OCPBUGS-85109: move required-scc annotation to pod template in gathering job

[liouk]

This PR fixes the location of the required-scc annotation in the periodic-gathering job pod template.

Failing monitor tests: https://sippy.dptools.openshift.org/sippy-ng/tests/5.0/analysis?test=%5Bsig-auth%5D%20all%20workloads%20in%20ns%2Fopenshift-insights%20must%20set%20the%20%27openshift.io%2Frequired-scc%27%20annotation

Fixing this will allow us to drop the exception from the required-scc-annotation-checker monitor test.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Breaking Changes

No -- the pinned SCC is the one that the job pods are already getting admitted with (restricted-v2).

References

https://redhat.atlassian.net/browse/CNTRLPLANE-3386

https://redhat.atlassian.net/browse/OCPBUGS-85109

[openshift-ci-robot]

@liouk: This pull request references Jira Issue OCPBUGS-85108, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR fixes the location of the required-scc annotation in the periodic-gathering job pod template.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Breaking Changes

No -- the pinned SCC is the one that the job pods are already getting admitted with (restricted-v2).

References

https://redhat.atlassian.net/browse/CNTRLPLANE-3386

https://redhat.atlassian.net/browse/OCPBUGS-85108

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

In CreateGathererJob, the openshift.io/required-scc: restricted-v2 annotation is moved from the Job's top-level ObjectMeta to the PodTemplateSpec's ObjectMeta. The Job metadata retains only its labels.

Changes

SCC Annotation Relocation

Layer / File(s)	Summary
Move required-SCC annotation from Job to PodTemplateSpec pkg/controller/periodic/job.go	Removes the Annotations map from the Job's ObjectMeta and adds an ObjectMeta with openshift.io/required-scc: restricted-v2 under PodTemplateSpec, so the SCC annotation applies to the created Pods instead of the Job resource.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Project does not use Ginkgo framework. Repository only uses standard Go testing package; no Ginkgo tests found anywhere in codebase.
Test Structure And Quality	✅ Passed	The custom check is not applicable to this PR. The PR modifies job.go, not Ginkgo test files. The periodic package uses standard Go testing with testify assertions, not Ginkgo.
Microshift Test Compatibility	✅ Passed	PR does not add any Ginkgo e2e tests. It only modifies annotation placement in a Kubernetes Job definition, which is infrastructure code not subject to MicroShift test compatibility check.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR does not add any new Ginkgo e2e tests. It only modifies pkg/controller/periodic/job.go, a production controller file, to relocate an annotation. The SNO compatibility check is not applicabl...
Topology-Aware Scheduling Compatibility	✅ Passed	PR only moves SCC annotation between metadata locations; introduces no affinity, anti-affinity, topology spread, nodeSelector, or other topology-incompatible scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR modifies only pkg/controller/periodic/job.go—a controller library file with no process-level code, test entry points, or stdout writes. The change moves Kubernetes Job annotation metadata only.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR does not add new Ginkgo e2e tests. It modifies a production controller file (job.go) to relocate an annotation. The custom check only applies when new tests are added.
No-Weak-Crypto	✅ Passed	PR contains no weak cryptography (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or non-constant-time comparisons). It only relocates a Kubernetes SCC annotation in job configuration.
Container-Privileges	✅ Passed	No privilege escalation flags found. Code enforces restricted security: AllowPrivilegeEscalation=false, RunAsNonRoot=true, ReadOnlyRootFilesystem=true, Capabilities=DROP:ALL, restricted-v2 SCC.
No-Sensitive-Data-In-Logs	✅ Passed	PR only relocates a Kubernetes annotation from Job to PodTemplateSpec metadata. No logging statements expose sensitive data (passwords, tokens, API keys, PII, emails, SSNs, credit cards, session ID...
Title check	✅ Passed	The title clearly and specifically describes the main change: moving the required-scc annotation to the pod template in the gathering job, which matches the primary objective of the PR.
Description check	✅ Passed	The PR description is complete and well-structured, following the template with all required sections filled appropriately for a bugfix.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@liouk: This pull request references Jira Issue OCPBUGS-85108, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

This PR fixes the location of the required-scc annotation in the periodic-gathering job pod template.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Breaking Changes

No -- the pinned SCC is the one that the job pods are already getting admitted with (restricted-v2).

References

https://redhat.atlassian.net/browse/CNTRLPLANE-3386

https://redhat.atlassian.net/browse/OCPBUGS-85108

Summary by CodeRabbit

• Bug Fixes
• Corrected the application of security constraints to ensure they are properly enforced on pods created by periodic jobs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@liouk: This pull request references Jira Issue OCPBUGS-85109, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR fixes the location of the required-scc annotation in the periodic-gathering job pod template.

Failing monitor tests: https://sippy.dptools.openshift.org/sippy-ng/tests/5.0/analysis?test=%5Bsig-auth%5D%20all%20workloads%20in%20ns%2Fopenshift-insights%20must%20set%20the%20%27openshift.io%2Frequired-scc%27%20annotation

Fixing this will allow us to drop the exception from the required-scc-annotation-checker monitor test.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Breaking Changes

No -- the pinned SCC is the one that the job pods are already getting admitted with (restricted-v2).

References

https://redhat.atlassian.net/browse/CNTRLPLANE-3386

https://redhat.atlassian.net/browse/OCPBUGS-85108

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@liouk: This pull request references Jira Issue OCPBUGS-85109, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

This PR fixes the location of the required-scc annotation in the periodic-gathering job pod template.

Failing monitor tests: https://sippy.dptools.openshift.org/sippy-ng/tests/5.0/analysis?test=%5Bsig-auth%5D%20all%20workloads%20in%20ns%2Fopenshift-insights%20must%20set%20the%20%27openshift.io%2Frequired-scc%27%20annotation

Fixing this will allow us to drop the exception from the required-scc-annotation-checker monitor test.

Categories

• Bugfix
• Data Enhancement
• Feature
• Backporting
• Others (CI, Infrastructure, Documentation)

Breaking Changes

No -- the pinned SCC is the one that the job pods are already getting admitted with (restricted-v2).

References

https://redhat.atlassian.net/browse/CNTRLPLANE-3386

https://redhat.atlassian.net/browse/OCPBUGS-85109

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[opokornyy]

/retest

[opokornyy]

/lgtm

[opokornyy]

/approve

[opokornyy]

/verified later @liouk

[openshift-ci-robot]

@opokornyy: This PR has been marked to be verified later by @liouk.

Details

In response to this:

/verified later @liouk

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liouk, opokornyy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [opokornyy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 4c4c3bb and 2 for PR HEAD c03e142 in total

[opokornyy]

/retest

[openshift-ci]

@liouk: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/insights-operator-e2e-tests	c03e142	link	true	/test insights-operator-e2e-tests
ci/prow/insights-operator-serial-tests	c03e142	link	true	/test insights-operator-serial-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.