CNF-26477: oran-o2ims: extract wait-for-tls-pods into step-registry ref - #83194
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@rauhersu: This pull request references CNF-26477 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @rauhersu. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
WalkthroughThe PR adds a shared ORAN O2IMS CI step for Inventory, TLS service, pod-readiness, and service-ca secret checks. Four TLS scan jobs now reference this step instead of duplicating the checks inline. ChangesORAN O2IMS TLS readiness
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant TLSScanJob
participant TLSReadinessStep
participant OpenShiftAPI
TLSScanJob->>TLSReadinessStep: Invoke shared readiness test
TLSReadinessStep->>OpenShiftAPI: Wait for Inventory CR
TLSReadinessStep->>OpenShiftAPI: Discover TLS-enabled services
TLSReadinessStep->>OpenShiftAPI: Check selector-matched pods
TLSReadinessStep->>OpenShiftAPI: Verify service-ca secrets
TLSReadinessStep-->>TLSScanJob: Return readiness result
Possibly related PRs
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/hold We depend on this PR: #82154 |
openshift-ci
Bot
added
the
do-not-merge/hold
openshift-ci
Bot
added
the
do-not-merge/invalid-owners-file
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/oran-o2ims/wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-commands.sh`:
- Around line 70-76: Update the secret check in the wait-for-TLS-pods loop to
poll each configured service-ca secret until it exists or the existing deadline
expires, rather than calling oc get secret only once. Keep the current success
output, and set FAILED only after the polling deadline is reached; use the
existing deadline and polling conventions in the script.
In `@ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh`:
- Around line 9-16: Update the externally owned namespace flow in
tls-scanner-run-commands.sh to create and use a scanner-specific service account
instead of the namespace’s default service account. Change the later
cluster-admin binding to target that account, track the run-scoped binding, and
ensure cleanup removes the binding and scanner service account while preserving
existing namespace ownership behavior.
- Around line 9-16: Update the scanner run flow to use a unique per-run pod
identity when jobs share SCANNER_NAMESPACE, rather than the fixed tls-scanner
name. Propagate that identity through every pod creation, lookup, wait, result
retrieval, RBAC/cluster-admin operation, purge, and cleanup path; alternatively
enforce single-flight execution per namespace.
In `@ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml`:
- Around line 10-15: Update the SCANNER_NAMESPACE documentation and the
top-level scanner documentation to describe its security contract: deployments
use the existing namespace with non-host, PodSecurity-restricted pods, without
hostNetwork, hostPID, root, privileged mode, or privileged SCC. Document that
management-cluster scans use SCAN_NAMESPACE as the deployment namespace when
TLS_SCANNER_CLUSTER_LABEL=management.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 1a71483b-7401-4653-ab94-c5b80fdea45c
⛔ Files ignored due to path filters (4)
ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (7)
ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yamlci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yamlci-operator/step-registry/oran-o2ims/wait-for-tls-pods/OWNERSci-operator/step-registry/oran-o2ims/wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-commands.shci-operator/step-registry/oran-o2ims/wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-ref.yamlci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.shci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
b1e8bfd to
39a8652
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
openshift-ci
Bot
added
approved
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
|
/pj-rehearse auto-ack |
|
@rauhersu: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
395e54b to
a799fef
Compare
|
@rauhersu, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-ci
Bot
removed
the
approved
Add missing OWNERS file at the oran-o2ims step-registry root directory and generate registry metadata for wait-for-tls-pods ref. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
|
@rauhersu, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
a799fef to
44359e2
Compare
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
/pj-rehearse auto-ack |
|
@rauhersu: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-merge-bot
Bot
removed
the
rehearsals-ack
Extract the ~80-line wait-for-server-pods inline script that was duplicated 4 times (on-demand and periodic jobs for main and release-4.22) into a shared step-registry ref at ci-operator/step-registry/oran-o2ims/wait-for-tls-pods/. The ref waits for the Inventory CR, discovers TLS-annotated services, verifies pod readiness and TLS secret presence, and fails the step on any error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
75a07cc to
f46f809
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
@rauhersu: |
|
/pj-rehearse auto-ack |
|
@rauhersu: your |
|
/pj-rehearse |
|
@rauhersu: your |
|
/pj-rehearse auto-ack |
|
@rauhersu: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Changes are just a refactor of the existing code, de-duplicating the bash snippet per job. /assign @alegacy |
|
/unhold |
openshift-ci
Bot
removed
the
do-not-merge/hold
| "rauhersu" | ||
| ] | ||
| } | ||
| } |
There was a problem hiding this comment.
Looks like there are some missing newlines at the end of some files
There was a problem hiding this comment.
[Comment authored by Claude]
The metadata JSON is auto-generated by make registry-metadata — all *.metadata.json files in the step-registry are produced without a trailing newline (e.g., tls-scanner-run-ref.metadata.json, ipi-aws-workflow.metadata.json). Adding one would cause the registry-metadata CI check to fail since it diffs against the regenerated output.
The wait-for-tls-pods/OWNERS file showing \ No newline at end of file is a symlink (../OWNERS) — that's just how git stores and GitHub renders symlinks. All other symlinked OWNERS in the step-registry (e.g., abi/chains/OWNERS, aro/provision/OWNERS) display the same way.
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alegacy, rauhersu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Summary
wait-for-server-podsinline script into a shared step-registry ref atci-operator/step-registry/oran-o2ims/wait-for-tls-pods/mainandrelease-4.22) with- ref: oran-o2ims-wait-for-tls-podsDepends on: #82154
Test plan
ci-operator-registryvalidation passesgenerated-configcheck passesinstall-bundle-tls-scansucceedsJira: CNF-26477
🤖 Generated with Claude Code
Summary by CodeRabbit
The PR centralizes ORAN O2IMS TLS pod readiness checks in the shared
oran-o2ims-wait-for-tls-podsCI step. It replaces four duplicated scripts in themainandrelease-4.22TLS scanning jobs.The new step waits for the Inventory CR, checks TLS-enabled services and their pods, reports failures, and verifies service-ca secrets. The affected CI jobs retain their existing TLS 1.3 and scanner checks.