Skip to content

CMP-3540: Remove SDN proxy kubeconfig assertions from 4.17+ assertion files #13987

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 17, 2025
Merged

CMP-3540: Remove SDN proxy kubeconfig assertions from 4.17+ assertion files #13987

merged 1 commit into from
Oct 17, 2025

Conversation

@rhmdnd
Copy link
Collaborator

@rhmdnd rhmdnd commented Oct 4, 2025

OpenShift uses OVN Kubernetes on 4.17, and the SDN rules are not
applicable in those versions such that they're not run in profiles that
use them. This commit removes the assertions that expect them to be
there on those versions.

@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 4, 2025

/test

@openshift-ci
Copy link

openshift-ci bot commented Oct 4, 2025

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.12-e2e-aws-ocp4-cis

/test 4.12-e2e-aws-ocp4-cis-node

/test 4.12-e2e-aws-ocp4-e8

/test 4.12-e2e-aws-ocp4-high

/test 4.12-e2e-aws-ocp4-high-node

/test 4.12-e2e-aws-ocp4-moderate

/test 4.12-e2e-aws-ocp4-moderate-node

/test 4.12-e2e-aws-ocp4-pci-dss

/test 4.12-e2e-aws-ocp4-pci-dss-4-0

/test 4.12-e2e-aws-ocp4-pci-dss-node

/test 4.12-e2e-aws-ocp4-pci-dss-node-4-0

/test 4.12-e2e-aws-ocp4-stig

/test 4.12-e2e-aws-ocp4-stig-node

/test 4.12-e2e-aws-rhcos4-e8

/test 4.12-e2e-aws-rhcos4-high

/test 4.12-e2e-aws-rhcos4-moderate

/test 4.12-e2e-aws-rhcos4-stig

/test 4.12-images

/test 4.14-e2e-aws-ocp4-bsi

/test 4.14-e2e-aws-ocp4-bsi-node

/test 4.14-e2e-aws-ocp4-pci-dss-4-0

/test 4.14-e2e-aws-ocp4-pci-dss-node-4-0

/test 4.14-e2e-aws-rhcos4-bsi

/test 4.14-images

/test 4.16-e2e-aws-ocp4-bsi

/test 4.16-e2e-aws-ocp4-bsi-node

/test 4.16-e2e-aws-ocp4-cis

/test 4.16-e2e-aws-ocp4-cis-node

/test 4.16-e2e-aws-ocp4-e8

/test 4.16-e2e-aws-ocp4-high

/test 4.16-e2e-aws-ocp4-high-node

/test 4.16-e2e-aws-ocp4-moderate

/test 4.16-e2e-aws-ocp4-moderate-node

/test 4.16-e2e-aws-ocp4-pci-dss

/test 4.16-e2e-aws-ocp4-pci-dss-4-0

/test 4.16-e2e-aws-ocp4-pci-dss-node

/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0

/test 4.16-e2e-aws-ocp4-stig

/test 4.16-e2e-aws-ocp4-stig-node

/test 4.16-e2e-aws-rhcos4-bsi

/test 4.16-e2e-aws-rhcos4-e8

/test 4.16-e2e-aws-rhcos4-high

/test 4.16-e2e-aws-rhcos4-moderate

/test 4.16-e2e-aws-rhcos4-stig

/test 4.16-images

/test 4.17-e2e-aws-ocp4-bsi

/test 4.17-e2e-aws-ocp4-bsi-node

/test 4.17-e2e-aws-ocp4-cis

/test 4.17-e2e-aws-ocp4-cis-node

/test 4.17-e2e-aws-ocp4-e8

/test 4.17-e2e-aws-ocp4-high

/test 4.17-e2e-aws-ocp4-high-node

/test 4.17-e2e-aws-ocp4-moderate

/test 4.17-e2e-aws-ocp4-moderate-node

/test 4.17-e2e-aws-ocp4-pci-dss

/test 4.17-e2e-aws-ocp4-pci-dss-4-0

/test 4.17-e2e-aws-ocp4-pci-dss-node

/test 4.17-e2e-aws-ocp4-pci-dss-node-4-0

/test 4.17-e2e-aws-ocp4-stig

/test 4.17-e2e-aws-ocp4-stig-node

/test 4.17-e2e-aws-rhcos4-bsi

/test 4.17-e2e-aws-rhcos4-e8

/test 4.17-e2e-aws-rhcos4-high

/test 4.17-e2e-aws-rhcos4-moderate

/test 4.17-e2e-aws-rhcos4-stig

/test 4.17-images

/test 4.18-e2e-aws-ocp4-bsi

/test 4.18-e2e-aws-ocp4-bsi-node

/test 4.18-e2e-aws-ocp4-cis

/test 4.18-e2e-aws-ocp4-cis-node

/test 4.18-e2e-aws-ocp4-e8

/test 4.18-e2e-aws-ocp4-high

/test 4.18-e2e-aws-ocp4-high-node

/test 4.18-e2e-aws-ocp4-moderate

/test 4.18-e2e-aws-ocp4-moderate-node

/test 4.18-e2e-aws-ocp4-pci-dss

/test 4.18-e2e-aws-ocp4-pci-dss-4-0

/test 4.18-e2e-aws-ocp4-pci-dss-node

/test 4.18-e2e-aws-ocp4-pci-dss-node-4-0

/test 4.18-e2e-aws-ocp4-stig

/test 4.18-e2e-aws-ocp4-stig-node

/test 4.18-e2e-aws-rhcos4-bsi

/test 4.18-e2e-aws-rhcos4-e8

/test 4.18-e2e-aws-rhcos4-high

/test 4.18-e2e-aws-rhcos4-moderate

/test 4.18-e2e-aws-rhcos4-stig

/test 4.18-images

/test 4.19-e2e-aws-ocp4-bsi

/test 4.19-e2e-aws-ocp4-bsi-node

/test 4.19-e2e-aws-ocp4-cis

/test 4.19-e2e-aws-ocp4-cis-node

/test 4.19-e2e-aws-ocp4-e8

/test 4.19-e2e-aws-ocp4-high

/test 4.19-e2e-aws-ocp4-high-node

/test 4.19-e2e-aws-ocp4-moderate

/test 4.19-e2e-aws-ocp4-moderate-node

/test 4.19-e2e-aws-ocp4-pci-dss

/test 4.19-e2e-aws-ocp4-pci-dss-4-0

/test 4.19-e2e-aws-ocp4-pci-dss-node

/test 4.19-e2e-aws-ocp4-pci-dss-node-4-0

/test 4.19-e2e-aws-ocp4-stig

/test 4.19-e2e-aws-ocp4-stig-node

/test 4.19-e2e-aws-rhcos4-bsi

/test 4.19-e2e-aws-rhcos4-e8

/test 4.19-e2e-aws-rhcos4-high

/test 4.19-e2e-aws-rhcos4-moderate

/test 4.19-e2e-aws-rhcos4-stig

/test 4.19-e2e-rosa-ocp4-cis-node

/test 4.19-e2e-rosa-ocp4-pci-dss-node

/test 4.19-images

/test e2e-aws-ocp4-bsi

/test e2e-aws-ocp4-bsi-node

/test e2e-aws-ocp4-cis

/test e2e-aws-ocp4-cis-arm

/test e2e-aws-ocp4-cis-node

/test e2e-aws-ocp4-cis-node-arm

/test e2e-aws-ocp4-e8

/test e2e-aws-ocp4-high

/test e2e-aws-ocp4-high-node

/test e2e-aws-ocp4-moderate

/test e2e-aws-ocp4-moderate-arm

/test e2e-aws-ocp4-moderate-node

/test e2e-aws-ocp4-moderate-node-arm

/test e2e-aws-ocp4-pci-dss

/test e2e-aws-ocp4-pci-dss-4-0

/test e2e-aws-ocp4-pci-dss-node

/test e2e-aws-ocp4-pci-dss-node-4-0

/test e2e-aws-ocp4-stig

/test e2e-aws-ocp4-stig-node

/test e2e-aws-openshift-node-compliance

/test e2e-aws-openshift-platform-compliance

/test e2e-aws-rhcos4-bsi

/test e2e-aws-rhcos4-e8

/test e2e-aws-rhcos4-high

/test e2e-aws-rhcos4-moderate

/test e2e-aws-rhcos4-moderate-arm

/test e2e-aws-rhcos4-stig

/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.12-images

pull-ci-ComplianceAsCode-content-master-4.14-images

pull-ci-ComplianceAsCode-content-master-4.16-images

pull-ci-ComplianceAsCode-content-master-4.17-images

pull-ci-ComplianceAsCode-content-master-4.18-images

pull-ci-ComplianceAsCode-content-master-4.19-images

pull-ci-ComplianceAsCode-content-master-e2e-aws-openshift-node-compliance

pull-ci-ComplianceAsCode-content-master-e2e-aws-openshift-platform-compliance

pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 4, 2025

/test 4.18-e2e-aws-ocp4-cis

@jan-cerny jan-cerny added the OpenShift OpenShift product related. label Oct 6, 2025
yuumasato
yuumasato requested changes Oct 7, 2025
View reviewed changes
Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rhmdnd So if I understand correctly, the rules are still evaluated, but result in NOT-APPLICABLE.
After ocp4e2e refactor we started looping through ComplianceCheckResutls, and rules resulting in NOT-APPLICABLE don't generate a CCR. Is that correct?
If so it probably makes sense to remove all rules resulting in NOT-APPLICABLE.

@rhmdnd rhmdnd force-pushed the CMP-3540-remove-sdn-assertions-from-newer-openshift-testing branch from c84045d to 51d4af4 Compare October 15, 2025 18:53
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 15, 2025

Rebasing to freshen up the test results

@yuumasato yuumasato self-assigned this Oct 16, 2025
@yuumasato yuumasato added this to the 0.1.79 milestone Oct 16, 2025
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 16, 2025

/test e2e-aws-openshift-node-compliance
/test 4.18-e2e-aws-ocp4-cis

@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 16, 2025

@rhmdnd So if I understand correctly, the rules are still evaluated, but result in NOT-APPLICABLE. After ocp4e2e refactor we started looping through ComplianceCheckResutls, and rules resulting in NOT-APPLICABLE don't generate a CCR. Is that correct? If so it probably makes sense to remove all rules resulting in NOT-APPLICABLE.

I think it depends on how we want to view the results. Keeping the NOT-APPLICABLE in the assertion file is more explicit, but I do see where it adds overhead.

@rhmdnd rhmdnd force-pushed the CMP-3540-remove-sdn-assertions-from-newer-openshift-testing branch from 51d4af4 to 1aae4e2 Compare October 16, 2025 16:26
@rhmdnd
CMP-3540: Remove SDN proxy kubeconfig assertions from 4.17+ assertion…
fba218c 
… files

OpenShift uses OVN Kubernetes on 4.17, and the SDN rules are not
applicable in those versions such that they're not run in profiles that
use them. This commit removes the assertions that expect them to be
there on those versions.
@rhmdnd rhmdnd force-pushed the CMP-3540-remove-sdn-assertions-from-newer-openshift-testing branch from 1aae4e2 to fba218c Compare October 16, 2025 16:46
@rhmdnd rhmdnd requested a review from yuumasato October 16, 2025 16:47
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 16, 2025

/test 4.18-e2e-aws-ocp4-cis

@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Oct 16, 2025

/test 4.18-e2e-aws-ocp4-cis-node

@openshift-ci
Copy link

openshift-ci bot commented Oct 16, 2025

@rhmdnd: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-openshift-node-compliance fba218c link true /test e2e-aws-openshift-node-compliance
ci/prow/4.18-e2e-aws-ocp4-cis fba218c link true /test 4.18-e2e-aws-ocp4-cis
ci/prow/4.18-e2e-aws-ocp4-cis-node fba218c link true /test 4.18-e2e-aws-ocp4-cis-node

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

yuumasato
yuumasato approved these changes Oct 17, 2025
View reviewed changes
Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@yuumasato
Copy link
Member

@rhmdnd So if I understand correctly, the rules are still evaluated, but result in NOT-APPLICABLE. After ocp4e2e refactor we started looping through ComplianceCheckResutls, and rules resulting in NOT-APPLICABLE don't generate a CCR. Is that correct? If so it probably makes sense to remove all rules resulting in NOT-APPLICABLE.

I think it depends on how we want to view the results. Keeping the NOT-APPLICABLE in the assertion file is more explicit, but I do see where it adds overhead.

Yeah, let's remove these NOT-APPLICABLE results for now.

@yuumasato yuumasato merged commit 9445fe1 into ComplianceAsCode:master Oct 17, 2025
137 of 142 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yuumasato yuumasato yuumasato approved these changes

@Vincent056 Vincent056 Awaiting requested review from Vincent056 Vincent056 is a code owner

Assignees

@yuumasato yuumasato

Labels

OpenShift OpenShift product related.

Projects

None yet

Milestone

0.1.79

Development

Successfully merging this pull request may close these issues.

3 participants

@rhmdnd @yuumasato @jan-cerny