OCPBUGS-112332: Add missing `securityContextConfig: restricted` to catalog source templates by oceanc80 · Pull Request #31562 · openshift/origin

oceanc80 · 2026-08-26T12:59:47Z

Add missing securityContextConfig: restricted to catalog source templates

Summary by CodeRabbit

Bug Fixes
- Updated CatalogSource configurations to use restricted security contexts for gRPC pods.
- Preserved existing update strategies while applying the security configuration across supported CatalogSource scenarios.
Tests
- Updated compatibility test coverage to validate restricted security settings for address-based, ConfigMap, image-based, namespace, and OPM CatalogSources.

openshift-merge-bot · 2026-08-26T12:59:51Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-08-26T12:59:56Z

@oceanc80: This pull request references Jira Issue OCPBUGS-112332, which is invalid:

expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Verified instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Add missing securityContextConfig: restricted to catalog source templates

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-26T13:00:18Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: aa1ace9e-8549-47ec-9566-9dd3d22e4fe5

📥 Commits

Reviewing files that changed from the base of the PR and between 3068afd and 08dffdf.

📒 Files selected for processing (8)

test/extended/util/compat_otp/testdata/olm/catalogsource-address.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-configmap.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-image-cacheless.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-image-extract.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-image-incorrect-updatestrategy.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-image.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-namespace.yaml
test/extended/util/compat_otp/testdata/olm/catalogsource-opm.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The compatibility test fixtures now set grpcPodConfig.securityContextConfig to restricted across eight CatalogSource scenarios. The incorrect update strategy fixture preserves its registryPoll configuration.

Changes

CatalogSource security context

Layer / File(s)	Summary
Update CatalogSource fixture security settings `test/extended/util/compat_otp/testdata/olm/catalogsource-*.yaml`	The CatalogSource fixtures now configure restricted gRPC pod security contexts. The incorrect update strategy fixture retains its `registryPoll` configuration.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 08dff

This localized template update adds the requested security context configuration, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the missing `securityContextConfig: restricted` setting to catalog source templates. It also includes the relevant bug identifier.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only eight YAML CatalogSource fixtures under `test/extended/util/compat_otp/testdata/olm/`. The diff adds `grpcPodConfig.securityContextConfig: restricted` and normalize…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only eight YAML fixture files under `test/extended/util/compat_otp/testdata/olm`. The diff adds `grpcPodConfig.securityContextConfig: restricted` and changes no Ginkgo `…
Microshift Test Compatibility	✅ Passed	PASS — The pull request changes only eight existing YAML test fixtures. The commit adds `grpcPodConfig.securityContextConfig: restricted` and adjusts one `updateStrategy` formatting line. It adds no `…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only eight existing YAML CatalogSource fixtures. The exact patch adds `grpcPodConfig.securityContextConfig: restricted` and one whitespace normalization; it adds no `It(…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR changes only eight CatalogSource test fixtures. Each added field is `spec.grpcPodConfig.securityContextConfig: restricted`; the diff adds no replicas, affinity, topology spread, node sele…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only eight YAML test-data files under `test/extended/util/compat_otp/testdata/olm`. The diff adds `grpcPodConfig.securityContextConfig: restricted` and removes trailing …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only eight YAML CatalogSource fixtures. The diff adds `grpcPodConfig.securityContextConfig: restricted` and removes trailing whitespace. It adds no Ginkgo tests, IPv4 li…
No-Weak-Crypto	✅ Passed	The pull request changes only eight CatalogSource YAML fixtures. The added setting is `grpcPodConfig.securityContextConfig: restricted` (plus whitespace normalization in one file). The diff introduces…
Container-Privileges	✅ Passed	PASS. The pull request changes only eight CatalogSource YAML fixtures. The added fields are `grpcPodConfig.securityContextConfig: restricted`. No changed file or added line contains `privileged: true`…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request changes only eight CatalogSource YAML fixtures. The added content is `grpcPodConfig.securityContextConfig: restricted` (plus whitespace normalization of `updateStrategy:`). No l…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only eight YAML CatalogSource fixtures under test/extended/util/compat_otp/testdata/olm/. The diff adds grpcPodConfig.securityContextConfig: restricted and normalizes one YAML line. It adds no It(), Describe(), Context(), When(), or other test title, so it introduces no dynamic or overly specific test name.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only eight YAML fixture files under test/extended/util/compat_otp/testdata/olm. The diff adds grpcPodConfig.securityContextConfig: restricted and changes no Ginkgo It blocks, setup or cleanup hooks, cluster operations, waits, or assertions. Therefore, none of the five stated test-structure failure conditions applies.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request changes only eight existing YAML test fixtures. The commit adds grpcPodConfig.securityContextConfig: restricted and adjusts one updateStrategy formatting line. It adds no It(), Describe(), Context(), or When() Ginkgo tests, so the MicroShift test-compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only eight existing YAML CatalogSource fixtures. The exact patch adds grpcPodConfig.securityContextConfig: restricted and one whitespace normalization; it adds no It(), Describe(), Context(), or When() Ginkgo test. Therefore the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The PR changes only eight CatalogSource test fixtures. Each added field is spec.grpcPodConfig.securityContextConfig: restricted; the diff adds no replicas, affinity, topology spread, node selectors/affinity, tolerations, disruption budgets, or other scheduling constraints. The only other change removes trailing whitespace from updateStrategy:. Therefore, the PR does not introduce any failure condition in this topology-aware scheduling check.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only eight YAML test-data files under test/extended/util/compat_otp/testdata/olm. The diff adds grpcPodConfig.securityContextConfig: restricted and removes trailing whitespace from one YAML key. It changes no Go process code, main(), suite setup, logging configuration, or stdout write. Therefore, the pull request does not introduce the stated OTE binary stdout contract failure.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only eight YAML CatalogSource fixtures. The diff adds grpcPodConfig.securityContextConfig: restricted and removes trailing whitespace. It adds no Ginkgo tests, IPv4 literals, IPv6-sensitive URL construction, or external connectivity requirements.

Full details: No-Weak-Crypto

Explanation

The pull request changes only eight CatalogSource YAML fixtures. The added setting is grpcPodConfig.securityContextConfig: restricted (plus whitespace normalization in one file). The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB mode, custom cryptography, or secret/token comparison logic.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only eight CatalogSource YAML fixtures. The added fields are grpcPodConfig.securityContextConfig: restricted. No changed file or added line contains privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or root settings. The custom failure conditions are not introduced.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request changes only eight CatalogSource YAML fixtures. The added content is grpcPodConfig.securityContextConfig: restricted (plus whitespace normalization of updateStrategy:). No logging code, log configuration, passwords, tokens, API keys, PII, hostnames, or customer data is introduced. Existing ${SECRET} placeholders are unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

grokspawn · 2026-08-26T13:16:17Z

The changes look fine, but since we don't have any known tests executing in namespaces without openshift-* prefix this ensures that any catalogs created by these templates will have the appropriate PSA from creation.
We're left with a more general problem where the audit will fail if anyone creates a test in the future with no SCC on the catsrc pod, and would have to chase this issue anew.
/lgtm
/approve

grokspawn · 2026-08-26T13:18:19Z

      mediatype: ""
    publisher: "${PUBLISHER}"
    sourceType: "${SOURCETYPE}"
+    grpcPodConfig:


this is ignored by OLM, since this is not a GRPC pod

grokspawn · 2026-08-26T13:20:04Z

  name: scenario3
  namespace: scenario3
 spec:
  sourceType: internal


sourceType internal will take the configmap path, so these changes are ignored by OLM.

grokspawn · 2026-08-26T13:56:41Z

/test e2e-aws-ovn

openshift-merge-bot · 2026-08-26T14:16:18Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

redhat-chai-bot · 2026-08-26T14:54:24Z

/override ci/prow/e2e-aws-ovn-microshift-serial

Automated triage: This failure appears unrelated to the PR changes.

Rationale: The job failed in the openshift-microshift-infra-rpm-install-aws pre-step before the conformance tests ran. The MicroShift RPM installation could not resolve its required CRI-O version because the enabled repositories expose conflicting/unavailable CRI-O packages; this is an RPM repository/environment failure, not an OLM CatalogSource fixture failure.

Evidence:

The failing step is a MicroShift RPM installation pre-step; the test phase did not start.
The PR only changes eight OLM CatalogSource YAML fixtures to add grpcPodConfig.securityContextConfig: restricted, plus one YAML formatting normalization.
unit, verify, lint, image, and dependency checks passed.
The failure was reproduced by repeated DNF retries with the same dependency-resolution error.

If you disagree with this assessment, /retest ci/prow/e2e-aws-ovn-microshift-serial to re-run the job.

AI-generated. Review for accuracy.

openshift-ci · 2026-08-26T14:54:49Z

@redhat-chai-bot: Overrode contexts on behalf of redhat-chai-bot: ci/prow/e2e-aws-ovn-microshift-serial

Details

In response to this:

/override ci/prow/e2e-aws-ovn-microshift-serial

Automated triage: This failure appears unrelated to the PR changes.

Rationale: The job failed in the openshift-microshift-infra-rpm-install-aws pre-step before the conformance tests ran. The MicroShift RPM installation could not resolve its required CRI-O version because the enabled repositories expose conflicting/unavailable CRI-O packages; this is an RPM repository/environment failure, not an OLM CatalogSource fixture failure.

Evidence:

The failing step is a MicroShift RPM installation pre-step; the test phase did not start.

The PR only changes eight OLM CatalogSource YAML fixtures to add grpcPodConfig.securityContextConfig: restricted, plus one YAML formatting normalization.

unit, verify, lint, image, and dependency checks passed.

The failure was reproduced by repeated DNF retries with the same dependency-resolution error.

If you disagree with this assessment, /retest ci/prow/e2e-aws-ovn-microshift-serial to re-run the job.

AI-generated. Review for accuracy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

redhat-chai-bot · 2026-08-26T15:28:37Z

/override ci/prow/e2e-aws-ovn-serial-2of2

Automated triage: This failure appears unrelated to the PR changes.

Rationale: The job failed during ipi-install-install before any e2e tests ran. The AWS API returned TooManyLoadBalancers: The maximum number of load balancers has been reached, and the installer then timed out waiting for infrastructure. PR #31562 only updates eight catalog source testdata templates with grpcPodConfig.securityContextConfig: restricted; it does not change AWS installation or load-balancer configuration.

Evidence:

The failing step was e2e-aws-ovn-serial-ipi-install-install; the cluster was never installed.
The build log records HTTP 400 TooManyLoadBalancers followed by infrastructure was not ready within 15m0s.
The PR's non-e2e checks include passing unit, verify, lint, images, and go-verify-deps; the failure is an AWS provisioning quota error, not a catalog-source test failure.

If you disagree with this assessment, /retest ci/prow/e2e-aws-ovn-serial-2of2 to re-run the job.

AI-generated. Review for accuracy.

openshift-ci · 2026-08-26T15:28:57Z

@redhat-chai-bot: Overrode contexts on behalf of redhat-chai-bot: ci/prow/e2e-aws-ovn-serial-2of2

Details

In response to this:

/override ci/prow/e2e-aws-ovn-serial-2of2

Automated triage: This failure appears unrelated to the PR changes.

Rationale: The job failed during ipi-install-install before any e2e tests ran. The AWS API returned TooManyLoadBalancers: The maximum number of load balancers has been reached, and the installer then timed out waiting for infrastructure. PR #31562 only updates eight catalog source testdata templates with grpcPodConfig.securityContextConfig: restricted; it does not change AWS installation or load-balancer configuration.

Evidence:

The failing step was e2e-aws-ovn-serial-ipi-install-install; the cluster was never installed.

The build log records HTTP 400 TooManyLoadBalancers followed by infrastructure was not ready within 15m0s.

The PR's non-e2e checks include passing unit, verify, lint, images, and go-verify-deps; the failure is an AWS provisioning quota error, not a catalog-source test failure.

If you disagree with this assessment, /retest ci/prow/e2e-aws-ovn-serial-2of2 to re-run the job.

AI-generated. Review for accuracy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sdodson · 2026-08-26T16:46:51Z

/verified later @sdodson

openshift-ci-robot · 2026-08-26T16:47:04Z

@sdodson: This PR has been marked to be verified later by @sdodson.

Details

In response to this:

/verified later @sdodson

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-26T16:47:15Z

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: grokspawn, oceanc80

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

test/extended/util/compat_otp/testdata/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-08-26T17:12:33Z

/retest-required

Remaining retests: 0 against base HEAD 3068afd and 2 for PR HEAD 08dffdf in total

redhat-chai-bot · 2026-08-26T17:45:37Z

/override ci/prow/e2e-metal-ipi-ovn-ipv6

Automated triage: This failure appears unrelated to the PR changes.

Rationale: The job failed in the baremetalds-devscripts-setup pre-step while downloading https://go.dev/dl/go1.24.10.linux-amd64.tar.gz; the log reports Connection failure: The read operation timed out. The cluster was never installed and the E2E test phase did not run. The PR only changes CatalogSource test-data YAML, while other completed E2E jobs passed, including AWS OVN, AWS OVN FIPS, GCP CSI, and vSphere OVN jobs.

Evidence:

baremetalds-devscripts-setup failed before the test phase with make: *** [Makefile:68: requirements] Error 2.
The failing request was an external Go toolchain download and timed out after 10 seconds.
The PR changes eight CatalogSource template YAML files under test/extended/util/compat_otp/testdata/olm/; it does not change the bare-metal setup or provisioning path.
18 of 23 PR checks passed; this was the only completed failed check, with four checks still pending.

If you disagree with this assessment, /retest ci/prow/e2e-metal-ipi-ovn-ipv6 to re-run the job.

AI-generated. Review for accuracy.

openshift-ci · 2026-08-26T17:45:45Z

@redhat-chai-bot: Overrode contexts on behalf of redhat-chai-bot: ci/prow/e2e-metal-ipi-ovn-ipv6

Details

In response to this:

/override ci/prow/e2e-metal-ipi-ovn-ipv6

Automated triage: This failure appears unrelated to the PR changes.

Rationale: The job failed in the baremetalds-devscripts-setup pre-step while downloading https://go.dev/dl/go1.24.10.linux-amd64.tar.gz; the log reports Connection failure: The read operation timed out. The cluster was never installed and the E2E test phase did not run. The PR only changes CatalogSource test-data YAML, while other completed E2E jobs passed, including AWS OVN, AWS OVN FIPS, GCP CSI, and vSphere OVN jobs.

Evidence:

baremetalds-devscripts-setup failed before the test phase with make: *** [Makefile:68: requirements] Error 2.

The failing request was an external Go toolchain download and timed out after 10 seconds.

The PR changes eight CatalogSource template YAML files under test/extended/util/compat_otp/testdata/olm/; it does not change the bare-metal setup or provisioning path.

18 of 23 PR checks passed; this was the only completed failed check, with four checks still pending.

If you disagree with this assessment, /retest ci/prow/e2e-metal-ipi-ovn-ipv6 to re-run the job.

AI-generated. Review for accuracy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-08-26T18:23:06Z

@oceanc80: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-microshift	`08dffdf`	link	true	`/test e2e-aws-ovn-microshift`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Add securityContextConfig: restricted

08dffdf

openshift-ci Bot requested review from deads2k and tomasdavidorg August 26, 2026 13:01

coderabbitai Bot approved these changes Aug 26, 2026

View reviewed changes

openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Aug 26, 2026

openshift-ci Bot assigned grokspawn Aug 26, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 26, 2026

grokspawn reviewed Aug 26, 2026

View reviewed changes

openshift-ci-robot added verified-later verified Signifies that the PR passed pre-merge verification criteria labels Aug 26, 2026

Uh oh!

Conversation

oceanc80 commented Aug 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

openshift-ci-robot commented Aug 26, 2026

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

grokspawn commented Aug 26, 2026

Uh oh!

grokspawn Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

grokspawn Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

grokspawn commented Aug 26, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

redhat-chai-bot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

redhat-chai-bot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

sdodson commented Aug 26, 2026

Uh oh!

openshift-ci-robot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 26, 2026

Uh oh!

redhat-chai-bot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

oceanc80 commented Aug 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading