Release v0.1.50 - #5
Closed
Vincent056 wants to merge 15 commits into
Closed
Conversation
We recently broke apart the release process, but we forgot to add the conversion of the release version to the tag in the last two steps. This commit adds that step to the last two parts of the release process so it doesn't fail or assume 'latest' for the release version.
We are going to have a new rule to check if cluster logging operator has been installed, that requires api-resource-collector to have additional permission to read clusterloggings resources.[1] PR to the new rule: ComplianceAsCode/content#8511
The CIS benchmarks recommends using a CNI that supports network policies. Previously, this was a manual check in the profile, but it's actually something we can check by querying the K8S operator API. This commit adds the network resource to the operator.openshift.io API group so that the api-resource container can fetch that resource. This change is required to automate this check and used in: ComplianceAsCode/content#8524 Partial-Fix: https://bugzilla.redhat.com/show_bug.cgi?id=2072431
…r is installed Added permission for `api-resource-collector` to fetch network resources for the `gitopsservices.pipelines.openshift.io` API group, so that we can if the cluster is using GitOps operator
Added node resource to the list of resources we always fetch so that arch CPEs will be evaluated appropriately.
Let's rebase this dep to the new release which fixes important bugs. Jira: OCPBUGSM-42329 Jira: OCPBUGSM-42368
We have a check that makes sure that even an INFO-level check generates a remediation. However, the only INFO-level check that is available in the content is x86-specific. This patch makes that test only run on x86 as well.
No functional fixes.
…images We recently started updating the compliance content and publishing it in a different repository. The previous home for the content hadn't been updated and contained stale container image builds, causing CI failures. https://quay.io/repository/compliance-operator/compliance-operator-content
Fix issues of unpausing machine config pool too soon after applying remediations, added a check to check if kubeletconfig has been fully rendered into machine config before unpause affected pool. [1] ([1]https://bugzilla.redhat.com/show_bug.cgi?id=2071854).
Fix compliance operator crashloop issue when there is MachineConfigPool that does not have NodeSelector, this pr will check if there is NodeSelector in a MachineConfigPool before comparing the match.
This also highlights the environment variables we rely on for content images and where to find the Dockerfiles for them.
We didn't delete scan pods and the aggregator after a scan was done unless the delete was forced by the scan object being deleted. This appears to be breaking the cluster-autoscaler which can't drain pods from nodes that are not backed by a replicating controller. Since there appears to be no reason to keep the pods around unless the debug=true option is set, let's remove those pods when the scan reaches done and only keep the other resources around that are needed for eventually re-running the scan. Jira: OCPBUGSM-43262
|
@Vincent056: PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Vincent056 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.