OTA-2106: drop NetworkCheck (SDN gone, proxy data unused) - #1442
OTA-2106: drop NetworkCheck (SDN gone, proxy data unused)#1442jrangelramos wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@jrangelramos: This pull request references OTA-2025 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe network readiness check and its resource identifiers were removed. Readiness fixtures and tests no longer register network resources or expect the ChangesReadiness network check removal
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The PR removes the unused NetworkCheck readiness data and its associated references, eliminating the proxy-credential exposure surface. No actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
Full details: Stable And Deterministic Test NamesExplanation PASS. The pull-request diff removes one static Ginkgo title and adds no Ginkgo test title. The remaining Full details: Test Structure And QualityExplanation PASS: The only changed Ginkgo test is Full details: Microshift Test CompatibilityExplanation PASS: The PR adds no new Ginkgo e2e tests. The diff only removes the existing readiness Full details: Single Node Openshift (Sno) Test CompatibilityExplanation PASS. The pull request adds no Ginkgo e2e tests. The diff removes one existing Full details: Topology-Aware Scheduling CompatibilityExplanation PASS: The pull request does not add or modify deployment manifests, operator scheduling code, or controllers. The exact diff contains only removal of Full details: Ote Binary Stdout ContractExplanation PASS. The only process-level code change adds a test name to Full details: Ipv6 And Disconnected Network Test CompatibilityExplanation PASS. The pull request adds no Ginkgo e2e tests or test constructors. It removes one readiness test and updates existing test expectations. The added lines introduce no IPv4 literals or external connectivity requirements. Full details: No-Weak-CryptoExplanation PASS: The commit only removes Full details: Container-PrivilegesExplanation PASS. The pull request diff contains no Full details: No-Sensitive-Data-In-LogsExplanation PASS. The pull request adds no logging statements and changes only readiness registration, tests, fixtures, test metadata, and an obsolete-test entry. The exact diff shows deletion of ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/readiness/checks_test.go`:
- Around line 742-746: Update the proxy redaction test around the https_proxy
assertion to always compare proxy["https_proxy"] with tt.wantHTTPS, including
empty expectations. Extend the test cases with the hostless proxy input
http:admin:s3cret@proxy.corp:8080 and expect [configured], preserving coverage
of fail-closed redaction.
In `@pkg/readiness/network.go`:
- Around line 81-86: Update the proxy URL sanitization flow after url.Parse and
before returning u.String() to validate that the parsed URL has both a scheme
and host; return "[configured]" when either is missing. Preserve removing u.User
before returning valid sanitized URLs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: c640fbe3-6a62-4dbc-a304-8f5b15936e70
📒 Files selected for processing (2)
pkg/readiness/checks_test.gopkg/readiness/network.go
f0b656d to
8d4a5a1
Compare
8d4a5a1 to
09cdec7
Compare
|
Scheduling tests matching the |
|
/retest-required |
| "http_proxy": NestedString(proxy.Object, "spec", "httpProxy"), | ||
| "https_proxy": NestedString(proxy.Object, "spec", "httpsProxy"), | ||
| "http_proxy": redactProxyURL(NestedString(proxy.Object, "spec", "httpProxy")), | ||
| "https_proxy": redactProxyURL(NestedString(proxy.Object, "spec", "httpsProxy")), |
There was a problem hiding this comment.
Seems like a good time to revisit pkg/readiness/network.go as a whole (CC @harche). It currently has:
-
An SDN warning, but SDN is gone since 4.17, so... no point in a 5.0 CVO looking around for it, right?
-
Embedding the Proxy config in the output, but:
agentic-skills$ git grep -i proxy origin/main -- cluster-update ...no hits...
So maybe we can just drop that whole check, like we dropped the CRD check in #1415?
|
/retitle "OTA-2106: Redact proxy URL credentials from AgenticRun readiness data" |
openshift-ci
Bot
changed the title
|
@jrangelramos: This pull request references OTA-2106 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
09cdec7 to
f6bd3dd
Compare
|
/retitle "OTA-2106: drop NetworkCheck (SDN gone, proxy data unused)" |
openshift-ci
Bot
changed the title
|
@jrangelramos: This pull request references OTA-2106 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
openshift-ci
Bot
added
the
approved
|
/retest |
|
/verified by @jrangelramos Before $ oc get agenticrun ota-5-0-0-ec-5-to-5-0-1 -o yaml | grep '```json' -A1 | tail -1 | jq '.checks["network"]'
{
"_elapsed_seconds": 2.79701431,
"_status": "ok",
"network_type": "OVNKubernetes",
"proxy": {
"http_proxy": "",
"https_proxy": "",
"no_proxy": ""
},
"summary": {
"is_sdn": false,
"network_type": "OVNKubernetes"
},
"tls_profile": "Intermediate"
}After $ oc get agenticrun ota-5-0-0-ec-5-to-5-0-1 -o yaml | grep '```json' -A1 | tail -1 | jq '.checks["network"]'
null |
openshift-ci-robot
added
the
verified
|
@jrangelramos: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
f6bd3dd to
8bd133a
Compare
openshift-ci-robot
removed
the
verified
|
@jrangelramos: This pull request references OTA-2106 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
The NetworkCheck gathered SDN status, proxy configuration, and TLS profile from the cluster. SDN is gone since 4.17 (irrelevant for a 5.0 CVO), proxy URLs are not consumed by cluster-update tooling, and embedding them in readiness data risks leaking credentials to the LLM provider (OTA-2106). Remove the entire check rather than just redacting proxy credentials — data that is never collected cannot leak. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8bd133a to
6bf5c89
Compare
jrangelramos
changed the title
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ankitathomas, jrangelramos, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/verified by @jrangelramos |
openshift-ci-robot
added
the
verified
|
@jrangelramos: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jrangelramos: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
5 participants
Summary
user:password@host). TheNetworkCheckreadiness collector forwarded these unsanitized into the AgenticRun request sent to the LLM provider.redactProxyURL()to strip the userinfo component vianet/url.Parsebefore including proxy URLs in readiness output. Falls back to[configured]if parsing fails (fail-closed).no_proxyis unchanged — it's a host list, not a URL.Test plan
TestNetworkCheck_ProxyCredentialRedaction: credentials stripped, no-credentials passthrough, empty stringUpdate: NetworkCheck removed entirely
Per review feedback, the initial redaction approach was replaced by dropping
the
NetworkCheckaltogether:git grep -i proxy -- cluster-updatereturns no hits — nothing consumes this dataData that is never collected cannot leak. This fully addresses OTA-2106 by
eliminating the exposure surface rather than sanitizing it.
What was removed
pkg/readiness/network.go(NetworkCheck + redactProxyURL)GVRNetwork,GVRProxy,GVRAPIServerdeclarations🤖 Generated with Claude Code
Summary by CodeRabbit
Changes