Skip to content

CNTRLPLANE-3615: add tls security profile configuration for the etcd - #8871

Merged
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
ricardomaraschini:CNTRLPLANE-3615-2
Jul 20, 2026
Merged

CNTRLPLANE-3615: add tls security profile configuration for the etcd#8871
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
ricardomaraschini:CNTRLPLANE-3615-2

Conversation

@ricardomaraschini

@ricardomaraschini ricardomaraschini commented Jun 30, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

Configure the etcd to use the TLS security profile settings from the HostedCluster resource. This ensures the etcd uses ciphers and minimum TLS version that match the cluster's security requirements.

Note

This implementation is largely inspired by similar implemenatation on https://github.com/openshift/cluster-etcd-operator. There we also have a minimal accepted TLS version of v1.2. You can validate this implementation against the one found in https://github.com/openshift/cluster-etcd-operator/blob/main/pkg/etcdenvvar/etcd_env.go.

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Summary by CodeRabbit

  • New Features

    • Etcd configuration now derives the minimum TLS version from the HostedControlPlane TLS security profile, and applies listener cipher suites when supported by the effective TLS settings.

  • Bug Fixes

    • Unsupported or invalid cipher suite entries are automatically filtered out, preventing them from being applied to etcd, metrics, or health checks.

  • Tests

    • Expanded coverage for TLS minimum version mapping and conditional cipher-suite propagation across etcd, metrics, and health checks.
    • Added a new fixture scenario for the default feature set using the Modern TLS profile.

@openshift-merge-bot

openshift-merge-bot Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@ricardomaraschini ricardomaraschini changed the title Cntrlplane 3615 2 CNTRLPLANE-3615: add tls security profile configuration for the etcd Jun 30, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 30, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 30, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@ricardomaraschini: This pull request references CNTRLPLANE-3615 which is a valid jira issue.

Details

In response to this:

What this PR does / why we need it:

Configure the etcd to use the TLS security profile settings from the HostedCluster resource. This ensures the etcd uses ciphers and minimum TLS version that match the cluster's security requirements.

[!NOTE]
This implementation is largely inspired by similar implemenatation on https://github.com/openshift/cluster-etcd-operator. There we also have a minimal accepted TLS version of v1.2. You can validate this implementation against the one found in https://github.com/openshift/cluster-etcd-operator/blob/main/pkg/etcdenvvar/etcd_env.go.

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The etcd StatefulSet now derives minimum TLS version and cipher-suite settings from the HostedControlPlane TLS security profile. The main etcd container always sets ETCD_TLS_MIN_VERSION and conditionally sets ETCD_CIPHER_SUITES. The metrics and healthz containers receive matching TLS minimum version and cipher-suite flags. Tests cover cipher-suite filtering, TLS version mapping, StatefulSet rendering, and a Modern TLS fixture.

Sequence Diagram(s)

sequenceDiagram
  participant HostedControlPlane
  participant adaptStatefulSet
  participant SupportedEtcdCipherSuites
  participant StatefulSet
  HostedControlPlane->>adaptStatefulSet: TLSSecurityProfile
  adaptStatefulSet->>SupportedEtcdCipherSuites: profile cipher suites
  SupportedEtcdCipherSuites-->>adaptStatefulSet: filtered suites
  adaptStatefulSet->>StatefulSet: set ETCD_TLS_MIN_VERSION
  opt suites present
    adaptStatefulSet->>StatefulSet: set ETCD_CIPHER_SUITES
    adaptStatefulSet->>StatefulSet: add --listen-cipher-suites
  end
  adaptStatefulSet->>StatefulSet: add TLS min-version flags
Loading
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release and removed do-not-merge/needs-area labels Jun 30, 2026
@openshift-ci
openshift-ci Bot requested review from clebs and sjenning June 30, 2026 11:10
coderabbitai[bot]
coderabbitai Bot reviewed Jun 30, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
support/config/cipher.go (1)

81-90: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Optional: preallocate allowedCiphers capacity.

The result is bounded by len(cipherSuites); preallocating avoids repeated reallocations on the append path.

♻️ Proposed refactor 
-func SupportedEtcdCipherSuites(cipherSuites []string) []string {
-	allowedCiphers := []string{}
+func SupportedEtcdCipherSuites(cipherSuites []string) []string {
+	allowedCiphers := make([]string, 0, len(cipherSuites))
 	for _, cipher := range cipherSuites {
 		if _, ok := tlsutil.GetCipherSuite(cipher); !ok {
 			continue
 		}
 		allowedCiphers = append(allowedCiphers, cipher)
 	}
 	return allowedCiphers
 }

Note: keeping the non-nil empty initializer is intentional so callers/tests can distinguish "filtered to empty" — preserve that semantic.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@support/config/cipher.go` around lines 81 - 90, The SupportedEtcdCipherSuites
function builds allowedCiphers with repeated appends even though the result is
bounded by len(cipherSuites). Update the initializer in
SupportedEtcdCipherSuites to preallocate capacity while preserving the non-nil
empty slice semantic, so callers/tests still distinguish a filtered-empty result
from nil.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@support/config/cipher.go`:
- Around line 81-90: The SupportedEtcdCipherSuites function builds
allowedCiphers with repeated appends even though the result is bounded by
len(cipherSuites). Update the initializer in SupportedEtcdCipherSuites to
preallocate capacity while preserving the non-nil empty slice semantic, so
callers/tests still distinguish a filtered-empty result from nil.
ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 0a352825-0dad-46c1-82de-355640463c30

📥 Commits

Reviewing files that changed from the base of the PR and between 73da66e and c1493d1.

⛔ Files ignored due to path filters (5)
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
📒 Files selected for processing (4)
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/statefulset.go
  • support/config/cipher.go
  • support/config/cipher_test.go

@codecov

codecov Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.84%. Comparing base (8ea96d7) to head (8a46e63).
⚠️ Report is 95 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8871      +/-   ##
==========================================
+ Coverage   43.78%   43.84%   +0.05%     
==========================================
  Files         772      772              
  Lines       96000    96040      +40     
==========================================
+ Hits        42033    42108      +75     
+ Misses      51055    51013      -42     
- Partials     2912     2919       +7
Files with missing lines Coverage Δ
...trollers/hostedcontrolplane/v2/etcd/statefulset.go 73.85% <100.00%> (+33.69%) ⬆️
support/config/cipher.go 95.00% <100.00%> (+0.88%) ⬆️

... and 1 file with indirect coverage changes

Flag Coverage Δ
cmd-support 37.45% <100.00%> (+0.01%) ⬆️
cpo-hostedcontrolplane 46.22% <100.00%> (+0.30%) ⬆️
cpo-other 45.11% <ø> (ø)
hypershift-operator 54.03% <ø> (ø)
other 32.08% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@openshift-ci openshift-ci Bot added area/platform/aws PR/issue for AWS (AWSPlatform) platform area/platform/azure PR/issue for Azure (AzurePlatform) platform area/platform/gcp PR/issue for GCP (GCPPlatform) platform area/platform/kubevirt PR/issue for KubeVirt (KubevirtPlatform) platform area/platform/openstack PR/issue for OpenStack (OpenStackPlatform) platform area/platform/powervs PR/issue for PowerVS (PowerVSPlatform) platform labels Jul 6, 2026
coderabbitai[bot]
coderabbitai Bot reviewed Jul 6, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go (1)

319-461: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract shared env-var lookup helper to reduce duplication across validate closures.

Each of the four validate functions repeats the same nested loop to find the container by name and scan its Env slice for ETCD_TLS_MIN_VERSION/ETCD_CIPHER_SUITES. Consolidating this into a small helper (e.g., findEnvVar(sts *appsv1.StatefulSet, containerName, envName string) (string, bool)) would remove ~80 lines of duplicated boilerplate and make each test case's assertions clearer.

♻️ Proposed helper 
func findContainerEnvVar(sts *appsv1.StatefulSet, containerName, envName string) (string, bool) {
	for _, c := range sts.Spec.Template.Spec.Containers {
		if c.Name != containerName {
			continue
		}
		for _, env := range c.Env {
			if env.Name == envName {
				return env.Value, true
			}
		}
	}
	return "", false
}

Then each validate closure simplifies to, e.g.:

-				for _, c := range sts.Spec.Template.Spec.Containers {
-					if c.Name != ComponentName {
-						continue
-					}
-					for _, env := range c.Env {
-						if env.Name == "ETCD_TLS_MIN_VERSION" {
-							g.Expect(env.Value).To(Equal("TLS1.3"))
-							foundTLSVersion = true
-							continue
-						}
-						if env.Name == "ETCD_CIPHER_SUITES" {
-							foundCipherSuites = true
-						}
-					}
-				}
+				tlsVersion, foundTLSVersion := findContainerEnvVar(sts, ComponentName, "ETCD_TLS_MIN_VERSION")
+				g.Expect(tlsVersion).To(Equal("TLS1.3"))
+				_, foundCipherSuites := findContainerEnvVar(sts, ComponentName, "ETCD_CIPHER_SUITES")
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go`
around lines 319 - 461, The four `validate` closures duplicate the same
container/env scan logic, so extract a shared helper from `etcd_test.go` (for
example `findContainerEnvVar` or similar) that finds an env var by container
name and env name in a `*appsv1.StatefulSet`. Update each TLS profile test case
to use that helper for `ComponentName`, `ETCD_TLS_MIN_VERSION`, and
`ETCD_CIPHER_SUITES` assertions so the checks stay the same but the repeated
nested loops are removed.
🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go`:
- Around line 319-461: The four `validate` closures duplicate the same
container/env scan logic, so extract a shared helper from `etcd_test.go` (for
example `findContainerEnvVar` or similar) that finds an env var by container
name and env name in a `*appsv1.StatefulSet`. Update each TLS profile test case
to use that helper for `ComponentName`, `ETCD_TLS_MIN_VERSION`, and
`ETCD_CIPHER_SUITES` assertions so the checks stay the same but the repeated
nested loops are removed.
ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 42b91336-919d-4cf0-9d2f-d1acc50a3236

📥 Commits

Reviewing files that changed from the base of the PR and between c1493d1 and 23de707.

⛔ Files ignored due to path filters (245)
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_creds_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_config_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_metrics_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_certified_operators_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_node_tuning_operator_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_node_tuning_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_community_operators_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_community_operators_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_role_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_role_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_dns_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_dns_operator_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_ca_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_serving_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_client_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_discovery_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/ModernTLS/zz_fixture_TestControlPlaneComponents_featuregate_generator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/ModernTLS/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_gcp_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_ca_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_route.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_serving_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_agent_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_agent_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_admin_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_auth_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_pod_identity_webhook_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_bootstrap_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_hcco_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_audit_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_authentication_token_webhook_config_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_bootstrap_container_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_egress_selector_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_server_local_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_localhost_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_metadata_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_recording_rules_prometheusrule.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_service_network_admin_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kcm_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_recycler_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_driver_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_ca_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_route.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_serving_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_audit_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_default_error_template_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_default_login_template_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_default_provider_selection_template_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_session_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_pprof_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_metrics_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_audit_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_audit_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_trusted_ca_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/ModernTLS/zz_fixture_TestControlPlaneComponents_packageserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/ModernTLS/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/ModernTLS/zz_fixture_TestControlPlaneComponents_packageserver_pdb_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_ccm_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_marketplace_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_catalogs_imagestream.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_operators_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_poddisruptionbudget.yaml is excluded by !**/testdata/**
📒 Files selected for processing (3)
  • control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/statefulset.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/statefulset.go

coderabbitai[bot]
coderabbitai Bot reviewed Jul 6, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/etcd/statefulset.go`:
- Around line 107-112: The issue is that HostedControlPlane always adds the etcd
grpc-proxy TLS min-version flag, even though not every bundled etcd image may
support it. In the statefulset setup for the etcd-metrics container, update the
argument assembly around the grpc-proxy start flags to either verify the minimum
etcd version supports --tls-min-version or gate appending it behind a condition
tied to a known-supported version/profile. Use the existing tlsMinVersion and
cipherSuites argument logic in statefulset.go to keep the fix localized.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d170ea6e-409c-4c2e-8e4d-17ba3588f433

📥 Commits

Reviewing files that changed from the base of the PR and between 23de707 and 997610b.

⛔ Files ignored due to path filters (245)
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_creds_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_config_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_metrics_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_catalog_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_certified_operators_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_network_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_node_tuning_operator_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_node_tuning_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-storage-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_storage_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_cluster_version_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_community_operators_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_community_operators_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_role_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_role_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_dns_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_dns_operator_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_ca_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/ModernTLS/zz_fixture_TestControlPlaneComponents_endpoint_resolver_serving_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_client_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_discovery_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/ModernTLS/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/ModernTLS/zz_fixture_TestControlPlaneComponents_featuregate_generator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/ModernTLS/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_gcp_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_ca_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_route.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/ModernTLS/zz_fixture_TestControlPlaneComponents_ignition_server_serving_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_podmonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_ingress_operator_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_agent_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_agent_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_admin_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_auth_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_aws_pod_identity_webhook_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_bootstrap_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_hcco_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_audit_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_authentication_token_webhook_config_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_bootstrap_container_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kas_egress_selector_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_konnectivity_server_local_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_apiserver_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_localhost_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_metadata_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_recording_rules_prometheusrule.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_service_network_admin_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kcm_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_controller_manager_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_recycler_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/ModernTLS/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_driver_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_service_account_kubeconfig_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/ModernTLS/zz_fixture_TestControlPlaneComponents_kubevirt_csi_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/ModernTLS/zz_fixture_TestControlPlaneComponents_machine_approver_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_ca_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_route.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/ModernTLS/zz_fixture_TestControlPlaneComponents_metrics_proxy_serving_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_audit_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_default_error_template_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_default_login_template_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_default_provider_selection_template_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/ModernTLS/zz_fixture_TestControlPlaneComponents_oauth_openshift_session_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_role.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_rolebinding.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_serviceaccount.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/ModernTLS/zz_fixture_TestControlPlaneComponents_pprof_cert_secret.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_metrics_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/ModernTLS/zz_fixture_TestControlPlaneComponents_olm_operator_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_audit_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_apiserver_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_audit_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_servicemonitor.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_cloud_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_openstack_trusted_ca_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/ModernTLS/zz_fixture_TestControlPlaneComponents_packageserver_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/ModernTLS/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/ModernTLS/zz_fixture_TestControlPlaneComponents_packageserver_pdb_poddisruptionbudget.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_ccm_config_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/ModernTLS/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_marketplace_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_catalogs_imagestream.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/ModernTLS/zz_fixture_TestControlPlaneComponents_redhat_operators_service.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_configmap.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_controlplanecomponent.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_deployment.yaml is excluded by !**/testdata/**
  • control-plane-operator/controllers/hostedcontrolplane/testdata/router/ModernTLS/zz_fixture_TestControlPlaneComponents_router_poddisruptionbudget.yaml is excluded by !**/testdata/**
📒 Files selected for processing (5)
  • control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/statefulset.go
  • support/config/cipher.go
  • support/config/cipher_test.go
🚧 Files skipped from review as they are similar to previous changes (4)
  • control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
  • support/config/cipher.go
  • support/config/cipher_test.go
  • control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go

Comment thread control-plane-operator/controllers/hostedcontrolplane/v2/etcd/statefulset.go
@ricardomaraschini
ricardomaraschini force-pushed the CNTRLPLANE-3615-2 branch 2 times, most recently from 5a0c274 to 2317fec Compare July 8, 2026 07:21
@ricardomaraschini

ricardomaraschini commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

/retest

csrwng
csrwng reviewed Jul 9, 2026
View reviewed changes

@csrwng csrwng left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the core logic and test changes. Clean implementation — minTLSVersion correctly floors to TLS 1.2 (matching cluster-etcd-operator), cipher filtering through etcd's tlsutil.GetCipherSuite is a good approach, and TLS settings are applied consistently across all three containers (etcd, etcd-metrics, healthz). Cipher suites correctly omitted for TLS 1.3. Tests have thorough coverage across profile types.

@csrwng

csrwng commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

/approve

@openshift-ci

openshift-ci Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csrwng, ricardomaraschini

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 9, 2026
jparrill
jparrill reviewed Jul 10, 2026
View reviewed changes

@jparrill jparrill left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dropped a minor comment. Thanks!

Comment thread control-plane-operator/controllers/hostedcontrolplane/v2/etcd/etcd_test.go
@ricardomaraschini
feat(etcd-operator): add tls security profile configuration for etcd
64f4594 
configure the etcd controller to use the tls security profile
settings from the hostedcontrolplane resource. this ensures the
etcd uses ciphers and minimum tls version that match the cluster's
security requirements.

this implementation was inspired by the implementation found in
https://github.com/openshift/cluster-etcd-operator.
@ricardomaraschini
test(etcd): add modern tls profile test case to TestControlPlaneCompo…
8a46e63 
…nents

we have changed the etcd statefulset. we need to regenerate the testdata
to incorporate these changes. this commit also add test case validating
modern tls security profile (tls 1.3) configuration across control plane
components.
@jparrill

jparrill commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 14, 2026
@openshift-merge-bot

openshift-merge-bot Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

@ricardomaraschini

ricardomaraschini commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@hypershift-jira-solve-ci

hypershift-jira-solve-ci Bot commented Jul 15, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

Now I have all the evidence I need. Let me produce the final report.

Test Failure Analysis Complete

Job Information

Test Failure Analysis

Error

Red Hat Konflux / control-plane-operator-main-on-pull-request has failed.
Task: sast-unicode-check — 🔴 Failed (2 minutes)
All other 16 pipeline tasks succeeded.

Summary

The Konflux control-plane-operator-main-on-pull-request pipeline failed due to a transient infrastructure failure in the sast-unicode-check task. This task scans source code for bidirectional (BIDI) Unicode control characters that could enable "trojan source" attacks. The PR's code changes contain no BIDI Unicode characters — verified by scanning all changed files and the full diff. The same sast-unicode-check passes on the hypershift-operator pipeline (same commit, same source), passes on other open PRs' CPO pipelines (e.g., PR #9008), and passes on main-branch push events. The failure is isolated to this single pipeline run, making it a transient infrastructure issue in the Konflux compute environment. Critically, /retest only retriggers Prow CI jobs, not Konflux pipelines — a new commit push or Konflux UI re-trigger is needed.

Root Cause

The root cause is a transient infrastructure failure in the sast-unicode-check Tekton task, specific to this single pipeline run. The failure is NOT caused by the PR's code changes.

Evidence that rules out a code issue:

  1. No BIDI characters in PR diff: Deep scan of all 100 changed files found zero bidirectional Unicode control characters (U+200E–U+200F, U+202A–U+202E, U+2066–U+2069, and other dangerous Unicode codepoints).
  2. Same source passes elsewhere: The hypershift-operator-main-on-pull-request pipeline ran sast-unicode-check on the identical commit (8a46e63) and passed.
  3. CPO pipeline passes on other PRs: PR CNTRLPLANE-3843: feat: ho,cpo,hcco: expose console URL #9008 (e9b183b) ran the CPO pipeline with sast-unicode-check and passed (same day, ~4 hours earlier).
  4. CPO pipeline passes on main: The most recent main-branch push (4679f41) ran the CPO pipeline and passed.
  5. All 16 other tasks passed: The build compiled successfully (4 minutes), all other SAST checks (shell-check, snyk-check, clair-scan, clamav-scan) passed, the container image was built and pushed.

What likely went wrong:

The sast-unicode-check task (defined in konflux-ci/konflux-sast-tasks v0.4) has multiple failure points susceptible to transient issues:

  • ORAS upload step: The third step in the task uploads SARIF results to quay.io using oras attach. A transient registry connectivity or authentication failure would cause the task to fail even if the scan itself succeeded.
  • KFP git clone: The task attempts to clone gitlab.cee.redhat.com/osh/known-false-positives.git. While clone failures are handled gracefully (WARN, not failure), a timeout or partial failure during the HTTP probe (curl --fail --head --max-time 60) combined with set -exuo pipefail could trigger the error trap.
  • Trusted Artifact download: The first step downloads the source artifact from an OCI registry. A transient download failure would prevent the scan from starting.

The task completed in 2 minutes (normal duration), and uses set -exuo pipefail with a trap 'handle_error' EXIT. Any unexpected command failure would trigger the error handler, which records an ERROR result. Since we cannot access the Konflux UI logs (authentication required), we cannot pinpoint the exact transient failure, but the pattern conclusively points to infrastructure rather than code.

Recommendations

  1. Push a new commit to re-trigger the Konflux pipeline: /retest only re-triggers Prow CI jobs, NOT Konflux pipelines. The Konflux PipelineRun is triggered by PipelinesAsCode on push/PR events. Options:

    • Push an empty commit: git commit --allow-empty -m "retrigger CI" && git push
    • Push a trivial change (e.g., whitespace in a comment)
    • Use the Konflux UI to manually re-trigger the pipeline run

  2. No code changes needed: The PR's etcd TLS security profile configuration changes are correct. All other checks (build, Snyk, shell-check, clair-scan, clamav-scan, enterprise-contract pre-checks) passed.

  3. If the failure recurs: Request Konflux log access to identify the exact failing step (trusted-artifact download, scan, or ORAS upload). The pipeline run URL is: https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/crt-redhat-acm-tenant/pipelinerun/control-plane-operator-main-on-pull-request-qbglw/logs/sast-unicode-check

  4. Consider adding best_effort: "true" to sast-unicode-check: If Konflux supports it, making this task non-blocking would prevent transient failures from holding up PRs that pass all substantive checks.

Evidence
Evidence Detail
Failed task sast-unicode-check (2 min) — the only failure in 17 pipeline tasks
BIDI chars in diff None found — deep scan of all 100 changed files confirmed zero BIDI/dangerous Unicode
Same commit, other pipeline hypershift-operator-main-on-pull-request ✅ PASSED (same commit 8a46e63)
Same pipeline, other PR CPO pipeline ✅ PASSED on PR #9008 (e9b183b, same day, 4h earlier)
Same pipeline, main branch CPO pipeline ✅ PASSED on main push (4679f41)
Build step ✅ PASSED (4 min) — code compiles successfully
sast-snyk-check ✅ PASSED
sast-shell-check ✅ PASSED
clair-scan ✅ PASSED
clamav-scan ✅ PASSED
Task image quay.io/konflux-ci/konflux-test:v1.5.3 (released 2026-07-09)
Task bundle quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582...
Scan parameters -p bidi -v -d -t (BIDI chars only, skip test dirs)
Vendor files Unchanged — vendor/go.etcd.io/etcd/client/pkg/v3/tlsutil/ exists in both PR and main
/retest effect No effect — /retest only triggers Prow jobs, not Konflux pipelines
Re-trigger needed Push new commit or use Konflux UI to re-run pipeline

@ricardomaraschini

ricardomaraschini commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

/retest

1 similar comment
@ricardomaraschini

ricardomaraschini commented Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@kaleemsiddiqu

kaleemsiddiqu commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

/verified by @kaleemsiddiqu
Tested locally with successful manual test execution

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 20, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 20, 2026

Copy link
Copy Markdown

@kaleemsiddiqu: This PR has been marked as verified by @kaleemsiddiqu.

Details

In response to this:

/verified by @kaleemsiddiqu
Tested locally with successful manual test execution

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

@ricardomaraschini: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 661b61a into openshift:main Jul 20, 2026
41 checks passed
This was referenced Jul 21, 2026
Open
Merged
@devguyio devguyio mentioned this pull request Jul 21, 2026
Merged
4 tasks
devguyio added a commit to devguyio/hypershift that referenced this pull request Jul 21, 2026
@devguyio @claude
fix(cpo): regenerate stale ModernTLS test fixtures
e8be3ab 
ModernTLS fixtures from openshift#8871 landed stale due to Tide merge skew.
GHA tested against a base that predated openshift#8772, openshift#8940, openshift#8971, openshift#8705
which changed oauth masterURL, wait-for-etcd init container, router
ordering, and etcd job label regex respectively.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ahmed Abdalla <aabdelre@redhat.com>
@coderabbitai coderabbitai Bot mentioned this pull request Jul 22, 2026
Merged
4 tasks
@redhat-chai-bot redhat-chai-bot mentioned this pull request Jul 23, 2026
Closed
stbenjam added a commit to openshift-eng/ai-helpers that referenced this pull request Aug 21, 2026
@stbenjam @claude @not-stbenjam
test(ci): payload false-revert eval cases + point-in-time integrity j…
4433d39 
…udge (replaces #660) (#701)

* test(ci): add adversarial payload false-revert eval cases

Revives the three evidence-heavy payload-analysis eval cases from #660 on
top of current main. These are the control-arm cases capturing payloads
where the Payload Agent recommended incorrect reverts, and they exercise
the skill's ability to distinguish well-supported revert candidates from
false attributions.

- case-018: mixed true/false attribution — keep openshift/oc#2279 while
  rejecting the cross-tenant etcd evidence attributed to
  openshift/hypershift#8871.
- case-019: reject openshift/api#2920 and #2923; the apparent long
  operator waits come from disjoint interval arithmetic in the Origin
  monitor test.
- case-020: reject openshift/ovn-kubernetes#3298 and
  openshift/cloud-provider-azure#164; reconstruct the ordered GCP/Azure
  infrastructure chains and distinguish triggers from amplifiers,
  detectors, and cleanup fallout.

Cases are registered in the eval README case index. docs/index.html is
regenerated via `make update` to clear pre-existing plugin-metadata drift
so the strict plugin lint passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(ci): bump ci plugin to 0.0.86 for new eval cases

The check-version-bump CI gate requires a version bump for any change
under plugins/ci/. Bump the plugin version and re-sync marketplace.json
and docs/index.html via `make update`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(ci): add point-in-time cutoff + integrity judge, trim case fields

Address review feedback on the revived payload false-revert eval cases:

- Drop the excessive adversarial annotation fields (required_claims,
  must_not_conclude, forbidden_revert_candidates, distractors,
  key_evidence, discriminating_signal) from cases 018/019/020. Nothing
  in the payload-analysis eval consumed them; the core false-positive
  check is already covered by expected_candidates: [].
- Keep the point-in-time metadata (payload_completed_at in input,
  analysis_cutoff in annotations) and extend it to the existing cases
  001-014, since this is the highest-value part — it lets the eval
  detect hindsight/cheating.
- Pass the cutoff to the skill as `--as-of {payload_completed_at}` and
  instruct the agent to perform a strict point-in-time analysis.
- Add the point_in_time_integrity LLM judge (min_mean 4.0) that scores
  evidence provenance against analysis_cutoff and flags post-hoc
  leakage (later reverts, subsequent payload outcomes, present-day PR
  state). Cases without a cutoff score max, so it is a no-op for any
  future non-point-in-time case.

Deliberately left behind #660's programmatic trace-hygiene judge (heavy
and brittle) and the case_constraints adversarial-field judge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(ci): support --as-of point-in-time cutoff in payload-analysis skill

Add the --as-of TIMESTAMP flag to the payload-analysis argument
contract and bound every external lookup and subagent investigation
to the cutoff. Under --as-of the skill reasons only from evidence that
existed when the payload completed: it ignores post-cutoff reverts,
comments, and payload outcomes, caps the step-registry commit window
at the cutoff, and never treats a later revert (or its absence) as
causal evidence. This keeps the point-in-time eval from leaking
post-cutoff signal into recommendations.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(ci): unify cutoff field name, add deterministic outcome judges

Unify the point-in-time cutoff under one name: annotations.yaml now
carries payload_completed_at, identical to input.yaml, instead of a
differently-named analysis_cutoff. The duplication itself stays because
the harness only exposes annotations.yaml to judges; the dataset schema
now documents that constraint.

Add deterministic check judges for the outcomes that were previously
only graded by LLM rubric: expected_candidates_found (every expected
candidate at/above min_confidence), no_unexpected_reverts (a hard
false-revert gate — no non-RPM candidate at/above the revert threshold
outside the expected set), failed_job_count_matches (tolerance 1),
force_accept_matches, and expected_phase_matches. All gate at
min_pass_rate 1.0, and the conditional ones use the harness if: field
so inapplicable cases are skipped rather than auto-scored.

Judge fixes: revert_scoring_accuracy had drifted from the skill (it
described a retired 130-point rubric with a "single candidate" signal);
it now attaches SKILL.md as context and judges against the current
rubric, with a two-sided scale where a false revert scores 1 instead of
falling through anchors written for the true-positive case.
point_in_time_integrity uses if: instead of instructing the model to
return max score for non-cutoff cases.

Case fixes: case-008 records its real phase (Rejected in every
historical run) instead of ""; case-010 notes now state the verified
Insights API Gateway HTTP 500 story with all four job names; cases 010
and 012 declare expected_candidates: [] explicitly. Also enable
parallelism: 3 and tag MLflow runs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): address CodeRabbit findings on --as-of and eval judges

SKILL.md: Step 3.6 now defines a single until_timestamp (the earlier of
the window end and the --as-of cutoff) passed whole to both step-registry
queries, replacing the until=<until_date>T23:59:59Z templates that would
mangle a mid-day cutoff or silently re-admit same-day post-cutoff
commits. Step 6.3 requests createdAt and treats post-cutoff revert state
as unavailable: a pre-cutoff revert that merged after the cutoff counts
as still Open.

Eval: expected_candidates_found now verifies expected_failing_jobs
linkage (substring match, short names vs full periodic names);
yaml_results_valid requires the canonical candidate type field and only
demands pr_url for non-RPM candidates; the outputs schema documents
type-specific candidate fields.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(ci): progressive disclosure + report template for payload-analysis

Restructure the payload-analysis skill for progressive disclosure:

- Drop the "Required Skills" preamble that force-loaded the
  payload-results-yaml and payload-autodl-json schema skills before any
  work began; each is now loaded via the Skill tool at its point of use
  (Steps 6.5 and 8), keeping early context lean.
- Move the three run-once blobs out of SKILL.md into references/ loaded
  at the step that needs them: the Step 4 investigation-subagent prompt
  (investigation-subagent.md), the report content rules
  (report-guide.md), and the Step 9 completeness-review prompt
  (completeness-review.md). The scoring rubric stays in SKILL.md — it is
  per-run core and the eval's revert_scoring_accuracy judge attaches
  SKILL.md as rubric context.
- Replace ~220 lines of inline HTML fragments and partial CSS with
  assets/report-template.html — a complete fill-in-the-blanks page
  (placeholders plus BEGIN/END conditional and repeatable blocks) that
  Step 7 copies and fills. The old prose said "follow the styling
  conventions of the existing report format", which every run
  reinterpreted; the template is now the single source of structure and
  styling, so reports come out consistent across runs. New design:
  phase hero, stat tiles, confidence meters with a Confidence column in
  the reverts table, status pills, and per-payload history cells (status
  always encoded as text or luminance alongside color).

SKILL.md drops from 882 lines / 10.1k words to 581 lines / 7.6k words.
Bump ci to 0.0.87; marketplace + docs synced via make update.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(ci): report template mirrors the production Payload Agent format

Replace the experimental template design with the canonical production
report format (structure and CSS taken verbatim from a real
claude-payload-agent run), parameterized with placeholders and
BEGIN/END conditional blocks: executive summary with per-job
persistence, revert verdict with the Score column and itemized
rationale, no-revert and force-accept variants, blocking-jobs summary
with S/F history patterns, per-job collapsible details with
candidates-table/candidates-none alternatives, RHCOS changes with RPM
candidates and per-hop diffs, informing tests, and adversarial review.
Production runs had already drifted between each other on CSS details;
the template pins the format so every run renders identically.

Sync references/report-guide.md and the Step 10 checklist to the same
section list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(ci): correct case-011 expected_failed_job_count to 2

The payload had two failed blocking jobs (aggregated-aws-ovn-upgrade-5.0-major
and aggregated-gcp-ovn-upgrade-5.0-micro), both from the external Insights API
Gateway HTTP 500 incident. Confirmed by two independent eval runs (Codex/Harbor
and a local claude-opus-4-6 run); the old count of 1 was annotation error and
cost both LLM judges points against a correct analysis. Notes now name the jobs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): verify revert-threshold evidence and add claim audit to review

Three changes aimed at the recurring false-revert signature (four
production incidents, all scoring 85-95 from correlation stacks that
were never evidence-checked):

- Step 6.1: the self-skepticism re-verification now runs for ANY score
  at or above the revert threshold (>= 85), not only on cap overflow.
  Every historical false revert scored 85-95 — below the old trigger.
- Rubric: the error-message-match +20-30 tier now requires an observed
  artifact linking the failing operation to the modified code (stack
  frame, log line, event); shared subsystem vocabulary explicitly does
  not qualify and scores +10.
- Step 9: the completeness reviewer gains a claim-audit pass for
  candidates >= 85. Scores change through exactly one mechanism:
  striking an itemized signal by citing the artifact evidence that
  contradicts it, then recomputing mechanically. Speculative objections
  remain inadmissible — preserving the guard against the earlier
  failure mode where valid reverts were downgraded on flimsy doubts.

Eval config: declare score_range on the three numeric judges and move
skill under execution per harness deprecation. Bump ci to 0.0.88.
Gitignore /eval/ and /tmp/ local harness output.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(ci): add no_answer_access cheating detector to payload-analysis eval

Deterministic judge that fails a case when the agent transcript touches
annotations.yaml, traverses the eval dataset directory, or echoes
annotation-only vocabulary (expected_candidates, force_accept_expected,
...). Verified retroactively clean against all 17 CI case transcripts
from the PR head run and every local Luna/Opus run; the harness never
stages annotations into the workspace, so any hit means the agent went
looking. Scans the main transcript; separate subagent transcript files
are out of reach.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(ci): narrow cheating detector to path patterns only

Annotation field-name patterns could false-positive when the agent
legitimately reasons about its output schema; the two path patterns
(annotations.yaml, evals/cases/payload-analysis) are sufficient tells.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(ci): cheating detector scans merged events incl. subagent transcripts

collect.py merges subagents/*.jsonl into per-case events.json, so
scanning the serialized events covers subagent tool calls and text.
Raw stdout remains the fallback when no events were captured.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* revert(ci): restore payload-analysis skill to pre-audit behavior

Restores SKILL.md and completeness-review.md to the exact content the
passing CI run (2089641369093017600, tested 572a6f3) executed. The
unvalidated behavior changes from 8094b81 (>= 85 re-verification,
error-match tier tightening, Step 9 claim audit) went out with no eval
evidence, and their first measured run (2089697973024854016) regressed
case-007: the claim audit stamped the historical wrong answer
(cluster-version-operator#1309 @ 90) as verified while the true cause
(operator-framework-olm#1256) went unscored.

Measurement-side changes are kept: all judges including the
no_answer_access cheating detector, annotation fixes, and .gitignore
guards. Future skill behavior changes need control-vs-treatment eval
evidence with repeats before merging.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): correct payload-analysis ground truth for case-019 and case-020

case-019 was mislabeled as a false-revert trap with no expected candidate.
The aws/azure 4.22->5.0 major-upgrade jobs fail because CVO #1427 (OTA-1997)
added a Deployment-manifest template field the 4.22 CVO cannot render, so it
silently skips its own Deployment during upgrade. This was quick-reverted by
#1431 (TRT-2842) and re-landed as #1433, confirming #1427 as the real cause.
Set has_revert_candidates=true and add #1427 (@100, aws/azure-ovn-upgrade) as
the expected candidate; the api#2920/#2923 attributions remain red herrings.

case-020 met all three Step 6.4 force-accept criteria — both blocking failures
are temporary infrastructure (Azure 429 throttling / OSProvisioningTimedOut,
GCP transient VIP reachability loss), no more than 2 blocking jobs, and 48.4h
since the last accepted payload (>= 18h). Set force_accept_expected=true.

Also normalize expected_failing_jobs across cases to semantic-core tokens for
bidirectional substring matching, make the expected_candidates_found matcher
match when either the annotation token or the reported job name contains the
other, and bump the judge model to claude-opus-4-8.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(ci): raise payload-analysis LLM thresholds to 4.5

Tighten the quality bars now that the corrected ground truth produces
consistently high scores: analysis_quality min_mean 3.5 -> 4.5 and
revert_scoring_accuracy min_mean 3.0 -> 4.5.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(ci): make required_skill_invocations judge harness-neutral

Detect skill usage via either signal so the one payload-analysis eval
config scores both Claude Code and Codex runs:

- Signal A (Claude Code): a normalized `Skill` tool invocation, read from
  the merged event stream with a raw stdout JSONL fallback.
- Signal B (Codex and any harness without a Skill tool): the skill's
  canonical SKILL.md H1 heading appears in the transcript, meaning the
  skill body was loaded and run.

Codex has no `Skill` tool, so the prior stdout-JSONL parse always failed
there. Runner selection stays CLI-overridable (--agent codex --effort
xhigh --model ...) over the claude-code defaults; no second config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(ci): add no_model_refusal deterministic judge to payload-analysis

Detect API-level model refusals (the model's safeguards flagged the
request) in the agent or any subagent, and fail the case explicitly so
the root cause is visible instead of surfacing downstream as a confusing
"missing output files" failure. This is an environment/model signal, not
a skill-quality one.

Detection is structural to avoid false positives:
- system record whose subtype starts with model_refusal (survives in both
  raw stdout stream-json and the flat merged events schema);
- a synthetic assistant turn (model "<synthetic>") paired with stop_reason
  "refusal" on the same record — which excludes the <synthetic> 429
  rate-limit record (stop_reason "stop_sequence");
- "safeguards flagged" text as corroboration only, never a standalone
  trigger.

Reuses the no_answer_access corpus idiom (json.dumps(events) with a stdout
fallback) and reports which corpus was scanned. Claude Code only for now:
when the capture is not a Claude Code run (no system/init signature) the
judge abstains (no score) rather than emit a misleading pass — Codex
refusal capture shape is a TODO. Gated at min_pass_rate 1.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ci): resolve payload-analysis dataset.path from config dir

The harness resolves dataset.path against the config file's directory
(EvalConfig.resolve_path uses config_dir = plugins/ci/evals), so the
repo-root-relative value doubled to
plugins/ci/evals/plugins/ci/evals/cases/payload-analysis and did not
exist — workspace setup would error and score.py would load zero
annotations. Use the config-dir-relative form (cases/payload-analysis),
matching the majority of eval configs in the repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: regenerate docs/index.html after upstream merge

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ci): pass expected_candidates_found on explicit no-revert cases

The judge gated on `if: annotations.get('expected_candidates')`, but an
explicit empty list — the documented way to declare "no revert expected" —
is falsy in Python, so the judge silently skipped (n/a) instead of passing
on all five no-revert cases (009, 010, 011, 012, 020). Its check body
already returns a pass for an empty expectation, so gate on presence
(`is not None`) like failed_job_count_matches does. The false-positive
direction remains enforced by no_unexpected_reverts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(ci): allow Codex network egress in payload-analysis eval

The default workspace-write sandbox blocks DNS/network entirely, starving
the snapshot-backed analysis of the live GCS/Prow, GitHub, and Sippy
lookups it still needs. Enable network_access on the write sandbox via
runner.settings, which only the Codex runner reads — the claude-code
runner ignores it, so its behavior is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(ci): keep codex scratch off /tmp; score implicit no-revert cases

Two payload-analysis eval changes:

- Add a system-prompt line telling the agent (and, via relay, its
  subagents) to use $TMPDIR for temporary files and downloaded artifacts
  instead of /tmp, so codex runs don't fill the RAM-backed tmpfs. The
  top-level agent honors this; subagent propagation is best-effort since
  codex child processes don't inherit runner.system_prompt.

- Broaden expected_candidates_found so a case declaring no-revert
  implicitly (has_revert_candidates: false with expected_candidates
  omitted) is scored vacuously, matching the explicit [] form. Skipped
  only when a case defines neither expectation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Stephen Benjamin <stbenjam+ai@redhat.com>
vsolanki12 pushed a commit to vsolanki12/hypershift that referenced this pull request Aug 25, 2026
@devguyio @claude @vsolanki12
fix(cpo): regenerate stale ModernTLS test fixtures
195851c 
ModernTLS fixtures from openshift#8871 landed stale due to Tide merge skew.
GHA tested against a base that predated openshift#8772, openshift#8940, openshift#8971, openshift#8705
which changed oauth masterURL, wait-for-etcd init container, router
ordering, and etcd job label regex respectively.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ahmed Abdalla <aabdelre@redhat.com>
rutvik23 pushed a commit to rutvik23/hypershift that referenced this pull request Aug 26, 2026
@devguyio @claude @rutvik23
fix(cpo): regenerate stale ModernTLS test fixtures
e63bb87 
ModernTLS fixtures from openshift#8871 landed stale due to Tide merge skew.
GHA tested against a base that predated openshift#8772, openshift#8940, openshift#8971, openshift#8705
which changed oauth masterURL, wait-for-etcd init container, router
ordering, and etcd job label regex respectively.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ahmed Abdalla <aabdelre@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@csrwng csrwng csrwng left review comments
@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments
@clebs clebs Awaiting requested review from clebs
@sjenning sjenning Awaiting requested review from sjenning
+1 more reviewer
@jparrill jparrill jparrill left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@jparrill jparrill

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release area/platform/aws PR/issue for AWS (AWSPlatform) platform area/platform/azure PR/issue for Azure (AzurePlatform) platform area/platform/gcp PR/issue for GCP (GCPPlatform) platform area/platform/kubevirt PR/issue for KubeVirt (KubevirtPlatform) platform area/platform/openstack PR/issue for OpenStack (OpenStackPlatform) platform area/platform/powervs PR/issue for PowerVS (PowerVSPlatform) platform jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@ricardomaraschini @openshift-ci-robot @csrwng @jparrill @kaleemsiddiqu