OCPBUGS-83412: monitortests: skip PodSecurityViolation invariant when OpenShiftPodSecurityAdmission is disabled - #31561
Conversation
…curityAdmission is disabled With the OpenShiftPodSecurityAdmission feature gate disabled, the PSA label syncer runs in advising mode and no longer sets the pod-security.kubernetes.io/enforce label on namespaces. Workloads that key their security context off that label, such as OLM catalog registry pods via getDefaultPodContextConfig, then run with a legacy security context. The global PodSecurity audit configuration is not feature-gated and stays at restricted:latest, so creating those pods stamps pod-security.kubernetes.io/audit-violations annotations into the audit log by design, and this zero-tolerance invariant fails every run. Skip the invariant when the gate is explicitly disabled for the current cluster version. Any error or ambiguity while reading the FeatureGate keeps the invariant enforcing, and clusters with the gate enabled are unaffected.
|
Pipeline controller notification For optional jobs, comment This repository is configured in: automatic mode |
openshift-ci
Bot
added
the
do-not-merge/hold
openshift-ci-robot
added
jira/severity-critical
|
@ibihim: This pull request references Jira Issue OCPBUGS-83412, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (xxia@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ibihim The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Scheduling required tests: |
|
/override ci/prow/e2e-aws-ovn-microshift-serial Automated triage: This failure appears unrelated to the PR changes. Rationale: The job failed in the pre-test Evidence:
If you disagree with this assessment, AI-generated. Review for accuracy. |
|
@redhat-chai-bot: Overrode contexts on behalf of redhat-chai-bot: ci/prow/e2e-aws-ovn-microshift-serial DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test e2e-aws-ovn |
|
@ibihim: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
The
e2e-aws-ovn,e2e-azureande2e-gcppresubmits on openshift/api#3002 fail on a single monitor test,[bz-apiserver-auth][invariant] audit analysis PodSecurityViolation(example junit). Everything else in those runs is fail-then-pass flakes.What happens. With
OpenShiftPodSecurityAdmissiondisabled, the PSA label syncer runs in advising mode and no longer sets thepod-security.kubernetes.io/enforcelabel on namespaces (psalabelsyncer.go#L19). OLM's catalog-operator defaults the registry pod security context by reading exactly that label, no label meanslegacypod (reconciler.go#L412). The global PodSecurityaudit: restricted:latestconfiguration is not feature-gated, so every such pod stamps apod-security.kubernetes.io/audit-violationsannotation into the audit log, and this invariant fails on any violation. The violations are by design, the invariant asserts a property that a gate-off cluster intentionally gives up.What this PR does. Skip the invariant when the gate is explicitly disabled for the cluster's current version. Reading the
FeatureGatestatus follows the existing pattern in cluster.go#L152. Fail closed: any error or ambiguity keeps the invariant enforcing. Clusters with the gate enabled, which is every current payload including TechPreview, are unaffected.Test plan.
CreateJunitsandisPodSecurityEnforcementDisabled/testwith openshift/api/release-5.0/e2e-aws-ovn openshift/origin#31561commented on OCPBUGS-83412: Disable PSA for placeholder for 5.0 api#3002, the currently failing presubmit must go green with this PR in the payloadThe same patch applies to
main, the package is identical on both branches. Main PR follows, this one is the verification target for openshift/api#3002./hold until the verification on openshift/api#3002 is done