From 0c74f2f959ad04fc24d4636f029e4d0b843ab580 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Thu, 22 Oct 2026 09:38:39 +0000 Subject: [PATCH 1/2] Require E2E_NODE_IMAGE_UPDATE2_REF for EKS Assisted-by: AI Signed-off-by: Alice Frosi --- test/e2e/e2eutil/env.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go index 815d6abf..65681ec8 100644 --- a/test/e2e/e2eutil/env.go +++ b/test/e2e/e2eutil/env.go @@ -141,7 +141,7 @@ func New(t *testing.T) *Env { case "eks": nodeImageRef = requireEnv(t, "E2E_NODE_IMAGE_REF") updateRef = requireEnv(t, "E2E_NODE_IMAGE_UPDATE_REF") - update2Ref = os.Getenv("E2E_NODE_IMAGE_UPDATE2_REF") + update2Ref = requireEnv(t, "E2E_NODE_IMAGE_UPDATE2_REF") registryHost = os.Getenv("E2E_REGISTRY_HOST") if registryHost == "" { registryHost = extractRegistryHost(updateRef) From 00d071a8f4b790920ae73e06ad8b8bc423ab4acf Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Thu, 22 Oct 2026 09:38:47 +0000 Subject: [PATCH 2/2] Support pre-built pull secret via E2E_NODE_PULL_SECRET This is helpful for the EKS infrastructure and testing because the second upgrade image is built from the first one and pushed to the EKS registry. Therefore, the images might come from different registries and could requires multiple credentials. Assisted-by: AI Signed-off-by: Alice Frosi --- Makefile | 2 ++ test/e2e/e2eutil/env.go | 25 +++++++++++++++++-------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/Makefile b/Makefile index 09bf7638..14f67028 100644 --- a/Makefile +++ b/Makefile @@ -129,6 +129,7 @@ EKS_NODE_IMAGE_UPDATE2_REF ?= EKS_REGISTRY_HOST ?= EKS_REGISTRY_USER ?= EKS_REGISTRY_PASSWORD ?= +EKS_NODE_PULL_SECRET ?= .PHONY: e2e-eks e2e-eks: ## Run e2e tests against EKS. V=1 for verbose. RUN= to filter. @@ -145,6 +146,7 @@ e2e-eks: ## Run e2e tests against EKS. V=1 for verbose. RUN= to filter. E2E_REGISTRY_HOST="$(EKS_REGISTRY_HOST)" \ E2E_REGISTRY_USER="$(EKS_REGISTRY_USER)" \ E2E_REGISTRY_PASSWORD="$(EKS_REGISTRY_PASSWORD)" \ + E2E_NODE_PULL_SECRET="$(EKS_NODE_PULL_SECRET)" \ ARTIFACTS="$(ARTIFACTS)" \ go test -timeout 30m -count=1 -parallel 2 $(if $(V),-v) $(if $(RUN),-run '$(RUN)') . diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go index 65681ec8..86adf2fe 100644 --- a/test/e2e/e2eutil/env.go +++ b/test/e2e/e2eutil/env.go @@ -358,13 +358,22 @@ func (e *Env) RegistryPassword() string { func (e *Env) createNodePullSecret(t *testing.T) { t.Helper() - authStr := base64.StdEncoding.EncodeToString( - []byte(e.registryUser + ":" + e.registryPassword), - ) - dockerCfg := fmt.Sprintf( - `{"auths":{%q:{"auth":"%s"}}}`, - e.registryHost, authStr, - ) + var dockerCfgBytes []byte + if envSecret := os.Getenv("E2E_NODE_PULL_SECRET"); envSecret != "" { + var err error + dockerCfgBytes, err = base64.StdEncoding.DecodeString(envSecret) + if err != nil { + t.Fatalf("decoding E2E_NODE_PULL_SECRET: %v", err) + } + } else { + authStr := base64.StdEncoding.EncodeToString( + []byte(e.registryUser + ":" + e.registryPassword), + ) + dockerCfgBytes = []byte(fmt.Sprintf( + `{"auths":{%q:{"auth":"%s"}}}`, + e.registryHost, authStr, + )) + } secretName := e.testID + "-node-pull-secret" secret := &corev1.Secret{ @@ -374,7 +383,7 @@ func (e *Env) createNodePullSecret(t *testing.T) { }, Type: corev1.SecretTypeDockerConfigJson, Data: map[string][]byte{ - corev1.DockerConfigJsonKey: []byte(dockerCfg), + corev1.DockerConfigJsonKey: dockerCfgBytes, }, }