Skip to content

OCPBUGS-55140: Enhance RHCOS checks to include CoreOS variant for 4.19#13369

Merged
rhmdnd merged 1 commit intoComplianceAsCode:masterfrom
Vincent056:4.19-rhcos4
Apr 22, 2025
Merged

OCPBUGS-55140: Enhance RHCOS checks to include CoreOS variant for 4.19#13369
rhmdnd merged 1 commit intoComplianceAsCode:masterfrom
Vincent056:4.19-rhcos4

Conversation

@Vincent056
Copy link
Copy Markdown
Contributor

@Vincent056 Vincent056 commented Apr 21, 2025

On OCP 4.19+ we are using RHEL bootimages, we should include that to rhcos platform CPE.

Related Changes: openshift/installer#9392

@Vincent056
Copy link
Copy Markdown
Contributor Author

/test

@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Apr 21, 2025

@Vincent056: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.12-e2e-aws-ocp4-cis
/test 4.12-e2e-aws-ocp4-cis-node
/test 4.12-e2e-aws-ocp4-e8
/test 4.12-e2e-aws-ocp4-high
/test 4.12-e2e-aws-ocp4-high-node
/test 4.12-e2e-aws-ocp4-moderate
/test 4.12-e2e-aws-ocp4-moderate-node
/test 4.12-e2e-aws-ocp4-pci-dss
/test 4.12-e2e-aws-ocp4-pci-dss-4-0
/test 4.12-e2e-aws-ocp4-pci-dss-node
/test 4.12-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.12-e2e-aws-ocp4-stig
/test 4.12-e2e-aws-ocp4-stig-node
/test 4.12-e2e-aws-rhcos4-e8
/test 4.12-e2e-aws-rhcos4-high
/test 4.12-e2e-aws-rhcos4-moderate
/test 4.12-e2e-aws-rhcos4-stig
/test 4.12-images
/test 4.13-e2e-aws-ocp4-bsi
/test 4.13-e2e-aws-ocp4-bsi-node
/test 4.13-e2e-aws-ocp4-cis
/test 4.13-e2e-aws-ocp4-cis-node
/test 4.13-e2e-aws-ocp4-e8
/test 4.13-e2e-aws-ocp4-high
/test 4.13-e2e-aws-ocp4-high-node
/test 4.13-e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate-node
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.13-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig-node
/test 4.13-e2e-aws-rhcos4-bsi
/test 4.13-e2e-aws-rhcos4-e8
/test 4.13-e2e-aws-rhcos4-high
/test 4.13-e2e-aws-rhcos4-moderate
/test 4.13-e2e-aws-rhcos4-stig
/test 4.13-images
/test 4.14-e2e-aws-ocp4-bsi
/test 4.14-e2e-aws-ocp4-bsi-node
/test 4.14-e2e-aws-ocp4-pci-dss-4-0
/test 4.14-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.14-e2e-aws-rhcos4-bsi
/test 4.14-images
/test 4.15-e2e-aws-ocp4-bsi
/test 4.15-e2e-aws-ocp4-bsi-node
/test 4.15-e2e-aws-ocp4-cis
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-e8
/test 4.15-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high-node
/test 4.15-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate-node
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss-4-0
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.15-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig-node
/test 4.15-e2e-aws-rhcos4-bsi
/test 4.15-e2e-aws-rhcos4-e8
/test 4.15-e2e-aws-rhcos4-high
/test 4.15-e2e-aws-rhcos4-moderate
/test 4.15-e2e-aws-rhcos4-stig
/test 4.15-e2e-rosa-ocp4-cis-node
/test 4.15-e2e-rosa-ocp4-pci-dss-node
/test 4.15-images
/test 4.16-e2e-aws-ocp4-bsi
/test 4.16-e2e-aws-ocp4-bsi-node
/test 4.16-e2e-aws-ocp4-cis
/test 4.16-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-e8
/test 4.16-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high-node
/test 4.16-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate-node
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig-node
/test 4.16-e2e-aws-rhcos4-bsi
/test 4.16-e2e-aws-rhcos4-e8
/test 4.16-e2e-aws-rhcos4-high
/test 4.16-e2e-aws-rhcos4-moderate
/test 4.16-e2e-aws-rhcos4-stig
/test 4.16-images
/test 4.17-e2e-aws-ocp4-bsi
/test 4.17-e2e-aws-ocp4-bsi-node
/test 4.17-e2e-aws-ocp4-cis
/test 4.17-e2e-aws-ocp4-cis-node
/test 4.17-e2e-aws-ocp4-e8
/test 4.17-e2e-aws-ocp4-high
/test 4.17-e2e-aws-ocp4-high-node
/test 4.17-e2e-aws-ocp4-moderate
/test 4.17-e2e-aws-ocp4-moderate-node
/test 4.17-e2e-aws-ocp4-pci-dss
/test 4.17-e2e-aws-ocp4-pci-dss-4-0
/test 4.17-e2e-aws-ocp4-pci-dss-node
/test 4.17-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.17-e2e-aws-ocp4-stig
/test 4.17-e2e-aws-ocp4-stig-node
/test 4.17-e2e-aws-rhcos4-bsi
/test 4.17-e2e-aws-rhcos4-e8
/test 4.17-e2e-aws-rhcos4-high
/test 4.17-e2e-aws-rhcos4-moderate
/test 4.17-e2e-aws-rhcos4-stig
/test 4.17-images
/test 4.18-e2e-aws-ocp4-bsi
/test 4.18-e2e-aws-ocp4-bsi-node
/test 4.18-e2e-aws-ocp4-cis
/test 4.18-e2e-aws-ocp4-cis-node
/test 4.18-e2e-aws-ocp4-e8
/test 4.18-e2e-aws-ocp4-high
/test 4.18-e2e-aws-ocp4-high-node
/test 4.18-e2e-aws-ocp4-moderate
/test 4.18-e2e-aws-ocp4-moderate-node
/test 4.18-e2e-aws-ocp4-pci-dss
/test 4.18-e2e-aws-ocp4-pci-dss-4-0
/test 4.18-e2e-aws-ocp4-pci-dss-node
/test 4.18-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.18-e2e-aws-ocp4-stig
/test 4.18-e2e-aws-ocp4-stig-node
/test 4.18-e2e-aws-rhcos4-bsi
/test 4.18-e2e-aws-rhcos4-e8
/test 4.18-e2e-aws-rhcos4-high
/test 4.18-e2e-aws-rhcos4-moderate
/test 4.18-e2e-aws-rhcos4-stig
/test 4.18-images
/test 4.19-e2e-aws-ocp4-bsi
/test 4.19-e2e-aws-ocp4-bsi-node
/test 4.19-e2e-aws-ocp4-cis
/test 4.19-e2e-aws-ocp4-cis-node
/test 4.19-e2e-aws-ocp4-e8
/test 4.19-e2e-aws-ocp4-high
/test 4.19-e2e-aws-ocp4-high-node
/test 4.19-e2e-aws-ocp4-moderate
/test 4.19-e2e-aws-ocp4-moderate-node
/test 4.19-e2e-aws-ocp4-pci-dss
/test 4.19-e2e-aws-ocp4-pci-dss-4-0
/test 4.19-e2e-aws-ocp4-pci-dss-node
/test 4.19-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.19-e2e-aws-ocp4-stig
/test 4.19-e2e-aws-ocp4-stig-node
/test 4.19-e2e-aws-rhcos4-bsi
/test 4.19-e2e-aws-rhcos4-e8
/test 4.19-e2e-aws-rhcos4-high
/test 4.19-e2e-aws-rhcos4-moderate
/test 4.19-e2e-aws-rhcos4-stig
/test 4.19-images
/test e2e-aws-ocp4-bsi
/test e2e-aws-ocp4-bsi-node
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-arm
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-cis-node-arm
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-arm
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-moderate-node-arm
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-4-0
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-pci-dss-node-4-0
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-bsi
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-moderate-arm
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.12-images
pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-4.17-images
pull-ci-ComplianceAsCode-content-master-4.18-images
pull-ci-ComplianceAsCode-content-master-4.19-images
pull-ci-ComplianceAsCode-content-master-images
Details

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@Vincent056
Copy link
Copy Markdown
Contributor Author

/test e2e-aws-rhcos4-high
/test 4.19-e2e-aws-rhcos4-high

@Vincent056
Copy link
Copy Markdown
Contributor Author

/test 4.19-e2e-aws-rhcos4-high

@xiaojiey
Copy link
Copy Markdown
Collaborator

@Vincent056 Seems it still returns NOT-APPLICABLE for upstream-rhcos4-moderate profile. Could you please help to check again? Thanks.

% oc get pb
NAME              CONTENTIMAGE                                 CONTENTFILE         STATUS
ocp4              ghcr.io/complianceascode/k8scontent:latest   ssg-ocp4-ds.xml     VALID
rhcos4            ghcr.io/complianceascode/k8scontent:latest   ssg-rhcos4-ds.xml   VALID
upstream-ocp4     openscap-ocp4-ds:latest                      ssg-ocp4-ds.xml     VALID
upstream-rhcos4   openscap-ocp4-ds:latest                      ssg-rhcos4-ds.xml   VALID
% oc get scan
NAME                                 PHASE   RESULT
upstream-ocp4-moderate               DONE    NON-COMPLIANT
upstream-ocp4-moderate-node-master   DONE    NON-COMPLIANT
upstream-ocp4-moderate-node-worker   DONE    NON-COMPLIANT
upstream-rhcos4-moderate-master      DONE    NOT-APPLICABLE
upstream-rhcos4-moderate-worker      DONE    NOT-APPLICABLE

Signed-off-by: Vincent Shen <wenshen@redhat.com>
@qlty-cloud-legacy
Copy link
Copy Markdown

Code Climate has analyzed commit 3327fa3 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

@xiaojiey
Copy link
Copy Markdown
Collaborator

/test e2e-aws-rhcos4-high
/test 4.19-e2e-aws-rhcos4-high

@xiaojiey
Copy link
Copy Markdown
Collaborator

Verification pass with content built from PR #13369:
% oc apply -f ssb_moderate_upstream.yaml
scansettingbinding.compliance.openshift.io/moderate-test created

% oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.19.0-0.nightly-2025-04-17-154552   True        False         4h48m   Cluster version is 4.19.0-0.nightly-2025-04-17-154552
% cat ssb_moderate_upstream.yaml 
apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: moderate-test
  namespace: openshift-compliance
profiles:
- apiGroup: compliance.openshift.io/v1alpha1
  kind: Profile
  name: upstream-ocp4-moderate
- apiGroup: compliance.openshift.io/v1alpha1
  kind: Profile
  name: upstream-ocp4-moderate-node
- apiGroup: compliance.openshift.io/v1alpha1
  kind: Profile
  name: upstream-rhcos4-moderate
settingsRef:
  apiGroup: compliance.openshift.io/v1alpha1
  kind: ScanSetting
  name: default
% oc get scan
NAME                                 PHASE   RESULT
upstream-ocp4-moderate               DONE    NON-COMPLIANT
upstream-ocp4-moderate-node-master   DONE    NON-COMPLIANT
upstream-ocp4-moderate-node-worker   DONE    NON-COMPLIANT
upstream-rhcos4-moderate-master      DONE    NON-COMPLIANT
upstream-rhcos4-moderate-worker      DONE    NON-COMPLIANT

@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Apr 22, 2025

@Vincent056: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/4.19-e2e-aws-rhcos4-high 3327fa3 link true /test 4.19-e2e-aws-rhcos4-high

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@xiaojiey
Copy link
Copy Markdown
Collaborator

For 4.19-e2e-aws-rhcos4-high job:

helpers.go:963: failed to find profile assertion file /go/src/github.com/ComplianceAsCode/content/tests/assertions/ocp4/rhcos4-high-4.19.yml
    helpers.go:973: No profile assertion file found, you should create /go/src/github.com/ComplianceAsCode/content/tests/assertions/ocp4/rhcos4-high-4.19.yml to assert the test results

@rhmdnd rhmdnd added this to the 0.1.77 milestone Apr 22, 2025
@rhmdnd
Copy link
Copy Markdown
Collaborator

rhmdnd commented Apr 22, 2025

Seems to continue working on 4.16, which is good.

Copy link
Copy Markdown
Collaborator

@rhmdnd rhmdnd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

Nearly all the differences in the assertions between 4.19 and 4.18 are related to the ARM rules, where we set them to or NOT-APPLICABLE.

Otherwise, it looks like the majority of what's in the assertion file generated by the suite it the same as what is in the assertion file for 4.18.

@rhmdnd rhmdnd merged commit 047f7ae into ComplianceAsCode:master Apr 22, 2025
111 of 112 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants