CMP-2525: Implement dynamic scan settings for ROSA #511

Vincent056 · 2024-05-01T18:46:48Z

Made change to be able to detect what managed cluster we are on using ClusterClaim, through /apis/cluster.open-cluster-management.io/v1alpha1/clusterclaims/product.open-cluster-management.io

oc get clusterclaims product.open-cluster-management.io -v 7 -o json
I0501 09:56:39.390722   70110 loader.go:373] Config loaded from file:  /Users/vincent/.kube/config
I0501 09:56:39.397643   70110 round_trippers.go:463] GET https://api.thb83-r47s4-4hg.6hoh.p3.openshiftapps.com:443/apis/cluster.open-cluster-management.io/v1alpha1/clusterclaims/product.open-cluster-management.io
I0501 09:56:39.397652   70110 round_trippers.go:469] Request Headers:
I0501 09:56:39.397657   70110 round_trippers.go:473]     User-Agent: oc/4.14.0 (darwin/arm64) kubernetes/0c63f9d
I0501 09:56:39.397661   70110 round_trippers.go:473]     Authorization: Bearer <masked>
I0501 09:56:39.397665   70110 round_trippers.go:473]     Accept: application/json
I0501 09:56:39.712622   70110 round_trippers.go:574] Response Status: 200 OK in 314 milliseconds
{
    "apiVersion": "cluster.open-cluster-management.io/v1alpha1",
    "kind": "ClusterClaim",
    "metadata": {
        "creationTimestamp": "2024-05-01T15:29:30Z",
        "generation": 1,
        "labels": {
            "open-cluster-management.io/hub-managed": "",
            "velero.io/exclude-from-backup": "true"
        },
        "name": "product.open-cluster-management.io",
        "resourceVersion": "7268",
        "uid": "6ad67a1c-ecf9-4d8e-87e0-68111bbaf97f"
    },
    "spec": {
        "value": "ROSA"
    }
}

Added ROSA platform type, disable master role if detected running on ROSA

openshift-ci-robot · 2024-05-01T18:46:51Z

@Vincent056: This pull request references CMP-2525 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

Made change to be able to detect what managed cluster we are on using ClusterClaim, through /apis/cluster.open-cluster-management.io/v1alpha1/clusterclaims/product.open-cluster-management.io

oc get clusterclaims product.open-cluster-management.io -v 7 -o json
I0501 09:56:39.390722   70110 loader.go:373] Config loaded from file:  /Users/vincent/.kube/config
I0501 09:56:39.397643   70110 round_trippers.go:463] GET https://api.thb83-r47s4-4hg.6hoh.p3.openshiftapps.com:443/apis/cluster.open-cluster-management.io/v1alpha1/clusterclaims/product.open-cluster-management.io
I0501 09:56:39.397652   70110 round_trippers.go:469] Request Headers:
I0501 09:56:39.397657   70110 round_trippers.go:473]     User-Agent: oc/4.14.0 (darwin/arm64) kubernetes/0c63f9d
I0501 09:56:39.397661   70110 round_trippers.go:473]     Authorization: Bearer <masked>
I0501 09:56:39.397665   70110 round_trippers.go:473]     Accept: application/json
I0501 09:56:39.712622   70110 round_trippers.go:574] Response Status: 200 OK in 314 milliseconds
{
   "apiVersion": "cluster.open-cluster-management.io/v1alpha1",
   "kind": "ClusterClaim",
   "metadata": {
       "creationTimestamp": "2024-05-01T15:29:30Z",
       "generation": 1,
       "labels": {
           "open-cluster-management.io/hub-managed": "",
           "velero.io/exclude-from-backup": "true"
       },
       "name": "product.open-cluster-management.io",
       "resourceVersion": "7268",
       "uid": "6ad67a1c-ecf9-4d8e-87e0-68111bbaf97f"
   },
   "spec": {
       "value": "ROSA"
   }
}

Added ROSA platform type, disable master role and default-auto-apply scansetting if detected running on ROSA

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-05-01T18:47:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Vincent056

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Vincent056]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rhmdnd · 2024-05-06T20:30:21Z

cmd/manager/operator.go

+		} else {
+			// check the value of the clusterClaim
+			if clusterClaim.Spec.Value != "" {
+				pflag = clusterClaim.Spec.Value


Is this used consistently across all managed offerings? Can we also rely on this for ARO?

rhmdnd · 2024-05-06T20:42:09Z

cmd/manager/operator.go

+	if pflag == "" {
+		clusterClaim := &clusterv1alpha1.ClusterClaim{}
+		if err := kubeClient.RESTClient().Get().RequestURI("/apis/cluster.open-cluster-management.io/v1alpha1/clusterclaims/product.open-cluster-management.io").Do(ctx).Into(clusterClaim); err != nil {
+			setupLog.Info("Couldn't get ClusterClaim. This is not fatal though.")


Since we're using ClusterClaim as an internal implementation detail, we could say something like:

setupLog.Info("Unable to determine managed offering type.")

Then if readers see the error, but they're using self-managed, they don't really have a reason to be alarmed.

agree, let me fix it

rhmdnd

Only a couple comments inline. This is looking good, and we just need to get some testing wired up.

Thanks, Vincent!

xiaojiey · 2024-05-07T01:19:18Z

/hold for test

xiaojiey · 2024-05-09T03:45:10Z

@Vincent056 I am not sure if it is an env issue. The operator was installed correctly, and default ss only contains worker role. However, the pb was not created. Could you please help to double check? thanks.

% oc get csv
NAME                         DISPLAY               VERSION   REPLACES   PHASE
compliance-operator.v1.4.0   Compliance Operator   1.4.0                Succeeded
% oc get pod
NAME                                   READY   STATUS    RESTARTS   AGE
compliance-operator-7f68c5fdb4-rgkwc   1/1     Running   0          15s
 % oc get ss
NAME      AGE
default   32s
% oc get ss default -o=jsonpath={.roles}
["worker"]%                                                                                                                                                                                                         % oc get pb
No resources found in openshift-compliance namespace.
% oc get csv -o yaml | grep -i image:
                  image: quay.io/xiyuan/compliance-operator:pr-511
    - image: ghcr.io/complianceascode/openscap-ocp:latest
    - image: quay.io/xiyuan/compliance-operator:pr-511
    - image: ghcr.io/complianceascode/k8scontent:latest
% oc get pod
NAME                                   READY   STATUS    RESTARTS   AGE
compliance-operator-7f68c5fdb4-rgkwc   1/1     Running   0          102s

rhmdnd · 2024-05-10T12:05:04Z

Working to get #515 landed so you have something to test against.

rhmdnd · 2024-05-11T03:50:57Z

/test e2e-rosa

Vincent056 · 2024-05-13T15:23:09Z

/test e2e-rosa

Vincent056 · 2024-05-14T23:55:03Z

/test e2e-rosa

Vincent056 · 2024-05-15T15:19:42Z

/test e2e-rosa

rhmdnd · 2024-05-15T21:06:01Z

@Vincent056 I am not sure if it is an env issue. The operator was installed correctly, and default ss only contains worker role. However, the pb was not created. Could you please help to double check? thanks.

% oc get csv
NAME                         DISPLAY               VERSION   REPLACES   PHASE
compliance-operator.v1.4.0   Compliance Operator   1.4.0                Succeeded
% oc get pod
NAME                                   READY   STATUS    RESTARTS   AGE
compliance-operator-7f68c5fdb4-rgkwc   1/1     Running   0          15s
 % oc get ss
NAME      AGE
default   32s
% oc get ss default -o=jsonpath={.roles}
["worker"]%                                                                                                                                                                                                         % oc get pb
No resources found in openshift-compliance namespace.
% oc get csv -o yaml | grep -i image:
                  image: quay.io/xiyuan/compliance-operator:pr-511
    - image: ghcr.io/complianceascode/openscap-ocp:latest
    - image: quay.io/xiyuan/compliance-operator:pr-511
    - image: ghcr.io/complianceascode/k8scontent:latest
% oc get pod
NAME                                   READY   STATUS    RESTARTS   AGE
compliance-operator-7f68c5fdb4-rgkwc   1/1     Running   0          102s

I may have a fix for this in #518 - which includes a new platform type for ROSA, and ensure the rhcos4 and ocp4 bundles are supported for that platform type.

…lations Made change to be able to detect what managed cluster we are on using ClusterClaim, added ROSA platform type, disable master role if detected running on ROSA

openshift-ci · 2024-05-16T17:23:26Z

@Vincent056: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-rosa	`3b1c0c7`	link	true	`/test e2e-rosa`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Vincent056 · 2024-05-16T20:44:51Z

close this in favor of #518

openshift-ci-robot added the jira/valid-reference label May 1, 2024

openshift-ci bot requested review from mrogers950 and xiaojiey May 1, 2024 18:46

openshift-ci bot added the approved label May 1, 2024

Vincent056 force-pushed the rosa_scan branch from 3eb4b9a to 7e965c2 Compare May 1, 2024 18:55

openshift-merge-robot added the needs-rebase label May 4, 2024

Vincent056 force-pushed the rosa_scan branch from 7e965c2 to dd58255 Compare May 6, 2024 15:23

openshift-merge-robot removed the needs-rebase label May 6, 2024

rhmdnd requested review from yuumasato, BhargaviGudi, mkumku and GroceryBoyJr and removed request for mrogers950 May 6, 2024 20:27

rhmdnd reviewed May 6, 2024

View reviewed changes

openshift-ci bot added the do-not-merge/hold label May 7, 2024

Vincent056 force-pushed the rosa_scan branch from dd58255 to fa27043 Compare May 7, 2024 16:31

Vincent056 force-pushed the rosa_scan branch from fa27043 to 8a0fc44 Compare May 10, 2024 20:26

Vincent056 force-pushed the rosa_scan branch from 8a0fc44 to a94f538 Compare May 13, 2024 05:35

Vincent056 force-pushed the rosa_scan branch 3 times, most recently from f1e71bb to 32085ba Compare May 14, 2024 01:50

Vincent056 force-pushed the rosa_scan branch from 32085ba to a3be1c2 Compare May 14, 2024 16:53

Vincent056 force-pushed the rosa_scan branch from a3be1c2 to 4945b6a Compare May 15, 2024 21:12

CMP-2525: Implement dynamic scan settings for managed offering instal…

3b1c0c7

…lations Made change to be able to detect what managed cluster we are on using ClusterClaim, added ROSA platform type, disable master role if detected running on ROSA

Vincent056 force-pushed the rosa_scan branch from 4945b6a to 3b1c0c7 Compare May 16, 2024 15:41

Vincent056 closed this May 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CMP-2525: Implement dynamic scan settings for ROSA #511

CMP-2525: Implement dynamic scan settings for ROSA #511

Vincent056 commented May 1, 2024 •

edited

openshift-ci-robot commented May 1, 2024

openshift-ci bot commented May 1, 2024

rhmdnd May 6, 2024

rhmdnd May 6, 2024

Vincent056 May 7, 2024

rhmdnd left a comment

xiaojiey commented May 7, 2024

xiaojiey commented May 9, 2024

rhmdnd commented May 10, 2024

rhmdnd commented May 11, 2024

Vincent056 commented May 13, 2024

Vincent056 commented May 14, 2024

Vincent056 commented May 15, 2024

rhmdnd commented May 15, 2024

openshift-ci bot commented May 16, 2024

Vincent056 commented May 16, 2024

CMP-2525: Implement dynamic scan settings for ROSA #511

CMP-2525: Implement dynamic scan settings for ROSA #511

Conversation

Vincent056 commented May 1, 2024 • edited

openshift-ci-robot commented May 1, 2024

openshift-ci bot commented May 1, 2024

rhmdnd May 6, 2024

Choose a reason for hiding this comment

rhmdnd May 6, 2024

Choose a reason for hiding this comment

Vincent056 May 7, 2024

Choose a reason for hiding this comment

rhmdnd left a comment

Choose a reason for hiding this comment

xiaojiey commented May 7, 2024

xiaojiey commented May 9, 2024

rhmdnd commented May 10, 2024

rhmdnd commented May 11, 2024

Vincent056 commented May 13, 2024

Vincent056 commented May 14, 2024

Vincent056 commented May 15, 2024

rhmdnd commented May 15, 2024

openshift-ci bot commented May 16, 2024

Vincent056 commented May 16, 2024

Vincent056 commented May 1, 2024 •

edited