Skip to content

ROX-37315: Keep deploy checks with image exclusions (release-4.11) - #23214

Merged
kovayur merged 2 commits into
release-4.11from
codex/backport-23107-release-4.11
Oct 16, 2026
Merged

ROX-37315: Keep deploy checks with image exclusions (release-4.11)#23214
kovayur merged 2 commits into
release-4.11from
codex/backport-23107-release-4.11

Conversation

@sachaudh

@sachaudh sachaudh commented Oct 2, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor

Description

Jira: ROX-37315

Backport PR #23107 to release-4.11. Image-only exclusions currently cause Build and Deploy policies to skip all deployment checks. The fix keeps deploy-time detection and entity policy lists active while image exclusions continue to apply at Build.

  • Guard deployment and audit-event exclusion matching against image-only exclusions.
  • Carry the regression tests and add the behavior notice to the next-release changelog.

Deployment exclusions remain the way to exempt deployments. Applying image exclusions at Deploy would change their documented Build-only behavior.

Release timing: Please have the 4.11 release engineer approve the patch cycle before merging this draft. Target 4.11.6 after the 4.11.5 candidate process.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

  • Passed go test ./central/policy/matcher ./pkg/detection ./pkg/detection/deploytime on release-4.11.
  • No UI code changed. The matcher test covers policy visibility for deployments, namespaces, and clusters.

@sachaudh
fix(policy): preserve deploy checks with image exclusions
5d8ca29 
Backport PR #23107 to release-4.11 so secured clusters on this stream regain deploy-time checks. Keep the behavior notice in the next-release changelog for the release engineer to place in the appropriate patch.

(cherry picked from commit 7fdaba1)
Signed-off-by: Saif Chaudhry <schaudhr@redhat.com>
@sachaudh sachaudh added backport PR to backport changes from master to release branch ai-assisted labels Oct 2, 2026
@openshift-ci

openshift-ci Bot commented Oct 2, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@github-actions

github-actions Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit ec86d95. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.6-rc.0-15-gec86d953af

@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest create-custom-snapshot

2 similar comments
@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest create-custom-snapshot

@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest create-custom-snapshot

@sachaudh sachaudh added this to the 4.11.6-rc.1 milestone Oct 7, 2026
@sachaudh
sachaudh marked this pull request as ready for review October 7, 2026 21:23
@sachaudh
sachaudh requested a review from a team as a code owner October 7, 2026 21:23
@sachaudh sachaudh added the pls-merge Indicates to the *reviewer* that the PR can be merged once tests pass and approval is granted label Oct 8, 2026
@openshift-ci

openshift-ci Bot commented Oct 16, 2026

Copy link
Copy Markdown

@sachaudh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/gke-nongroovy-e2e-tests 337b9ea link false /test gke-nongroovy-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@kovayur
kovayur merged commit ec86d95 into release-4.11 Oct 16, 2026
100 of 116 checks passed
@kovayur
kovayur deleted the codex/backport-23107-release-4.11 branch October 16, 2026 12:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kovayur kovayur kovayur approved these changes

Assignees

No one assigned

Labels

ai-assisted area/central backport PR to backport changes from master to release branch pls-merge Indicates to the *reviewer* that the PR can be merged once tests pass and approval is granted

Projects

None yet

Milestone

4.11.6-rc.1

Development

Successfully merging this pull request may close these issues.

2 participants

@sachaudh @kovayur