CNF-19617, CNF-21768, CNF-21832, CNF-22018, OCPBUGS-59883, OCPBUGS-66407: Sync from upstream (07-Apr-2026)#692
Draft
nocturnalastro wants to merge 21 commits intoopenshift:mainfrom
Draft
Conversation
The operator now honors the cluster-wide TLS security profile from the APIServer CR, so declare this capability via the OLM feature annotation. Signed-off-by: Jack Ding <jackding@gmail.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move builder image to non-docker image so that we do not get hit with pull limits
Set tls-profiles feature annotation to true in CSV
Update Dockerfile.krp to use Go version 1.25.7 for the builder stage
This is needed for TLSAdherence support. - Upgrade from Go 1.24 to Go 1.25.0 - Update openshift/api to v0.0.0-20260318185450-1f2fa3f09f4e - Update openshift/library-go to v0.0.0-20260318142011-72bf34f474bc - Update openshift/controller-runtime-common to v0.0.0-20260318085703-1812aed6dbd2 - Upgrade sigs.k8s.io/controller-runtime from v0.22.5 to v0.23.3 - Upgrade k8s.io dependencies from v0.34.3 to v0.35.2 - Update l2discovery-lib from v0.0.21 to v0.1.0 - Update l2discovery image in CI test - Fix webhook registrations for controller-runtime v0.23 generic API Signed-off-by: Jack Ding <jackding@gmail.com>
…mage Update Dockerfile builder image
… (OCPBUGS-59883, OCPBUGS-66407)
Upgrade to Go 1.25 and update dependencies
…-locked-after-degrading PTP CI: Add BC clock class recovery test for upstream link outage
Add must-gather collection to CI pipeline
CNF-19617: Add test coverage for clockClass verification when locking PTP source
Read the tlsAdherence policy from the APIServer CR and use ShouldHonorClusterTLSProfile to conditionally apply the cluster TLS profile. In Legacy mode (default), Go TLS defaults are used. In Strict mode, the cluster-wide TLS profile is enforced on the operator's webhook/metrics servers and on the daemon's kube-rbac-proxy. The SecurityProfileWatcher now also monitors adherence policy changes and triggers a graceful restart when the policy changes. Signed-off-by: Jack Ding <jackding@gmail.com>
Signed-off-by: Jack Ding <jackding@gmail.com>
Expose system-level and base board hardware details in NodePtpDevice Status
Replace the separate TLSAdherencePolicy field on the reconciler with a nil *TLSProfileSpec pointer pattern. When the pointer is nil, legacy hardcoded ciphers are used. When non-nil, the cluster TLS profile is applied. The adherence decision is made once in main.go and expressed through the pointer value. Signed-off-by: Jack Ding <jackding@gmail.com>
update OWNERS
CNF-21768: Add TLS adherence support
openshift-ci-robot
added
jira/severity-important
Contributor
|
@nocturnalastro: This pull request references CNF-19617 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references CNF-21768 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references CNF-21832 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references CNF-22018 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references Jira Issue OCPBUGS-59883, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-66407, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
@nocturnalastro: This pull request references CNF-19617 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references CNF-21768 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references CNF-21832 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references CNF-22018 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. This pull request references Jira Issue OCPBUGS-59883, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-66407, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughPR introduces PTP operator enhancements including new API types for system/baseboard information, updated Go toolchain (1.25), TLS profile support with legacy fallback, boundary clock conformance tests, and dependency upgrades. Webhook and CRD schemas updated accordingly. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~75 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: nocturnalastro The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
openshift-ci
bot
added
the
do-not-merge/work-in-progress
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (4)
ptp-tools/Dockerfile.ptpop (1)
2-2: Use--no-install-recommendsfor theapt-get installcommand.The current command pulls recommended packages unnecessarily, increasing build time and image size. This is inconsistent with the rest of the codebase.
Proposed change
-RUN apt-get update && apt-get install -y binutils-gold && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get install -y --no-install-recommends binutils-gold && rm -rf /var/lib/apt/lists/*🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ptp-tools/Dockerfile.ptpop` at line 2, Update the RUN instruction that installs binutils-gold to avoid pulling recommended packages: change the apt-get install invocation in the Dockerfile.ptpop RUN line to include --no-install-recommends (i.e., apt-get update && apt-get install -y --no-install-recommends binutils-gold && rm -rf /var/lib/apt/lists/*) so the image build is smaller and consistent with the rest of the codebase.controllers/tls_watcher_test.go (1)
40-50: Consider adding an assertion forTLSCipherSuitesin the Modern profile test.The comment on line 49 notes that TLS 1.3 ciphers aren't configurable in Go, but no assertion verifies the actual
TLSCipherSuitesvalue. Adding an assertion (even for an empty string) would document the expected behavior.💡 Suggested addition
func TestSetTLSTemplateData_ModernProfile(t *testing.T) { profile := *configv1.TLSProfiles[configv1.TLSProfileModernType] r := &PtpOperatorConfigReconciler{ TLSProfileSpec: &profile, } data := render.MakeRenderData() r.setTLSTemplateData(&data) assert.Equal(t, "VersionTLS13", data.Data["TLSMinVersion"]) // TLS 1.3 ciphers are not configurable in Go, so cipher list may be empty + expectedCiphers := strings.Join(libgocrypto.OpenSSLToIANACipherSuites(profile.Ciphers), ",") + assert.Equal(t, expectedCiphers, data.Data["TLSCipherSuites"], + "TLSCipherSuites should match converted profile ciphers (may be empty for TLS 1.3)") }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@controllers/tls_watcher_test.go` around lines 40 - 50, Add an explicit assertion in TestSetTLSTemplateData_ModernProfile to verify the TLSCipherSuites value produced by setTLSTemplateData: locate the test function TestSetTLSTemplateData_ModernProfile, call r.setTLSTemplateData(&data) as already done, then assert the expected value for data.Data["TLSCipherSuites"] (e.g., assert.Equal(t, "", data.Data["TLSCipherSuites"])) to document that TLS 1.3 cipher suites are not configurable in Go.controllers/tls_profile_test.go (1)
128-174: Consider referencinglegacyCipherSuitesconstant instead of duplicating the cipher list.The hardcoded cipher string on lines 133-137 and 168-172 duplicates the
legacyCipherSuitesconstant from the controller. If the constant changes, these tests won't catch the drift.💡 Suggested improvement
func TestTLSProfileTemplateRendering_LegacyAdherence(t *testing.T) { // When TLS adherence is legacy, kube-rbac-proxy should use the hardcoded // cipher suites that were in place before cluster TLS profile support. data := makeTestRenderData() data.Data["TLSMinVersion"] = "" - data.Data["TLSCipherSuites"] = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256," + - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256," + - "TLS_RSA_WITH_AES_128_CBC_SHA256," + - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256," + - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" + data.Data["TLSCipherSuites"] = legacyCipherSuites // ... assertions ... - assert.Contains(t, rbacProxyArgs, - "--tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,"+ - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,"+ - "TLS_RSA_WITH_AES_128_CBC_SHA256,"+ - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,"+ - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256") + assert.Contains(t, rbacProxyArgs, "--tls-cipher-suites="+legacyCipherSuites) }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@controllers/tls_profile_test.go` around lines 128 - 174, The test TestTLSProfileTemplateRendering_LegacyAdherence duplicates the cipher list; replace the hardcoded cipher string in the test (both where data.Data["TLSCipherSuites"] is set and the assert.Contains expected value) with a reference to the controller constant legacyCipherSuites so the test uses the single source of truth; update imports if needed to access legacyCipherSuites from the controller package and ensure the test assembles rbacProxyArgs comparison against that constant.api/v1/ptpconfig_webhook.go (1)
59-61: Consider migrating toWithValidatorinstead of the deprecatedWithCustomValidator.Per controller-runtime v0.23,
WithCustomValidatoris deprecated in favor ofWithValidator. To migrate, updateptpConfigValidatormethods to accept typed*PtpConfigparameters instead ofruntime.Object:func (v *ptpConfigValidator) ValidateCreate(ctx context.Context, obj *PtpConfig) (admission.Warnings, error) func (v *ptpConfigValidator) ValidateUpdate(ctx context.Context, oldObj, newObj *PtpConfig) (admission.Warnings, error) func (v *ptpConfigValidator) ValidateDelete(ctx context.Context, obj *PtpConfig) (admission.Warnings, error)Then replace
WithCustomValidator(&ptpConfigValidator{})withWithValidator(&ptpConfigValidator{}). This eliminates type casts, improves type safety, and aligns with current controller-runtime practices.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@api/v1/ptpconfig_webhook.go` around lines 59 - 61, Replace the deprecated WithCustomValidator usage and update ptpConfigValidator to the typed validator API: change the call ctrl.NewWebhookManagedBy(mgr, r).WithCustomValidator(&ptpConfigValidator{}).Complete() to use WithValidator(&ptpConfigValidator{}), and modify ptpConfigValidator's methods to the typed signatures ValidateCreate(ctx context.Context, obj *PtpConfig) (admission.Warnings, error), ValidateUpdate(ctx context.Context, oldObj, newObj *PtpConfig) (admission.Warnings, error) and ValidateDelete(ctx context.Context, obj *PtpConfig) (admission.Warnings, error), removing runtime.Object casts and returning the same behavior with the new typed parameters.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Around line 1-3: The Dockerfile currently sets USER root in the builder stage
(FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS builder / USER root)
and never switches to a non-root user for the final runtime image; update the
Dockerfile to create or use a non-root user/group in the build (or final) stage
and add a USER <nonroot> directive in the runtime stage so the shipped container
does not run as root; ensure any runtime-owned files or directories are chowned
to that user (e.g., during the builder stage or in a dedicated setup step) and
reference the created username in the final USER instruction.
In `@main.go`:
- Around line 90-117: fetchTLSConfig() can return a sentinel "missing-policy"
result that should be treated as the non-OpenShift fallback, but other errors
(transient/RBAC/read failures) must not be collapsed into that case; update the
main() handling around fetchTLSConfig so it: call fetchTLSConfig(restConfig),
then if err == nil proceed as before, else if errors.Is(err, <the sentinel error
exported by fetchTLSConfig/openshifttls> /* e.g.
ErrTLSProfileMissing/ErrPolicyUnavailable */ then log and fall back to
Intermediate profile as currently done, otherwise treat it as a real read
failure (log error and return/exit or requeue) so you do NOT set
isOpenShiftCluster=false or skip SecurityProfileWatcher; use errors.Is to detect
the sentinel error and reference fetchTLSConfig, tlsAdherencePolicy,
honorClusterTLS and SecurityProfileWatcher when making the change.
In `@ptp-tools/Dockerfile.debug`:
- Around line 1-2: Replace running the debug image as root and installing
tcpdump with a non-root tcpdump user and grant tcpdump only the required
capabilities: after installing tcpdump in the Dockerfile (the RUN that installs
tcpdump), add creation of a tcpdump user (useradd tcpdump) and run setcap to
grant CAP_NET_RAW and CAP_NET_ADMIN on the tcpdump binary (setcap
cap_net_raw,cap_net_admin=ep /usr/sbin/tcpdump), then switch to that user with
USER tcpdump so the container no longer runs as root but tcpdump retains
necessary packet-capture privileges.
In `@scripts/run-tests.sh`:
- Around line 40-43: The script references DEBUG_IMAGE during option parsing but
never initializes it, causing a failure under set -u; initialize DEBUG_IMAGE
(e.g., set to an empty string or sensible default) before option parsing starts
so references like ${DEBUG_IMAGE} later (used in the run/tests logic) are safe;
update the top-level variable declarations or the option-parsing default block
(symbols: DEBUG_IMAGE and the --debug-image case in the option parsing) to
ensure DEBUG_IMAGE is always defined even if --debug-image is not provided.
In `@test/conformance/serial/ptp.go`:
- Around line 1117-1119: The test currently brings BC slave interfaces down
unconditionally via portEngine.TurnOffAndWaitFaulty(nic1.SlaveIf, nodeName),
which ignores the SKIP_INTERFACES safeguard; update the spec to first check the
SKIP_INTERFACES set (or call the existing helper used by the outage path) and
skip the test when nic1.SlaveIf (and the counterpart in the other spec range) is
present in SKIP_INTERFACES, logging a clear skip message and returning early
instead of calling TurnOffAndWaitFaulty; reference the SKIP_INTERFACES variable
and the TurnOffAndWaitFaulty(portEngine.*) usage to locate where to insert the
guard.
- Around line 3574-3605: When event.Enable() is true, do not silently disable
event validation on setup errors; update setupBCClockClassEvents so that
failures from event.CreateConsumerApp or event.MonitorPodLogsRegex cause the
test to fail (or explicitly skip with a clear message) instead of returning a
ctx that makes later verifyClockClassViaEvent a no-op. Locate
setupBCClockClassEvents and replace the current early return/log-only behavior
around event.CreateConsumerApp and the MonitorPodLogsRegex error branch with a
call that fails the spec (e.g., Ginkgo.Fail/Ginkgo.Skip or the project's
test-fail helper) including the error details, while keeping the existing
cleanup logic (eventCleanup, StopMonitor, event.PubSub.Close,
DeleteConsumerNamespace) intact.
- Around line 2054-2096: The FAULTY/SLAVE assertions currently use the full
slaveIf slice even though TurnAllPortsDown(skipInterfaces) leaves skipped NICs
up; update the test to build a filtered slice (e.g., filteredSlaveIf) by
excluding interfaces present in skipInterfaces (the map built from
SKIP_INTERFACES) and then create faultyRoles and slaveRoles using
len(filteredSlaveIf); call metrics.CheckClockRole with filteredSlaveIf (and
&slavePodNodeName) instead of slaveIf for both the FAULTY and SLAVE Eventually
checks so the assertions only cover the interfaces actually toggled by
TurnAllPortsDown/TurnAllPortsUp.
---
Nitpick comments:
In `@api/v1/ptpconfig_webhook.go`:
- Around line 59-61: Replace the deprecated WithCustomValidator usage and update
ptpConfigValidator to the typed validator API: change the call
ctrl.NewWebhookManagedBy(mgr,
r).WithCustomValidator(&ptpConfigValidator{}).Complete() to use
WithValidator(&ptpConfigValidator{}), and modify ptpConfigValidator's methods to
the typed signatures ValidateCreate(ctx context.Context, obj *PtpConfig)
(admission.Warnings, error), ValidateUpdate(ctx context.Context, oldObj, newObj
*PtpConfig) (admission.Warnings, error) and ValidateDelete(ctx context.Context,
obj *PtpConfig) (admission.Warnings, error), removing runtime.Object casts and
returning the same behavior with the new typed parameters.
In `@controllers/tls_profile_test.go`:
- Around line 128-174: The test TestTLSProfileTemplateRendering_LegacyAdherence
duplicates the cipher list; replace the hardcoded cipher string in the test
(both where data.Data["TLSCipherSuites"] is set and the assert.Contains expected
value) with a reference to the controller constant legacyCipherSuites so the
test uses the single source of truth; update imports if needed to access
legacyCipherSuites from the controller package and ensure the test assembles
rbacProxyArgs comparison against that constant.
In `@controllers/tls_watcher_test.go`:
- Around line 40-50: Add an explicit assertion in
TestSetTLSTemplateData_ModernProfile to verify the TLSCipherSuites value
produced by setTLSTemplateData: locate the test function
TestSetTLSTemplateData_ModernProfile, call r.setTLSTemplateData(&data) as
already done, then assert the expected value for data.Data["TLSCipherSuites"]
(e.g., assert.Equal(t, "", data.Data["TLSCipherSuites"])) to document that TLS
1.3 cipher suites are not configurable in Go.
In `@ptp-tools/Dockerfile.ptpop`:
- Line 2: Update the RUN instruction that installs binutils-gold to avoid
pulling recommended packages: change the apt-get install invocation in the
Dockerfile.ptpop RUN line to include --no-install-recommends (i.e., apt-get
update && apt-get install -y --no-install-recommends binutils-gold && rm -rf
/var/lib/apt/lists/*) so the image build is smaller and consistent with the rest
of the codebase.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 49423af0-2b12-4fdc-83c1-6a27c8e649f7
⛔ Files ignored due to path filters (268)
go.sumis excluded by!**/*.sumvendor/github.com/gogo/protobuf/AUTHORSis excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/CONTRIBUTORSis excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/Makefileis excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/clone.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/custom_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/decode.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/discard.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/duration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/duration_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/encode.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/encode_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/equal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/extensions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/extensions_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/lib.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/lib_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/message_set.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/pointer_reflect.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/pointer_reflect_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/pointer_unsafe.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/pointer_unsafe_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/properties.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/properties_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/skip_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/table_marshal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/table_marshal_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/table_merge.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/table_unmarshal.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/table_unmarshal_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/text.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/text_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/text_parser.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/timestamp.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/timestamp_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/wrappers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/proto/wrappers_gogo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/gogo/protobuf/sortkeys/sortkeys.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_apiserver.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_authentication.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_version.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_ingress.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_insights.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_network.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/register.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_backup.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_cluster_image_policy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_crio_credential_provider_config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_image_policy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_insights.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_pki.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yamlis excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha2/types_insights.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/api/config/v1alpha2/zz_generated.featuregated-crd-manifests.yamlis excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/controller-runtime-common/pkg/tls/controller.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/controller-runtime-common/pkg/tls/tls.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/library-go/pkg/crypto/tls_adherence.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/encoding/tag/tag.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/encoding/text/decode.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/impl/codec_map.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/impl/decode.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/impl/validate.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/proto/decode.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admission/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1alpha1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1alpha1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1alpha1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1alpha1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1alpha1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1beta1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/admissionregistration/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apiserverinternal/v1alpha1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apiserverinternal/v1alpha1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/apps/v1beta2/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1alpha1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1alpha1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1alpha1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1alpha1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authentication/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/authorization/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta2/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta2/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta2/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/autoscaling/v2beta2/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/batch/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/register.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1alpha1/zz_generated.prerelease-lifecycle.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/register.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/certificates/v1beta1/zz_generated.prerelease-lifecycle.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1alpha2/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1alpha2/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1alpha2/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1alpha2/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/coordination/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/toleration.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/core/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/types_swagger_doc_generated.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/discovery/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/events/v1beta1/zz_generated.model_name.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/extensions/v1beta1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/extensions/v1beta1/generated.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/extensions/v1beta1/generated.protois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/api/extensions/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/k8s.io/api/extensions/v1beta1/types.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (32)
DockerfileOWNERSapi/v1/nodeptpdevice_types.goapi/v1/ptpconfig_webhook.goapi/v1/ptpoperatorconfig_webhook.goapi/v1/zz_generated.deepcopy.gobindata/linuxptp/ptp-daemon.yamlbundle/manifests/ptp-operator.clusterserviceversion.yamlbundle/manifests/ptp.openshift.io_nodeptpdevices.yamlconfig/crd/bases/ptp.openshift.io_nodeptpdevices.yamlconfig/manifests/bases/ptp-operator.clusterserviceversion.yamlconfig/prometheus/monitor.yamlcontrollers/ptpoperatorconfig_controller.gocontrollers/tls_profile_test.gocontrollers/tls_watcher_test.gogo.modmain.gomanifests/stable/ptp-operator.clusterserviceversion.yamlmanifests/stable/ptp.openshift.io_nodeptpdevices.yamlmust-gather/collection-scripts/gatherptp-tools/Dockerfile.cepptp-tools/Dockerfile.debugptp-tools/Dockerfile.krpptp-tools/Dockerfile.lptpdptp-tools/Dockerfile.ptpopptp-tools/Makefilescripts/k8s-start.shscripts/run-on-vm.shscripts/run-tests.shtest/conformance/serial/ptp.gotest/pkg/ptptesthelper/ptptesthelper.gotest/pkg/testconfig/testconfig.go
Comment on lines
+1
to
+3
| FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS builder | ||
| # Set as root to permission issues as its only for the builder | ||
| USER root |
There was a problem hiding this comment.
Set a non-root user for the runtime stage.
Line 3 explicitly sets root in build stage, and the runtime stage still has no USER, so the shipped container runs as root by default.
Proposed change (runtime stage)
FROM quay.io/centos/centos:stream9
COPY --from=builder /go/src/github.com/k8snetworkplumbingwg/ptp-operator/build/_output/bin/ptp-operator /usr/local/bin/
COPY --from=builder /go/src/github.com/k8snetworkplumbingwg/ptp-operator/manifests /manifests
COPY bindata /bindata
@@
+USER 65532
ENTRYPOINT ["/usr/local/bin/ptp-operator"]As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."
🧰 Tools
🪛 Trivy (0.69.3)
[error] 3-3: Image user should not be 'root'
Last USER command in Dockerfile should not be 'root'
Rule: DS-0002
(IaC/Dockerfile)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 1 - 3, The Dockerfile currently sets USER root in
the builder stage (FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS
builder / USER root) and never switches to a non-root user for the final runtime
image; update the Dockerfile to create or use a non-root user/group in the build
(or final) stage and add a USER <nonroot> directive in the runtime stage so the
shipped container does not run as root; ensure any runtime-owned files or
directories are chowned to that user (e.g., during the builder stage or in a
dedicated setup step) and reference the created username in the final USER
instruction.
Comment on lines
+90
to
117
| // Fetch the TLS security profile and adherence policy from the APIServer CR. | ||
| // Defaults to the Intermediate profile if the CR is not accessible. | ||
| tlsProfileSpec, err := fetchTLSProfile(restConfig) | ||
| tlsProfileSpec, tlsAdherencePolicy, err := fetchTLSConfig(restConfig) | ||
| isOpenShiftCluster := err == nil | ||
| if !isOpenShiftCluster { | ||
| setupLog.Info("unable to fetch TLS profile from APIServer CR, using Intermediate profile", "error", err) | ||
| setupLog.Info("unable to fetch TLS config from APIServer CR, using Intermediate profile", "error", err) | ||
| tlsProfileSpec, _ = openshifttls.GetTLSProfileSpec(nil) | ||
| } | ||
| setupLog.Info("TLS security profile resolved", "minTLSVersion", tlsProfileSpec.MinTLSVersion, "ciphers", tlsProfileSpec.Ciphers) | ||
| tlsOption, unsupportedCiphers := openshifttls.NewTLSConfigFromProfile(tlsProfileSpec) | ||
| if len(unsupportedCiphers) > 0 { | ||
| setupLog.Info("some ciphers from the TLS profile are not supported", "unsupportedCiphers", unsupportedCiphers) | ||
| honorClusterTLS := libgocrypto.ShouldHonorClusterTLSProfile(tlsAdherencePolicy) | ||
| setupLog.Info("TLS security profile resolved", | ||
| "minTLSVersion", tlsProfileSpec.MinTLSVersion, | ||
| "ciphers", tlsProfileSpec.Ciphers, | ||
| "tlsAdherence", tlsAdherencePolicy, | ||
| "honorClusterTLSProfile", honorClusterTLS) | ||
|
|
||
| var tlsOption func(*tls.Config) | ||
| var tlsProfileSpecPtr *configv1.TLSProfileSpec | ||
| if honorClusterTLS { | ||
| tlsProfileSpecPtr = &tlsProfileSpec | ||
| var unsupportedCiphers []string | ||
| tlsOption, unsupportedCiphers = openshifttls.NewTLSConfigFromProfile(tlsProfileSpec) | ||
| if len(unsupportedCiphers) > 0 { | ||
| setupLog.Info("some ciphers from the TLS profile are not supported", "unsupportedCiphers", unsupportedCiphers) | ||
| } | ||
| } else { | ||
| setupLog.Info("TLS adherence is legacy, using default TLS configuration") | ||
| tlsOption = func(*tls.Config) {} // no-op: use Go defaults | ||
| } |
There was a problem hiding this comment.
Don't collapse all APIServer TLS read errors into the non-OpenShift fallback.
fetchTLSConfig() now distinguishes the supported missing-policy case, but main() still treats any returned error here as "use fallback TLS". A transient or RBAC failure while reading the APIServer config will silently change the TLS posture and skip SecurityProfileWatcher startup on an actual OpenShift cluster. Please separate the expected "cluster TLS config unavailable" case from real read failures.
Also applies to: 334-361
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@main.go` around lines 90 - 117, fetchTLSConfig() can return a sentinel
"missing-policy" result that should be treated as the non-OpenShift fallback,
but other errors (transient/RBAC/read failures) must not be collapsed into that
case; update the main() handling around fetchTLSConfig so it: call
fetchTLSConfig(restConfig), then if err == nil proceed as before, else if
errors.Is(err, <the sentinel error exported by fetchTLSConfig/openshifttls> /*
e.g. ErrTLSProfileMissing/ErrPolicyUnavailable */ then log and fall back to
Intermediate profile as currently done, otherwise treat it as a real read
failure (log error and return/exit or requeue) so you do NOT set
isOpenShiftCluster=false or skip SecurityProfileWatcher; use errors.Is to detect
the sentinel error and reference fetchTLSConfig, tlsAdherencePolicy,
honorClusterTLS and SecurityProfileWatcher when making the change.
Comment on lines
+1
to
+2
| FROM quay.io/centos/centos:stream9 | ||
| RUN yum install -y tcpdump && yum clean all |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify where debug image is consumed
rg -n -- '--debug-image|test:debug|Dockerfile.debug'
# Check whether manifests/jobs set explicit security context and capabilities
rg -n --iglob '*.{yaml,yml,json}' 'securityContext|runAsUser|capabilities|privileged'Repository: openshift/ptp-operator
Length of output: 1418
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check how debug image is used in run-on-vm.sh
echo "=== run-on-vm.sh usage of debug image ==="
sed -n '85,95p' scripts/run-on-vm.sh
echo -e "\n=== run-tests.sh usage of debug image ==="
sed -n '40,50p' scripts/run-tests.sh
echo -e "\n=== gather script usage ==="
sed -n '20,30p' must-gather/collection-scripts/gather
echo -e "\n=== Check Dockerfile.debug for any additional context ==="
cat ptp-tools/Dockerfile.debug
echo -e "\n=== Check if ptp-tools/Makefile uses Dockerfile.debug ==="
if [ -f ptp-tools/Makefile ]; then
grep -n -i "dockerfile.debug\|debug.*image" ptp-tools/Makefile || echo "No matches found"
else
echo "ptp-tools/Makefile not found"
fi
echo -e "\n=== Check root Makefile for debug image build ==="
grep -n -i "dockerfile.debug\|debug.*image" Makefile 2>/dev/null | head -20 || echo "No matches"Repository: openshift/ptp-operator
Length of output: 1119
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Full gather script to see DEBUG_IMAGE usage ==="
cat must-gather/collection-scripts/gather | head -100
echo -e "\n=== Search for how DEBUG_IMAGE is used later in gather ==="
grep -n "DEBUG_IMAGE" must-gather/collection-scripts/gather
echo -e "\n=== Check if there's a pod/container run command with DEBUG_IMAGE ==="
rg -n -A5 'DEBUG_IMAGE' must-gather/collection-scripts/
echo -e "\n=== Check tcpdump requirements for capabilities ==="
# Search for any security context or capability specs that might apply to debug
rg -n 'tcpdump|CAP_' ptp-tools/ 2>/dev/null || echo "No tcpdump/CAP refs in ptp-tools"
echo -e "\n=== Check if gather script creates pods/containers ==="
rg -n 'kubectl.*run|oc.*run|podman.*run' must-gather/ || echo "No container run commands found"Repository: openshift/ptp-operator
Length of output: 4841
Use Linux capabilities instead of root for tcpdump in debug image.
The debug image defaults to root unnecessarily. Since tcpdump only needs network packet capture privileges, use Linux capabilities (CAP_NET_RAW and CAP_NET_ADMIN) instead. This reduces the blast radius if the image is accidentally used outside debug contexts.
Example:
FROM quay.io/centos/centos:stream9
RUN yum install -y tcpdump && yum clean all
RUN useradd -m tcpdump && setcap cap_net_raw,cap_net_admin=ep /usr/sbin/tcpdump
USER tcpdump🧰 Tools
🪛 Trivy (0.69.3)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ptp-tools/Dockerfile.debug` around lines 1 - 2, Replace running the debug
image as root and installing tcpdump with a non-root tcpdump user and grant
tcpdump only the required capabilities: after installing tcpdump in the
Dockerfile (the RUN that installs tcpdump), add creation of a tcpdump user
(useradd tcpdump) and run setcap to grant CAP_NET_RAW and CAP_NET_ADMIN on the
tcpdump binary (setcap cap_net_raw,cap_net_admin=ep /usr/sbin/tcpdump), then
switch to that user with USER tcpdump so the container no longer runs as root
but tcpdump retains necessary packet-capture privileges.
Comment on lines
+40
to
+43
| --must-gather-image) | ||
| MUST_GATHER_IMAGE="$2"; shift 2 ;; | ||
| --debug-image) | ||
| DEBUG_IMAGE="$2"; shift 2 ;; |
There was a problem hiding this comment.
Missing DEBUG_IMAGE initialization will cause runtime error with set -u.
DEBUG_IMAGE is parsed on line 42-43 but never initialized with a default value. Since the script uses set -u (line 17), referencing ${DEBUG_IMAGE} on line 127 will fail if --debug-image is not provided.
🐛 Proposed fix
LINUXPTP_DAEMON_IMAGE=""
MUST_GATHER_IMAGE=""
+DEBUG_IMAGE=""
while [[ $# -gt 0 ]]; do🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/run-tests.sh` around lines 40 - 43, The script references DEBUG_IMAGE
during option parsing but never initializes it, causing a failure under set -u;
initialize DEBUG_IMAGE (e.g., set to an empty string or sensible default) before
option parsing starts so references like ${DEBUG_IMAGE} later (used in the
run/tests logic) are safe; update the top-level variable declarations or the
option-parsing default block (symbols: DEBUG_IMAGE and the --debug-image case in
the option parsing) to ensure DEBUG_IMAGE is always defined even if
--debug-image is not provided.
Comment on lines
+1117
to
+1119
| // Step 2: cut upstream sync by bringing slave interface down | ||
| By(fmt.Sprintf("Step 2: Locking NIC-1 PTP source (bringing down %s)", nic1.SlaveIf)) | ||
| portEngine.TurnOffAndWaitFaulty(nic1.SlaveIf, nodeName) |
There was a problem hiding this comment.
Honor SKIP_INTERFACES before dropping BC slave links.
These specs bring discovered BC slave interfaces down unconditionally. The outage path later in this file already treats that operation as risky enough to require a skip list, and on clusters where one of these NICs also carries node traffic this can strand the node and cascade failures. Reuse the same safeguard here, or skip the spec when the target interface is protected.
Also applies to: 1176-1189
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@test/conformance/serial/ptp.go` around lines 1117 - 1119, The test currently
brings BC slave interfaces down unconditionally via
portEngine.TurnOffAndWaitFaulty(nic1.SlaveIf, nodeName), which ignores the
SKIP_INTERFACES safeguard; update the spec to first check the SKIP_INTERFACES
set (or call the existing helper used by the outage path) and skip the test when
nic1.SlaveIf (and the counterpart in the other spec range) is present in
SKIP_INTERFACES, logging a clear skip message and returning early instead of
calling TurnOffAndWaitFaulty; reference the SKIP_INTERFACES variable and the
TurnOffAndWaitFaulty(portEngine.*) usage to locate where to insert the guard.
Comment on lines
+2054
to
+2096
| By("Setting all slave interfaces down") | ||
| skippedInterfacesStr, isSet := os.LookupEnv("SKIP_INTERFACES") | ||
| if !isSet { | ||
| Skip("Mandatory to provide skipped interface to avoid making a node disconnected from the cluster") | ||
| } | ||
| skipInterfaces := make(map[string]bool) | ||
| for _, val := range strings.Split(skippedInterfacesStr, ",") { | ||
| skipInterfaces[val] = true | ||
| } | ||
| err := portEngine.TurnAllPortsDown(skipInterfaces) | ||
| Expect(err).To(BeNil()) | ||
| DeferCleanup(func() { | ||
| portEngine.TurnAllPortsUp() | ||
| }) | ||
|
|
||
| faultyRoles := make([]metrics.MetricRole, len(slaveIf)) | ||
| for i := range faultyRoles { | ||
| faultyRoles[i] = metrics.MetricRoleFaulty | ||
| } | ||
| slaveRoles := make([]metrics.MetricRole, len(slaveIf)) | ||
| for i := range slaveRoles { | ||
| slaveRoles[i] = metrics.MetricRoleSlave | ||
| } | ||
|
|
||
| By("Checking that all slave port roles are FAULTY after wait") | ||
| Eventually(func() error { | ||
| return metrics.CheckClockRole(faultyRoles, slaveIf, &slavePodNodeName) | ||
| }, 5*time.Minute, 10*time.Second).Should(BeNil()) | ||
|
|
||
| By("Checking clock class has degraded away from Locked (6)") | ||
| Eventually(func() bool { | ||
| return !checkClockClassStateReturnBool(fullConfig, strconv.Itoa(int(fbprotocol.ClockClass6))) | ||
| }, 5*time.Minute, 10*time.Second).Should(BeTrue(), | ||
| "expected clock class to degrade from Locked (6) after upstream link loss") | ||
|
|
||
| By("Setting all slave interfaces up") | ||
| err = portEngine.TurnAllPortsUp() | ||
| Expect(err).To(BeNil()) | ||
|
|
||
| By("Checking that all slave port roles are SLAVE after wait") | ||
| Eventually(func() error { | ||
| return metrics.CheckClockRole(slaveRoles, slaveIf, &slavePodNodeName) | ||
| }, 5*time.Minute, 10*time.Second).Should(BeNil()) |
There was a problem hiding this comment.
Use the filtered interface set for the FAULTY/SLAVE assertions.
TurnAllPortsDown(skipInterfaces) intentionally leaves skipped NICs up, but faultyRoles and slaveRoles are still built against the full slaveIf slice. If SKIP_INTERFACES overlaps any BC slave port, these checks can never pass.
Suggested fix
skipInterfaces := make(map[string]bool)
for _, val := range strings.Split(skippedInterfacesStr, ",") {
skipInterfaces[val] = true
}
+ testIfs := make([]string, 0, len(slaveIf))
+ for _, iface := range slaveIf {
+ if !skipInterfaces[iface] {
+ testIfs = append(testIfs, iface)
+ }
+ }
+ Expect(testIfs).ToNot(BeEmpty(), "all BC slave interfaces were skipped")
err := portEngine.TurnAllPortsDown(skipInterfaces)
Expect(err).To(BeNil())
DeferCleanup(func() {
portEngine.TurnAllPortsUp()
})
- faultyRoles := make([]metrics.MetricRole, len(slaveIf))
+ faultyRoles := make([]metrics.MetricRole, len(testIfs))
for i := range faultyRoles {
faultyRoles[i] = metrics.MetricRoleFaulty
}
- slaveRoles := make([]metrics.MetricRole, len(slaveIf))
+ slaveRoles := make([]metrics.MetricRole, len(testIfs))
for i := range slaveRoles {
slaveRoles[i] = metrics.MetricRoleSlave
}
By("Checking that all slave port roles are FAULTY after wait")
Eventually(func() error {
- return metrics.CheckClockRole(faultyRoles, slaveIf, &slavePodNodeName)
+ return metrics.CheckClockRole(faultyRoles, testIfs, &slavePodNodeName)
}, 5*time.Minute, 10*time.Second).Should(BeNil())
@@
By("Checking that all slave port roles are SLAVE after wait")
Eventually(func() error {
- return metrics.CheckClockRole(slaveRoles, slaveIf, &slavePodNodeName)
+ return metrics.CheckClockRole(slaveRoles, testIfs, &slavePodNodeName)
}, 5*time.Minute, 10*time.Second).Should(BeNil())🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@test/conformance/serial/ptp.go` around lines 2054 - 2096, The FAULTY/SLAVE
assertions currently use the full slaveIf slice even though
TurnAllPortsDown(skipInterfaces) leaves skipped NICs up; update the test to
build a filtered slice (e.g., filteredSlaveIf) by excluding interfaces present
in skipInterfaces (the map built from SKIP_INTERFACES) and then create
faultyRoles and slaveRoles using len(filteredSlaveIf); call
metrics.CheckClockRole with filteredSlaveIf (and &slavePodNodeName) instead of
slaveIf for both the FAULTY and SLAVE Eventually checks so the assertions only
cover the interfaces actually toggled by TurnAllPortsDown/TurnAllPortsUp.
Comment on lines
+3574
to
+3605
| func setupBCClockClassEvents(nodeName string) bcEventContext { | ||
| ctx := bcEventContext{} | ||
| if !event.Enable() { | ||
| return ctx | ||
| } | ||
| logrus.Info("Deploy consumer app for BC clock class event monitoring") | ||
| if createErr := event.CreateConsumerApp(nodeName); createErr != nil { | ||
| logrus.Warnf("PTP events not available: %s; skipping event checks", createErr) | ||
| return ctx | ||
| } | ||
| time.Sleep(10 * time.Second) | ||
| event.InitPubSub() | ||
| var eventCleanup func() | ||
| ctx.subs, eventCleanup = event.SubscribeToGMChangeEvents(100, true, 60*time.Second) | ||
| termMonitor, monErr := event.MonitorPodLogsRegex() | ||
| if monErr != nil { | ||
| logrus.Warnf("Could not start event monitoring: %s; skipping event checks", monErr) | ||
| } else { | ||
| ctx.available = true | ||
| } | ||
| DeferCleanup(func() { | ||
| if termMonitor != nil { | ||
| stopMonitor(termMonitor) | ||
| } | ||
| eventCleanup() | ||
| event.PubSub.Close() | ||
| if deleteErr := event.DeleteConsumerNamespace(); deleteErr != nil { | ||
| logrus.Debugf("Deleting consumer namespace failed: %s", deleteErr) | ||
| } | ||
| }) | ||
| return ctx | ||
| } |
There was a problem hiding this comment.
Don't silently disable Event API validation after setup failures.
Once event.Enable() is true, failing consumer creation or log monitoring means the event path is broken. Returning available=false makes every later verifyClockClassViaEvent call a no-op, so these specs can pass without validating Event API behavior at all.
Suggested fix
func setupBCClockClassEvents(nodeName string) bcEventContext {
ctx := bcEventContext{}
if !event.Enable() {
return ctx
}
logrus.Info("Deploy consumer app for BC clock class event monitoring")
- if createErr := event.CreateConsumerApp(nodeName); createErr != nil {
- logrus.Warnf("PTP events not available: %s; skipping event checks", createErr)
- return ctx
- }
+ Expect(event.CreateConsumerApp(nodeName)).To(Succeed(), "event consumer setup failed")
time.Sleep(10 * time.Second)
event.InitPubSub()
var eventCleanup func()
ctx.subs, eventCleanup = event.SubscribeToGMChangeEvents(100, true, 60*time.Second)
termMonitor, monErr := event.MonitorPodLogsRegex()
- if monErr != nil {
- logrus.Warnf("Could not start event monitoring: %s; skipping event checks", monErr)
- } else {
- ctx.available = true
- }
+ Expect(monErr).NotTo(HaveOccurred(), "event monitoring failed")
+ ctx.available = true
DeferCleanup(func() {
if termMonitor != nil {
stopMonitor(termMonitor)
}
eventCleanup()
- event.PubSub.Close()
+ if event.PubSub != nil {
+ event.PubSub.Close()
+ }
if deleteErr := event.DeleteConsumerNamespace(); deleteErr != nil {
logrus.Debugf("Deleting consumer namespace failed: %s", deleteErr)
}
})
return ctx
}Also applies to: 3609-3614
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@test/conformance/serial/ptp.go` around lines 3574 - 3605, When event.Enable()
is true, do not silently disable event validation on setup errors; update
setupBCClockClassEvents so that failures from event.CreateConsumerApp or
event.MonitorPodLogsRegex cause the test to fail (or explicitly skip with a
clear message) instead of returning a ctx that makes later
verifyClockClassViaEvent a no-op. Locate setupBCClockClassEvents and replace the
current early return/log-only behavior around event.CreateConsumerApp and the
MonitorPodLogsRegex error branch with a call that fails the spec (e.g.,
Ginkgo.Fail/Ginkgo.Skip or the project's test-fail helper) including the error
details, while keeping the existing cleanup logic (eventCleanup, StopMonitor,
event.PubSub.Close, DeleteConsumerNamespace) intact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream PRs included
Skipped PRs
#195 Configure AWS timeout to 2 hours for long jobs— all changed files are upstream-only (not present downstream)