-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CMP-2378: Fix OCP version regex #11499
Conversation
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
deployed and tested on a OCP 4.14.6 cluster:
|
/test |
@Vincent056: The
Use
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/test e2e-aws-ocp4-cis |
/hold for test |
@Vincent056 The expected result should be there will be test result for ocp4-cis-api-server-kubelet-client-key, and no result for ocp4-cis-api-server-kubelet-client-key-pre-4-9, right? |
Verification pass with 4.14.6 and content in #11499: $ oc compliance bind -N test profile/upstream-ocp4-cis |
/unhold |
/label qe-approved |
@xiaojiey: The label(s) In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
applications/openshift/api-server/api_server_api_priority_v1beta2_flowschema_catch_all/rule.yml
Show resolved
Hide resolved
@BhargaviGudi Hi, could you check this PR once again? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
/hold for test |
Verification passed with 4.14.6 + compliance-operator with compliance-operator code + PR #11499 code
|
/unhold |
@BhargaviGudi: The label(s) In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/lgtm |
/test |
@lbragstad I did not observe the issue with 4.16.0 or 4.15.0 or 4.13.0
|
/test 4.15-e2e-aws-ocp4-stig |
The 4.16 e2e tests still seem to be failing on:
|
OCP4.16 has introduced flowcontrol.apiserver.k8s.io/v1 https://kubernetes.io/docs/reference/using-api/deprecation-guide/ |
/retest |
We have issues when the OCP version is something like 4.14.6, the old regex matches this version into both 4.6 and 4.14, this commit change the regex so it requires the match to start with '4'.
Adding ocp4.14 ocp4.15 to applicable rules so they get run on those OCP versions
8c74b93
to
cd0824f
Compare
/test 4.15-e2e-aws-ocp4-stig |
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_api_priority_flowschema_catch_all'.
--- xccdf_org.ssgproject.content_rule_api_server_api_priority_flowschema_catch_all
+++ xccdf_org.ssgproject.content_rule_api_server_api_priority_flowschema_catch_all
@@ -17,7 +17,8 @@
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/flowcontrol.apiserver.k8s.io/v1alpha1/flowschemas/catch-all API endpoint to the local /apis/flowcontrol.apiserver.k8s.io/v1alpha1/flowschemas/catch-all file true
/apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/catch-all API endpoint to the local /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/catch-all file true
- /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/catch-all API endpoint to the local /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/catch-all file true .
+ /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/catch-all API endpoint to the local /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/catch-all file true
+ /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/catch-all API endpoint to the local /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/catch-all file true .
[reference]:
CIP-003-8 R6
OVAL for rule 'xccdf_org.ssgproject.content_rule_api_server_api_priority_flowschema_catch_all' differs.
--- oval:ssg-api_server_api_priority_flowschema_catch_all:def:1
+++ oval:ssg-api_server_api_priority_flowschema_catch_all:def:1
@@ -2,3 +2,4 @@
extend_definition oval:ssg-api_server_api_priority_v1alpha1_flowschema_catch_all:def:1
extend_definition oval:ssg-api_server_api_priority_v1beta1_flowschema_catch_all:def:1
extend_definition oval:ssg-api_server_api_priority_v1beta2_flowschema_catch_all:def:1
+extend_definition oval:ssg-api_server_api_priority_v1_flowschema_catch_all:def:1
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_api_server_api_priority_v1beta2_flowschema_catch_all'
--- xccdf_org.ssgproject.content_rule_api_server_api_priority_v1beta2_flowschema_catch_all
+++ xccdf_org.ssgproject.content_rule_api_server_api_priority_v1beta2_flowschema_catch_all
@@ -1,3 +1,5 @@
oval:ssg-installed_app_is_ocp4_11:def:1
oval:ssg-installed_app_is_ocp4_12:def:1
oval:ssg-installed_app_is_ocp4_13:def:1
+oval:ssg-installed_app_is_ocp4_14:def:1
+oval:ssg-installed_app_is_ocp4_15:def:1
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_api_server_kubelet_client_cert'
--- xccdf_org.ssgproject.content_rule_api_server_kubelet_client_cert
+++ xccdf_org.ssgproject.content_rule_api_server_kubelet_client_cert
@@ -3,4 +3,7 @@
oval:ssg-installed_app_is_ocp4_11:def:1
oval:ssg-installed_app_is_ocp4_12:def:1
oval:ssg-installed_app_is_ocp4_13:def:1
+oval:ssg-installed_app_is_ocp4_14:def:1
+oval:ssg-installed_app_is_ocp4_15:def:1
+oval:ssg-installed_app_is_ocp4_16:def:1
oval:ssg-installed_app_is_ocp4_9:def:1
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_api_server_kubelet_client_key'
--- xccdf_org.ssgproject.content_rule_api_server_kubelet_client_key
+++ xccdf_org.ssgproject.content_rule_api_server_kubelet_client_key
@@ -3,4 +3,7 @@
oval:ssg-installed_app_is_ocp4_11:def:1
oval:ssg-installed_app_is_ocp4_12:def:1
oval:ssg-installed_app_is_ocp4_13:def:1
+oval:ssg-installed_app_is_ocp4_14:def:1
+oval:ssg-installed_app_is_ocp4_15:def:1
+oval:ssg-installed_app_is_ocp4_16:def:1
oval:ssg-installed_app_is_ocp4_9:def:1
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cert'
--- xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cert
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cert
@@ -3,4 +3,7 @@
oval:ssg-installed_app_is_ocp4_11:def:1
oval:ssg-installed_app_is_ocp4_12:def:1
oval:ssg-installed_app_is_ocp4_13:def:1
+oval:ssg-installed_app_is_ocp4_14:def:1
+oval:ssg-installed_app_is_ocp4_15:def:1
+oval:ssg-installed_app_is_ocp4_16:def:1
oval:ssg-installed_app_is_ocp4_9:def:1
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_tls_key'
--- xccdf_org.ssgproject.content_rule_kubelet_configure_tls_key
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_tls_key
@@ -3,4 +3,7 @@
oval:ssg-installed_app_is_ocp4_11:def:1
oval:ssg-installed_app_is_ocp4_12:def:1
oval:ssg-installed_app_is_ocp4_13:def:1
+oval:ssg-installed_app_is_ocp4_14:def:1
+oval:ssg-installed_app_is_ocp4_15:def:1
+oval:ssg-installed_app_is_ocp4_16:def:1
oval:ssg-installed_app_is_ocp4_9:def:1 |
cd0824f
to
7056711
Compare
/test 4.15-e2e-aws-ocp4-stig |
/hold for test |
Verification passed with 4.16.0-0.nightly-2024-02-17-094036 + compliance-operator with compliance-operator code + PR #11499 code
|
/unhold |
applications/openshift/api-server/api_server_api_priority_v1_flowschema_catch_all/rule.yml
Outdated
Show resolved
Hide resolved
7056711
to
5c15969
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
applications/openshift/api-server/api_server_api_priority_flowschema_catch_all/oval/shared.xml
Outdated
Show resolved
Hide resolved
OCP 4.16 has introduced flowcontrol.apiserver.k8s.io/v1, this commit adds the v1 for ocp 4.16
5c15969
to
26626d3
Compare
Code Climate has analyzed commit 26626d3 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.3% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
Checking to see if we can get the test farm to pass, even though it seems unrelated.
We have issues when the OCP version is something like 4.14.6, the old regex matches this version into both 4.6 and 4.14, this commit changes the regex so it requires the match to start with '4'.
This is related to:
https://issues.redhat.com/browse/CMP-2378