INTEROP-9361: Add FIPS variant ci-operator config for OPP - #82563
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@amp-rh: This pull request references INTEROP-9361 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a generated policy-collection CI configuration for OCP 4.22 FIPS testing. It defines images, release selection, resource defaults, AWS interop workflows, reporting settings, and variant metadata. ChangesPolicy-collection OCP 4.22 FIPS
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-merge-bot
Bot
added
the
rehearsals-ack
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml`:
- Around line 87-90: Update the stolostron-policy-collection configuration by
adding FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION with value 5.0.0 alongside the
existing FIREWATCH_DEFAULT_JIRA_* settings, ensuring LPINTEROP issues receive
the correct default affected version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: b5ab8906-a690-4b75-b05c-be8b800adb0f
📒 Files selected for processing (1)
ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: amp-rh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
/pj-rehearse |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
e4e0862 to
00d0200
Compare
Chai Bot ReviewHere's my review of openshift/release#82563 — INTEROP-9361: Add FIPS variant ci-operator config for OPP. 🔴 Blocking: The Fix: run ✅ Safety & Production Risk: None
✅ Config Correctness Compared against the existing
ℹ️ Minor: Jira target version warning The jira-lifecycle-plugin warns that INTEROP-9361 has no target version set (expected Summary: The approach is sound — a clean FIPS variant derived from the existing OPP interop config with proper isolation. The only blocker is the YAML quoting issue that Review requested by PR author via Chai Bot ([SHIP Public]) |
65b75f8 to
7b50be6
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml (1)
88-88: 🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick winQuote the Firewatch affected version.
The CI metadata validation requires this value to be
"5.0.0"; the unquoted form blocks the configuration check.Proposed fix
- FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: 5.0.0 + FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "5.0.0"Based on PR objectives, the metadata check requires this exact value to be YAML-quoted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml` at line 88, Update FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION in the policy collection configuration to use the YAML-quoted string value "5.0.0", preserving the exact required version.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In
`@ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml`:
- Line 88: Update FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION in the policy
collection configuration to use the YAML-quoted string value "5.0.0", preserving
the exact required version.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 0faf40ef-a8d9-47c6-8f73-18afab934183
⛔ Files ignored due to path filters (2)
ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml
|
/retest |
|
@amp-rh, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
7e3aa24 to
87bf245
Compare
openshift-ci
Bot
added
the
needs-rebase
87bf245 to
aa667f7
Compare
openshift-ci
Bot
removed
the
needs-rebase
Add a FIPS-enabled ci-operator config for OPP interop testing on OCP 4.22. Based on existing ocp4.22 AWS config with FIPS_ENABLED=true and FIPS-specific Jira routing (epic INTEROP-9104).
- Update FIREWATCH_DEFAULT_JIRA_ASSIGNEE to mpruitt@redhat.com - Add FIREWATCH_DEFAULT_JIRA_AFFECTS_VERSION: "4.22" - Regenerate Prow job YAML for the new FIPS variant
Run determinize-ci-operator to canonicalize YAML formatting for the FIPS variant config (fixes ci-operator-config-metadata).
aa667f7 to
59d4f18
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/pj-rehearse |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@amp-rh: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Rehearsal AnalysisThe rehearsal The /pj-rehearse ack |
|
@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
Pre-Review Gate Summary
All pre-review gates have been evaluated and cleared. This is a purely additive change (291 additions, 0 deletions) adding a FIPS variant of the existing OPP interop config, with @dhaiducek — could you review when you get a chance? This adds a FIPS-enabled variant of the OPP interop CI config (disabled cron, |
|
Chai Bot Review Summary (Gate 2: Approach Validation) Chai Bot reviewed the PR and config approach. Findings:
No code changes required from this review. |
- Update ACM base images from 2.16 to 2.17 - Update operator channel from release-2.16 to release-2.17 - Add DR__RP__CR_COMP_NAME for data router integration - Add mpiit-data-router-reporter post step
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
2 participants
TL;DR
Adds a FIPS-enabled ci-operator config variant for OPP interop testing on OCP 4.22 (AWS only). Mirrors the existing
ocp4.22config withFIPS_ENABLED: "true"and FIPS-specific Jira routing.What changed
ocp4.22-fipsvariant config forstolostron/policy-collectionFIPS_ENABLED: "true"to provision a FIPS-enabled clusterfipslabel added to default labels0 23 31 2 *, Feb 31 = never fires) pending initial validationCore files (review these)
ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-fips.yaml__ocp4.22.yamlconfig for correctness.Mechanical/generated files
These are auto-generated by
make update(prowgen). No manual edits.ci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-periodics.yamlci-operator/jobs/stolostron/policy-collection/stolostron-policy-collection-main-presubmits.yamlRisk areas
Testing
ci/prow/ci-operator-config): passingci/prow/ci-operator-registry): passingmake updateperiodic-ci-stolostron-policy-collection-main-ocp4.22-fips-interop-opp-aws); failure is a known pipeline blocker (ACM observability S3 credential issue), not a PR code defectJira