Add etcd signer verification and etcd-operator presubmits for ConfigurablePKI feature#78663
Conversation
WalkthroughThis pull request introduces PKI mode verification infrastructure for OpenShift installers. Two new E2E test jobs are added to validate default ECDSA and RSA PKI modes on AWS, with the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yaml (1)
289-303: ⚡ Quick winSet
EXPECTED_PKI_MODEexplicitly in the RSA job to avoid implicit coupling to ref defaults.Line 290 onward currently inherits the step default. Pinning it in-job makes intent explicit and avoids accidental behavior drift if the ref default ever changes.
♻️ Proposed fix
- always_run: false as: e2e-aws-ovn-pki-rsa-techpreview optional: true steps: cluster_profile: openshift-org-aws env: EXPECTED_ALGORITHM: RSA EXPECTED_KEY_PARAM: "4096" + EXPECTED_PKI_MODE: Custom FEATURE_SET: TechPreviewNoUpgrade PKI_ALGORITHM: RSA PKI_RSA_KEY_SIZE: "4096"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yaml` around lines 289 - 303, The job e2e-aws-ovn-pki-rsa-techpreview currently relies on a ref default for PKI mode; explicitly set the EXPECTED_PKI_MODE environment variable in that job's env block (alongside EXPECTED_ALGORITHM, EXPECTED_KEY_PARAM, PKI_ALGORITHM, PKI_RSA_KEY_SIZE) to "RSA" so the behavior is pinned regardless of changes in the referenced refs like openshift-installer-pki-verify.ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh (1)
130-135: ⚡ Quick winUse structured field lookup for PKI mode instead of grepping YAML.
Line 130 currently parses
modeviagrep "mode:", which can misread future YAML changes. Querying.spec.modedirectly is safer and still simple.♻️ Proposed fix
- mode=$(echo "${pki_cr}" | grep "mode:" | head -1 | awk '{print $2}' || true) + mode=$(oc get pki cluster -o jsonpath='{.spec.mode}' 2>/dev/null || true)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh` around lines 130 - 135, Replace the fragile grep-based YAML parsing for `mode` with a structured lookup into `.spec.mode`; specifically, instead of using the `grep|head|awk` pipeline on `pki_cr`, extract the field via a YAML/JSON parser (e.g., `yq` or `jq`/`oc/kubectl --output=jsonpath`) so `mode=$(echo "${pki_cr}" | yq e '.spec.mode' - 2>/dev/null || true)` (or the equivalent jsonpath invocation) is used; keep the rest of the logic (the comparison against EXPECTED_PKI_MODE, logging to ARTIFACT_LOG, and setting pki_status="FAIL") unchanged and reference `pki_cr`, `EXPECTED_PKI_MODE`, `ARTIFACT_LOG`, and `pki_status` when making the replacement.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In
`@ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yaml`:
- Around line 289-303: The job e2e-aws-ovn-pki-rsa-techpreview currently relies
on a ref default for PKI mode; explicitly set the EXPECTED_PKI_MODE environment
variable in that job's env block (alongside EXPECTED_ALGORITHM,
EXPECTED_KEY_PARAM, PKI_ALGORITHM, PKI_RSA_KEY_SIZE) to "RSA" so the behavior is
pinned regardless of changes in the referenced refs like
openshift-installer-pki-verify.
In
`@ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh`:
- Around line 130-135: Replace the fragile grep-based YAML parsing for `mode`
with a structured lookup into `.spec.mode`; specifically, instead of using the
`grep|head|awk` pipeline on `pki_cr`, extract the field via a YAML/JSON parser
(e.g., `yq` or `jq`/`oc/kubectl --output=jsonpath`) so `mode=$(echo "${pki_cr}"
| yq e '.spec.mode' - 2>/dev/null || true)` (or the equivalent jsonpath
invocation) is used; keep the rest of the logic (the comparison against
EXPECTED_PKI_MODE, logging to ARTIFACT_LOG, and setting pki_status="FAIL")
unchanged and reference `pki_cr`, `EXPECTED_PKI_MODE`, `ARTIFACT_LOG`, and
`pki_status` when making the replacement.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: ffcee320-13a9-4ea5-ba59-57aeb58e0a1a
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (8)
ci-operator/config/openshift/cluster-etcd-operator/openshift-cluster-etcd-operator-main.yamlci-operator/config/openshift/installer/openshift-installer-main.yamlci-operator/config/openshift/installer/openshift-installer-release-4.22.yamlci-operator/config/openshift/installer/openshift-installer-release-4.23.yamlci-operator/config/openshift/installer/openshift-installer-release-5.0.yamlci-operator/config/openshift/installer/openshift-installer-release-5.1.yamlci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.shci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-ref.yaml
|
/pj-rehearse |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/lgtm |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse ack |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
I think you need another |
|
@hasbro17: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/hold Revision 9b84f15 was retested 3 times: holding |
openshift-ci
Bot
added
the
do-not-merge/hold
Extend pki-verify to unconditionally check etcd-signer and etcd-metrics-signer secrets (openshift-etcd namespace), bringing the total from 7 to 9 verified signers. Add configurable EXPECTED_PKI_MODE env var (default: Custom) to support the updated installer behavior where mode is "Default" when pki section is omitted from install-config. Add optional PKI presubmit jobs (e2e-aws-ovn-pki-default-techpreview, e2e-aws-ovn-pki-rsa-techpreview) to the etcd-operator main config as the etcd-operator is adding support for consuming PKI config. Assisted-by: Claude Code (Opus 4.6)
9b84f15 to
39a70ac
Compare
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
/pj-rehearse ack |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hasbro17, rh-roman, tthvo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
…penshift#78663) Extend pki-verify to unconditionally check etcd-signer and etcd-metrics-signer secrets (openshift-etcd namespace), bringing the total from 7 to 9 verified signers. Add configurable EXPECTED_PKI_MODE env var (default: Custom) to support the updated installer behavior where mode is "Default" when pki section is omitted from install-config. Add optional PKI presubmit jobs (e2e-aws-ovn-pki-default-techpreview, e2e-aws-ovn-pki-rsa-techpreview) to the etcd-operator main config as the etcd-operator is adding support for consuming PKI config. Assisted-by: Claude Code (Opus 4.6)
…penshift#78663) Extend pki-verify to unconditionally check etcd-signer and etcd-metrics-signer secrets (openshift-etcd namespace), bringing the total from 7 to 9 verified signers. Add configurable EXPECTED_PKI_MODE env var (default: Custom) to support the updated installer behavior where mode is "Default" when pki section is omitted from install-config. Add optional PKI presubmit jobs (e2e-aws-ovn-pki-default-techpreview, e2e-aws-ovn-pki-rsa-techpreview) to the etcd-operator main config as the etcd-operator is adding support for consuming PKI config. Assisted-by: Claude Code (Opus 4.6)
3 participants
Follow up to #77043
Adding tests for openshift/cluster-etcd-operator#1593
Summary
openshift-installer-pki-verifyto unconditionally check etcd-signer and etcd-metrics-signer secrets (9 total, up from 7)EXPECTED_PKI_MODEenv var to supportmode: Default(pki section omitted) vsmode: Custom(explicit pki.signerCertificates)e2e-aws-ovn-pki-default-techpreview,e2e-aws-ovn-pki-rsa-techpreview)Test plan
/test e2e-aws-ovn-pki-default-techpreviewon etcd-operator PR validates ECDSA P-384 default behavior/test e2e-aws-ovn-pki-rsa-techpreviewon etcd-operator PR validates explicit RSA-4096 overrideSummary by CodeRabbit