CMP-1097 FIO 1.3.1 bug fix and enhancement #61261

GroceryBoyJr · 2023-06-14T21:22:24Z

Version(s): 4.10+

Issue: https://issues.redhat.com/browse/CMP-2039

Link to docs preview:

https://61261--docspreview.netlify.app/openshift-enterprise/latest/security/file_integrity_operator/file-integrity-operator-release-notes.html

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2023-06-14T21:30:56Z

🤖 Updated build preview is available at:
https://61261--docspreview.netlify.app

Build log: https://circleci.com/gh/ocpdocs-previewbot/openshift-docs/21775

GroceryBoyJr · 2023-06-14T21:50:18Z

/label hold

openshift-ci · 2023-06-14T21:50:21Z

@GroceryBoyJr: The label(s) /label hold cannot be applied. These labels are supported: platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, downstream-change-needed, rebase/manual, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, cnv, dev-tools, distributed-tracing, ims, jira/valid-bug, merge-review-in-progress, merge-review-needed, mtc, multi-arch, oadp, peer-review-done, peer-review-in-progress, peer-review-needed, rhacs, rhv, sd-docs, serverless, service-mesh, sme-review-done, sme-review-needed, staff-eng-approved, telco. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/label hold

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sheriff-rh

Looks like a great start! I have a few comments.

security/file_integrity_operator/file-integrity-operator-release-notes.adoc

Vincent056

/lgtm

GroceryBoyJr · 2023-06-15T19:21:07Z

@xiaojiey PTAL

rhmdnd

/lgtm

GroceryBoyJr · 2023-06-16T17:27:49Z

ty

…

On Fri, Jun 16, 2023 at 1:26 PM Lance Bragstad ***@***.***> wrote: ***@***.**** commented on this pull request. /lgtm — Reply to this email directly, view it on GitHub <#61261 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASABLFAJEHT6ILMKANWVJQ3XLSJLVANCNFSM6AAAAAAZG6COLI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

sheriff-rh · 2023-07-10T14:40:22Z

@xiaojiey PTAL at FIO as well please, thanks!

openshift-ci · 2023-08-09T17:20:35Z

New changes are detected. LGTM label has been removed.

GroceryBoyJr · 2023-08-09T18:38:36Z

Hello @xiaojiey or @wangke19 seeking your QE LGTM. PTAL? TY!

GroceryBoyJr · 2023-08-09T18:46:46Z

@rhmdnd your SME approval requested please. PTAL, TY!

sheriff-rh

LGTM, adding peer review done label for now.

security/file_integrity_operator/file-integrity-operator-release-notes.adoc

xiaojiey · 2023-08-10T03:29:02Z

security/file_integrity_operator/file-integrity-operator-release-notes.adoc

+
+* Previously, FIO would not clean up node status CRDs when nodes are removed from the cluster. FIO would also erroneously indicate that new nodes failed integrity checks. FIO has been updated to correctly clean up node status CRDs on node removal or when adding new nodes to the cluster. This provides correct node status notifications. (link:https://issues.redhat.com/browse/OCPBUGS-8502[*OCPBUGS-8502*])
+
+* Previously, when FIO was reconciling File Integrity CRDs, it would pause scanning until the reconciliation was done. This caused an overly aggressive re-initiatization process on nodes not impacted by the reconciliation. This problem also resulted in unnecessary daemonsets for machine config pools which are unrelated to the file integrity being changed. FIO correctly handles these cases and only pauses AIDE scanning for nodes that are affected by file integrity changes. (link:https://issues.redhat.com/browse/CMP-1097[*CMP-1097*])


Better to update "reconciling File Integrity CRDs" to " FileIntegrity CRDs"

I was wondering if you could change "Previously, when FIO was reconciling File Integrity CRDs, it would pause scanning until the reconciliation was done. " to something like "Previously, during a node updates causing by MCP updates, it would pause scanning on all nodes until the update was done."

xiaojiey · 2023-08-10T03:31:38Z

One more comment, could you please address https://issues.redhat.com/browse/OCPBUGS-8502? Thanks.

sheriff-rh · 2023-08-16T16:38:38Z

@GroceryBoyJr is out of the office between now and the release date. I will be closing this PR in favor of #63648 because I added a known issues section.

openshift-ci bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jun 14, 2023

sheriff-rh reviewed Jun 15, 2023

View reviewed changes

GroceryBoyJr force-pushed the CMP-2039 branch 2 times, most recently from 9fd14a6 to 26a0e3b Compare June 15, 2023 17:12

rhmdnd reviewed Jun 15, 2023

View reviewed changes

security/file_integrity_operator/file-integrity-operator-release-notes.adoc Outdated Show resolved Hide resolved

Vincent056 approved these changes Jun 15, 2023

View reviewed changes

openshift-ci bot assigned Vincent056 Jun 15, 2023

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. and removed lgtm Indicates that a PR is ready to be merged. labels Jun 15, 2023

GroceryBoyJr force-pushed the CMP-2039 branch 2 times, most recently from 05e16a1 to 7ec8011 Compare June 15, 2023 18:27

rhmdnd reviewed Jun 16, 2023

View reviewed changes

openshift-ci bot assigned rhmdnd Jun 16, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 16, 2023

sheriff-rh requested a review from xiaojiey June 26, 2023 14:35

sheriff-rh added branch/enterprise-4.10 branch/enterprise-4.11 branch/enterprise-4.12 branch/enterprise-4.13 branch/enterprise-4.14 labels Jul 10, 2023

sheriff-rh added this to the Continuous Release milestone Jul 10, 2023

GroceryBoyJr changed the title ~~CMP-1097 FIO 1.3.0 bug fix and enhancement~~ CMP-1097 FIO 1.3.1 bug fix and enhancement Aug 9, 2023

GroceryBoyJr force-pushed the CMP-2039 branch from 7ec8011 to e209aef Compare August 9, 2023 17:18

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 9, 2023

CMP-1097 FIO 1.3.0 bug fix and enhancement

6375770

GroceryBoyJr force-pushed the CMP-2039 branch from 8c8f166 to 6375770 Compare August 9, 2023 18:11

sheriff-rh reviewed Aug 9, 2023

View reviewed changes

sheriff-rh added the peer-review-done Signifies that the peer review team has reviewed this PR label Aug 9, 2023

xiaojiey reviewed Aug 10, 2023

View reviewed changes

security/file_integrity_operator/file-integrity-operator-release-notes.adoc Outdated Show resolved Hide resolved

xiaojiey reviewed Aug 10, 2023

View reviewed changes

SME and QE Feedback

cf5943d

sheriff-rh closed this Aug 16, 2023

sheriff-rh mentioned this pull request Aug 16, 2023

CMP-2039: FIO 1.3.1 release notes #63648

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CMP-1097 FIO 1.3.1 bug fix and enhancement #61261

CMP-1097 FIO 1.3.1 bug fix and enhancement #61261

GroceryBoyJr commented Jun 14, 2023 •

edited by sheriff-rh

ocpdocs-previewbot commented Jun 14, 2023 •

edited

GroceryBoyJr commented Jun 14, 2023

openshift-ci bot commented Jun 14, 2023

sheriff-rh left a comment

Vincent056 left a comment

GroceryBoyJr commented Jun 15, 2023

rhmdnd left a comment

GroceryBoyJr commented Jun 16, 2023 via email

sheriff-rh commented Jul 10, 2023

openshift-ci bot commented Aug 9, 2023

GroceryBoyJr commented Aug 9, 2023

GroceryBoyJr commented Aug 9, 2023

sheriff-rh left a comment

xiaojiey Aug 10, 2023

Vincent056 Aug 10, 2023

xiaojiey commented Aug 10, 2023

sheriff-rh commented Aug 16, 2023


		* Previously, FIO would not clean up node status CRDs when nodes are removed from the cluster. FIO would also erroneously indicate that new nodes failed integrity checks. FIO has been updated to correctly clean up node status CRDs on node removal or when adding new nodes to the cluster. This provides correct node status notifications. (link:https://issues.redhat.com/browse/OCPBUGS-8502[OCPBUGS-8502])

		* Previously, when FIO was reconciling File Integrity CRDs, it would pause scanning until the reconciliation was done. This caused an overly aggressive re-initiatization process on nodes not impacted by the reconciliation. This problem also resulted in unnecessary daemonsets for machine config pools which are unrelated to the file integrity being changed. FIO correctly handles these cases and only pauses AIDE scanning for nodes that are affected by file integrity changes. (link:https://issues.redhat.com/browse/CMP-1097[CMP-1097])

CMP-1097 FIO 1.3.1 bug fix and enhancement #61261

CMP-1097 FIO 1.3.1 bug fix and enhancement #61261

Conversation

GroceryBoyJr commented Jun 14, 2023 • edited by sheriff-rh

ocpdocs-previewbot commented Jun 14, 2023 • edited

GroceryBoyJr commented Jun 14, 2023

openshift-ci bot commented Jun 14, 2023

sheriff-rh left a comment

Choose a reason for hiding this comment

Vincent056 left a comment

Choose a reason for hiding this comment

GroceryBoyJr commented Jun 15, 2023

rhmdnd left a comment

Choose a reason for hiding this comment

GroceryBoyJr commented Jun 16, 2023 via email

sheriff-rh commented Jul 10, 2023

openshift-ci bot commented Aug 9, 2023

GroceryBoyJr commented Aug 9, 2023

GroceryBoyJr commented Aug 9, 2023

sheriff-rh left a comment

Choose a reason for hiding this comment

xiaojiey Aug 10, 2023

Choose a reason for hiding this comment

Vincent056 Aug 10, 2023

Choose a reason for hiding this comment

xiaojiey commented Aug 10, 2023

sheriff-rh commented Aug 16, 2023

GroceryBoyJr commented Jun 14, 2023 •

edited by sheriff-rh

ocpdocs-previewbot commented Jun 14, 2023 •

edited