Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCPBUGS-44961: Fix "Enforce the required-scc monitor test and validate usage of non-standard OCP SCCs" #29323

Merged

Conversation

kramaranya
Copy link
Contributor

@kramaranya kramaranya commented Nov 25, 2024

Enforced required-scc monitor test for fixed namespaces. Extended the required-scc monitor test to validate non-standard SCCs and ensure they are only used in allowed namespaces.

Fixed the issue from revert #29321

Added system namespaces such as default, kube-system, kube-public, openshift-node, openshift-infra, and openshift to ensure they are treated as flaking namespaces.

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Nov 25, 2024
@openshift-ci-robot
Copy link

@kramaranya: This pull request references Jira Issue OCPBUGS-42435, which is invalid:

  • expected the bug to target either version "4.19." or "openshift-4.19.", but it targets "4.18.0" instead
  • expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@kramaranya kramaranya changed the title OCPBUGS-42435: Fix "Enforce the required-scc monitor test and validate usage of non-standard OCP SCCs" NO-JIRA: Fix "Enforce the required-scc monitor test and validate usage of non-standard OCP SCCs" Nov 25, 2024
@openshift-ci-robot
Copy link

@kramaranya: This pull request explicitly references no jira issue.

In response to this:

Enforced required-scc monitor test for fixed namespaces. Extended the required-scc monitor test to validate non-standard SCCs and ensure they are only used in allowed namespaces.

Fixed the issue from revert #29321

Added system namespaces such as default, kube-system, kube-public, openshift-node, openshift-infra, and openshift to ensure they are treated as flaking namespaces.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Nov 25, 2024
"openshift-machine-api",
"openshift-marketplace",
"openshift-monitoring",
)
Copy link
Member

@stbenjam stbenjam Nov 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you include https://github.com/openshift/origin/blob/master/test/extended/util/managed_services.go#L8-L28 in this set?

.Union(ManagedServiceNamespaces)

ROSA managed service namespaces had also failed on this enforcement

Comment on lines +116 to +118
if exutil.ManagedServiceNamespaces.Has(ns.Name) {
continue
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stbenjam we have decided to skip scc pinning for the namespaces in ManagedServiceNamespaces. If you believe these namespaces should instead be treated as flaking, please let us know.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI ^^^ Flaking means that the test might sometimes pass and sometimes fail. By treating these namespaces as flaking, we allow our tests to continue without blocking progress. So if we decide to treat them as flaking, those namespaces should be fixed and eventually removed from the flaking list.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipping them entirely sounds fine, thanks

@kramaranya kramaranya force-pushed the enforce-required-scc-test branch from 0d5aa49 to 46485ae Compare November 26, 2024 14:35
@sosiouxme sosiouxme changed the title NO-JIRA: Fix "Enforce the required-scc monitor test and validate usage of non-standard OCP SCCs" OCPBUGS-44961: Fix "Enforce the required-scc monitor test and validate usage of non-standard OCP SCCs" Nov 26, 2024
@openshift-ci-robot openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Nov 26, 2024
@openshift-ci-robot
Copy link

@kramaranya: This pull request references Jira Issue OCPBUGS-44961, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.19.0) matches configured target version for branch (4.19.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Enforced required-scc monitor test for fixed namespaces. Extended the required-scc monitor test to validate non-standard SCCs and ensure they are only used in allowed namespaces.

Fixed the issue from revert #29321

Added system namespaces such as default, kube-system, kube-public, openshift-node, openshift-infra, and openshift to ensure they are treated as flaking namespaces.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@liouk
Copy link
Member

liouk commented Nov 28, 2024

/lgtm

@liouk
Copy link
Member

liouk commented Nov 28, 2024

Holding for open question: #29323 (comment)

/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 28, 2024
@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 28, 2024
@kramaranya
Copy link
Contributor Author

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 2, 2024
@kramaranya
Copy link
Contributor Author

/payload-job periodic-ci-openshift-hypershift-release-4.19-periodics-e2e-aws-ovn-conformance

Copy link
Contributor

openshift-ci bot commented Dec 2, 2024

@kramaranya: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-4.19-periodics-e2e-aws-ovn-conformance

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/28607f00-b0b0-11ef-80d7-6c637312998c-0

@sosiouxme
Copy link
Member

/approve
/retest

Copy link
Contributor

openshift-ci bot commented Dec 2, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kramaranya, liouk, sosiouxme

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 2, 2024
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 3020953 and 2 for PR HEAD 46485ae in total

Copy link
Contributor

openshift-ci bot commented Dec 2, 2024

@kramaranya: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-single-node-upgrade 46485ae link false /test e2e-aws-ovn-single-node-upgrade
ci/prow/e2e-openstack-ovn 46485ae link false /test e2e-openstack-ovn
ci/prow/e2e-aws-ovn-single-node 46485ae link false /test e2e-aws-ovn-single-node
ci/prow/e2e-agnostic-ovn-cmd 46485ae link false /test e2e-agnostic-ovn-cmd

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit e075d0e into openshift:master Dec 2, 2024
24 of 28 checks passed
@openshift-ci-robot
Copy link

@kramaranya: Jira Issue OCPBUGS-44961: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-44961 has been moved to the MODIFIED state.

In response to this:

Enforced required-scc monitor test for fixed namespaces. Extended the required-scc monitor test to validate non-standard SCCs and ensure they are only used in allowed namespaces.

Fixed the issue from revert #29321

Added system namespaces such as default, kube-system, kube-public, openshift-node, openshift-infra, and openshift to ensure they are treated as flaking namespaces.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot
Copy link
Contributor

[ART PR BUILD NOTIFIER]

Distgit: openshift-enterprise-tests
This PR has been included in build openshift-enterprise-tests-container-v4.19.0-202412030238.p0.ge075d0e.assembly.stream.el9.
All builds following this will include this PR.

@kramaranya
Copy link
Contributor Author

/cherry-pick release-4.18

@openshift-cherrypick-robot

@kramaranya: new pull request created: #29338

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants