 
+            .metadata.uid, 
+            .metadata.resourceVersion, 
+            .metadata.creationTimestamp, 
+            .metadata.managedFields,
+            .metadata.ownerReferences
+        )' | oc apply -n "$TARGET_NS" -f-
+done

manifests/ocpci-sa/rbac-wip-ns.yaml

@@ -0,0 +1,29 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ocpci-fournos-job-manager
+  namespace: psap-automation-wip
+rules:
+  - apiGroups: ["fournos.dev"]
+    resources: ["fournosjobs"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ocpci-fournos-job-manager
+  namespace: psap-automation-wip
+subjects:
+  - kind: ServiceAccount
+    name: ocpci
+    namespace: psap-automation  # This points back to the original namespace
+roleRef:
+  kind: Role
+  name: ocpci-fournos-job-manager
+  apiGroup: rbac.authorization.k8s.io

manifests/ocpci-sa/role.yaml

@@ -6,4 +6,10 @@ metadata:
 rules:
   - apiGroups: ["fournos.dev"]
     resources: ["fournosjobs"]
-    verbs: ["create", "get", "list", "watch"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]