OCPBUGS-83412: set catalogsource spec.grpcpodconfig.scc: restricted for all non-legacy cases

[grokspawn]

Set explicit SCC for all catsrc specs used for non-legacy cases (defined as where the opm version inside does not support PSA labeling concerns for OCP... pre 1.21), since this can cause a PodSecurityViolation event to get logged.
Since these specs are used in namespaces other than openshift-* naming but do not actually test legacy pre-PSA-support behavior, best practice is to define the SCC so that OLM will set appropriate labels to satisfy OCP PSA audits.

Summary by CodeRabbit

• Security

  • CatalogSource gRPC pods now use a restricted security context by default across supported deployment templates.
  • Improves workload isolation and aligns CatalogSource deployments with stricter security requirements.

• Tests

  • Updated CatalogSource test scenarios to validate deployments using the restricted security configuration.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6f0c68a9-d247-483d-a8b8-0548385328e5

📥 Commits

Reviewing files that changed from the base of the PR and between 730f1c5 and 7f0ebd4.

📒 Files selected for processing (7)

• tests-extension/test/qe/testdata/olm/catalogsource-image-cacheless.yaml
• tests-extension/test/qe/testdata/olm/catalogsource-image-extract.yaml
• tests-extension/test/qe/testdata/olm/catalogsource-image-incorrect-updatestrategy.yaml
• tests-extension/test/qe/testdata/olm/catalogsource-image.yaml
• tests-extension/test/qe/testdata/olm/catalogsource-opm.yaml
• tests-extension/test/qe/testdata/olm/cs-image-template.yaml
• tests-extension/test/qe/testdata/olm/cs-without-interval.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The CatalogSource test templates now configure their gRPC pods with the restricted security context.

Changes

CatalogSource security context configuration

Layer / File(s)	Summary
Configure restricted gRPC pod security contexts tests-extension/test/qe/testdata/olm/catalogsource-*.yaml, tests-extension/test/qe/testdata/olm/cs-*.yaml	Seven CatalogSource templates set grpcPodConfig.securityContextConfig to restricted.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 7f0eb

This localized test-data change sets an explicit security context for non-legacy catalog sources; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only seven YAML CatalogSource templates. Each change adds the static value securityContextConfig: restricted; no It, Describe, Context, or When call changes. The tem…
Test Structure And Quality	✅ Passed	PASS: The commit changes only seven YAML CatalogSource fixtures, with ten additions of grpcPodConfig.securityContextConfig: restricted. git diff HEAD^ HEAD shows no changed Go files or Ginkgo cons…
Microshift Test Compatibility	✅ Passed	PASS — the pull request changes only seven existing YAML CatalogSource fixtures. The diff adds grpcPodConfig.securityContextConfig: restricted and adds no new Ginkgo declarations, test names, API re…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only seven YAML CatalogSource fixtures under tests-extension/test/qe/testdata/olm/. The exact diff adds grpcPodConfig.securityContextConfig: restricted; it adds no G…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request adds only spec.grpcPodConfig.securityContextConfig: restricted to seven CatalogSource test templates. The committed diff introduces no anti-affinity, topology spread constrain…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request changes only seven YAML CatalogSource test-data files. The added lines set securityContextConfig: restricted; they add no executable code, logging, stdout writes, or suite set…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only seven existing YAML CatalogSource fixtures. The diff adds grpcPodConfig.securityContextConfig: restricted and no Ginkgo test code, IPv4 values, or external connec…
No-Weak-Crypto	✅ Passed	PASS. The parent-to-HEAD diff changes only seven YAML CatalogSource fixtures. Each added line sets grpcPodConfig.securityContextConfig: restricted; no weak cryptography, custom crypto implementation…
Container-Privileges	✅ Passed	PASS: The commit adds only grpcPodConfig.securityContextConfig: restricted to seven CatalogSource templates. The complete added-line scan found no privileged: true, host namespace settings, `SYS_A…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request only adds the literal securityContextConfig: restricted field to seven YAML CatalogSource templates. The diff adds no logging code or log content. Existing ${SECRET} referen…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the bug reference and the main change: setting the CatalogSource gRPC pod security configuration to restricted for non-legacy cases.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The pull request changes only seven YAML CatalogSource templates. Each change adds the static value securityContextConfig: restricted; no It, Describe, Context, or When call changes. The templates are consumed by tests with existing static Ginkgo titles, and the new field cannot introduce dynamic title content. No stated test-name failure condition is introduced.

Full details: Test Structure And Quality

Explanation

PASS: The commit changes only seven YAML CatalogSource fixtures, with ten additions of grpcPodConfig.securityContextConfig: restricted. git diff HEAD^ HEAD shows no changed Go files or Ginkgo constructs. Therefore, the stated requirements for It-block responsibility, resource cleanup, wait timeouts, assertion messages, and Ginkgo test patterns are not implicated by this pull request.

Full details: Microshift Test Compatibility

Explanation

PASS — the pull request changes only seven existing YAML CatalogSource fixtures. The diff adds grpcPodConfig.securityContextConfig: restricted and adds no new Ginkgo declarations, test names, API references, namespaces, or unsupported assumptions. The MicroShift Test Compatibility check is therefore not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only seven YAML CatalogSource fixtures under tests-extension/test/qe/testdata/olm/. The exact diff adds grpcPodConfig.securityContextConfig: restricted; it adds no Go files and no new It(), Describe(), Context(), or When() declarations. Therefore, the SNO multi-node test compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request adds only spec.grpcPodConfig.securityContextConfig: restricted to seven CatalogSource test templates. The committed diff introduces no anti-affinity, topology spread constraints, replica changes, PDBs, control-plane or worker selectors, arbiter tolerations, or other topology-dependent scheduling rules. The reconciler applies this field through addSecurityContext to pod security-context fields; scheduling overrides such as nodeSelector, tolerations, and affinity are separate fields. The existing architecture nodeSelector in catalogsource-image.yaml is unchanged.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request changes only seven YAML CatalogSource test-data files. The added lines set securityContextConfig: restricted; they add no executable code, logging, stdout writes, or suite setup. Therefore, the OTE binary stdout contract is not affected.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only seven existing YAML CatalogSource fixtures. The diff adds grpcPodConfig.securityContextConfig: restricted and no Ginkgo test code, IPv4 values, or external connectivity. No explicit failure condition applies.

Full details: No-Weak-Crypto

Explanation

PASS. The parent-to-HEAD diff changes only seven YAML CatalogSource fixtures. Each added line sets grpcPodConfig.securityContextConfig: restricted; no weak cryptography, custom crypto implementation, or secret/token comparison is introduced.

Full details: Container-Privileges

Explanation

PASS: The commit adds only grpcPodConfig.securityContextConfig: restricted to seven CatalogSource templates. The complete added-line scan found no privileged: true, host namespace settings, SYS_ADMIN, allowPrivilegeEscalation: true, or root settings. The added restricted configuration does not match any stated failure condition.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request only adds the literal securityContextConfig: restricted field to seven YAML CatalogSource templates. The diff adds no logging code or log content. Existing ${SECRET} references are unchanged template inputs and are not logged by this change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: grokspawn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [grokspawn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@grokspawn: This pull request references Jira Issue OCPBUGS-83412, which is invalid:

• expected the bug to target either version "5.1.0." or "openshift-5.1.0.", but it targets "5.0.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Set explicit SCC for all catsrc specs used for non-legacy cases (defined as where the opm version inside does not support PSA labeling concerns for OCP... pre 1.21), since this can cause a PodSecurityViolation event to get logged.
Since these specs are used in namespaces other than openshift-* naming but do not actually test legacy pre-PSA-support behavior, best practice is to define the SCC so that OLM will set appropriate labels to satisfy OCP PSA audits.

Summary by CodeRabbit

• Security

• CatalogSource gRPC pods now use a restricted security context by default across supported deployment templates.

• Improves workload isolation and aligns CatalogSource deployments with stricter security requirements.

• Tests

• Updated CatalogSource test scenarios to validate deployments using the restricted security configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[grokspawn]

/retest-required

[grokspawn]

/retest prow/unit-olm

[grokspawn]

/retest
(not sure if my previous command worked or was ignored, but there's lots of pressure on app.ci right now, so I'll belt-and-suspenders this command)

[tmshort]

/retest

[tmshort]

/lgtm
Some whitespace changes, but they're fixing things.

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-olmv0-ext

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-ovn
/test e2e-upgrade

[sdodson]

/verified later

[openshift-ci-robot]

@sdodson: /verified later <@username> requires at least one GitHub @username to be specified (it can be a comma delimited list). It indicates the engineer(s) that will be performing the verification. See https://docs.ci.openshift.org/docs/architecture/jira/#premerge-verification for more information.

Details

In response to this:

/verified later

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sdodson]

/retest-required

[sdodson]

/verified later by @sdodson

[openshift-ci-robot]

@sdodson: Only users can be targets for the /verified later command.

Details

In response to this:

/verified later by @sdodson

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sdodson]

/verified later @sdodson

[openshift-ci-robot]

@sdodson: This PR has been marked to be verified later by @sdodson.

Details

In response to this:

/verified later @sdodson

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sdodson]

/tide refresh

[openshift-ci]

@grokspawn: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@grokspawn: Jira Issue OCPBUGS-83412: Some pull requests linked via external trackers have merged:

The following pull request, linked via external tracker, has not merged:

• openshift/api#3002 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-83412 has not been moved to the MODIFIED state.

This PR is marked as verified-later. Jira issue(s) in the title of this PR will require post-merge verification. After testing, it must be manually moved to the VERIFIED state.

Details

In response to this:

Set explicit SCC for all catsrc specs used for non-legacy cases (defined as where the opm version inside does not support PSA labeling concerns for OCP... pre 1.21), since this can cause a PodSecurityViolation event to get logged.
Since these specs are used in namespaces other than openshift-* naming but do not actually test legacy pre-PSA-support behavior, best practice is to define the SCC so that OLM will set appropriate labels to satisfy OCP PSA audits.

Summary by CodeRabbit

• Security

• CatalogSource gRPC pods now use a restricted security context by default across supported deployment templates.

• Improves workload isolation and aligns CatalogSource deployments with stricter security requirements.

• Tests

• Updated CatalogSource test scenarios to validate deployments using the restricted security configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sdodson]

/cherry-pick release-5.0

[openshift-cherrypick-robot]

@sdodson: new pull request created: #1360

Details

In response to this:

/cherry-pick release-5.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.