[main] OCPBUGS-112332: monitortests: skip PodSecurityViolation invariant when OpenShiftPodSecurityAdmission is disabled - #31571
Conversation
…curityAdmission is disabled With the OpenShiftPodSecurityAdmission feature gate disabled, the PSA label syncer runs in advising mode and no longer sets the pod-security.kubernetes.io/enforce label on namespaces. Workloads that key their security context off that label, such as OLM catalog registry pods via getDefaultPodContextConfig, then run with a legacy security context. The global PodSecurity audit configuration is not feature-gated and stays at restricted:latest, so creating those pods stamps pod-security.kubernetes.io/audit-violations annotations into the audit log by design, and this zero-tolerance invariant fails every run. Skip the invariant when the gate is explicitly disabled for the current cluster version. Any error or ambiguity while reading the FeatureGate keeps the invariant enforcing, and clusters with the gate enabled are unaffected.
|
Pipeline controller notification For optional jobs, comment This repository is configured in: automatic mode |
openshift-ci
Bot
added
the
ready-for-human-review
|
@openshift-cherrypick-robot: Detected clone of Jira Issue OCPBUGS-83412 with correct target version. Will retitle the PR to link to the clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/severity-critical
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-112332, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-cherrypick-robot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. WalkthroughThe audit log analyzer now detects whether ChangesPSA audit validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This localized change updates monitor-test behavior for disabled OpenShift pod security admission and adds coverage; no actionable merge-blocking risk remains beyond normal checks and review. Sequence Diagram(s)sequenceDiagram
participant auditLogAnalyzer
participant FeatureGateClient
participant CreateJunits
auditLogAnalyzer->>FeatureGateClient: determine PSA enforcement state
FeatureGateClient-->>auditLogAnalyzer: return FeatureGate configuration
auditLogAnalyzer->>CreateJunits: pass psaEnforcementDisabled
CreateJunits-->>auditLogAnalyzer: produce failure or skipped JUnit result
🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
Full details: Stable And Deterministic Test NamesExplanation PASS. The pull request adds standard Go tests and table-driven Full details: Test Structure And QualityExplanation PASS: The pull request adds ordinary Full details: Microshift Test CompatibilityExplanation PASS: The pull request adds standard Go unit tests, not new Ginkgo e2e tests. The added file imports Full details: Single Node Openshift (Sno) Test CompatibilityExplanation The check is not applicable. The pull request adds standard Go Full details: Topology-Aware Scheduling CompatibilityExplanation PASS: The pull request changes only audit-log monitor logic and tests. The diff adds FeatureGate lookup and JUnit skip behavior. It adds no deployment, controller, or operator scheduling configuration. The changed hunks contain no affinity, topology spread, replica, node selector, toleration, PDB, or control-plane scheduling constraints. Therefore, the topology-aware scheduling check is not applicable. Full details: Ote Binary Stdout ContractExplanation PASS: The pull request adds no stdout writes in process-level code. The changed implementation uses Full details: Ipv6 And Disconnected Network Test CompatibilityExplanation PASS — The pull request adds standard Go Full details: No-Weak-CryptoExplanation PASS: The pull request adds FeatureGate lookup, JUnit skip logic, and tests only. The exact diff introduces no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret/token comparisons. No weak-crypto usage is present in the changed files. Full details: Container-PrivilegesExplanation The pull request changes only three Go files under the audit log analyzer. The diff adds no container or Kubernetes manifest and no added line contains Full details: No-Sensitive-Data-In-LogsExplanation No sensitive-data logging was introduced. The new skip message contains only the feature-gate name, a violation count, and a generic reference to the audit log. The existing failure output still includes audit ID, resource, namespace, username, and violation text, but that output is unchanged from the parent revision. The new tests use synthetic service-account data.
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@sdodson: This pull request references Jira Issue OCPBUGS-112332, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (xxia@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling required tests: |
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
|
@openshift-cherrypick-robot: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
This is an automated cherry-pick of #31561
/assign sdodson
Summary by CodeRabbit
Bug Fixes
Tests