CMP-4656: Wait for TailoredProfile to be READY before creating ScanSettingBinding - #86
Merged
taimurhafeez merged 2 commits intoSep 2, 2026
Conversation
TestPlatformCompliance and TestNodeCompliance create a TailoredProfile and
then immediately create a ScanSettingBinding that references it. The
compliance-operator's ScanSettingBinding controller can fail to generate a
ComplianceSuite when it reconciles a binding whose referenced TailoredProfile
has not finished rendering (i.e. has not reached the READY state). When that
happens the suite is never created and the test polls for it until it times
out:
the Compliance Suite 'platform-scan-binding' didn't get to DONE phase:
compliancesuites.compliance.openshift.io "platform-scan-binding" not found
This is an intermittent, timing-dependent failure: whether the suite is
created depends on whether the TailoredProfile happens to be rendered before
the binding is reconciled.
Wait for each TailoredProfile to reach READY at the end of
createTailoredProfile, so no caller can create a ScanSettingBinding against an
unrendered profile. The wait fails fast (via backoff.Permanent) with the
operator's error message if the profile lands in ERROR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
yuumasato
changed the title
The platform TailoredProfile is built from every Platform rule in the ocp4
bundle. Newer content ships CEL-typed platform rules alongside the OpenSCAP
ones, and the compliance-operator rejects a TailoredProfile that mixes the two:
TailoredProfile cannot mix CEL-typed Rules with OpenSCAP Rules
The profile then lands in ERROR, no ComplianceSuite is generated, and the test
times out (now surfaced immediately by the READY wait added in the previous
commit).
Filter out CEL-typed rules in findPlatformRules so the platform tailored
profile only contains OpenSCAP rules. CEL checks are Platform-only, so the node
rule selection is unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
taimurhafeez
approved these changes
Sep 2, 2026
|
@yuumasato: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
TestPlatformComplianceandTestNodeCompliancecreate a TailoredProfile and then immediately create a ScanSettingBinding that references it. Two issues in this path made thee2e-aws-openshift-platform-compliancepresubmit hang for the full ~30-minute wait and then fail, on PRs that don't touch this code at all:ComplianceSuitewhen it reconciles a binding whose referenced TailoredProfile has not finished rendering. The suite is then never created and the test polls until timeout:ocp4bundle, and newer content ships CEL-typed platform rules alongside the OpenSCAP ones. The operator rejects that:Fix
createTailoredProfilenow waits for the TailoredProfile to reachREADYbefore returning, so no caller (platform,ocp-node,rhcos-node) creates a binding against an unrendered profile. It fails fast (viabackoff.Permanent) with the operator'sErrorMessageif the profile lands inERROR— this is what turned the silent 30-minute timeout into an immediate, diagnostic failure that revealed issue Skip IdP setting on profiles with "moderate" prefix #2.findPlatformRulesnow filters out CEL-typed rules, so the platform tailored profile contains only OpenSCAP rules. CEL checks are Platform-only, so node rule selection is unaffected.Notes
WaitForTailoredProfileReadyhelper, but only its new variable-customization test calls it — the existing platform/node flow still creates the binding without waiting, so that PR does not close this race. If CMP-3830: Added testing TailoredProfile variable customization #76 merges first, these can be consolidated onto a single helper.e2e-aws-openshift-node-compliancejob has a separate failure (a MachineConfigPool rollout timeout,master (Updated: 1/3, Unavailable: 1)) that is unrelated to this race and not addressed here.Jira: CMP-4656
🤖 Generated with Claude Code