Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revert "Enable PSA FG on Kubevirt (#2093)" #2136

Merged
merged 3 commits into from
Nov 15, 2022
Merged

Revert "Enable PSA FG on Kubevirt (#2093)" #2136

merged 3 commits into from
Nov 15, 2022

Conversation

tiraboschi
Copy link
Member

This reverts commit 4731026.

Signed-off-by: Simone Tiraboschi stirabos@redhat.com

Reviewer Checklist

Reviewers are supposed to review the PR for every aspect below one by one. To check an item means the PR is either "OK" or "Not Applicable" in terms of that item. All items are supposed to be checked before merging a PR.

  • PR Message
  • Commit Messages
  • How to test
  • Unit Tests
  • Functional Tests
  • User Documentation
  • Developer Documentation
  • Upgrade Scenario
  • Uninstallation Scenario
  • Backward Compatibility
  • Troubleshooting Friendly

Release note:

Revert PSA FG on Kubevirt

@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Nov 8, 2022
@coveralls
Copy link
Collaborator

coveralls commented Nov 8, 2022 •
edited
Loading

Pull Request Test Coverage Report for Build 3463583524

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 85.419%
Totals Coverage Status
Change from base Build 3463389073: 0.0%
Covered Lines: 4634
Relevant Lines: 5425
💛 - Coveralls

@tiraboschi
Copy link
Member Author

/hold

@kubevirt-bot kubevirt-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 8, 2022
@tiraboschi
Copy link
Member Author

/retest

@tiraboschi
Copy link
Member Author

hco-e2e-upgrade-prev-index-sno-aws succeeded
/override ci/prow/hco-e2e-upgrade-prev-index-sno-azure

@kubevirt-bot
Copy link
Contributor

@tiraboschi: Overrode contexts on behalf of tiraboschi: ci/prow/hco-e2e-upgrade-prev-index-sno-azure

In response to this:

hco-e2e-upgrade-prev-index-sno-aws succeeded
/override ci/prow/hco-e2e-upgrade-prev-index-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Copy link
Member Author

/retest

@tiraboschi
Copy link
Member Author

hco-e2e-image-index-aws
/override ci/prow/hco-e2e-image-index-azure

hco-e2e-image-index-sno-aws succeeded
/override ci/prow/hco-e2e-image-index-sno-azure

hco-e2e-upgrade-index-aws succeeded
/override ci/prow/hco-e2e-upgrade-index-azure

hco-e2e-upgrade-index-sno-aws succeeded
/override ci/prow/hco-e2e-upgrade-index-sno-azure

hco-e2e-upgrade-prev-index-aws succeeded
/override ci/prow/hco-e2e-upgrade-prev-index-azure

@kubevirt-bot
Copy link
Contributor

@tiraboschi: Overrode contexts on behalf of tiraboschi: ci/prow/hco-e2e-image-index-azure, ci/prow/hco-e2e-image-index-sno-azure, ci/prow/hco-e2e-upgrade-index-azure, ci/prow/hco-e2e-upgrade-index-sno-azure, ci/prow/hco-e2e-upgrade-prev-index-azure

In response to this:

hco-e2e-image-index-aws
/override ci/prow/hco-e2e-image-index-azure

hco-e2e-image-index-sno-aws succeeded
/override ci/prow/hco-e2e-image-index-sno-azure

hco-e2e-upgrade-index-aws succeeded
/override ci/prow/hco-e2e-upgrade-index-azure

hco-e2e-upgrade-index-sno-aws succeeded
/override ci/prow/hco-e2e-upgrade-index-sno-azure

hco-e2e-upgrade-prev-index-aws succeeded
/override ci/prow/hco-e2e-upgrade-prev-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi tiraboschi self-assigned this Nov 8, 2022
@tiraboschi
Copy link
Member Author

/retest

@tiraboschi
Copy link
Member Author

ignoring rounding on coverage
/override coverage/coveralls

@kubevirt-bot
Copy link
Contributor

@tiraboschi: Overrode contexts on behalf of tiraboschi: coverage/coveralls

In response to this:

ignoring rounding on coverage
/override coverage/coveralls

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi tiraboschi mentioned this pull request Nov 9, 2022
Merged
tiraboschi added a commit to tiraboschi/kubevirt that referenced this pull request Nov 11, 2022
@tiraboschi
tests: avoid opting out from OCP/OKD podSecurityLabelSync
43b65f2 
Avoid opting out from OCP/OKD podSecurityLabelSync

This was done there because the virt-controller auto labelling
mechanism is overlapping and fighting with the
Openshift Pod Security Admission Autolabeling.
So we were setting that at test suite level
assuming that the Kubevirt PSA FG was always
on when deploying on Openshift.

Now we revisited that decision and so HCO
is not going to enable the PSA FG on Kubevirt, see:
kubevirt/hyperconverged-cluster-operator#2136
kubevirt/hyperconverged-cluster-operator#2135
kubevirt/hyperconverged-cluster-operator#2134
kubevirt/hyperconverged-cluster-operator#2133

but at this point, if PSA is enabled on the cluster,
on Openshift we should rely on its default
Pod Security Admission Autolabeling,
and so always blindly setting
"security.openshift.io/scc.podSecurityLabelSync": "false"
at testsuite level appears as a bad idea.

Set also
pod-security.kubernetes.io/warn=privileged
on the namespaces where we set
pod-security.kubernetes.io/enforce=privileged
to get rid of warnings from those namespaces.

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
@tiraboschi
Copy link
Member Author

/reopen

@kubevirt-bot kubevirt-bot reopened this Nov 14, 2022
@kubevirt-bot
Copy link
Contributor

@tiraboschi: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Revert "Enable PSA FG on Kubevirt (kubevirt#2093)"
d6a76d8 
This reverts commit 4731026.

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
@tiraboschi
hack: brutal workaround to bypass SCC->PSA on OCP
ba7725b 
brutal workaround to bypass SCC -> PSA on OCP >= 4.12

remove ASAP!!!

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
@tiraboschi
Another workaround for PSA on OCP/OKD 4.12
99f3ef7 
Remove once kubevirt/kubevirt#8748
lands in Kubevirt v0.59.0

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
@tiraboschi
Copy link
Member Author

/unhold

@kubevirt-bot kubevirt-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 14, 2022
@sonarcloud
Copy link

sonarcloud bot commented Nov 14, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 14, 2022

hco-e2e-upgrade-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-index-azure

In response to this:

hco-e2e-upgrade-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 14, 2022

hco-e2e-upgrade-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-index-sno-azure

In response to this:

hco-e2e-upgrade-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 14, 2022

hco-e2e-upgrade-prev-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-sno-azure
hco-e2e-image-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-image-index-sno-azure, ci/prow/hco-e2e-upgrade-prev-index-sno-azure

In response to this:

hco-e2e-upgrade-prev-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-sno-azure
hco-e2e-image-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 14, 2022

hco-e2e-upgrade-prev-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-prev-index-azure

In response to this:

hco-e2e-upgrade-prev-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Copy link
Member Author

/retest

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 14, 2022

hco-e2e-image-index-gcp lane succeeded.
/override ci/prow/hco-e2e-image-index-aws

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-image-index-aws

In response to this:

hco-e2e-image-index-gcp lane succeeded.
/override ci/prow/hco-e2e-image-index-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 14, 2022

hco-e2e-image-index-gcp lane succeeded.
/override ci/prow/hco-e2e-image-index-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-image-index-azure

In response to this:

hco-e2e-image-index-gcp lane succeeded.
/override ci/prow/hco-e2e-image-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Copy link
Member Author

/retest

@openshift-ci
Copy link

openshift-ci bot commented Nov 15, 2022

@tiraboschi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/hco-e2e-upgrade-index-azure 99f3ef7 link true /test hco-e2e-upgrade-index-azure
ci/prow/hco-e2e-upgrade-index-sno-azure 99f3ef7 link false /test hco-e2e-upgrade-index-sno-azure
ci/prow/hco-e2e-image-index-sno-azure 99f3ef7 link false /test hco-e2e-image-index-sno-azure
ci/prow/hco-e2e-upgrade-prev-index-sno-azure 99f3ef7 link false /test hco-e2e-upgrade-prev-index-sno-azure
ci/prow/hco-e2e-upgrade-prev-index-azure 99f3ef7 link true /test hco-e2e-upgrade-prev-index-azure
ci/prow/hco-e2e-image-index-aws 99f3ef7 link true /test hco-e2e-image-index-aws
ci/prow/hco-e2e-image-index-azure 99f3ef7 link true /test hco-e2e-image-index-azure
ci/prow/hco-e2e-kv-smoke-azure 99f3ef7 link true /test hco-e2e-kv-smoke-azure
ci/prow/hco-e2e-kv-smoke-gcp 99f3ef7 link true /test hco-e2e-kv-smoke-gcp

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@tiraboschi
Copy link
Member Author

it failed a single test that is not strictly related to PSA:

• [FAILED] [279.174 seconds]
[rfe_id:151][crit:high][vendor:cnv-qe@redhat.com][level:component][sig-compute]CloudInit UserData [rfe_id:151][crit:medium][vendor:cnv-qe@redhat.com][level:component]A new VirtualMachineInstance with cloudInitConfigDrive networkData [It] [test_id:4622]should have cloud-init meta_data with tagged devices
tests/vmi_cloudinit_test.go:457

let's ignore it for now, we will eventually quarantine it to move forward.

/override ci/prow/hco-e2e-kv-smoke-azure
/override ci/prow/hco-e2e-kv-smoke-gcp

@kubevirt-bot
Copy link
Contributor

@tiraboschi: Overrode contexts on behalf of tiraboschi: ci/prow/hco-e2e-kv-smoke-azure, ci/prow/hco-e2e-kv-smoke-gcp

In response to this:

it failed a single test that is not strictly related to PSA:

• [FAILED] [279.174 seconds]
[rfe_id:151][crit:high][vendor:cnv-qe@redhat.com][level:component][sig-compute]CloudInit UserData [rfe_id:151][crit:medium][vendor:cnv-qe@redhat.com][level:component]A new VirtualMachineInstance with cloudInitConfigDrive networkData [It] [test_id:4622]should have cloud-init meta_data with tagged devices
tests/vmi_cloudinit_test.go:457

let's ignore it for now, we will eventually quarantine it to move forward.

/override ci/prow/hco-e2e-kv-smoke-azure
/override ci/prow/hco-e2e-kv-smoke-gcp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

orenc1
orenc1 approved these changes Nov 15, 2022
View reviewed changes
Copy link
Collaborator

@orenc1 orenc1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@kubevirt-bot kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Nov 15, 2022
@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: orenc1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 15, 2022
@kubevirt-bot kubevirt-bot merged commit e2d6f31 into kubevirt:main Nov 15, 2022
@tiraboschi tiraboschi deleted the main_nopsa branch November 15, 2022 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@orenc1 orenc1 orenc1 approved these changes

@machadovilaca machadovilaca Awaiting requested review from machadovilaca

Assignees

@tiraboschi tiraboschi

@orenc1 orenc1

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@tiraboschi @coveralls @kubevirt-bot @hco-bot @orenc1