OSASINFRA-4389: Use EPEL for openstackclient#80522
Open
stephenfin wants to merge 4 commits into
Open
Conversation
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@stephenfin: This pull request references OSASINFRA-4389 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
WalkthroughReplaces OpenStack-based RPM mirror services with EPEL 9/10 mirrors across all OCP releases (4.6–5.1), adds generator support for conditional repo exclusion on vsphere02, deploys EPEL content-mirror workloads to build-shared, removes openstack mirrors from vsphere02, updates ci-operator pipeline cache steps to use EPEL endpoints, and introduces OCP 5.1 release infrastructure including RBAC, ImageStreams, RPM mirror manifests, and complex multi-variant RHEL repository configuration. ChangesEPEL Mirror Migration
OCP 5.1 Release Infrastructure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests (beta)
|
Contributor
Author
|
/jira refresh |
Contributor
|
@stephenfin: This pull request references OSASINFRA-4389 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
Author
|
/cc @mandre |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/installer/openshift-installer-release-4.20.yaml`:
- Line 119: The curl commands fetching EPEL repo files across four release
versions lack robustness flags. Update the curl invocations in
ci-operator/config/openshift/installer/openshift-installer-release-4.20.yaml
(line 119), openshift-installer-release-4.21.yaml (line 126),
openshift-installer-release-4.22.yaml (line 126), and
openshift-installer-release-4.23.yaml (line 130) by adding the flags --fail
--silent --show-error to fail fast on HTTP errors, plus --connect-timeout and
--max-time options to bound connection and total request time, and --retry with
--retry-delay flags to enable automatic retries on transient failures. Apply the
same hardened curl flags to all four locations to ensure consistent and reliable
repo materialization across all release branches.
In `@ci-operator/config/openshift/installer/openshift-installer-release-5.1.yaml`:
- Line 130: The curl command in the build step references the
base-5-1-epel-10.ocp.svc endpoint which does not have corresponding
infrastructure defined. Create the missing infrastructure manifest file
clusters/build-clusters/build-shared/release-controller/rpms-ocp-5.1.yaml that
defines the Service and Deployment resources needed for the base-5-1-epel-10
service. Use the existing rpms-ocp-5.0.yaml as a reference template, adapting
the resource names and labels appropriately for the 5.1 version to match what
the curl command on line 130 expects to reach.
In `@ci-operator/config/openshift/origin/openshift-origin-release-4.23.yaml`:
- Line 39: Update the EPEL mirror endpoint in the curl command on line 39 to
match the 4.23 release context. Change the reference from base-4-22-epel-9 to
base-4-23-epel-9 in both the URL and the output file path to ensure the correct
repository metadata is fetched for 4.23 jobs.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.16.yaml`:
- Around line 126-202: This Deployment manifest is generated from a template and
is missing required hardening and operability controls. Fix the template in
hack/generators/release-controllers/content/art_rpm_mirroring_services.py by
adding to the mirror container: a securityContext block with
allowPrivilegeEscalation set to false, readOnlyRootFilesystem set to true,
runAsNonRoot set to true, and capabilities with drop containing ALL; liveness
and readiness probes appropriate for the HTTP service on port 8080; and resource
limits (cpu and memory) to complement the existing memory requests. After
updating the template, regenerate the manifest so the changes appear in the
Deployment specification.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.21.yaml`:
- Around line 126-202: The base-4-21-epel-9 Deployment lacks required security
hardening and resource controls as per the coding guidelines. In the container
spec for the mirror container, add a securityContext with runAsNonRoot true,
readOnlyRootFilesystem true, allowPrivilegeEscalation false, and capabilities
drop set to ALL. Additionally, add resources.limits specifying memory and CPU
constraints to the container. Finally, add both livenessProbe and readinessProbe
health checks to the container definition. If this Deployment is generated from
a template, apply these same security context, resource limits, and health probe
configurations to the template so all generated mirror Deployments inherit these
controls consistently.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.6.yaml`:
- Around line 126-202: The Deployment manifests for the EPEL mirror are missing
essential security hardening controls across both ocp-4.6 and ocp-4.7
configurations. In both files
(clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.6.yaml at
lines 126-202 and
clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.7.yaml at
lines 126-202), add container-level security context settings to the mirror
container with runAsNonRoot: true, allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true, and capabilities.drop for all unnecessary
capabilities. Additionally, add pod-level security context settings at the
spec.template.spec level, and ensure the mirror container has explicit resource
limits and health check probes. Apply these same hardening controls identically
to both deployment files to establish consistent security defaults.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.8.yaml`:
- Around line 126-202: The base-4-8-epel-9 Deployment and similar content-mirror
Deployments lack required security hardening settings including
allowPrivilegeEscalation: false, runAsNonRoot: true, readOnlyRootFilesystem:
true, and dropped ALL capabilities, as well as missing resource limits and
liveness/readiness probes. Update the generator template that produces these
Deployments to include these security context configurations and probe
definitions by default in the mirror container specification, then regenerate
the manifests to apply the changes across all affected deployments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 5caf504d-95cb-48ea-a9bc-7fe6492257ce
📒 Files selected for processing (82)
ci-operator/config/openshift/installer/openshift-installer-main.yamlci-operator/config/openshift/installer/openshift-installer-release-4.16.yamlci-operator/config/openshift/installer/openshift-installer-release-4.17.yamlci-operator/config/openshift/installer/openshift-installer-release-4.18.yamlci-operator/config/openshift/installer/openshift-installer-release-4.19.yamlci-operator/config/openshift/installer/openshift-installer-release-4.20.yamlci-operator/config/openshift/installer/openshift-installer-release-4.21.yamlci-operator/config/openshift/installer/openshift-installer-release-4.22.yamlci-operator/config/openshift/installer/openshift-installer-release-4.23.yamlci-operator/config/openshift/installer/openshift-installer-release-5.0.yamlci-operator/config/openshift/installer/openshift-installer-release-5.1.yamlci-operator/config/openshift/origin/openshift-origin-main.yamlci-operator/config/openshift/origin/openshift-origin-release-4.16.yamlci-operator/config/openshift/origin/openshift-origin-release-4.17.yamlci-operator/config/openshift/origin/openshift-origin-release-4.18.yamlci-operator/config/openshift/origin/openshift-origin-release-4.19.yamlci-operator/config/openshift/origin/openshift-origin-release-4.20.yamlci-operator/config/openshift/origin/openshift-origin-release-4.21.yamlci-operator/config/openshift/origin/openshift-origin-release-4.22.yamlci-operator/config/openshift/origin/openshift-origin-release-4.23.yamlci-operator/config/openshift/origin/openshift-origin-release-5.0.yamlci-operator/config/openshift/origin/openshift-origin-release-5.1.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.10.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.11.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.12.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.13.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.14.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.15.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.16.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.17.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.18.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.19.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.20.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.21.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.22.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.23.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.6.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.7.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.8.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.9.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-5.0.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.10.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.11.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.12.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.13.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.14.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.15.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.16.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.17.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.18.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.19.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.20.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.21.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.22.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.23.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.6.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.7.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.8.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.9.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-5.0.yamlcore-services/release-controller/_repos/ocp-4.10-epel-9.repocore-services/release-controller/_repos/ocp-4.11-epel-9.repocore-services/release-controller/_repos/ocp-4.12-epel-9.repocore-services/release-controller/_repos/ocp-4.13-epel-9.repocore-services/release-controller/_repos/ocp-4.14-epel-9.repocore-services/release-controller/_repos/ocp-4.15-epel-9.repocore-services/release-controller/_repos/ocp-4.16-epel-9.repocore-services/release-controller/_repos/ocp-4.17-epel-9.repocore-services/release-controller/_repos/ocp-4.18-epel-9.repocore-services/release-controller/_repos/ocp-4.19-epel-9.repocore-services/release-controller/_repos/ocp-4.20-epel-9.repocore-services/release-controller/_repos/ocp-4.21-epel-9.repocore-services/release-controller/_repos/ocp-4.22-epel-9.repocore-services/release-controller/_repos/ocp-4.23-epel-9.repocore-services/release-controller/_repos/ocp-4.6-epel-9.repocore-services/release-controller/_repos/ocp-4.7-epel-9.repocore-services/release-controller/_repos/ocp-4.8-epel-9.repocore-services/release-controller/_repos/ocp-4.9-epel-9.repocore-services/release-controller/_repos/ocp-5.0-epel-10.repocore-services/release-controller/_repos/ocp-5.1-epel-10.repohack/generators/release-controllers/content/art_rpm_mirroring_services.pyhack/generators/release-controllers/generate-release-controllers.py
💤 Files with no reviewable changes (19)
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.21.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.23.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.12.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.20.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.17.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.10.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.7.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.22.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.19.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.8.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.16.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.11.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.9.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.15.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.6.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.13.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.18.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-5.0.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.14.yaml
Contributor
Author
|
/pj-rehearse pull-ci-openshift-installer-main-e2e-openstack-ovn |
Contributor
|
@stephenfin: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
OSP 17.1 is nearing end-of-life, meaning these repos will soon disappear. Switch to EPEL instead. Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
stephenfin
force-pushed
the
openstack-epel-repos
branch
from
989aca6 to
14f3833
Compare
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: stephenfin The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
Author
|
/pj-rehearse pull-ci-openshift-installer-main-e2e-openstack-ovn |
Contributor
|
@stephenfin: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Contributor
|
[REHEARSALNOTIFIER]
A total of 2191 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
hack/generators/release-controllers/generate-release-controllers.py (1)
63-63: 💤 Low valueConsider unpacking syntax for cleaner list construction.
The current concatenation works correctly, but Python's unpacking syntax is more idiomatic.
♻️ Proposed refactor
- for major_minor in ['3.11'] + config.releases: + for major_minor in ['3.11', *config.releases]:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/generators/release-controllers/generate-release-controllers.py` at line 63, Replace the list concatenation using the plus operator with Python's unpacking syntax in the for loop that iterates over major_minor versions. Instead of concatenating ['3.11'] with config.releases using the plus operator, use the unpacking operator inside the list literal to combine them in a more idiomatic way. This applies to the for loop statement where major_minor is being assigned.Source: Linters/SAST tools
clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.10.yaml (1)
126-201: 🏗️ Heavy liftHarden security posture and add resource limits in EPEL mirror deployments. All EPEL mirror deployments share a missing security context and resource limit configuration because they are generated from the same template in
art_rpm_mirroring_services.py. Fix in the generator to apply to all versions.
clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.10.yaml#L126-L201: AddsecurityContextwithallowPrivilegeEscalation: false,runAsNonRoot: true, andreadOnlyRootFilesystem: trueto thebase-4-10-epel-9Deployment container spec; add CPU and memory limits alongside the existing memory request.clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.11.yaml#L126-L202: Apply the same security context and resource limits to thebase-4-11-epel-9Deployment.clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.12.yaml#L126-L202: Apply the same security context and resource limits to thebase-4-12-epel-9Deployment.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.10.yaml` around lines 126 - 201, Add security hardening and resource limits to the container specs across three EPEL mirror deployment files. In rpms-ocp-4.10.yaml lines 126-201, add a securityContext block to the base-4-10-epel-9 Deployment container with allowPrivilegeEscalation set to false, runAsNonRoot set to true, and readOnlyRootFilesystem set to true; additionally add CPU and memory limits to the resources section alongside the existing memory request. Apply the identical securityContext and resource limits changes to rpms-ocp-4.11.yaml lines 126-202 for the base-4-11-epel-9 Deployment container, and to rpms-ocp-4.12.yaml lines 126-202 for the base-4-12-epel-9 Deployment container. Consider updating the template generator in art_rpm_mirroring_services.py to ensure these configurations are applied consistently to all future EPEL mirror deployments.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.13.yaml`:
- Around line 126-202: The Deployment base-4-13-epel-9 and its mirror container
lack required security hardening controls. Update the generator template that
produces this manifest to add: a securityContext with allowPrivilegeEscalation
set to false, runAsNonRoot set to true, readOnlyRootFilesystem set to true, and
capabilities dropping ALL; add resource limits alongside the existing memory
request; add readiness and liveness probes for the mirror container; and set
automountServiceAccountToken to false at the pod spec level unless the service
account token is explicitly required. After updating the generator template,
regenerate the manifest to apply these hardening controls.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.19.yaml`:
- Around line 126-202: The Deployment for base-4-19-epel-9 in the generated
manifest file lacks required security hardening controls including
securityContext settings, resource limits, and health probes. Since this file is
generated from the template, locate the generator file at
hack/generators/release-controllers/content/art_rpm_mirroring_services.py and
update it to add the missing security controls to all generated mirror
Deployments. The fixes must include: adding securityContext with runAsNonRoot
true, readOnlyRootFilesystem true, and allowPrivilegeEscalation false to both
the pod and container specs; dropping ALL capabilities in securityContext;
defining resources.limits for cpu and memory in the container; and adding both
livenessProbe and readinessProbe to the mirror container. Ensure these controls
are applied in the template so they are inherited by all generated mirror
Deployments.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-5.1.yaml`:
- Around line 28-104: The generated Kubernetes Deployment manifest lacks
security hardening including securityContext settings, explicit resource limits,
and health check probes. Rather than patching this YAML directly, update the
generator script in
hack/generators/release-controllers/content/art_rpm_mirroring_services.py to
include these configurations in the baseline template. Add a
non-root/no-privilege-escalation securityContext at both pod and container level
in the generated templates, define resource limits alongside the existing memory
requests, and include appropriate liveness and readiness probes for the mirror
service. After updating the generator, regenerate the YAML manifests to apply
these hardening measures across all newly generated mirror workloads.
In `@core-services/release-controller/_repos/ocp-5.1-rhel102.repo`:
- Around line 1-88: All repository stanzas in the file (rhel-10.2-baseos,
rhel-10.2-appstream, rhel-10.2-nfv, rhel-10.2-highavailability,
rhel-10.2-fast-datapath, rhel-10.2-server-ose-5.0, and rhel-10.2-early-kernel)
have both sslverify disabled and gpgcheck disabled, creating a critical security
vulnerability. Change sslverify from false to 1 and gpgcheck from 0 to 1 across
all repository stanzas. If these restrictive settings are required due to
infrastructure constraints such as internal CA issues, document the specific
justification with comments explaining why and what compensating controls are in
place (such as network-level access restrictions or post-installation integrity
verification), rather than leaving the security settings disabled without
explanation.
---
Nitpick comments:
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.10.yaml`:
- Around line 126-201: Add security hardening and resource limits to the
container specs across three EPEL mirror deployment files. In rpms-ocp-4.10.yaml
lines 126-201, add a securityContext block to the base-4-10-epel-9 Deployment
container with allowPrivilegeEscalation set to false, runAsNonRoot set to true,
and readOnlyRootFilesystem set to true; additionally add CPU and memory limits
to the resources section alongside the existing memory request. Apply the
identical securityContext and resource limits changes to rpms-ocp-4.11.yaml
lines 126-202 for the base-4-11-epel-9 Deployment container, and to
rpms-ocp-4.12.yaml lines 126-202 for the base-4-12-epel-9 Deployment container.
Consider updating the template generator in art_rpm_mirroring_services.py to
ensure these configurations are applied consistently to all future EPEL mirror
deployments.
In `@hack/generators/release-controllers/generate-release-controllers.py`:
- Line 63: Replace the list concatenation using the plus operator with Python's
unpacking syntax in the for loop that iterates over major_minor versions.
Instead of concatenating ['3.11'] with config.releases using the plus operator,
use the unpacking operator inside the list literal to combine them in a more
idiomatic way. This applies to the for loop statement where major_minor is being
assigned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 684a24e2-d834-4de3-adfc-fe57dbf639d3
📒 Files selected for processing (88)
ci-operator/config/openshift/installer/openshift-installer-main.yamlci-operator/config/openshift/installer/openshift-installer-release-4.16.yamlci-operator/config/openshift/installer/openshift-installer-release-4.17.yamlci-operator/config/openshift/installer/openshift-installer-release-4.18.yamlci-operator/config/openshift/installer/openshift-installer-release-4.19.yamlci-operator/config/openshift/installer/openshift-installer-release-4.20.yamlci-operator/config/openshift/installer/openshift-installer-release-4.21.yamlci-operator/config/openshift/installer/openshift-installer-release-4.22.yamlci-operator/config/openshift/installer/openshift-installer-release-4.23.yamlci-operator/config/openshift/installer/openshift-installer-release-5.0.yamlci-operator/config/openshift/installer/openshift-installer-release-5.1.yamlci-operator/config/openshift/origin/openshift-origin-main.yamlci-operator/config/openshift/origin/openshift-origin-release-4.16.yamlci-operator/config/openshift/origin/openshift-origin-release-4.17.yamlci-operator/config/openshift/origin/openshift-origin-release-4.18.yamlci-operator/config/openshift/origin/openshift-origin-release-4.19.yamlci-operator/config/openshift/origin/openshift-origin-release-4.20.yamlci-operator/config/openshift/origin/openshift-origin-release-4.21.yamlci-operator/config/openshift/origin/openshift-origin-release-4.22.yamlci-operator/config/openshift/origin/openshift-origin-release-4.23.yamlci-operator/config/openshift/origin/openshift-origin-release-5.0.yamlci-operator/config/openshift/origin/openshift-origin-release-5.1.yamlclusters/app.ci/release-controller/admin_deploy-ocp-controller.yamlclusters/app.ci/release-controller/admin_deploy-ocp-publish-art.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.10.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.11.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.12.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.13.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.14.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.15.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.16.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.17.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.18.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.19.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.20.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.21.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.22.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.23.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.6.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.7.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.8.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-4.9.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-5.0.yamlclusters/build-clusters/build-shared/release-controller/rpms-ocp-5.1.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.10.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.11.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.12.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.13.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.14.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.15.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.16.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.17.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.18.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.19.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.20.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.21.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.22.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.23.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.6.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.7.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.8.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.9.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-5.0.yamlclusters/build-clusters/vsphere02/release-controller/rpms-ocp-5.1.yamlcore-services/release-controller/_repos/ocp-4.10-epel-9.repocore-services/release-controller/_repos/ocp-4.11-epel-9.repocore-services/release-controller/_repos/ocp-4.12-epel-9.repocore-services/release-controller/_repos/ocp-4.13-epel-9.repocore-services/release-controller/_repos/ocp-4.14-epel-9.repocore-services/release-controller/_repos/ocp-4.15-epel-9.repocore-services/release-controller/_repos/ocp-4.16-epel-9.repocore-services/release-controller/_repos/ocp-4.17-epel-9.repocore-services/release-controller/_repos/ocp-4.18-epel-9.repocore-services/release-controller/_repos/ocp-4.19-epel-9.repocore-services/release-controller/_repos/ocp-4.20-epel-9.repocore-services/release-controller/_repos/ocp-4.21-epel-9.repocore-services/release-controller/_repos/ocp-4.22-epel-9.repocore-services/release-controller/_repos/ocp-4.23-epel-9.repocore-services/release-controller/_repos/ocp-4.6-epel-9.repocore-services/release-controller/_repos/ocp-4.7-epel-9.repocore-services/release-controller/_repos/ocp-4.8-epel-9.repocore-services/release-controller/_repos/ocp-4.9-epel-9.repocore-services/release-controller/_repos/ocp-5.0-epel-10.repocore-services/release-controller/_repos/ocp-5.1-epel-10.repocore-services/release-controller/_repos/ocp-5.1-rhel102.repohack/generators/release-controllers/config/__init__.pyhack/generators/release-controllers/content/art_rpm_mirroring_services.pyhack/generators/release-controllers/generate-release-controllers.py
💤 Files with no reviewable changes (19)
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.12.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.8.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.6.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.23.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.10.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.7.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.20.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.14.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.17.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.22.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.13.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.11.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.21.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.9.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-5.0.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.16.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.15.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.19.yaml
- clusters/build-clusters/vsphere02/release-controller/rpms-ocp-4.18.yaml
✅ Files skipped from review due to trivial changes (7)
- core-services/release-controller/_repos/ocp-4.12-epel-9.repo
- core-services/release-controller/_repos/ocp-4.13-epel-9.repo
- core-services/release-controller/_repos/ocp-4.17-epel-9.repo
- core-services/release-controller/_repos/ocp-4.19-epel-9.repo
- core-services/release-controller/_repos/ocp-4.23-epel-9.repo
- core-services/release-controller/_repos/ocp-4.15-epel-9.repo
- core-services/release-controller/_repos/ocp-4.11-epel-9.repo
🚧 Files skipped from review as they are similar to previous changes (31)
- core-services/release-controller/_repos/ocp-5.0-epel-10.repo
- ci-operator/config/openshift/origin/openshift-origin-release-4.22.yaml
- core-services/release-controller/_repos/ocp-4.10-epel-9.repo
- ci-operator/config/openshift/installer/openshift-installer-release-4.23.yaml
- core-services/release-controller/_repos/ocp-4.14-epel-9.repo
- core-services/release-controller/_repos/ocp-4.9-epel-9.repo
- ci-operator/config/openshift/origin/openshift-origin-release-4.17.yaml
- core-services/release-controller/_repos/ocp-4.18-epel-9.repo
- ci-operator/config/openshift/installer/openshift-installer-release-4.17.yaml
- ci-operator/config/openshift/origin/openshift-origin-release-4.16.yaml
- ci-operator/config/openshift/installer/openshift-installer-release-4.22.yaml
- ci-operator/config/openshift/installer/openshift-installer-release-5.0.yaml
- core-services/release-controller/_repos/ocp-4.20-epel-9.repo
- ci-operator/config/openshift/origin/openshift-origin-release-5.1.yaml
- ci-operator/config/openshift/origin/openshift-origin-release-4.19.yaml
- ci-operator/config/openshift/installer/openshift-installer-release-4.18.yaml
- core-services/release-controller/_repos/ocp-4.16-epel-9.repo
- ci-operator/config/openshift/installer/openshift-installer-release-4.19.yaml
- core-services/release-controller/_repos/ocp-5.1-epel-10.repo
- ci-operator/config/openshift/installer/openshift-installer-main.yaml
- ci-operator/config/openshift/origin/openshift-origin-release-4.23.yaml
- ci-operator/config/openshift/installer/openshift-installer-release-4.20.yaml
- ci-operator/config/openshift/origin/openshift-origin-release-4.18.yaml
- core-services/release-controller/_repos/ocp-4.6-epel-9.repo
- ci-operator/config/openshift/origin/openshift-origin-release-4.20.yaml
- core-services/release-controller/_repos/ocp-4.7-epel-9.repo
- ci-operator/config/openshift/installer/openshift-installer-release-4.21.yaml
- core-services/release-controller/_repos/ocp-4.8-epel-9.repo
- ci-operator/config/openshift/origin/openshift-origin-main.yaml
- hack/generators/release-controllers/content/art_rpm_mirroring_services.py
- ci-operator/config/openshift/installer/openshift-installer-release-4.16.yaml
Comment on lines
+126
to
+202
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| annotations: | ||
| keel.sh/matchTag: 'true' | ||
| keel.sh/policy: force | ||
| keel.sh/pollSchedule: '@every 5m' | ||
| keel.sh/trigger: poll | ||
| labels: | ||
| app: base-4-13-epel-9 | ||
| name: base-4-13-epel-9 | ||
| namespace: ocp | ||
| spec: | ||
| replicas: 2 | ||
| selector: | ||
| matchLabels: | ||
| app: base-4-13-epel-9 | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| cluster-autoscaler.kubernetes.io/safe-to-evict: 'true' | ||
| labels: | ||
| app: base-4-13-epel-9 | ||
| spec: | ||
| containers: | ||
| - command: | ||
| - content-mirror | ||
| - --path=/tmp/config | ||
| - --max-size=5g | ||
| - --timeout=30m | ||
| - /tmp/repos | ||
| - /tmp/key | ||
| - /tmp/mirror-enterprise-basic-auth | ||
| image: quay-proxy.ci.openshift.org/openshift/ci:ci_content-mirror_latest | ||
| imagePullPolicy: Always | ||
| name: mirror | ||
| ports: | ||
| - containerPort: 8080 | ||
| name: http | ||
| resources: | ||
| requests: | ||
| memory: 500Mi | ||
| volumeMounts: | ||
| - mountPath: /tmp/repos | ||
| name: repos | ||
| readOnly: true | ||
| - mountPath: /tmp/key | ||
| name: key | ||
| readOnly: true | ||
| - mountPath: /tmp/mirror-enterprise-basic-auth | ||
| name: mirror-enterprise-basic-auth | ||
| readOnly: true | ||
| - mountPath: /tmp/cache | ||
| name: cache | ||
| workingDir: /tmp/repos | ||
| nodeSelector: | ||
| kubernetes.io/arch: amd64 | ||
| kubernetes.io/os: linux | ||
| volumes: | ||
| - configMap: | ||
| items: | ||
| - key: ocp-4.13-epel-9.repo | ||
| path: ocp-4.13-epel-9.repo | ||
| name: base-repos | ||
| name: repos | ||
| - name: key | ||
| secret: | ||
| secretName: mirror.openshift.com | ||
| - name: mirror-enterprise-basic-auth | ||
| secret: | ||
| defaultMode: 420 | ||
| secretName: mirror-enterprise-basic-auth | ||
| - emptyDir: {} | ||
| name: cache | ||
| - emptyDir: {} | ||
| name: run | ||
| --- |
Contributor
There was a problem hiding this comment.
Harden the new base-4-13-epel-9 Deployment in the generator before merge.
Line 126 introduces a new Deployment that still lacks required container/pod hardening and operability controls (allowPrivilegeEscalation: false, runAsNonRoot, readOnlyRootFilesystem, dropping ALL capabilities, resource limits, readiness/liveness probes, and explicit automountServiceAccountToken: false unless required). Since this file is generated, update the generator template and regenerate these manifests.
Suggested manifest shape for the generated Deployment
spec:
template:
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
containers:
- name: mirror
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ capabilities:
+ drop: ["ALL"]
resources:
requests:
memory: 500Mi
+ limits:
+ cpu: "1"
+ memory: 1Gi
+ readinessProbe:
+ httpGet:
+ path: /
+ port: 8080
+ livenessProbe:
+ httpGet:
+ path: /
+ port: 8080As per coding guidelines, Kubernetes manifests must include hardened securityContext, resource limits, probes, and automountServiceAccountToken: false unless needed.
🧰 Tools
🪛 Checkov (3.2.530)
[medium] 126-202: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 126-202: Minimize the admission of root containers
(CKV_K8S_23)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.13.yaml`
around lines 126 - 202, The Deployment base-4-13-epel-9 and its mirror container
lack required security hardening controls. Update the generator template that
produces this manifest to add: a securityContext with allowPrivilegeEscalation
set to false, runAsNonRoot set to true, readOnlyRootFilesystem set to true, and
capabilities dropping ALL; add resource limits alongside the existing memory
request; add readiness and liveness probes for the mirror container; and set
automountServiceAccountToken to false at the pod spec level unless the service
account token is explicitly required. After updating the generator template,
regenerate the manifest to apply these hardening controls.
Sources: Coding guidelines, Linters/SAST tools
Comment on lines
+126
to
+202
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| annotations: | ||
| keel.sh/matchTag: 'true' | ||
| keel.sh/policy: force | ||
| keel.sh/pollSchedule: '@every 5m' | ||
| keel.sh/trigger: poll | ||
| labels: | ||
| app: base-4-19-epel-9 | ||
| name: base-4-19-epel-9 | ||
| namespace: ocp | ||
| spec: | ||
| replicas: 2 | ||
| selector: | ||
| matchLabels: | ||
| app: base-4-19-epel-9 | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| cluster-autoscaler.kubernetes.io/safe-to-evict: 'true' | ||
| labels: | ||
| app: base-4-19-epel-9 | ||
| spec: | ||
| containers: | ||
| - command: | ||
| - content-mirror | ||
| - --path=/tmp/config | ||
| - --max-size=5g | ||
| - --timeout=30m | ||
| - /tmp/repos | ||
| - /tmp/key | ||
| - /tmp/mirror-enterprise-basic-auth | ||
| image: quay-proxy.ci.openshift.org/openshift/ci:ci_content-mirror_latest | ||
| imagePullPolicy: Always | ||
| name: mirror | ||
| ports: | ||
| - containerPort: 8080 | ||
| name: http | ||
| resources: | ||
| requests: | ||
| memory: 500Mi | ||
| volumeMounts: | ||
| - mountPath: /tmp/repos | ||
| name: repos | ||
| readOnly: true | ||
| - mountPath: /tmp/key | ||
| name: key | ||
| readOnly: true | ||
| - mountPath: /tmp/mirror-enterprise-basic-auth | ||
| name: mirror-enterprise-basic-auth | ||
| readOnly: true | ||
| - mountPath: /tmp/cache | ||
| name: cache | ||
| workingDir: /tmp/repos | ||
| nodeSelector: | ||
| kubernetes.io/arch: amd64 | ||
| kubernetes.io/os: linux | ||
| volumes: | ||
| - configMap: | ||
| items: | ||
| - key: ocp-4.19-epel-9.repo | ||
| path: ocp-4.19-epel-9.repo | ||
| name: base-repos | ||
| name: repos | ||
| - name: key | ||
| secret: | ||
| secretName: mirror.openshift.com | ||
| - name: mirror-enterprise-basic-auth | ||
| secret: | ||
| defaultMode: 420 | ||
| secretName: mirror-enterprise-basic-auth | ||
| - emptyDir: {} | ||
| name: cache | ||
| - emptyDir: {} | ||
| name: run | ||
| --- |
Contributor
There was a problem hiding this comment.
Harden the new EPEL mirror Deployment in the generator template.
Line 126 introduces a new Deployment without the baseline manifest controls (securityContext hardening, container resources.limits, and liveness/readiness probes). Because this file is generated, apply the fix in hack/generators/release-controllers/content/art_rpm_mirroring_services.py so all generated mirror Deployments inherit it.
As per coding guidelines, Kubernetes/OpenShift manifests must set runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, drop ALL capabilities, and define resource limits plus readiness/liveness probes.
🧰 Tools
🪛 Checkov (3.2.530)
[medium] 126-202: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 126-202: Minimize the admission of root containers
(CKV_K8S_23)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-4.19.yaml`
around lines 126 - 202, The Deployment for base-4-19-epel-9 in the generated
manifest file lacks required security hardening controls including
securityContext settings, resource limits, and health probes. Since this file is
generated from the template, locate the generator file at
hack/generators/release-controllers/content/art_rpm_mirroring_services.py and
update it to add the missing security controls to all generated mirror
Deployments. The fixes must include: adding securityContext with runAsNonRoot
true, readOnlyRootFilesystem true, and allowPrivilegeEscalation false to both
the pod and container specs; dropping ALL capabilities in securityContext;
defining resources.limits for cpu and memory in the container; and adding both
livenessProbe and readinessProbe to the mirror container. Ensure these controls
are applied in the template so they are inherited by all generated mirror
Deployments.
Source: Coding guidelines
Comment on lines
+28
to
+104
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| annotations: | ||
| keel.sh/matchTag: 'true' | ||
| keel.sh/policy: force | ||
| keel.sh/pollSchedule: '@every 5m' | ||
| keel.sh/trigger: poll | ||
| labels: | ||
| app: base-5-1 | ||
| name: base-5-1 | ||
| namespace: ocp | ||
| spec: | ||
| replicas: 2 | ||
| selector: | ||
| matchLabels: | ||
| app: base-5-1 | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| cluster-autoscaler.kubernetes.io/safe-to-evict: 'true' | ||
| labels: | ||
| app: base-5-1 | ||
| spec: | ||
| containers: | ||
| - command: | ||
| - content-mirror | ||
| - --path=/tmp/config | ||
| - --max-size=5g | ||
| - --timeout=30m | ||
| - /tmp/repos | ||
| - /tmp/key | ||
| - /tmp/mirror-enterprise-basic-auth | ||
| image: quay-proxy.ci.openshift.org/openshift/ci:ci_content-mirror_latest | ||
| imagePullPolicy: Always | ||
| name: mirror | ||
| ports: | ||
| - containerPort: 8080 | ||
| name: http | ||
| resources: | ||
| requests: | ||
| memory: 500Mi | ||
| volumeMounts: | ||
| - mountPath: /tmp/repos | ||
| name: repos | ||
| readOnly: true | ||
| - mountPath: /tmp/key | ||
| name: key | ||
| readOnly: true | ||
| - mountPath: /tmp/mirror-enterprise-basic-auth | ||
| name: mirror-enterprise-basic-auth | ||
| readOnly: true | ||
| - mountPath: /tmp/cache | ||
| name: cache | ||
| workingDir: /tmp/repos | ||
| nodeSelector: | ||
| kubernetes.io/arch: amd64 | ||
| kubernetes.io/os: linux | ||
| volumes: | ||
| - configMap: | ||
| items: | ||
| - key: ocp-5.1-default.repo | ||
| path: ocp-5.1-default.repo | ||
| name: base-repos | ||
| name: repos | ||
| - name: key | ||
| secret: | ||
| secretName: mirror.openshift.com | ||
| - name: mirror-enterprise-basic-auth | ||
| secret: | ||
| defaultMode: 420 | ||
| secretName: mirror-enterprise-basic-auth | ||
| - emptyDir: {} | ||
| name: cache | ||
| - emptyDir: {} | ||
| name: run | ||
| --- |
Contributor
There was a problem hiding this comment.
Harden the generated content-mirror Deployment baseline before adding more 5.1 workloads.
These new Deployment specs still omit pod/container securityContext, explicit resource limits, and liveness/readiness probes. That keeps default privilege/runtime behavior across every newly generated mirror workload. Please fix this in hack/generators/release-controllers/content/art_rpm_mirroring_services.py and regenerate, rather than patching generated YAML directly.
As per coding guidelines, Kubernetes manifests should set non-root/no-privilege-escalation security context, drop unnecessary capabilities, define limits, and include readiness/liveness probes.
🧰 Tools
🪛 Checkov (3.2.530)
[medium] 28-104: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 28-104: Minimize the admission of root containers
(CKV_K8S_23)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@clusters/build-clusters/build-shared/release-controller/rpms-ocp-5.1.yaml`
around lines 28 - 104, The generated Kubernetes Deployment manifest lacks
security hardening including securityContext settings, explicit resource limits,
and health check probes. Rather than patching this YAML directly, update the
generator script in
hack/generators/release-controllers/content/art_rpm_mirroring_services.py to
include these configurations in the baseline template. Add a
non-root/no-privilege-escalation securityContext at both pod and container level
in the generated templates, define resource limits alongside the existing memory
requests, and include appropriate liveness and readiness probes for the mirror
service. After updating the generator, regenerate the YAML manifests to apply
these hardening measures across all newly generated mirror workloads.
Sources: Coding guidelines, Linters/SAST tools
Comment on lines
+1
to
+88
| [rhel-10.2-baseos] | ||
| name = rhel-10.2-baseos | ||
| baseurl = https://cdn.redhat.com/content/e4s/rhel10/10.2/x86_64/baseos/os/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| # https://projects.engineering.redhat.com/browse/RCM-65421 | ||
| sslclientkey = /tmp/key/rh-cdn.pem | ||
| sslclientcert = /tmp/key/rh-cdn.pem | ||
| failovermethod = priority | ||
| skip_if_unavailable = true | ||
|
|
||
| [rhel-10.2-appstream] | ||
| name = rhel-10.2-appstream | ||
| baseurl = https://cdn.redhat.com/content/e4s/rhel10/10.2/x86_64/appstream/os/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| # https://projects.engineering.redhat.com/browse/RCM-65421 | ||
| sslclientkey = /tmp/key/rh-cdn.pem | ||
| sslclientcert = /tmp/key/rh-cdn.pem | ||
| failovermethod = priority | ||
| skip_if_unavailable = true | ||
|
|
||
| [rhel-10.2-nfv] | ||
| name = rhel-10.2-nfv | ||
| baseurl = https://cdn.redhat.com/content/e4s/rhel10/10.2/x86_64/nfv/os/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| # https://projects.engineering.redhat.com/browse/RCM-65421 | ||
| sslclientkey = /tmp/key/rh-cdn.pem | ||
| sslclientcert = /tmp/key/rh-cdn.pem | ||
| failovermethod = priority | ||
| skip_if_unavailable = true | ||
|
|
||
| [rhel-10.2-highavailability] | ||
| name = rhel-10.2-highavailability | ||
| baseurl = https://cdn.redhat.com/content/e4s/rhel10/10.2/x86_64/highavailability/os/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| # https://projects.engineering.redhat.com/browse/RCM-65421 | ||
| sslclientkey = /tmp/key/rh-cdn.pem | ||
| sslclientcert = /tmp/key/rh-cdn.pem | ||
| failovermethod = priority | ||
| skip_if_unavailable = true | ||
|
|
||
| [rhel-10.2-fast-datapath] | ||
| name = rhel-10.2-fast-datapath | ||
| baseurl = https://cdn.redhat.com/content/dist/layered/rhel10/x86_64/fast-datapath/os/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| sslclientkey = /tmp/key/rh-cdn.pem | ||
| sslclientcert = /tmp/key/rh-cdn.pem | ||
| failovermethod = priority | ||
|
|
||
| [rhel-10.2-server-ose-5.0] | ||
| name = rhel-10.2-server-ose-5.0 | ||
| baseurl = https://openshift-mirror-list.ci-systems.workers.dev/enterprise/reposync/5.0/rhel-10-server-ose-rpms/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| username_file = /tmp/mirror-enterprise-basic-auth/username | ||
| password_file = /tmp/mirror-enterprise-basic-auth/password | ||
| failovermethod = priority | ||
| skip_if_unavailable = true | ||
|
|
||
| [rhel-10.2-early-kernel] | ||
| name = rhel-10.2-early-kernel | ||
| baseurl = https://openshift-mirror-list.ci-systems.workers.dev/enterprise/reposync/5.0/rhel-102-early-kernel/ | ||
| enabled = 1 | ||
| gpgkey = https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-release https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-beta https://mirror.ops.rhcloud.com/libra/keys/RPM-GPG-KEY-redhat-openshifthosted | ||
| sslverify = false | ||
| gpgcheck = 0 | ||
| username_file = /tmp/mirror-enterprise-basic-auth/username | ||
| password_file = /tmp/mirror-enterprise-basic-auth/password | ||
| failovermethod = priority | ||
| skip_if_unavailable = true | ||
| # For iptables, see https://github.com/coreos/rhel-coreos-config/issues/254 | ||
| includepkgs = kernel,kernel-*,iptables,iptables-* |
Contributor
There was a problem hiding this comment.
Critical security posture degradation: TLS and package verification disabled.
Every repository stanza disables both TLS certificate verification (sslverify = false) and RPM signature checking (gpgcheck = 0). This combination exposes the CI infrastructure to:
- MITM attacks that can inject malicious RPM content during transport
- Installation of unsigned or tampered packages without detection
- Compromise of build containers and test environments
If these settings are required due to infrastructure constraints (e.g., internal CA issues or mirror proxy behavior), document the justification in comments and implement compensating controls such as:
- Network-level restrictions limiting access to trusted mirror endpoints
- Post-installation integrity verification
- Isolated build environments with limited blast radius
Otherwise, enable both sslverify = 1 and gpgcheck = 1.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-services/release-controller/_repos/ocp-5.1-rhel102.repo` around lines 1
- 88, All repository stanzas in the file (rhel-10.2-baseos, rhel-10.2-appstream,
rhel-10.2-nfv, rhel-10.2-highavailability, rhel-10.2-fast-datapath,
rhel-10.2-server-ose-5.0, and rhel-10.2-early-kernel) have both sslverify
disabled and gpgcheck disabled, creating a critical security vulnerability.
Change sslverify from false to 1 and gpgcheck from 0 to 1 across all repository
stanzas. If these restrictive settings are required due to infrastructure
constraints such as internal CA issues, document the specific justification with
comments explaining why and what compensating controls are in place (such as
network-level access restrictions or post-installation integrity verification),
rather than leaving the security settings disabled without explanation.
Contributor
|
@stephenfin: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
Author
|
/hold Let's get #80542 in first, and we'll rebase this on top then to allow us to do rehearsals. |
openshift-ci
Bot
added
the
do-not-merge/hold
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for the EPEL repos, giving us an alternative to the OSP 17.1 repos that will eventually be removed.
Summary by CodeRabbit
This PR updates OpenShift CI infrastructure to stop relying on the deprecated OpenStack Package Repository (OSP) 17.1 for packages needed by installer workflows, and instead sources those dependencies from EPEL.
What changes in practice
ci-operatorconfiguration for OpenShift installer and origin has itsraw_stepslogic updated to pull repository metadata from internalbase-*-epel-*endpoints (EPEL 9 for OCP 4.x, EPEL 10 for OCP 5.x), writing them into the CI yum repo artifact locations used during builds.Service/Deploymentpairs are added forbase-4.x-epel-9andbase-5.0-epel-10/base-5.1-epel-10so CI can mirror and consume EPEL packages reliably.Service/Deploymentresources previously tied tobase-openstack-*are replaced with the corresponding non-EPEL “default” base resources, using*-default.repoconfig map keys.Supporting infrastructure updates
core-services/release-controller/_repos/for the relevant OCP versions, defining the EPEL 9/10[epel]stanzas with enabled GPG verification and correct base URLs.add_rpm_mirror_service()now supports anexclude_repo_keysoption.generate-release-controllers.pyuses this to compute EPEL-related exclusions for vsphere02.5.1.5.1release.Overall, the practical outcome is that OpenShift CI (installer/origin pipelines and RPM mirroring) switches its base package source to EPEL to maintain continuity as OSP 17.1 approaches end-of-life.