Skip to content

Validate PasswordSecret namespace matches OpenStackBaremetalSet namespace - #422

Merged
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
rabi:secret_namespace
Jul 27, 2026
Merged

Validate PasswordSecret namespace matches OpenStackBaremetalSet namespace#422
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
rabi:secret_namespace

Conversation

@rabi

@rabi rabi commented Jul 24, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

Add validation that PasswordSecret must be in the OpenStackBaremetalSet's own namespace (where the user already has RBAC access).

Extend the existing secret namespace validation to cover PasswordSecret and also enforce it on update (previously only on create).

jira: OSPRH-33377

@openshift-ci
openshift-ci Bot requested review from abays and steveb July 24, 2026 04:26
@rabi
Validate PasswordSecret namespace matches OpenStackBaremetalSet names…
f89c56d 
…pace

The PasswordSecret field (corev1.SecretReference) was not validated to
restrict its namespace. This could allow a user to reference a secret
in an arbitrary namespace and have the operator read it on their behalf.

Add validation that PasswordSecret must be in the OpenStackBaremetalSet's
own namespace (where the user already has RBAC access), since this secret
is only consumed by this operator and not passed to Metal3 directly.

Also enforce secret namespace validation on update (previously only on
create).

Signed-off-by: rabi <ramishra@redhat.com>
@rabi rabi changed the title Validate PasswordSecret namespace matches bmhNamespace Validate PasswordSecret namespace matches OpenStackBaremetalSet namespace Jul 24, 2026
@rabi
rabi force-pushed the secret_namespace branch from 8742c97 to f89c56d Compare July 24, 2026 04:33
@centosinfra-prod-github-app

centosinfra-prod-github-app Bot commented Jul 24, 2026

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/43fde2e0ab1142b490f964aba272daba

❌ openstack-baremetal-operator-content-provider FAILURE in 14m 14s
⚠️ openstack-baremetal-operator-crc-podified-edpm-baremetal SKIPPED Skipped due to failed job openstack-baremetal-operator-content-provider
⚠️ openstack-baremetal-operator-edpm-baremetal-minor-update SKIPPED Skipped due to failed job openstack-baremetal-operator-content-provider

@rabi

rabi commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

recheck

@centosinfra-prod-github-app

centosinfra-prod-github-app Bot commented Jul 24, 2026

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/27e9ff05199e44429845739426123d73

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 08m 15s
✔️ openstack-baremetal-operator-crc-podified-edpm-baremetal SUCCESS in 1h 48m 05s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update POST_FAILURE in 45m 59s

@rabi

rabi commented Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

recheck

@centosinfra-prod-github-app

centosinfra-prod-github-app Bot commented Jul 27, 2026

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/12ebdae2abaa4c028b7ca15d36cd8dc2

❌ openstack-baremetal-operator-content-provider FAILURE in 13m 57s
⚠️ openstack-baremetal-operator-crc-podified-edpm-baremetal SKIPPED Skipped due to failed job openstack-baremetal-operator-content-provider
⚠️ openstack-baremetal-operator-edpm-baremetal-minor-update SKIPPED Skipped due to failed job openstack-baremetal-operator-content-provider

@rabi

rabi commented Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

recheck

2026-07-27 07:43:08.505351 | controller |     - '    github.com/openstack-k8s-operators/openstack-baremetal-operator/tests/functional.init.func2.4.1()'
2026-07-27 07:43:08.505365 | controller |     - "    \t/home/zuul/src/github.com/openstack-k8s-operators/openstack-baremetal-operator/tests/functional/openstackprovisionserver_controller_test.go:126
2026-07-27 07:43:08.505370 | controller |       +0x445"
2026-07-27 07:43:08.505375 | controller |     - "\e[38;5;243m------------------------------\e[0m"
2026-07-27 07:43:08.505379 | controller |     - "\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m\e[38;5;10m•\e[0m"
2026-07-27 07:43:08.505384 | controller |     - ''
2026-07-27 07:43:08.505389 | controller |     - "\e[38;5;9m\e[1mSummarizing 1 Failure:\e[0m"
2026-07-27 07:43:08.505393 | controller |     - "  \e[38;5;9m[FAIL]\e[0m \e[0mProvisionServer Test \e[38;5;9m\e[1mwhen A ProvisionServer
2026-07-27 07:43:08.505398 | controller |       resource is created with pause annotation [BeforeEach] \e[0mshould resume reconciliation
2026-07-27 07:43:08.505403 | controller |       when pause annotation is removed\e[0m"
2026-07-27 07:43:08.505407 | controller |     - "  \e[38;5;243m/home/zuul/go/pkg/mod/github.com/openstack-k8s-operators/lib-common/modules/common@v0.6.1-0.20260724091355-a86f6d29e055/test/helpers/common.go:109\e[0m"

@openshift-ci openshift-ci Bot added the lgtm label Jul 27, 2026
@openshift-ci

openshift-ci Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rabi, steveb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit 5b306b0 into openstack-k8s-operators:main Jul 27, 2026
7 checks passed
@rabi

rabi commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

/cherry-pick 18-stable

@openshift-cherrypick-robot

openshift-cherrypick-robot commented Jul 29, 2026

Copy link
Copy Markdown

@rabi: new pull request created: #433

Details

In response to this:

/cherry-pick 18-stable

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Jul 29, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@steveb steveb steveb approved these changes
@abays abays Awaiting requested review from abays

Assignees

@steveb steveb

Labels

approved lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rabi @openshift-cherrypick-robot @steveb