Add ssh-bastion to interop job and exclude interop tests from FAR standalone jobs - #83179
Add ssh-bastion to interop job and exclude interop tests from FAR standalone jobs#83179ugreener wants to merge 1 commit into
Conversation
WalkthroughThe Medik8s FAR AWS workflows exclude upgrade and interop tiers from test selection. The FAR/NHC interop AWS workflow runs ChangesMedik8s AWS workflow updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ugreener The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml`:
- Line 78: Update the ssh-bastion step, identified by the removed ref:
ssh-bastion, so its remote deploy script is fetched from a reviewed immutable
commit or otherwise ensure AWS credentials are unset before invoking it.
Preserve the step’s deployment behavior while preventing mutable master-branch
code from running with credentials.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 60a15060-e89e-4330-b789-6ae9e114ec07
📒 Files selected for processing (1)
ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml
| test: | ||
| - chain: medik8s-setup | ||
| - ref: medik8s-aws-credentials | ||
| - ref: ssh-bastion |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate target file =="
git ls-files | rg 'ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml|ci-operator/step-registry/ssh-bastion|zz_generated_metadata' || true
echo
echo "== target file around referenced step =="
sed -n '1,140p' ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml 2>/dev/null || true
echo
echo "== ssh-bastion command registry files =="
find ci-operator/step-registry -path '*ssh-bastion*' -type f -print | sort
for f in $(find ci-operator/step-registry -path '*ssh-bastion*' -type f | sort); do
echo "--- $f"
cat -n "$f"
done
echo
echo "== AWS cred setup references in target config =="
rg -n "AWS|aws|credentials|credential|env|step|ref:|curl|ssh-bastion" ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml || trueRepository: openshift/release
Length of output: 10882
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== all references to ssh-bastion in CI configs =="
rg -n "ssh-bastion|e2e-far-nhc-interop-aws" ci-operator/config || true
echo
echo "== generated metadata references =="
rg -n "medik8s-system-tests-main__4.22-konflux|ssh-bastion|e2e-far-nhc-interop-aws" ci-operator zzz_generated_metadata zz_generated_metadata 2>/dev/null || trueRepository: openshift/release
Length of output: 16773
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== diff stat/status =="
git diff --stat || true
git diff --name-only || true
echo
echo "== deterministic grep for pipe-to-bash pattern in ssh-bastion =="
python3 - <<'PY'
from pathlib import Path
root=Path('ci-operator/step-registry/ssh-bastion')
for p in sorted(root.rglob('*')):
if p.is_file():
text=p.read_text(errors='replace')
for i,line in enumerate(text.splitlines(),1):
if 'curl' in line or 'bash' in line or 'AWS_ACCESS_KEY_ID' in line or 'AWS_SECRET_ACCESS_KEY' in line:
print(f"{p}:{i}:{line}")
PYRepository: openshift/release
Length of output: 698
Pin the remote bastion deployment script before running it with AWS credentials.
medik8s-aws-credentials runs immediately before ssh-bastion, and ssh-bastion-commands.sh executes curl https://raw.githubusercontent.com/eparis/ssh-bastion/master/deploy/deploy.sh | bash -x. The later tested step has no credentials-unset guard, so a changed master branch can execute code in that env. Pin the script to a reviewed commit or remove credentials before invoking it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml`
at line 78, Update the ssh-bastion step, identified by the removed ref:
ssh-bastion, so its remote deploy script is fetched from a reviewed immutable
commit or otherwise ensure AWS credentials are unset before invoking it.
Preserve the step’s deployment behavior while preventing mutable master-branch
code from running with credentials.
d74a111 to
b948f5b
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
ugreener
changed the title
|
/pj-rehearse pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-far-nhc-interop-aws |
|
@ugreener: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@ugreener: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Problem
The NHC+FAR interop test (RHWA-1035) needs to stop kubelet on a worker node to simulate an unhealthy node for NHC to detect. Without ssh-bastion, the test relies on
oc debugwhich consistently fails: the debug pod dies when kubelet stops, causingoc debugto exit with error. Kubelet then auto-restarts before NHC's 30s unhealthy duration threshold is met, so NHC never triggers remediation.Additionally, the FAR standalone jobs (
e2e-far-aws,e2e-far-weekly-aws) filter with!tier:upgradebut would still match interop tests. Since those jobs don't install NHC or deploy ssh-bastion, interop tests would fail.Summary
ssh-bastionstep reference to thee2e-far-nhc-interop-awspresubmit job, matching the existinge2e-nhc-awsjob pattern!tier:upgradeto!tier:upgrade && !tier:interopChanges
medik8s-system-tests-main__4.22-konflux.yaml: added- ref: ssh-bastionto the interop job's test stepsmedik8s-system-tests-main__4.22-konflux.yaml: changedECO_TEST_LABELSfrom!tier:upgradeto!tier:upgrade && !tier:interopin bothe2e-far-aws(presubmit) ande2e-far-weekly-aws(periodic)Summary by CodeRabbit
ECO_TEST_LABELS.ssh-bastionstep to the FAR/NHC interop AWS workflow after AWS credential setup.