WIP: CNTRLPLANE-3386: Required scc annotation checker updates#31325
WIP: CNTRLPLANE-3386: Required scc annotation checker updates#31325liouk wants to merge 2 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: automatic mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@liouk: This pull request references CNTRLPLANE-3386 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Walkthrough
ChangesRequired-SCC Monitor Filtering
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: liouk The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
openshift-ci
Bot
added
the
ready-for-human-review
|
Scheduling required tests: |
… required-scc requirement
…e system namespaces instead of flaking
liouk
force-pushed
the
required-scc-annotation-checker-updates
branch
from
b9ff22b to
51eaa69
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/monitortests/authentication/requiredsccmonitortests/monitortest.go`:
- Line 84: The pod filtering in CollectData only skips entire namespaces, so
CatalogSource-owned pods in allowed namespaces still reach the SCC validation
path. Update the pod-processing logic in CollectData to add an explicit owner
check for CatalogSource before calling the RequiredSCCAnnotation validation,
using the existing namespace skip helper and the pod iteration flow to keep the
exclusion at the pod level.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7d959271-f444-4097-bcc5-f7dc5f1c240e
📒 Files selected for processing (1)
pkg/monitortests/authentication/requiredsccmonitortests/monitortest.go
| // ignore openshift-must-gather-* namespaces which are generated dynamically | ||
| isPermanentOpenShiftNamespace := (ns.Name == "openshift" || strings.HasPrefix(ns.Name, "openshift-")) && !strings.HasPrefix(ns.Name, "openshift-must-gather-") | ||
| if !strings.HasPrefix(ns.Name, "kube-") && ns.Name != "default" && !isPermanentOpenShiftNamespace { | ||
| if shouldSkipNamespace(&ns) { |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the required-scc monitor has an explicit CatalogSource pod exclusion.
# Expected: a match that skips/continues CatalogSource-owned pods before required SCC validation.
rg -n -C4 --type go 'CatalogSource|catalogsource|OwnerReference|ownerReferences|RequiredSCCAnnotation' pkg/monitortests/authentication/requiredsccmonitortests/monitortest.goRepository: openshift/origin
Length of output: 1589
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the monitor implementation around the validation loop and namespace skip logic.
sed -n '1,260p' pkg/monitortests/authentication/requiredsccmonitortests/monitortest.goRepository: openshift/origin
Length of output: 6351
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the monitor implementation around the validation loop and namespace skip logic.
sed -n '1,260p' pkg/monitortests/authentication/requiredsccmonitortests/monitortest.goRepository: openshift/origin
Length of output: 6351
Add a pod-level CatalogSource skip. CollectData only filters namespaces here; pods in included namespaces still go through the SCC checks, so CatalogSource-owned pods are not excluded. Add an explicit pod-owner check before validating RequiredSCCAnnotation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/monitortests/authentication/requiredsccmonitortests/monitortest.go` at
line 84, The pod filtering in CollectData only skips entire namespaces, so
CatalogSource-owned pods in allowed namespaces still reach the SCC validation
path. Update the pod-processing logic in CollectData to add an explicit owner
check for CatalogSource before calling the RequiredSCCAnnotation validation,
using the existing namespace skip helper and the pod iteration flow to keep the
exclusion at the pod level.
|
Scheduling required tests: |
|
@liouk: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
This PR does the following updates in the
required-scc-annotation-checkermonitor test:Summary by CodeRabbit
Summary by CodeRabbit