Add etcd signer verification and etcd-operator presubmits for ConfigurablePKI feature#78663
Add etcd signer verification and etcd-operator presubmits for ConfigurablePKI feature#78663hasbro17 wants to merge 1 commit into
Conversation
Extend pki-verify to unconditionally check etcd-signer and etcd-metrics-signer secrets (openshift-etcd namespace), bringing the total from 7 to 9 verified signers. Add configurable EXPECTED_PKI_MODE env var (default: Custom) to support the updated installer behavior where mode is "Default" when pki section is omitted from install-config. Add optional PKI presubmit jobs (e2e-aws-ovn-pki-default-techpreview, e2e-aws-ovn-pki-rsa-techpreview) to the etcd-operator main config as the etcd-operator is adding support for consuming PKI config. Assisted-by: Claude Code (Opus 4.6)
WalkthroughThis pull request introduces PKI mode verification infrastructure for OpenShift installers. Two new E2E test jobs are added to validate default ECDSA and RSA PKI modes on AWS, with the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yaml (1)
289-303: ⚡ Quick winSet
EXPECTED_PKI_MODEexplicitly in the RSA job to avoid implicit coupling to ref defaults.Line 290 onward currently inherits the step default. Pinning it in-job makes intent explicit and avoids accidental behavior drift if the ref default ever changes.
♻️ Proposed fix
- always_run: false as: e2e-aws-ovn-pki-rsa-techpreview optional: true steps: cluster_profile: openshift-org-aws env: EXPECTED_ALGORITHM: RSA EXPECTED_KEY_PARAM: "4096" + EXPECTED_PKI_MODE: Custom FEATURE_SET: TechPreviewNoUpgrade PKI_ALGORITHM: RSA PKI_RSA_KEY_SIZE: "4096"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yaml` around lines 289 - 303, The job e2e-aws-ovn-pki-rsa-techpreview currently relies on a ref default for PKI mode; explicitly set the EXPECTED_PKI_MODE environment variable in that job's env block (alongside EXPECTED_ALGORITHM, EXPECTED_KEY_PARAM, PKI_ALGORITHM, PKI_RSA_KEY_SIZE) to "RSA" so the behavior is pinned regardless of changes in the referenced refs like openshift-installer-pki-verify.ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh (1)
130-135: ⚡ Quick winUse structured field lookup for PKI mode instead of grepping YAML.
Line 130 currently parses
modeviagrep "mode:", which can misread future YAML changes. Querying.spec.modedirectly is safer and still simple.♻️ Proposed fix
- mode=$(echo "${pki_cr}" | grep "mode:" | head -1 | awk '{print $2}' || true) + mode=$(oc get pki cluster -o jsonpath='{.spec.mode}' 2>/dev/null || true)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh` around lines 130 - 135, Replace the fragile grep-based YAML parsing for `mode` with a structured lookup into `.spec.mode`; specifically, instead of using the `grep|head|awk` pipeline on `pki_cr`, extract the field via a YAML/JSON parser (e.g., `yq` or `jq`/`oc/kubectl --output=jsonpath`) so `mode=$(echo "${pki_cr}" | yq e '.spec.mode' - 2>/dev/null || true)` (or the equivalent jsonpath invocation) is used; keep the rest of the logic (the comparison against EXPECTED_PKI_MODE, logging to ARTIFACT_LOG, and setting pki_status="FAIL") unchanged and reference `pki_cr`, `EXPECTED_PKI_MODE`, `ARTIFACT_LOG`, and `pki_status` when making the replacement.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In
`@ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yaml`:
- Around line 289-303: The job e2e-aws-ovn-pki-rsa-techpreview currently relies
on a ref default for PKI mode; explicitly set the EXPECTED_PKI_MODE environment
variable in that job's env block (alongside EXPECTED_ALGORITHM,
EXPECTED_KEY_PARAM, PKI_ALGORITHM, PKI_RSA_KEY_SIZE) to "RSA" so the behavior is
pinned regardless of changes in the referenced refs like
openshift-installer-pki-verify.
In
`@ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh`:
- Around line 130-135: Replace the fragile grep-based YAML parsing for `mode`
with a structured lookup into `.spec.mode`; specifically, instead of using the
`grep|head|awk` pipeline on `pki_cr`, extract the field via a YAML/JSON parser
(e.g., `yq` or `jq`/`oc/kubectl --output=jsonpath`) so `mode=$(echo "${pki_cr}"
| yq e '.spec.mode' - 2>/dev/null || true)` (or the equivalent jsonpath
invocation) is used; keep the rest of the logic (the comparison against
EXPECTED_PKI_MODE, logging to ARTIFACT_LOG, and setting pki_status="FAIL")
unchanged and reference `pki_cr`, `EXPECTED_PKI_MODE`, `ARTIFACT_LOG`, and
`pki_status` when making the replacement.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: ffcee320-13a9-4ea5-ba59-57aeb58e0a1a
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (8)
ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yamlci-operator/config/openshift/installer/openshift-installer-main.yamlci-operator/config/openshift/installer/openshift-installer-release-4.22.yamlci-operator/config/openshift/installer/openshift-installer-release-4.23.yamlci-operator/config/openshift/installer/openshift-installer-release-5.0.yamlci-operator/config/openshift/installer/openshift-installer-release-5.1.yamlci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.shci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-ref.yaml
|
@hasbro17: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: hasbro17, rh-roman The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 participants
Follow up to #77043
Adding tests for openshift/cluster-etcd-operator#1593
Summary
openshift-installer-pki-verifyto unconditionally check etcd-signer and etcd-metrics-signer secrets (9 total, up from 7)EXPECTED_PKI_MODEenv var to supportmode: Default(pki section omitted) vsmode: Custom(explicit pki.signerCertificates)e2e-aws-ovn-pki-default-techpreview,e2e-aws-ovn-pki-rsa-techpreview)Test plan
/test e2e-aws-ovn-pki-default-techpreviewon etcd-operator PR validates ECDSA P-384 default behavior/test e2e-aws-ovn-pki-rsa-techpreviewon etcd-operator PR validates explicit RSA-4096 overrideSummary by CodeRabbit