NO-JIRA: report preflight pod status in status condition#2315
Conversation
|
@tjungblu: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
Walkthrough
ChangesKMS Preflight Pod Status Reporting
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning, 1 inconclusive)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: tjungblu The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/operator/encryption/kms/preflight/cmd.go`:
- Around line 65-71: The error returned by the setPodCheckCondition function
call is being logged but discarded; if checkErr is nil (preflight check passed),
the function still returns success on line 74 even though the condition
reporting failed. Instead of only logging the error from setPodCheckCondition,
properly handle it by either returning it directly if it occurs, or aggregating
it with checkErr so that failures in condition reporting are not silently
ignored and result in the function returning an error rather than success.
In `@pkg/operator/encryption/kms/preflight/pod_status.go`:
- Around line 52-53: The UpdateStatus call at line 52 needs to handle concurrent
pod status updates that may result in conflict errors. Wrap the entire operation
that includes the preceding Get call and the UpdateStatus call within
retry.RetryOnConflict to automatically retry on conflicts. The retry logic
should fetch the current pod state with Get, apply any necessary modifications
to the status, and then attempt UpdateStatus, allowing the operation to retry if
a conflict occurs during the update.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c82a7e83-4d01-4726-9221-4235504bb722
📒 Files selected for processing (5)
pkg/operator/encryption/kms/preflight/checker.gopkg/operator/encryption/kms/preflight/checker_test.gopkg/operator/encryption/kms/preflight/cmd.gopkg/operator/encryption/kms/preflight/pod_status.gopkg/operator/encryption/kms/preflight/pod_status_test.go
Uses the downward API and service account from openshift#2307 to post the status of the check in dedicated pod conditions. This also adds the kekId that is important for the rotation later. Signed-off-by: Thomas Jungblut <tjungblu@redhat.com>
tjungblu
force-pushed
the
report_preflight_result_pod_status
branch
from
9eb3372 to
b137471
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/operator/encryption/kms/preflight/pod_status.go`:
- Around line 33-35: The condition at lines 33-35 silently returns nil when
namespace or name is empty, which allows the preflight check to appear
successful without actually reporting Pod status. Replace this silent nil return
with an appropriate error return that indicates the pod identity environment
variables are missing, ensuring the preflight check fails fast and clearly
reports the failure when namespace or name is empty.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fbac80ca-2faf-4ed1-bf2d-e34e03aff280
📒 Files selected for processing (5)
pkg/operator/encryption/kms/preflight/checker.gopkg/operator/encryption/kms/preflight/checker_test.gopkg/operator/encryption/kms/preflight/cmd.gopkg/operator/encryption/kms/preflight/pod_status.gopkg/operator/encryption/kms/preflight/pod_status_test.go
🚧 Files skipped from review as they are similar to previous changes (2)
- pkg/operator/encryption/kms/preflight/checker_test.go
- pkg/operator/encryption/kms/preflight/checker.go
| if namespace == "" || name == "" { | ||
| return nil | ||
| } |
There was a problem hiding this comment.
Fail fast when pod identity env vars are missing.
At Line 33-Line 35, returning nil silently skips condition publication, so preflight can appear successful without reporting Pod status. This weakens the feature’s primary objective.
Suggested fix
- if namespace == "" || name == "" {
- return nil
- }
+ if namespace == "" || name == "" {
+ return fmt.Errorf("missing POD_NAMESPACE or POD_NAME; cannot report preflight pod conditions")
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if namespace == "" || name == "" { | |
| return nil | |
| } | |
| if namespace == "" || name == "" { | |
| return fmt.Errorf("missing POD_NAMESPACE or POD_NAME; cannot report preflight pod conditions") | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/operator/encryption/kms/preflight/pod_status.go` around lines 33 - 35,
The condition at lines 33-35 silently returns nil when namespace or name is
empty, which allows the preflight check to appear successful without actually
reporting Pod status. Replace this silent nil return with an appropriate error
return that indicates the pod identity environment variables are missing,
ensuring the preflight check fails fast and clearly reports the failure when
namespace or name is empty.
|
@tjungblu: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Uses the downward API and service account from #2307 to post the status of the check in dedicated pod conditions.
This also adds the kekId that is important for the rotation later.
Summary by CodeRabbit
Release Notes
New Features
Improvements
Tests