Skip to content

CNTRLPLANE-2202: Check for debug pod (regardless of ns) in default service account monitor test#30815

Open
ehearne-redhat wants to merge 3 commits intoopenshift:mainfrom
ehearne-redhat:fix-debug-pod-exception
Open

CNTRLPLANE-2202: Check for debug pod (regardless of ns) in default service account monitor test#30815
ehearne-redhat wants to merge 3 commits intoopenshift:mainfrom
ehearne-redhat:fix-debug-pod-exception

Conversation

@ehearne-redhat
Copy link
Contributor

@ehearne-redhat ehearne-redhat commented Feb 26, 2026

This fix addresses debug pod using default service account detection in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Summary by CodeRabbit

  • Tests
    • Added an exception for the nmstate console plugin in authentication monitoring.
    • Improved detection and handling of debug-related pods by recognizing debug annotations and labels, reducing false outliers and improving test reliability.

@openshift-ci-robot
Copy link

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 26, 2026
@openshift-ci-robot
Copy link

openshift-ci-robot commented Feb 26, 2026

@ehearne-redhat: This pull request references CNTRLPLANE-2202 which is a valid jira issue.

Details

In response to this:

This fix addresses debug pod detection using default service account in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai
Copy link

coderabbitai bot commented Feb 26, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between e53f764 and 0e37c91.

📒 Files selected for processing (1)
  • pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

Walkthrough

Replaces a namespace/name-based debug-pod exception with detection via annotations/labels containing "debug.openshift.io"; adds a Jira exception entry for openshift-nmstate/nmstate-console-plugin- and updates inlined comments around outlier handling.

Changes

Cohort / File(s) Summary
Exception Handler Logic
pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go
Added a Jira exception for openshift-nmstate/nmstate-console-plugin-. Replaced the debug-pod outlier heuristic (namespace/name) with detection based on annotations containing debug.openshift.io or the label debug.openshift.io/managed-by=oc-debug; updated comments accordingly.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Test Structure And Quality ❓ Inconclusive The custom_check instructions are designed for Ginkgo-style test suites, but this PR modifies a monitoring service implementation that does not use Ginkgo test patterns. Clarify whether this check applies only to Ginkgo tests or all test-related code, and provide guidelines appropriate to monitoring service implementations.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly describes the main change: improving debug pod detection in the default service account monitor test to work across all namespaces.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names ✅ Passed Test names use static values without dynamic pod names, timestamps, UUIDs, or node names; deterministic monitoring logic with stable Jira exceptions.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.5.0)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions


Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Feb 26, 2026

@ehearne-redhat: This pull request references CNTRLPLANE-2202 which is a valid jira issue.

Details

In response to this:

This fix addresses debug pod using default service account detection in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Feb 26, 2026

@ehearne-redhat: This pull request references CNTRLPLANE-2202 which is a valid jira issue.

Details

In response to this:

This fix addresses debug pod using default service account detection in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Summary by CodeRabbit

  • Tests
  • Refined exception handling in authentication monitoring to recognize debug-related pods system-wide, enhancing test coverage and improving monitoring reliability.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from deads2k and p0lyn0mial February 26, 2026 17:29
@openshift-ci-robot
Copy link

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@ehearne-redhat
Copy link
Contributor Author

/retest

@neisw
Copy link
Contributor

neisw commented Feb 27, 2026

/approve

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 27, 2026
Copy link
Contributor

@everettraven everettraven left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 27, 2026
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 27, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ehearne-redhat, everettraven, neisw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ehearne-redhat
Copy link
Contributor Author

/hold

We seem to have missed one.

https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-ipsec/2027144866420494336

openshift-nmstate/nmstate-console-plugin is using a default service account. I believe this one was missed as the script looked at its conformance test and didn't report the actual test itself.

I'm going to add this one and discuss this with my team on next steps.

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 27, 2026
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 27, 2026
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 27, 2026

New changes are detected. LGTM label has been removed.

@ehearne-redhat
Copy link
Contributor Author

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 27, 2026
@openshift-ci-robot
Copy link

openshift-ci-robot commented Feb 27, 2026

@ehearne-redhat: This pull request references CNTRLPLANE-2202 which is a valid jira issue.

Details

In response to this:

This fix addresses debug pod using default service account detection in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Summary by CodeRabbit

  • Tests
  • Added an exception for the nmstate console plugin in authentication monitoring.
  • Improved detection of debug-related pods by checking pod names across all namespaces, enhancing test coverage and monitoring reliability.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go`:
- Around line 92-96: The current debug-pod detection in the anonymous function
(func(pod corev1.Pod) (string, bool)) uses strings.Contains(pod.Name, "debug")
and should be tightened; change the logic to detect true oc debug pods by either
using strings.HasSuffix(pod.Name, "-debug") or, preferably, checking for the
debug annotation on the Pod (presence of "debug.openshift.io/source-resource" in
pod.Annotations) and return the same exemption when that condition is met
instead of the broad substring match.

ℹ️ Review info

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 7c6a322 and 2203355.

📒 Files selected for processing (1)
  • pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

@openshift-ci-robot
Copy link

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@ehearne-redhat
Copy link
Contributor Author

/retest

@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 3, 2026

@ehearne-redhat: This pull request references CNTRLPLANE-2202 which is a valid jira issue.

Details

In response to this:

This fix addresses debug pod using default service account detection in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Summary by CodeRabbit

  • Tests
  • Added an exception for the nmstate console plugin in authentication monitoring.
  • Improved detection of debug-related pods by using annotations/labels with debug markers, enhancing test accuracy and monitoring reliability.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ehearne-redhat ehearne-redhat force-pushed the fix-debug-pod-exception branch from e53f764 to 0e37c91 Compare March 3, 2026 11:40
@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 3, 2026

@ehearne-redhat: This pull request references CNTRLPLANE-2202 which is a valid jira issue.

Details

In response to this:

This fix addresses debug pod using default service account detection in https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040 .

Summary by CodeRabbit

  • Tests
  • Added an exception for the nmstate console plugin in authentication monitoring.
  • Improved detection and handling of debug-related pods by recognizing debug annotations and labels, reducing false outliers and improving test reliability.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ehearne-redhat
Copy link
Contributor Author

images test appears to be broken due to coreos label issues. The image needs to be rebuilt with Red Hat Enterprise Linux CoreOS 9 8 or the symbols need to be updated to include . --> [():-.]

error: unable to check whether to include image quay-proxy.ci.openshift.org/openshift/ci@sha256:800e57dce493a5785335000053e881476c6fbfda6492304a3ab7c1117f5d6279: tag "rhel-coreos" has an invalid io.openshift.build.versions or io.openshift.build.version-display-names label: the display name "Red Hat Enterprise Linux CoreOS 9.8" must only be alphanumerics, spaces, and symbols in [():-]

Manually triggering additional tests to see if debug issue resolved. Once these tests pass, I'll do another check on Sippy to ensure all cases have been caught so that the monitor tests won't fail due to uncaught reasonable exceptions.

/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Mar 3, 2026

@ehearne-redhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-microshift 0e37c91 link true /test e2e-aws-ovn-microshift
ci/prow/e2e-aws-ovn-fips 0e37c91 link true /test e2e-aws-ovn-fips
ci/prow/e2e-gcp-csi 0e37c91 link true /test e2e-gcp-csi
ci/prow/e2e-vsphere-ovn-upi 0e37c91 link true /test e2e-vsphere-ovn-upi
ci/prow/e2e-aws-ovn-microshift-serial 0e37c91 link true /test e2e-aws-ovn-microshift-serial
ci/prow/e2e-aws-csi 0e37c91 link true /test e2e-aws-csi
ci/prow/e2e-vsphere-ovn 0e37c91 link true /test e2e-vsphere-ovn
ci/prow/images 0e37c91 link true /test images
ci/prow/e2e-metal-ipi-ovn-ipv6 0e37c91 link true /test e2e-metal-ipi-ovn-ipv6
ci/prow/e2e-aws-ovn-serial-2of2 0e37c91 link true /test e2e-aws-ovn-serial-2of2
ci/prow/e2e-aws-ovn-serial-1of2 0e37c91 link true /test e2e-aws-ovn-serial-1of2
ci/prow/e2e-gcp-ovn-upgrade 0e37c91 link true /test e2e-gcp-ovn-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants