Apply nothing but secrets on api.ci

Author: hongkailiu

README.md

@@ -35,22 +35,13 @@ and are split into the following categories:
 
 ### Core Services and Configuration
 
-Manifests for important services (like [OpenShift CI cluster](https://api.ci.openshift.org/)
-and the CI service components that run on it) are present in the
-[`core-services`](./core-services) directory. The services configured in this
-directory are critical for some part of the OpenShift project development
-workflow, must meet basic quality criteria and must be deployed to the cluster
-automatically by a postsubmit job. See its [README](./core-services/README.md)
-for details.
-
-### Additional Services and Configuration
-
-The [`services`](./services) directory contains manifests for services that run
-on [OpenShift CI cluster](https://api.ci.openshift.org/) and are not critical
-for the OpenShift project development workflow, but want to follow the same
-quality criteria and automated check and deployment process that the [core
-services](#core-services-and-configuration) do (DPTP intends to support only
-these additional services). See its [README](./services/README.md) for details.
+_Only `core-services/secrets` folder is applied to the cluster api.ci._
+
+Except [user secret management](https://docs.ci.openshift.org/docs/how-tos/adding-a-new-secret-to-ci/), no services are running on `api.ci`.
+
+### Additional Services and Configuration (legacy)
+
+_This folder is no longer applied to the cluster api.ci which is going to be offline soon._
 
 ### Cluster Configuration Manifests (legacy)
 

ci-operator/jobs/infra-periodics.yaml

@@ -830,8 +830,7 @@ periodics:
   spec:
     containers:
     - args:
-      - --config-dir=core-services
-      - --config-dir=clusters/build-clusters/common
+      - --config-dir=core-services/secrets
       - --confirm=true
       - --kubeconfig=/etc/build-farm-credentials/kubeconfig
       - --as=
@@ -861,44 +860,6 @@ periodics:
         - key: sa.config-updater.api.ci.config
           path: kubeconfig
         secretName: build-farm-credentials
-- agent: kubernetes
-  cluster: app.ci
-  decorate: true
-  extra_refs:
-  - base_ref: master
-    org: openshift
-    repo: release
-  interval: 12h
-  labels:
-    ci.openshift.io/role: infra
-  name: periodic-openshift-release-master-services-apply
-  spec:
-    containers:
-    - args:
-      - --config-dir=services
-      - --confirm=true
-      - --kubeconfig=/etc/build-farm-credentials/kubeconfig
-      - --as=
-      command:
-      - applyconfig
-      image: applyconfig:latest
-      imagePullPolicy: Always
-      name: ""
-      resources:
-        requests:
-          cpu: 10m
-      volumeMounts:
-      - mountPath: /etc/build-farm-credentials
-        name: build-farm-credentials
-        readOnly: true
-    serviceAccountName: config-updater
-    volumes:
-    - name: build-farm-credentials
-      secret:
-        items:
-        - key: sa.config-updater.api.ci.config
-          path: kubeconfig
-        secretName: build-farm-credentials
 - agent: kubernetes
   cluster: app.ci
   decorate: true

ci-operator/jobs/openshift/release/openshift-release-master-postsubmits.yaml

@@ -229,8 +229,7 @@ postsubmits:
     spec:
       containers:
       - args:
-        - --config-dir=core-services
-        - --config-dir=clusters/build-clusters/common
+        - --config-dir=core-services/secrets
         - --confirm=true
         - --kubeconfig=/etc/build-farm-credentials/kubeconfig
         - --as=
@@ -318,39 +317,3 @@ postsubmits:
           requests:
             cpu: 10m
       serviceAccountName: config-updater
-  - agent: kubernetes
-    branches:
-    - ^master$
-    cluster: app.ci
-    decorate: true
-    labels:
-      ci.openshift.io/role: infra
-    max_concurrency: 1
-    name: branch-ci-openshift-release-master-services-apply
-    spec:
-      containers:
-      - args:
-        - --config-dir=services
-        - --confirm=true
-        - --kubeconfig=/etc/build-farm-credentials/kubeconfig
-        - --as=
-        command:
-        - applyconfig
-        image: registry.ci.openshift.org/ci/applyconfig:latest
-        imagePullPolicy: Always
-        name: ""
-        resources:
-          requests:
-            cpu: 10m
-        volumeMounts:
-        - mountPath: /etc/build-farm-credentials
-          name: build-farm-credentials
-          readOnly: true
-      serviceAccountName: config-updater
-      volumes:
-      - name: build-farm-credentials
-        secret:
-          items:
-          - key: sa.config-updater.api.ci.config
-            path: kubeconfig
-          secretName: build-farm-credentials

ci-operator/jobs/openshift/release/openshift-release-master-presubmits.yaml

@@ -424,9 +424,7 @@ presubmits:
       containers:
       - args:
         - --config-dir
-        - core-services
-        - --config-dir
-        - clusters/build-clusters/common
+        - core-services/secrets
         - --kubeconfig
         - /etc/build-farm-credentials/kubeconfig
         - --as=
@@ -839,53 +837,6 @@ presubmits:
           requests:
             cpu: 10m
     trigger: (?m)^/test( | .* )secret-generator-config-valid,?($|\s.*)
-  - agent: kubernetes
-    always_run: true
-    branches:
-    - master
-    cluster: app.ci
-    context: ci/prow/services-dry
-    decorate: true
-    labels:
-      pj-rehearse.openshift.io/can-be-rehearsed: "true"
-    name: pull-ci-openshift-release-master-services-dry
-    rerun_command: /test services-dry
-    spec:
-      containers:
-      - args:
-        - --config-dir
-        - services
-        - --kubeconfig
-        - /etc/build-farm-credentials/kubeconfig
-        - --as=
-        command:
-        - applyconfig
-        env:
-        - name: HOME
-          value: /tmp
-        image: registry.ci.openshift.org/ci/applyconfig:latest
-        imagePullPolicy: Always
-        name: ""
-        resources:
-          requests:
-            cpu: 10m
-        volumeMounts:
-        - mountPath: /etc/build-farm-credentials
-          name: build-farm-credentials
-          readOnly: true
-        - mountPath: /tmp
-          name: tmp
-      serviceAccountName: config-updater
-      volumes:
-      - name: build-farm-credentials
-        secret:
-          items:
-          - key: sa.config-updater.api.ci.config
-            path: kubeconfig
-          secretName: build-farm-credentials
-      - emptyDir: {}
-        name: tmp
-    trigger: (?m)^/test( | .* )services-dry,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:

clusters/app.ci/common_except_api.ci

@@ -1,16 +1,8 @@
 # Core Services and Configuration
 
-Manifests for important services (like [OpenShift CI cluster](https://api.ci.openshift.org/)
-and the CI service components that run on it) are present in this directory. The
-services configured here are critical for some part of the OpenShift project
-development workflow, must meet basic quality criteria and must be deployed to
-the cluster automatically by a postsubmit job.
+_Only `core-services/secrets` folder is applied to the cluster api.ci._
 
-## How to add new service
-
-Create a new directory for your service, containing all [necessary files](#quality-criteria-and-conventions).
-You may copy the `_TEMPLATE` directory and start using the files there. Add
-manifests and other configuration as needed.
+Except [user secret management](https://docs.ci.openshift.org/docs/how-tos/adding-a-new-secret-to-ci/), no services are running on `api.ci`.
 
 ## Quality criteria and conventions