[DNM] Sync Serverless CI config/serverless-operator.yaml - #80826
Conversation
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
WalkthroughUpdates the Serverless operator CI config for OCP 4.22 to the ChangesServerless OCP 4.22 lpGA lp-ocp-compat CI config
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 inconclusive)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: maschmid The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__ocp-4.22-lpGA-lp-ocp-compat.yaml`:
- Around line 176-192: The curl command fetching the ExitTrap script uses a
mutable branch reference (refs/heads/main) which creates reproducibility and
security risks. Replace the mutable GitHub URL in all six command blocks (the
ones starting at lines 176, 222, 268, 354, 400, and 446) with an immutable
commit SHA instead of refs/heads/main. After fetching with the pinned SHA, add a
checksum verification step to validate the downloaded script before executing it
via eval. Additionally, add curl retry options (such as --retry and
--retry-all-errors flags) to the curl command to improve resilience against
transient network failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: f6b264f6-a688-40da-9393-8de0be4b0231
⛔ Files ignored due to path filters (2)
ci-operator/jobs/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__ocp-4.22-lpGA-lp-ocp-compat.yaml
| commands: | | ||
| set -euxo pipefail; shopt -s inherit_errexit | ||
| eval "$(curl -fsSL https://raw.githubusercontent.com/RedHatQE/OpenShift-LP-QE--Tools/refs/heads/main/libs/bash/ci-operator/interop/common/ExitTrap--PostProcessPrep.sh)" | ||
| # Avoid conflicts with the older versioned yq from the image: | ||
| # Write /tmp/bin/yq as a tiny script (#!/bin/sh; exit 1), so yq --version fails and ExitTrap EnsureReqs downloads latest yq (replacing the stub). | ||
| trap ' | ||
| mkdir -p /tmp/bin | ||
| printf "%s\n" "#!/bin/sh" "exit 1" > /tmp/bin/yq && chmod +x /tmp/bin/yq | ||
| PATH="/tmp/bin:${PATH}" | ||
| LP_IO__ET_PPP__NEW_TS_NAME="${DR__RP__CR_COMP_NAME}--%s" \ | ||
| ExitTrap--PostProcessPrep junit--serverless-operator__operator-e2e.xml | ||
| ' EXIT | ||
| GOPATH=/tmp/go \ | ||
| PATH=$PATH:/tmp/go/bin \ | ||
| SKIP_MESH_AUTH_POLICY_GENERATION=true \ | ||
| SKIP_SPOT_INSTANCES=true \ | ||
| make test-e2e-with-kafka |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__ocp-4.22-lpGA-lp-ocp-compat.yaml"
echo "All remote-eval call sites:"
rg -n 'eval "\$\(curl -fsSL https://raw\.githubusercontent\.com/' "$FILE"
echo
echo "Mutable refs currently used (should be zero after fix):"
rg -n 'raw\.githubusercontent\.com/.*/refs/heads/main/' "$FILE" || trueRepository: openshift/release
Length of output: 2318
Pin and verify the fetched ExitTrap script before eval.
The six command blocks at lines 178, 224, 270, 356, 402, and 448 fetch code directly from a mutable refs/heads/main URL and execute it via eval. This enables upstream compromise/drift and makes CI runs non-reproducible. Pin each fetch to an immutable commit SHA and verify checksum before execution. Add curl retries for resilience.
Suggested hardening pattern
- eval "$(curl -fsSL https://raw.githubusercontent.com/RedHatQE/OpenShift-LP-QE--Tools/refs/heads/main/libs/bash/ci-operator/interop/common/ExitTrap--PostProcessPrep.sh)"
+ EXITTRAP_URL="https://raw.githubusercontent.com/RedHatQE/OpenShift-LP-QE--Tools/<pinned-commit-sha>/libs/bash/ci-operator/interop/common/ExitTrap--PostProcessPrep.sh"
+ EXITTRAP_SHA256="<expected-sha256>"
+ EXITTRAP_SCRIPT="$(curl --retry 3 --retry-delay 2 --retry-all-errors -fsSL "${EXITTRAP_URL}")"
+ printf '%s -\n' "${EXITTRAP_SHA256}" | sha256sum -c -
+ eval "${EXITTRAP_SCRIPT}"Apply to all six command blocks (lines 176–192, 222–238, 268–284, 354–370, 400–416, 446–462).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/openshift-knative/serverless-operator/openshift-knative-serverless-operator-release-1.37__ocp-4.22-lpGA-lp-ocp-compat.yaml`
around lines 176 - 192, The curl command fetching the ExitTrap script uses a
mutable branch reference (refs/heads/main) which creates reproducibility and
security risks. Replace the mutable GitHub URL in all six command blocks (the
ones starting at lines 176, 222, 268, 354, 400, and 446) with an immutable
commit SHA instead of refs/heads/main. After fetching with the pinned SHA, add a
checksum verification step to validate the downloaded script before executing it
via eval. Additionally, add curl retry options (such as --retry and
--retry-all-errors flags) to the curl command to improve resilience against
transient network failures.
|
/pj-rehearse |
|
@maschmid: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@maschmid: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
testing openshift-knative/hack#988
Summary by CodeRabbit
This PR creates a new CI configuration file for the OpenShift Knative Serverless operator release 1.37, adding support for a new test variant targeting OCP 4.22 with the
ocp-4.22-lpGA-lp-ocp-compatprofile.What Changed
The PR adds
openshift-knative-serverless-operator-release-1.37__ocp-4.22-lpGA-lp-ocp-compat.yaml— a complete CI operator configuration that defines how the Serverless operator is tested on OCP 4.22.Key Features of This New Test Configuration
Test Strategy: Defines three E2E test jobs running against OCP 4.22:
operator-e2e— Validates operator functionality with Kafka supportknative-serving-eventing-e2e— Tests Knative Serving and Eventing integrationknative-eventing-kafka-broker-e2e— Tests Kafka broker integrationEnhanced Observability Integration: Each test step includes:
ExitTrap--PostProcessPrepDR__RP__CR_COMP_NAME=lp-ocp-compat--Serverless)Resource Management:
Test Infrastructure:
This configuration aligns the Serverless operator CI with the LP (Long-Lived Payload) testing framework for OpenShift, enabling more structured compatibility testing across the Knative ecosystem.