Skip to content

create e2e coverage on medik8s-5.0 branch - #84028

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
weshayutin:nhc-medik8s-5.0
Aug 26, 2026
Merged

create e2e coverage on medik8s-5.0 branch#84028
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
weshayutin:nhc-medik8s-5.0

Conversation

@weshayutin

@weshayutin weshayutin commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

Adds OpenShift CI coverage for the Medik8s Node Healthcheck Operator 5.0 branch. The configuration supports UBI builds, bundle generation, nightly releases, unit tests, and AWS end-to-end workflows for installation, upgrades, readiness, and TLS checks.

Signed-off-by: Wesley Hayutin <weshayutin@gmail.com>
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 25, 2026
@weshayutin

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6c9e064a-b722-42d1-a20c-4edbbe977450

📥 Commits

Reviewing files that changed from the base of the PR and between 89a2bdd and 9a7baf8.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (2)
  • ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__4.23.yaml
  • ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__5.0.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.


Walkthrough

The pull request adds CI configurations for the Medik8s Node Healthcheck Operator on OpenShift 4.23 and the 5.0 branch. The configurations define builds, bundles, releases, unit tests, AWS end-to-end workflows, and optional TLS validation workflows.

Changes

Node Healthcheck Operator CI

Layer / File(s) Summary
Build and release configuration
ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__4.23.yaml, ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__5.0.yaml
Defines UBI-based images, operator bundles, pullspec substitution, release targets, resource settings, and repository metadata.
Unit and AWS end-to-end validation
ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__4.23.yaml, ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__5.0.yaml
Configures unit tests and AWS workflows for namespace setup, security labels, bundle installation, readiness checks, upgrades, and end-to-end tests.
Optional TLS validation workflows
ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-medik8s-5.0__5.0.yaml
Adds optional AWS workflows for TLS 1.3 readiness, PQC checks, scanner execution, and strict TLS adherence validation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 9a7ba

This PR adds end-to-end CI coverage for the medik8s 5.0 branch, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the primary change: adding end-to-end CI coverage for the Medik8s 5.0 branch. It is concise and specific, although the pull request also adds a 4.23 configuration.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The pull request adds CI YAML and generated Prow job YAML only. The added files contain static CI step names such as test, openshift-e2e, and e2e-test, plus commands that invoke make test and …
Test Structure And Quality ✅ Passed PASS — The pull request changes only CI YAML and generated Prow job metadata. It adds shell commands that invoke make test and make test-e2e, but it does not add or modify Ginkgo test code, It b…
Microshift Test Compatibility ✅ Passed PASS — The pull request adds only CI YAML and generated Prow job files. The exact commit diff contains no Go or other Ginkgo test source, no It/Describe/Context/When declarations, and no MicroShift gu…
Single Node Openshift (Sno) Test Compatibility ✅ Passed PASS: The pull request adds only CI YAML configuration and generated Prow jobs. The diff contains no new Ginkgo test declarations or test source. The make test-e2e entries only invoke tests from the…
Topology-Aware Scheduling Compatibility ✅ Passed PASS. The commit adds only two ci-operator configuration files and one generated Prow presubmit job file. These files define CI builds, tests, workflows, and CI job resources; they do not add or modif…
Ote Binary Stdout Contract ✅ Passed PASS: The commit adds only CI configuration and generated Prow job YAML. It adds no Go or OTE source code and no process-level stdout calls. The new 4.23 and 5.0 configurations match the existing main…
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS: The commit adds only CI configuration and generated Prow job YAML. It adds no Go or other test source files and no new Ginkgo declarations such as It(), Describe(), Context(), or When().…
No-Weak-Crypto ✅ Passed No weak-crypto usage is introduced. The pull request adds CI YAML and generated Prow jobs only. Exact added-line scans found no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB references. The TLS scanner …
Container-Privileges ✅ Passed The pull request adds two CI configuration files and one generated Prow job file. None contains privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, …
No-Sensitive-Data-In-Logs ✅ Passed No sensitive-data logging was introduced. The pull request adds CI YAML and generated Prow job definitions. Their command blocks invoke tests and operator installation, but do not print passwords, tok…
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The pull request adds CI YAML and generated Prow job YAML only. The added files contain static CI step names such as test, openshift-e2e, and e2e-test, plus commands that invoke make test and make test-e2e. They do not add or modify Ginkgo It, Describe, Context, or When titles. The namespace and other environment values are configuration data, not test titles.

Full details: Test Structure And Quality

Explanation

PASS — The pull request changes only CI YAML and generated Prow job metadata. It adds shell commands that invoke make test and make test-e2e, but it does not add or modify Ginkgo test code, It blocks, fixtures, assertions, or Eventually/Consistently calls. Therefore, none of the stated Ginkgo test-quality failure conditions is introduced.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request adds only CI YAML and generated Prow job files. The exact commit diff contains no Go or other Ginkgo test source, no It/Describe/Context/When declarations, and no MicroShift guards or API tags to assess. The new workflow only invokes existing targets such as make test-e2e; the same workflow pattern already exists in the prior Node Healthcheck configurations. Therefore, this check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request adds only CI YAML configuration and generated Prow jobs. The diff contains no new Ginkgo test declarations or test source. The make test-e2e entries only invoke tests from the external medik8s-5.0 source branch; they do not introduce a multi-node assumption in this pull request. Therefore, the SNO-specific failure condition is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS. The commit adds only two ci-operator configuration files and one generated Prow presubmit job file. These files define CI builds, tests, workflows, and CI job resources; they do not add or modify operator code, controllers, or deployment manifests. The additions contain no required/preferred affinity, topology spread constraints, node selectors or affinity, tolerations, replica derivation, or PDB settings. Therefore, no explicit topology-unsafe scheduling condition is introduced.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The commit adds only CI configuration and generated Prow job YAML. It adds no Go or OTE source code and no process-level stdout calls. The new 4.23 and 5.0 configurations match the existing main configurations except for the branch metadata. Their test commands delegate to make test and make test-e2e; the added diff contains no openshift-tests, OTE, Ginkgo suite setup, fmt.Print*, klog, or stdout references.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The commit adds only CI configuration and generated Prow job YAML. It adds no Go or other test source files and no new Ginkgo declarations such as It(), Describe(), Context(), or When(). The check is therefore not applicable to this change. The make test-e2e invocation and bundle image references only schedule existing repository tests; they do not introduce a changed Ginkgo test body with an IPv4 assumption or external-service call.

Full details: No-Weak-Crypto

Explanation

No weak-crypto usage is introduced. The pull request adds CI YAML and generated Prow jobs only. Exact added-line scans found no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB references. The TLS scanner and TLS 1.3/PQC workflow references configure security tests; they do not implement cryptography. The generated job secrets are CI credential mounts, with no secret or token comparison.

Full details: Container-Privileges

Explanation

The pull request adds two CI configuration files and one generated Prow job file. None contains privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or an explicit root security setting. The pod-security.kubernetes.io/enforce=privileged shell label only sets the namespace PSA mode; it is not a container or Kubernetes manifest privileged: true field.

Full details: No-Sensitive-Data-In-Logs

Explanation

No sensitive-data logging was introduced. The pull request adds CI YAML and generated Prow job definitions. Their command blocks invoke tests and operator installation, but do not print passwords, tokens, API keys, PII, session IDs, or customer data. Secret mounts are standard CI infrastructure references and expose no values. The TLS scanner and failure-analyzer steps contain logging, but those reusable step implementations are unchanged; the new configuration only references them, consistent with the existing Node Healthcheck 5.0 configuration.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from jmontleon and razo7 August 25, 2026 16:40
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@weshayutin: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-4.23-ci-bundle-my-bundle medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-4.23-images medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-4.23-openshift-e2e medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-4.23-test medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-5.0-ci-bundle-my-bundle medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-5.0-images medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-5.0-openshift-e2e medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-5.0-test medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-5.0-tls-pqc-readiness medik8s/node-healthcheck-operator presubmit Presubmit changed
pull-ci-medik8s-node-healthcheck-operator-medik8s-5.0-5.0-tls13-adherence medik8s/node-healthcheck-operator presubmit Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@weshayutin: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Aug 25, 2026
@openshift-ci

openshift-ci Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

@weshayutin: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@weshayutin

Copy link
Copy Markdown
Contributor Author

@jmontleon @mpryc @razo7 0/

@razo7

razo7 commented Aug 26, 2026

Copy link
Copy Markdown
Member

/pj-rehearse ack

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 26, 2026
@openshift-ci

openshift-ci Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: razo7, weshayutin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 6011d5b into openshift:main Aug 26, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants