CMP-2859: Resolve failing Image-stream-sets-schedule #12895

KaushikOP · 2025-01-24T13:34:26Z

Description:

Resolve failing Image-stream-sets-schedule. Changes to samples operator which were not accounted for, and ClusterVersion managed imagestreams should be excluded.

Rationale:

fixes failing rule
Fixes #CMP-2859

Review Hints:

Part of DISA-STIG profile for OCP

…ator and ClusterVersion Signed-off-by: Kaushik Talathi <kaushik.talathi1@ibm.com>

openshift-ci · 2025-01-24T13:34:38Z

Hi @KaushikOP. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

prb112 · 2025-01-24T13:44:09Z

/jira-refresh

prb112 · 2025-01-24T13:50:35Z

applications/openshift/registry/imagestream_sets_schedule/rule.yml

@@ -32,17 +32,17 @@ references:
    srg: SRG-APP-000456-CTR-001125

 {{% set api_path = '/apis/image.openshift.io/v1/imagestreams' %}}
-{{% set jqfilter = '[.items[] | .spec.tags[]? | select(.from.kind != "ImageStreamTag") | (.importPolicy.scheduled != null and .importPolicy.scheduled != false)] | all' %}}
+{{% set jqfilter = '[.items[] | select( .metadata.ownerReferences? // [] | all(.kind != "ClusterVersion")) | select(.metadata.labels[]? | select("samples.operator.openshift.io/managed: true") | not) | select(.spec.tags[]?.from.kind != "ImageStreamTag" and (.importPolicy.scheduled != null or .importPolicy.scheduled != false))] | any' %}}


Gather all ImageStreams - .items[]

Select only those not managed by ClusterVersion - select( .metadata.ownerReferences? // [] | all(.kind != "ClusterVersion"))

ClusterVersion implies on upgrade that these ImageStream entries are upgraded

From those that remain, check if it's managed by the Samples Operator, if so ignore those - select(.metadata.labels[]? | select("samples.operator.openshift.io/managed: true") | not)

Check the Remaining ones are not tags - select(.spec.tags[]?.from.kind != "ImageStreamTag" and (partial query here)

e.g. ImageStreamTag latest points to v1.2.3

The ones that remain from that check to see if scheduled is false or not set - (.importPolicy.scheduled != null or .importPolicy.scheduled != false))] | any' %}}

If any fail the last condition it returns false for the query.

Thanks a bunch for the breakdown and explanation of the jq filter.

prb112 · 2025-01-27T13:20:21Z

/retest-required

openshift-ci · 2025-01-27T13:20:38Z

@prb112: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/retest-required

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

prb112 · 2025-02-13T18:35:06Z

/jira-refresh

yuumasato · 2025-02-28T09:07:35Z

/ok-to-test

yuumasato

/LGTM

But could you also update the expected results so that our CI doesn't flag this change?

Change the following lines from FAIL to PASS.

$ grep -rA2 "imagestream-sets-schedule" tests/assertions/ocp4/
tests/assertions/ocp4/ocp4-stig-4.12.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.12.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.12.yml-    result_after_remediation: FAIL
--
tests/assertions/ocp4/ocp4-stig-4.13.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.13.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.13.yml-    result_after_remediation: FAIL
--
tests/assertions/ocp4/ocp4-stig-4.14.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.14.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.14.yml-    result_after_remediation: FAIL
--
tests/assertions/ocp4/ocp4-stig-4.15.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.15.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.15.yml-    result_after_remediation: FAIL
--
tests/assertions/ocp4/ocp4-stig-4.16.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.16.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.16.yml-    result_after_remediation: FAIL
--
tests/assertions/ocp4/ocp4-stig-4.17.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.17.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.17.yml-    result_after_remediation: FAIL
--
tests/assertions/ocp4/ocp4-stig-4.18.yml:  e2e-stig-imagestream-sets-schedule:
tests/assertions/ocp4/ocp4-stig-4.18.yml-    default_result: FAIL
tests/assertions/ocp4/ocp4-stig-4.18.yml-    result_after_remediation: FAIL

$ cat ./applications/openshift/registry/imagestream_sets_schedule/tests/ocp4/e2e.yml 
---
default_result: FAIL

prb112 · 2025-02-28T15:18:42Z

Thanks @yuumasato I'll leave a message with Kaushik letting him know

Signed-off-by: Kaushik Talathi <kaushik.talathi1@ibm.com>

yuumasato

@KaushikOP tests/assertions/ocp4/ocp4-stig-4.18.yml was left out of the assertion update.

Please update it as well.

yuumasato · 2025-03-03T15:35:12Z

/test 4.17-e2e-aws-ocp4-stig
/test 4.18-e2e-aws-ocp4-stig

Signed-off-by: Kaushik Talathi <kaushik.talathi1@ibm.com>

prb112 · 2025-03-04T14:09:47Z

/retest-required

KaushikOP · 2025-03-05T07:09:31Z

Hi @yuumasato

I have made the changes. Please re-review.

rhmdnd · 2025-03-05T16:13:20Z

/retest-required

yuumasato · 2025-03-05T16:13:55Z

/test 4.12-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig

prb112 · 2025-03-05T18:40:13Z

Grabbed the imagestreams from the must-gather. https://gist.github.com/prb112/06768521d08ecf0eba49476252580e8e

Will ask @KaushikOP to test the jq locally to see why it failed.

prb112 · 2025-03-06T20:28:16Z

Analyzed the gist / imagestreams - it should have passed. Perhaps a retest?

prb112 · 2025-03-06T20:28:30Z

/retest-required

prb112 · 2025-03-12T13:26:51Z

/retest-required

openshift-ci · 2025-03-12T15:10:06Z

@KaushikOP: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.17-e2e-aws-ocp4-stig	`e594653`	link	true	`/test 4.17-e2e-aws-ocp4-stig`
ci/prow/4.18-e2e-aws-ocp4-stig	`e594653`	link	true	`/test 4.18-e2e-aws-ocp4-stig`
ci/prow/4.12-e2e-aws-ocp4-stig	`ec65613`	link	true	`/test 4.12-e2e-aws-ocp4-stig`
ci/prow/4.16-e2e-aws-ocp4-stig	`ec65613`	link	true	`/test 4.16-e2e-aws-ocp4-stig`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

CMP-2859: filter default ImageStream constructs from the samples oper…

336507e

…ator and ClusterVersion Signed-off-by: Kaushik Talathi <kaushik.talathi1@ibm.com>

openshift-ci bot added the needs-ok-to-test label Jan 24, 2025

KaushikOP changed the title ~~CMP2859: Resolve failing Image-stream-sets-schedule~~ CMP-2859: Resolve failing Image-stream-sets-schedule Jan 24, 2025

prb112 reviewed Jan 24, 2025

View reviewed changes

jan-cerny added the OpenShift label Jan 27, 2025

yuumasato self-assigned this Feb 28, 2025

openshift-ci bot added ok-to-test and removed needs-ok-to-test labels Feb 28, 2025

yuumasato requested changes Feb 28, 2025

View reviewed changes

Updating Assertions for Rule

e594653

Signed-off-by: Kaushik Talathi <kaushik.talathi1@ibm.com>

yuumasato reviewed Mar 3, 2025

View reviewed changes

Updating missing assertion for rule

ec65613

Signed-off-by: Kaushik Talathi <kaushik.talathi1@ibm.com>

KaushikOP requested a review from yuumasato March 5, 2025 07:08

yuumasato added this to the 0.1.77 milestone Mar 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CMP-2859: Resolve failing Image-stream-sets-schedule #12895

CMP-2859: Resolve failing Image-stream-sets-schedule #12895

KaushikOP commented Jan 24, 2025 •

edited

Loading

openshift-ci bot commented Jan 24, 2025

prb112 commented Jan 24, 2025

prb112 Jan 24, 2025

yuumasato Feb 28, 2025

prb112 commented Jan 27, 2025

openshift-ci bot commented Jan 27, 2025

prb112 commented Feb 13, 2025

yuumasato commented Feb 28, 2025

yuumasato left a comment

prb112 commented Feb 28, 2025

yuumasato left a comment

yuumasato commented Mar 3, 2025

prb112 commented Mar 4, 2025

KaushikOP commented Mar 5, 2025

rhmdnd commented Mar 5, 2025

yuumasato commented Mar 5, 2025

prb112 commented Mar 5, 2025

prb112 commented Mar 6, 2025

prb112 commented Mar 6, 2025

prb112 commented Mar 12, 2025

openshift-ci bot commented Mar 12, 2025

CMP-2859: Resolve failing Image-stream-sets-schedule #12895

Are you sure you want to change the base?

CMP-2859: Resolve failing Image-stream-sets-schedule #12895

Conversation

KaushikOP commented Jan 24, 2025 • edited Loading

Description:

Rationale:

Review Hints:

openshift-ci bot commented Jan 24, 2025

prb112 commented Jan 24, 2025

prb112 Jan 24, 2025

Choose a reason for hiding this comment

yuumasato Feb 28, 2025

Choose a reason for hiding this comment

prb112 commented Jan 27, 2025

openshift-ci bot commented Jan 27, 2025

prb112 commented Feb 13, 2025

yuumasato commented Feb 28, 2025

yuumasato left a comment

Choose a reason for hiding this comment

prb112 commented Feb 28, 2025

yuumasato left a comment

Choose a reason for hiding this comment

yuumasato commented Mar 3, 2025

prb112 commented Mar 4, 2025

KaushikOP commented Mar 5, 2025

rhmdnd commented Mar 5, 2025

yuumasato commented Mar 5, 2025

prb112 commented Mar 5, 2025

prb112 commented Mar 6, 2025

prb112 commented Mar 6, 2025

prb112 commented Mar 12, 2025

openshift-ci bot commented Mar 12, 2025

KaushikOP commented Jan 24, 2025 •

edited

Loading