Skip to content

ROX-34114: Whitelist GKE filestore mount policy in DefaultPoliciesTest - #22945

Merged
AlexVulaj merged 2 commits into
masterfrom
AlexVulaj/ROX-34114-gke-csi-whitelist
Sep 22, 2026
Merged

ROX-34114: Whitelist GKE filestore mount policy in DefaultPoliciesTest#22945
AlexVulaj merged 2 commits into
masterfrom
AlexVulaj/ROX-34114-gke-csi-whitelist

Conversation

@AlexVulaj

@AlexVulaj AlexVulaj commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

ROX-34114 fixes DefaultPoliciesTest failures caused by expected CSI mount behavior in provider-specific environments.

Whitelisted the Docker CIS 5.19 violations for EKS ebs-csi-node and GKE filestore-node. This is test-only; customer-facing default policies are unchanged.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

  • CI should validate that the expected violations no longer cause the test to fail.

@AlexVulaj
AlexVulaj requested a review from janisz as a code owner September 21, 2026 18:40
@coderabbitai

coderabbitai Bot commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 41b468ea-cddc-42b4-a862-977c92d45a32

📥 Commits

Reviewing files that changed from the base of the PR and between 7fb02dd and e7c4f1c.

📒 Files selected for processing (1)
  • qa-tests-backend/src/test/groovy/DefaultPoliciesTest.groovy

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

📝 Summary

Summary by CodeRabbit

  • Tests
    • Updated built-in service validation for the kube-system namespace to account for expected Docker CIS 5.19 mount-propagation alerts associated with EKS EBS CSI and GKE Filestore node services. This improves validation accuracy for supported Kubernetes environments that use bidirectional mount propagation.

Walkthrough

The kube-system whitelist now includes Docker CIS 5.19 mount-propagation alerts for the EKS ebs-csi-node and GKE filestore-node DaemonSets.

Changes

Kube-system alert whitelist

Layer / File(s) Summary
Storage DaemonSet alert whitelist
qa-tests-backend/src/test/groovy/DefaultPoliciesTest.groovy		 Adds the EKS and GKE mount-propagation alerts to the kube-system whitelist. Comments document bidirectional mount propagation.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly identifies the issue and the main change: whitelisting the GKE filestore mount policy in DefaultPoliciesTest.
Description check ✅ Passed The description follows the required template, explains the test-only change, records documentation and quality checks, identifies the modified existing test, and states the CI validation method.
✨ Finishing Touches 💡 1
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

@AlexVulaj
AlexVulaj force-pushed the AlexVulaj/ROX-34114-gke-csi-whitelist branch from 7fb02dd to e7c4f1c Compare September 21, 2026 18:44
@AlexVulaj

AlexVulaj commented Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

/test eks-qa-e2e-tests gke-qa-e2e-tests

@github-actions

github-actions Bot commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit fb34e70. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-16-gfb34e70ec7

@codecov

codecov Bot commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.83%. Comparing base (8702541) to head (889bbbe).

Additional details and impacted files 
@@            Coverage Diff             @@
##           master   #22945      +/-   ##
==========================================
- Coverage   51.86%   51.83%   -0.04%     
==========================================
  Files        2901     2901              
  Lines      182895   182895              
==========================================
- Hits        94862    94796      -66     
- Misses      79740    79786      +46     
- Partials     8293     8313      +20
Flag Coverage Δ
go-unit-tests 51.83% <ø> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

davdhacs
davdhacs approved these changes Sep 21, 2026
View reviewed changes

@davdhacs davdhacs left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 this is needed for EKS (I think starting early/mid August)

@AlexVulaj

AlexVulaj commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

/test ocp-4-12-nongroovy-e2e-tests

@AlexVulaj

AlexVulaj commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

/test gke-latest-qa-e2e-tests

@msugakov

msugakov commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

/test ?

@openshift-ci

openshift-ci Bot commented Sep 22, 2026

Copy link
Copy Markdown

@msugakov: The following commands are available to trigger required jobs:

/test gke-nongroovy-e2e-tests

/test gke-ui-e2e-tests

The following commands are available to trigger optional jobs:

/test aks-qa-e2e-tests

/test aro-qa-e2e-tests

/test eks-qa-e2e-tests

/test gke-external-pg-17-qa-e2e-tests

/test gke-latest-nongroovy-e2e-tests

/test gke-latest-operator-e2e-tests

/test gke-latest-qa-e2e-tests

/test gke-latest-ui-e2e-tests

/test gke-nongroovy-compatibility-tests

/test gke-oldest-nongroovy-e2e-tests

/test gke-oldest-operator-e2e-tests

/test gke-oldest-qa-e2e-tests

/test gke-oldest-ui-e2e-tests

/test gke-operator-e2e-tests

/test gke-qa-e2e-tests

/test gke-race-condition-qa-e2e-tests

/test gke-scale-tests

/test gke-scanner-v4-install-tests

/test gke-version-compatibility-tests

/test ibmcloudz-4-14-qa-e2e-tests

/test ibmcloudz-4-15-qa-e2e-tests

/test ibmcloudz-4-16-qa-e2e-tests

/test ibmcloudz-4-17-qa-e2e-tests

/test ocp-4-12-compliance-e2e-tests

/test ocp-4-12-nongroovy-e2e-tests

/test ocp-4-12-operator-e2e-tests

/test ocp-4-12-qa-e2e-tests

/test ocp-4-12-scanner-v4-install-tests

/test ocp-4-12-ui-e2e-tests

/test ocp-4-14-vm-scanning-e2e-tests

/test ocp-4-18-vm-scanning-e2e-tests

/test ocp-4-22-compliance-e2e-tests

/test ocp-4-22-fips-qa-e2e-tests

/test ocp-4-22-nongroovy-e2e-tests

/test ocp-4-22-operator-e2e-tests

/test ocp-4-22-qa-e2e-tests

/test ocp-4-22-scanner-v4-install-tests

/test ocp-4-22-ui-e2e-tests

/test ocp-4-22-vm-scanning-e2e-tests

/test ocp-5-0-compliance-e2e-tests

/test ocp-5-0-fips-qa-e2e-tests

/test ocp-5-0-nongroovy-e2e-tests

/test ocp-5-0-operator-e2e-tests

/test ocp-5-0-qa-e2e-tests

/test ocp-5-0-scanner-v4-install-tests

/test ocp-5-0-ui-e2e-tests

/test ocp-5-0-vm-scanning-e2e-tests

/test ocp-dev-preview-compliance-e2e-tests

/test ocp-dev-preview-fips-qa-e2e-tests

/test ocp-dev-preview-nongroovy-e2e-tests

/test ocp-dev-preview-operator-e2e-tests

/test ocp-dev-preview-qa-e2e-tests

/test ocp-dev-preview-scanner-v4-install-tests

/test ocp-dev-preview-ui-e2e-tests

/test ocp-dev-preview-vm-scanning-e2e-tests

/test ocp-next-candidate-compliance-e2e-tests

/test ocp-next-candidate-fips-qa-e2e-tests

/test ocp-next-candidate-nongroovy-e2e-tests

/test ocp-next-candidate-operator-e2e-tests

/test ocp-next-candidate-qa-e2e-tests

/test ocp-next-candidate-scanner-v4-install-tests

/test ocp-next-candidate-ui-e2e-tests

/test ocp-next-candidate-vm-scanning-e2e-tests

/test ocp-stable-scanner-v4-install-compliance-e2e-tests

/test ocp-stable-scanner-v4-install-nongroovy-e2e-tests

/test ocp-stable-scanner-v4-install-operator-e2e-tests

/test ocp-stable-scanner-v4-install-qa-e2e-tests

/test ocp-stable-scanner-v4-install-scanner-v4-install-tests

/test ocp-stable-scanner-v4-install-ui-e2e-tests

/test osd-aws-qa-e2e-tests

/test osd-gcp-qa-e2e-tests

/test perf-scale-24nodes-scale-test

/test powervs-4-18-qa-corebpf-e2e-tests

/test powervs-4-19-qa-corebpf-e2e-tests

/test powervs-4-20-qa-corebpf-e2e-tests

/test powervs-4-21-qa-corebpf-e2e-tests

/test powervs-4-22-qa-corebpf-e2e-tests

/test rosa-fips-qa-e2e-tests

/test rosa-hcp-qa-e2e-tests

/test rosa-qa-e2e-tests

Use /test all to run the following jobs that were automatically triggered:

pull-ci-stackrox-stackrox-master-gke-nongroovy-e2e-tests

pull-ci-stackrox-stackrox-master-gke-qa-e2e-tests

pull-ci-stackrox-stackrox-master-gke-ui-e2e-tests

pull-ci-stackrox-stackrox-master-ocp-4-12-nongroovy-e2e-tests

pull-ci-stackrox-stackrox-master-ocp-4-22-nongroovy-e2e-tests
Details

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@AlexVulaj AlexVulaj added this to the 5.0.0-rc.1 milestone Sep 22, 2026
@openshift-ci

openshift-ci Bot commented Sep 22, 2026

Copy link
Copy Markdown

@AlexVulaj: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ocp-4-12-nongroovy-e2e-tests e7c4f1c link false /test ocp-4-12-nongroovy-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@AlexVulaj
AlexVulaj enabled auto-merge (squash) September 22, 2026 18:38
@AlexVulaj
AlexVulaj merged commit fb34e70 into master Sep 22, 2026
103 of 107 checks passed
@AlexVulaj
AlexVulaj deleted the AlexVulaj/ROX-34114-gke-csi-whitelist branch September 22, 2026 21:04
@github-actions

github-actions Bot commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

Merge commit has been cherry-picked to branch release-5.0.

rhacs-bot pushed a commit that referenced this pull request Sep 28, 2026
@AlexVulaj @web-flow
ROX-34114: Whitelist GKE filestore mount policy in DefaultPoliciesTest (
f000ca4 
#22945)

(cherry picked from commit fb34e70)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davdhacs davdhacs davdhacs approved these changes
@janisz janisz Awaiting requested review from janisz janisz is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

5.0.0-rc.1

Development

Successfully merging this pull request may close these issues.

3 participants

@AlexVulaj @msugakov @davdhacs