From 8905835fd1d00ad407dbb7868bdfe98d3ce4285d Mon Sep 17 00:00:00 2001 From: Gregory Giguashvili Date: Wed, 22 Jul 2026 11:12:45 +0300 Subject: [PATCH 1/5] Fix CIS scenarios to use common configuration functions --- .../el10/periodics/el102-src@cis-lvl2.sh | 101 +----------------- .../el9/periodics/el98-src@cis-lvl2.sh | 56 +--------- 2 files changed, 6 insertions(+), 151 deletions(-) diff --git a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh index 835e59f2dc..eefe938562 100644 --- a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh +++ b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh @@ -11,93 +11,6 @@ TEST_EXECUTION_TIMEOUT=60m # for greenboot to finish when creating the VM. export SKIP_GREENBOOT=true -configure_microshift_mirror() { - local -r repo=$1 - - if [[ -z "${repo}" ]] ; then - return - fi - - if [[ ! "${repo}" =~ ^http ]]; then - return - fi - - local -r tmp_file=$(mktemp) - tee "${tmp_file}" >/dev/null </dev/null </dev/null </dev/null </dev/null </dev/null < Date: Wed, 22 Jul 2026 11:27:33 +0300 Subject: [PATCH 2/5] Refactor local MicroShift installation to be consistent with other scenarios --- .../el10/periodics/el102-src@cis-lvl2.sh | 31 ++++++------------- .../el9/periodics/el98-src@cis-lvl2.sh | 29 ++++++----------- test/suites/cis/validate-cis-lvl2.robot | 10 ++++-- 3 files changed, 27 insertions(+), 43 deletions(-) diff --git a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh index eefe938562..6aeca372cc 100644 --- a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh +++ b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh @@ -18,12 +18,10 @@ scenario_create_vms() { configure_vm_firewall host1 subscription_manager_register host1 - # Configure repositories for MicroShift and its dependencies. - # MicroShift is NOT installed here — the Robot suite installs it - # after CIS hardening so the scan reveals what MicroShift changes. - local -r source_reponame=$(basename "${LOCAL_REPO}") - local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}" - + # Configure repositories for MicroShift dependencies. + # MicroShift itself is NOT installed here — the Robot suite configures + # the local source repo and installs MicroShift after CIS hardening + # so the scan reveals what MicroShift changes. configure_rhocp_repo "${RHOCP_MINOR_Y}" "${MAJOR_VERSION}" "${MINOR_VERSION}" configure_rhocp_repo "${RHOCP_MINOR_Y_BETA}" "${MAJOR_VERSION}" "${MINOR_VERSION}" configure_rhocp_repo "${RHOCP_MINOR_Y1}" "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}" @@ -31,21 +29,6 @@ scenario_create_vms() { configure_microshift_mirror "${PREVIOUS_RELEASE_REPO}" run_command_on_vm host1 "sudo subscription-manager release --set 10.2" configure_fast_datapath_repo - - # Add the source RPM repo for locally-built MicroShift packages. - local -r tmp_file=$(mktemp) - tee "${tmp_file}" >/dev/null </dev/null < Date: Wed, 22 Jul 2026 11:30:11 +0300 Subject: [PATCH 3/5] Define TEST_RANDOMIZATION consistently with other scenarios --- test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh | 5 +++-- test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh index 6aeca372cc..f420116ef3 100644 --- a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh +++ b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh @@ -11,6 +11,9 @@ TEST_EXECUTION_TIMEOUT=60m # for greenboot to finish when creating the VM. export SKIP_GREENBOOT=true +# CIS tests must run in order: harden, scan baseline, install, scan post. +export TEST_RANDOMIZATION=none + scenario_create_vms() { prepare_kickstart host1 kickstart-liveimg.ks.template "" launch_vm rhel102-installer @@ -40,8 +43,6 @@ scenario_run_tests() { local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}" local -r target_version=$(local_rpm_version) - # shellcheck disable=SC2034 # used elsewhere - TEST_RANDOMIZATION=none run_tests host1 \ --variable "SOURCE_REPO_URL:${source_repo_url}" \ --variable "TARGET_VERSION:${target_version}" \ diff --git a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh index 64b649dbf2..0740bbace5 100644 --- a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh +++ b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh @@ -11,6 +11,9 @@ TEST_EXECUTION_TIMEOUT=60m # for greenboot to finish when creating the VM. export SKIP_GREENBOOT=true +# CIS tests must run in order: harden, scan baseline, install, scan post. +export TEST_RANDOMIZATION=none + scenario_create_vms() { prepare_kickstart host1 kickstart-liveimg.ks.template "" launch_vm rhel98-installer @@ -40,8 +43,6 @@ scenario_run_tests() { local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}" local -r target_version=$(local_rpm_version) - # shellcheck disable=SC2034 # used elsewhere - TEST_RANDOMIZATION=none run_tests host1 \ --variable "SOURCE_REPO_URL:${source_repo_url}" \ --variable "TARGET_VERSION:${target_version}" \ From 77a1e1811ffb5c8d87858555529fb0faddc7a5f1 Mon Sep 17 00:00:00 2001 From: Gregory Giguashvili Date: Wed, 22 Jul 2026 13:27:54 +0300 Subject: [PATCH 4/5] CIS variable passed consistently to RF tests --- .../el9/periodics/el98-src@cis-lvl2.sh | 3 +++ test/suites/cis/validate-cis-lvl2.robot | 18 +++++++++++++----- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh index 0740bbace5..4d1f2fcc19 100644 --- a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh +++ b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh @@ -46,5 +46,8 @@ scenario_run_tests() { run_tests host1 \ --variable "SOURCE_REPO_URL:${source_repo_url}" \ --variable "TARGET_VERSION:${target_version}" \ + --variable "SCAP_DS_FILE:/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml" \ + --variable "CIS_REQUIREMENTS_FILE:cis-requirements-el9.yml" \ + --variable "CIS_HARDEN_FILE:cis-harden-el9.yml" \ suites/cis/ } diff --git a/test/suites/cis/validate-cis-lvl2.robot b/test/suites/cis/validate-cis-lvl2.robot index 3abadee402..4467d4360b 100644 --- a/test/suites/cis/validate-cis-lvl2.robot +++ b/test/suites/cis/validate-cis-lvl2.robot @@ -29,9 +29,9 @@ ${OSCAP_BASELINE_FILE} /tmp/cis-baseline-results.xml ${OSCAP_POST_FILE} /tmp/cis-post-results.xml ${OSCAP_REPORT_FILE} /tmp/cis-post-report.html ${OSCAP_PROFILE} xccdf_org.ssgproject.content_profile_cis -${SCAP_DS_FILE} /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml -${CIS_REQUIREMENTS_FILE} cis-requirements-el9.yml -${CIS_HARDEN_FILE} cis-harden-el9.yml +${SCAP_DS_FILE} ${EMPTY} +${CIS_REQUIREMENTS_FILE} ${EMPTY} +${CIS_HARDEN_FILE} ${EMPTY} # Rules that MicroShift is known to cause. Any new failure outside this # set means MicroShift introduced an unexpected CIS regression. @@ -78,7 +78,7 @@ Smoke Test With Route Setup [Documentation] Harden the system, run a baseline scan, install MicroShift, ... run a post-install scan, and prepare for functional tests. - Check Required Env Variables + Validate Required Variables Login MicroShift Host Harden And Scan Baseline Install And Enable MicroShift @@ -88,6 +88,15 @@ Setup Run CIS Scan ${OSCAP_POST_FILE} oscap_report=${OSCAP_REPORT_FILE} Setup Kubeconfig +Validate Required Variables + [Documentation] Fail fast if any required variable is missing. + Check Required Env Variables + Should Not Be Empty ${SOURCE_REPO_URL} SOURCE_REPO_URL variable is required + Should Not Be Empty ${TARGET_VERSION} TARGET_VERSION variable is required + Should Not Be Empty ${SCAP_DS_FILE} SCAP_DS_FILE variable is required + Should Not Be Empty ${CIS_REQUIREMENTS_FILE} CIS_REQUIREMENTS_FILE variable is required + Should Not Be Empty ${CIS_HARDEN_FILE} CIS_HARDEN_FILE variable is required + Teardown [Documentation] Archive scan artifacts and close SSH Run Keyword And Ignore Error @@ -131,7 +140,6 @@ Install And Enable MicroShift ... reveals what MicroShift changes to CIS compliance. ... The local source repo is created after hardening, so the ... repo-level gpgcheck=0 is preserved (not overwritten by CIS). - Should Not Be Empty ${SOURCE_REPO_URL} SOURCE_REPO_URL variable is required Install MicroShift RPM Packages From Repo ${SOURCE_REPO_URL} ${TARGET_VERSION} Command Should Work systemctl enable microshift From 158e97cb23c2aeb31745ed8cc65d268986f1e068 Mon Sep 17 00:00:00 2001 From: Gregory Giguashvili Date: Wed, 22 Jul 2026 13:34:59 +0300 Subject: [PATCH 5/5] Fix MicroShift RPM install for CIS tests --- test/resources/microshift-rpm.resource | 13 +++++++++---- test/suites/cis/validate-cis-lvl2.robot | 7 ++++--- test/suites/rpm/install.robot | 5 ----- 3 files changed, 13 insertions(+), 12 deletions(-) diff --git a/test/resources/microshift-rpm.resource b/test/resources/microshift-rpm.resource index 3335a64ca4..d1587b2e0f 100644 --- a/test/resources/microshift-rpm.resource +++ b/test/resources/microshift-rpm.resource @@ -14,13 +14,13 @@ ${REPO_FILE_NAME} "/etc/yum.repos.d/microshift-local.repo" *** Keywords *** Install MicroShift RPM Packages From System Repo [Documentation] Installs MicroShift RPM packages from a system repository - [Arguments] ${version} ${check_warnings}=True + [Arguments] ${version} ${check_warnings}=True ${extra_args}=${EMPTY} # Allow erasing because update may require a new version of openvswitch # and major versions of openvswitch are separate packages that obsolete # each other. Override default timeout to 2 min (-R 2) because the transmission rate sometimes dips below the # minrate threshold. This is not a fatal error and should not fail the test, so raising the timeout only helps to # keep logs clean of flakey error messages. - ${stdout}= Command Should Work dnf install -q -R 2 -y --allowerasing 'microshift-${version}' + ${stdout}= Command Should Work dnf install -q -R 2 -y --allowerasing ${extra_args} 'microshift-${version}' IF ${check_warnings} # Look for all warnings and errors before testing so that the log # shows the output for both. @@ -32,11 +32,16 @@ Install MicroShift RPM Packages From System Repo Install MicroShift RPM Packages From Repo [Documentation] Installs MicroShift RPM packages from the specified URL - [Arguments] ${repo_url} ${version} + [Arguments] ${repo_url} ${version} ${extra_args}=${EMPTY} Configure MicroShift Repository ${repo_url} - Install MicroShift RPM Packages From System Repo ${version} + Install MicroShift RPM Packages From System Repo ${version} extra_args=${extra_args} Unconfigure MicroShift Repository +Install Third Party Packages With Warnings + [Documentation] Install these separately to avoid having warnings + ... show up in the warning check when installing MicroShift. + Command Should Work dnf install -y NetworkManager-ovs containers-common + Configure MicroShift Repository [Documentation] Sets up repository [Arguments] ${repo_url} diff --git a/test/suites/cis/validate-cis-lvl2.robot b/test/suites/cis/validate-cis-lvl2.robot index 4467d4360b..6ce2b2213a 100644 --- a/test/suites/cis/validate-cis-lvl2.robot +++ b/test/suites/cis/validate-cis-lvl2.robot @@ -138,9 +138,10 @@ Reboot And Reconnect Install And Enable MicroShift [Documentation] Install MicroShift after CIS hardening so the scan ... reveals what MicroShift changes to CIS compliance. - ... The local source repo is created after hardening, so the - ... repo-level gpgcheck=0 is preserved (not overwritten by CIS). - Install MicroShift RPM Packages From Repo ${SOURCE_REPO_URL} ${TARGET_VERSION} + ... Uses --nogpgcheck because CIS hardening forces gpgcheck=1 + ... on dependency repos that contain unsigned beta RPMs. + Install Third Party Packages With Warnings + Install MicroShift RPM Packages From Repo ${SOURCE_REPO_URL} ${TARGET_VERSION} extra_args=--nogpgcheck Command Should Work systemctl enable microshift Run Hardening Playbook diff --git a/test/suites/rpm/install.robot b/test/suites/rpm/install.robot index 8eb93793be..805d8fd3d1 100644 --- a/test/suites/rpm/install.robot +++ b/test/suites/rpm/install.robot @@ -58,8 +58,3 @@ Setup Teardown [Documentation] Test suite teardown Logout MicroShift Host - -Install Third Party Packages With Warnings - [Documentation] Install these separately to avoid having warnings - ... show up in the warning check when installing MicroShift. - Command Should Work dnf install -y NetworkManager-ovs containers-common