Skip to content

ROX-37315: Keep deploy checks with image exclusions (release-5.0) - #23215

Open
sachaudh wants to merge 1 commit into
release-5.0from
codex/backport-23107-release-5.0
Open

ROX-37315: Keep deploy checks with image exclusions (release-5.0)#23215
sachaudh wants to merge 1 commit into
release-5.0from
codex/backport-23107-release-5.0

Conversation

@sachaudh

@sachaudh sachaudh commented Oct 2, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor

Description

Jira: ROX-37315

Backport PR #23107 to release-5.0. Image-only exclusions currently cause Build and Deploy policies to skip all deployment checks. The fix keeps deploy-time detection and entity policy lists active while image exclusions continue to apply at Build.

  • Guard deployment and audit-event exclusion matching against image-only exclusions.
  • Carry the regression tests and add the behavior notice to the next-release changelog.

Deployment exclusions remain the way to exempt deployments. Applying image exclusions at Deploy would change their documented Build-only behavior.

Release timing: Please have the 5.0 release engineer approve the patch cycle before merging this draft. Target 5.0.1 after the 5.0.0 candidate process.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

  • Passed go test ./central/policy/matcher ./pkg/detection ./pkg/detection/deploytime on release-5.0.
  • No UI code changed. The matcher test covers policy visibility for deployments, namespaces, and clusters.

@sachaudh
fix(policy): preserve deploy checks with image exclusions
6f820be 
Backport PR #23107 to release-5.0 so secured clusters on this stream regain deploy-time checks. Keep the behavior notice in the next-release changelog for the release engineer to place in the appropriate patch.

(cherry picked from commit 7fdaba1)
Signed-off-by: Saif Chaudhry <schaudhr@redhat.com>
@sachaudh sachaudh added backport PR to backport changes from master to release branch ai-assisted labels Oct 2, 2026
@openshift-ci

openshift-ci Bot commented Oct 2, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit 6f820be. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.0.0-rc.2-1-g6f820be9aa

@codecov

codecov Bot commented Oct 2, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.89%. Comparing base (c5682f9) to head (6f820be).

Additional details and impacted files 
@@               Coverage Diff               @@
##           release-5.0   #23215      +/-   ##
===============================================
- Coverage        51.93%   51.89%   -0.04%     
===============================================
  Files             2901     2905       +4     
  Lines           182875   182950      +75     
===============================================
- Hits             94973    94944      -29     
- Misses           79601    79674      +73     
- Partials          8301     8332      +31
Flag Coverage Δ
go-unit-tests 51.89% <100.00%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@sachaudh
sachaudh requested review from charmik-redhat and removed request for charmik-redhat October 7, 2026 18:35
@sachaudh sachaudh modified the milestone: 5.0.0-rc.3 Oct 7, 2026
@sachaudh
sachaudh marked this pull request as ready for review October 7, 2026 21:23
@sachaudh
sachaudh requested a review from a team as a code owner October 7, 2026 21:23
@openshift-ci

openshift-ci Bot commented Oct 8, 2026

Copy link
Copy Markdown

@sachaudh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ocp-4-22-qa-e2e-tests 6f820be link false /test ocp-4-22-qa-e2e-tests
ci/prow/ocp-4-12-qa-e2e-tests 6f820be link false /test ocp-4-12-qa-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@sachaudh sachaudh added the pls-merge Indicates to the *reviewer* that the PR can be merged once tests pass and approval is granted label Oct 8, 2026
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest operator-bundle-on-push

2 similar comments
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest operator-bundle-on-push

@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest operator-bundle-on-push

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ai-assisted area/central backport PR to backport changes from master to release branch pls-merge Indicates to the *reviewer* that the PR can be merged once tests pass and approval is granted

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sachaudh