CMP-4648: Fix the content image profile-enable list (virt profiles on all arches, un-break the enable chain) - #15075
Conversation
|
Note for the STIG owners: #15042 added |
3114b38 to
694ced1
Compare
|
One item deliberately left out of this PR for the STIG owners: the |
Four fixes to the enable list, found during joint testing on a mixed-architecture CNV cluster: 1. cis-vm-extension and cis-vm-extension-node moved from the x86_64-only block to the all-architecture block: the aarch64 datastream shipped without them, so ARM worker nodes fail with 'No profile matching suffix' and strictNodeScan turns the whole pool ERROR on mixed-arch clusters. 2. Remove the three seds for the STIG V2R2 profiles deleted in de52a3c: the failing sed short-circuited the && chain and silently skipped every later enable (stig-v2r3, the virt profiles, the rhcos4 bsi enables), masked by a trailing ';' that kept the RUN exit 0. The block is now a single && chain so a future missing file fails the build loudly. 3. Enable cis-1-9 and cis-node-1-9: cis and cis-node extend them, and profile resolution fails when the parent is not enabled. 4. Enable stig-v2r6, stig-node-v2r6 and rhcos4 stig-v2r6 with the same architecture support as the v2r3 snapshots: stig/stig-node now extend v2r6 (same resolution requirement as 3), and without this the flagship x86_64 image would ship only the older snapshot while ppc64le picks v2r6 up via its glob. The CEL stig-vm-extension profiles are intentionally not touched here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
694ced1 to
2719216
Compare
|
@Vincent056: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Description:
Fixes CMP-4648. Four fixes to the Konflux Containerfile's profile enable list, found during the CMP-4506 joint testing on a mixed-architecture CNV cluster:
Virt profiles were x86_64-only.
cis-vm-extension/cis-vm-extension-node(added in CMP-4513: Ship the CIS OCP-Virt profiles in the Konflux content image #14989) sat in the x86_64 block, so the aarch64 datastream shipped without them: ARM worker nodes fail withNo profile matching suffixandstrictNodeScanturns the whole worker pool ERROR. Verified by extracting the arm64 variant ofcontent-dev:master(14 profiles, no virt) and by per-node scanner exit codes on the test cluster (the two ARM nodes exit 1, all 19 x86_64 workers exit 2). Moved to the all-architecture enable block.The x86_64 enable chain has been silently broken since Bump OCP4 STIG from V2R2/V2R3 to V2R6 #15042 (STIG V2R2 removal): the list still
sed -i'ed the three deletedstig-v2r2files; the failing sed short-circuits the&&chain and skips every later enable - stig-v2r3, stig-node-v2r3, both virt profiles, and the rhcos4 bsi enables are all missing from currentcontent-dev:master(verified by extracting the amd64 datastream). The failure was masked by a trailing;keeping the RUN exit 0. Removed the dead seds; the block is now one&&chain so a missing file fails the build loudly.cis-1-9/cis-node-1-9enabled:cis/cis-nodeextend them and profile resolution fails when the parent is not enabled (reproduced on a clean local build of the enable set).STIG V2R6 enabled with the same architecture support as V2R3 (
stig-v2r6,stig-node-v2r6, rhcos4stig-v2r6in the x86_64 block):stig/stig-node/rhcos4stignow extend v2r6 - same resolution requirement as (3) - and without this x86_64 would ship only the older snapshot while ppc64le picks v2r6 up via itsfind *stig*glob. The CELstig-vm-extensionprofiles are deliberately untouched (they ship via the CEL bundle; see comments).Validated:
cis-vm-extension-nodeProfile CR created, master+worker node scans DONE with all five rules evaluated - the exact scenario that ERRORs today.🤖 Generated with Claude Code