OSSM: skip TLS ADherence test to avoid failures - #83115
Conversation
We will skip the test until we find the fix to avoid failures on arm and ocp 4.23. Currentrly from initial checks I see that those runs on IPI jobs and kube apiserver restarts causes timouts during test execution. Jira: https://redhat.atlassian.net/browse/OSSM-15256 Signed-off-by: Francisco Herrera <fjglira@gmail.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fjglira The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughThe Sail operator OCP E2E step now supports ChangesSail operator E2E filtering
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh`:
- Line 139: Update the remote command construction around GINKGO_LABEL_FILTER so
its value is passed as data through env or a positional parameter rather than
interpolated into the sh -c script. Escape the remote expansion and preserve the
existing empty-default behavior, preventing shell metacharacters such as command
substitutions, semicolons, backticks, and quotes from altering execution.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7099444a-6def-4b7c-8d90-5ded6c4c9d0b
📒 Files selected for processing (4)
ci-operator/config/openshift-service-mesh/sail-operator/openshift-service-mesh-sail-operator-main__ocp-4.22.yamlci-operator/config/openshift-service-mesh/sail-operator/openshift-service-mesh-sail-operator-main__ocp-4.23.yamlci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.shci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-ref.yaml
| export HUB=\"${HUB:-quay.io/sail-dev}\" | ||
| export USE_INTERNAL_REGISTRY=\"false\" | ||
| export PR_NUMBER=\"${PULL_NUMBER:-}\" | ||
| export GINKGO_LABEL_FILTER=\"${GINKGO_LABEL_FILTER:-}\" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
filter='$(printf INJECTED)'
unsafe_script="export GINKGO_LABEL_FILTER=\"${filter}\"; printf '%s' \"\$GINKGO_LABEL_FILTER\""
actual="$(sh -c "$unsafe_script")"
if [[ "$actual" == "INJECTED" ]]; then
echo "The current interpolation executes command substitution."
else
echo "The current interpolation did not reproduce the expected injection."
exit 1
fiRepository: openshift/release
Length of output: 212
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
file='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh'
printf '%s\n' '--- target lines ---'
sed -n '110,165p' "$file"
printf '%s\n' '--- relevant identifiers and shell invocations ---'
rg -n -C 3 'GINKGO_LABEL_FILTER|oc rsh|QUAY_PASSWORD|docker login|sh -c' "$file"Repository: openshift/release
Length of output: 3997
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
file='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh'
printf '%s\n' '--- repository references ---'
rg -n -C 3 'GINKGO_LABEL_FILTER|VERSIONS_YAML_CONFIG|E2E_COMMAND|QUAY_PASSWORD|servicemesh-sail-operator-e2e-ocp' \
--glob '!vendor/**' --glob '!node_modules/**' .
printf '%s\n' '--- exact nested-shell probe ---'
python3 - <<'PY'
import os
import subprocess
value = '$(printf INJECTED)'
unsafe = f'export GINKGO_LABEL_FILTER="{value}"; printf "%s" "$GINKGO_LABEL_FILTER"'
safe = 'export GINKGO_LABEL_FILTER="${GINKGO_LABEL_FILTER:-}"; printf "%s" "$GINKGO_LABEL_FILTER"'
unsafe_result = subprocess.run(
['sh', '-c', unsafe], text=True, capture_output=True, check=True
)
safe_env = os.environ.copy()
safe_env['GINKGO_LABEL_FILTER'] = value
safe_result = subprocess.run(
['sh', '-c', safe], env=safe_env, text=True, capture_output=True, check=True
)
print(f'unsafe output: {unsafe_result.stdout!r}')
print(f'safe output: {safe_result.stdout!r}')
assert unsafe_result.stdout == 'INJECTED'
assert safe_result.stdout == value
print('nested-shell probe passed')
PYRepository: openshift/release
Length of output: 50374
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
ref='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-ref.yaml'
file='ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh'
printf '%s\n' '--- step definition ---'
sed -n '1,55p' "$ref"
printf '%s\n' '--- direct callers ---'
rg -l 'servicemesh-sail-operator-e2e-ocp' ci-operator/config ci-operator/step-registry |
head -50 |
xargs -r rg -n -C 2 'servicemesh-sail-operator-e2e-ocp|GINKGO_LABEL_FILTER'
printf '%s\n' '--- exact nested-shell probe ---'
python3 - <<'PY'
import os
import subprocess
value = '$(printf INJECTED)'
unsafe = f'export GINKGO_LABEL_FILTER="{value}"; printf "%s" "$GINKGO_LABEL_FILTER"'
safe = 'export GINKGO_LABEL_FILTER="${GINKGO_LABEL_FILTER:-}"; printf "%s" "$GINKGO_LABEL_FILTER"'
unsafe_result = subprocess.run(
['sh', '-c', unsafe], text=True, capture_output=True, check=True
)
safe_env = os.environ.copy()
safe_env['GINKGO_LABEL_FILTER'] = value
safe_result = subprocess.run(
['sh', '-c', safe], env=safe_env, text=True, capture_output=True, check=True
)
print(f'unsafe output: {unsafe_result.stdout!r}')
print(f'safe output: {safe_result.stdout!r}')
assert unsafe_result.stdout == 'INJECTED'
assert safe_result.stdout == value
print('nested-shell probe passed')
PYRepository: openshift/release
Length of output: 27028
Pass GINKGO_LABEL_FILTER as data, not shell code.
GINKGO_LABEL_FILTER is interpolated into the script passed to remote sh -c. Values containing $(...), backticks, ;, or " can execute commands or alter the script. The commands run in the test pod, which has logged in to Quay and set KUBECONFIG.
Pass the value through env or a positional parameter, then escape the remote expansion.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/servicemesh/sail-operator/e2e-ocp/servicemesh-sail-operator-e2e-ocp-commands.sh`
at line 139, Update the remote command construction around GINKGO_LABEL_FILTER
so its value is passed as data through env or a positional parameter rather than
interpolated into the sh -c script. Escape the remote expansion and preserve the
existing empty-default behavior, preventing shell metacharacters such as command
substitutions, semicolons, backticks, and quotes from altering execution.
Source: Coding guidelines
|
@fjglira: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
We will skip the test until we find the fix to avoid failures on arm and ocp 4.23. Currentrly from initial checks I see that those runs on IPI jobs and kube apiserver restarts causes timouts during test execution. Jira: https://redhat.atlassian.net/browse/OSSM-15256
Summary by CodeRabbit
tls-profilein ARM OCP 4.22 jobs and OCP 4.23 E2E jobs.GINKGO_LABEL_FILTERthrough the Sail operator E2E step.