Skip to content
This repository was archived by the owner on Sep 9, 2026. It is now read-only.

OSAC-1699: Revert QoS policies created with wrong type for block storage tiers - #402

Merged
wgordon17 merged 1 commit into
mainfrom
revert-393-osac-jira-ai-issue-solver/OSAC-1699
Jul 7, 2026
Merged

wgordon17 merged 1 commit into
mainfrom
revert-393-osac-jira-ai-issue-solver/OSAC-1699

Conversation

@wgordon17

@wgordon17 wgordon17 commented Jul 7, 2026 •

Copy link
Copy Markdown
Contributor

Reverts #393

Summary by CodeRabbit

  • Bug Fixes

    • Updated QoS policy creation to support VAST 5.4.x constraints by only using supported policy types and excluding block-based QoS options.
    • Block storage class setup no longer adds QoS policy settings, reducing invalid configuration for block tiers.
  • Tests

    • Adjusted integration test data and expectations to match the updated storage tier and QoS behavior.

@openshift-ci-robot

openshift-ci-robot commented Jul 7, 2026 •

Copy link
Copy Markdown

@wgordon17: This pull request references OSAC-1699 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Reverts #393

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from rgolangh and ygalblum July 7, 2026 13:33
@openshift-ci

openshift-ci Bot commented Jul 7, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: wgordon17
Once this PR has been reviewed and has the lgtm label, please assign larsks for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 7, 2026 •

Copy link
Copy Markdown

Review Change Stack

Walkthrough

This PR restricts VAST QoS policy creation to non-block (VIEW/USER) tiers per VAST 5.4.x limitations, removing the policy_type field from creation payloads and dropping qos_policy from block-tier StorageClass parameters. Mock server defaults and integration test fixtures/assertions are updated accordingly to remove block-tier QoS expectations.

Changes

Block-tier QoS removal

Layer / File(s) Summary
QoS policy creation and tier filtering logic
collections/ansible_collections/osac/templates/roles/vast_storage/tasks/create_qos_policy.yaml
Documentation updated for VAST 5.4.x limits, tier filtering now excludes block-protocol tiers, and policy_type removed from the creation payload.
StorageClass parameter wiring for block tier
collections/ansible_collections/osac/templates/roles/vast_storage/tasks/ensure_storage_class.yaml
Conditional injection of qos_policy into block-tier StorageClass parameters removed.
Mock server and test fixtures alignment
tests/integration/mock_vms_server.py, tests/integration/fixtures/storage/secret-vast-tenant-config-test.yaml, tests/integration/setup_test_env.sh, tests/integration/targets/storage_provider_setup/tasks/main.yml
Mock server defaults drop policy_type; fixtures and setup scripts now define only the default tier, removing block-perf.
Integration test assertions for ensure_storage_class
tests/integration/targets/storage_provider_ensure_sc/tasks/main.yml
Test inputs drop block-tier qos_policy/qos_limits, StorageClass qos_policy assertion removed, and mock qospolicies POST call verification removed.

Estimated code review effort: 2 (Simple) | ~12 minutes

Sequence Diagram(s)

sequenceDiagram
    participant Playbook as Ansible Task
    participant Filter as Tier Filter
    participant VMS as VAST REST API

    Playbook->>Filter: evaluate storage tiers
    Filter-->>Playbook: keep tiers with qos_policy and protocol != block
    Playbook->>VMS: POST qospolicies (name, tenant_id, mode: STATIC)
    VMS-->>Playbook: created policy (no policy_type)
Loading

Related issues: None referenced in the provided diff.

Related PRs: None referenced in the provided diff.

Suggested labels: tests, vast-storage, bugfix

Suggested reviewers: None specified.

🐇 A tier once tried to block its way in,
But VAST 5.4 said "policy_type" is a sin—
No VOLUME, no fuss, just VIEW and just USER,
The bunny hops on, a cleaner composer.

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: reverting block-tier QoS policy creation/type handling.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets ✅ Passed No added hardcoded secrets in the diff; only existing test defaults like admin/admin and placeholders remain, and the new lines don't introduce creds/tokens/keys.
No-Weak-Crypto ✅ Passed Changed files contain no MD5/SHA1/DES/RC4/ECB or custom secret comparisons; only allowed rsa:2048 and aes-xts-plain64/sha256 appear.
No-Injection-Vectors ✅ Passed No touched file adds SQL/shell/eval/pickle/yaml/os.system/innerHTML risks; changes only remove qos_policy/policy_type and adjust test fixtures.
Container-Privileges ✅ Passed No changed file introduces privileged pods or risky securityContext fields; searches found no privileged/host* /SYS_ADMIN /allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed No new logging or debug output exposing secrets/PII was introduced; the mock server already strips auth headers and password/secret/token fields.
Ai-Attribution ✅ Passed No AI-tool references or Co-Authored-By trailers appear in the PR description or HEAD commit; no Red Hat AI attribution was required.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch revert-393-osac-jira-ai-issue-solver/OSAC-1699

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
tests/integration/targets/storage_provider_ensure_sc/tasks/main.yml (2)

384-411: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

QoS creation/exclusion is no longer verified via mock call log.

The previous qospolicies POST call assertions (per-protocol policy_type expectations) were removed entirely rather than adjusted. Given the default tier still declares qos_policy (line 75), the role should still POST to qospolicies for that tier — and critically, should make no such call for the block tier. Neither is currently verified, leaving the fixed bug (block tier wrongly getting a QoS policy) without direct test coverage.

✅ Proposed fix
     - name: Assert view policies were created
       ansible.builtin.assert:
         that:
           - _call_log | selectattr('path', 'search', 'viewpolicies') | list | length > 0
         fail_msg: "No view policy API calls found — ensure_storage_class should create view policies"
         success_msg: "View policy API calls detected"
+
+    - name: Assert QoS policy was created for the NFS tier only
+      ansible.builtin.assert:
+        that:
+          - _call_log | selectattr('path', 'search', 'qospolicies') | selectattr('method', 'equalto', 'POST') | list | length > 0
+        fail_msg: "No qospolicies POST call found — ensure_storage_class should create QoS policy for the default tier"
+        success_msg: "QoS policy API call detected"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/integration/targets/storage_provider_ensure_sc/tasks/main.yml` around
lines 384 - 411, Restore mock call log assertions in the integration test to
cover QoS policy behavior in addition to views and view policies. Update the
task sequence in main.yml to verify that `ensure_storage_class` POSTs to
`qospolicies` for the default tier that defines `qos_policy`, and also verify
that no `qospolicies` call is made for the block tier. Use the existing
`_mock_calls` / `_call_log` checks and add assertions keyed on the `path` and
`method` fields so the fixed block-tier QoS regression is directly covered.

223-234: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add a regression assertion that block SC has no qos_policy.

The block StorageClass parameter assertions dropped the qos_policy == test-qos-block check but don't add a negative assertion (parameters.qos_policy is not defined). Since this PR's entire purpose is preventing qos_policy from being wired into block-tier StorageClasses, this is the exact regression this test suite should guard against.

✅ Proposed fix
     - name: Assert block StorageClass parameters
       ansible.builtin.assert:
         that:
           - _block_sc_result.resources[0].parameters.vip_pool_name == "osac-test-pool"
           - _block_sc_result.resources[0].parameters.subsystem == "view-test-ensuresc-d0f7f176-block-tier"
           - "_block_sc_result.resources[0].parameters['csi.storage.k8s.io/provisioner-secret-name'] == 'vast-csi-test-ensuresc'"
           - "_block_sc_result.resources[0].parameters['csi.storage.k8s.io/provisioner-secret-namespace'] == 'osac-system'"
           - _block_sc_result.resources[0].parameters.storagePath is not defined
           - _block_sc_result.resources[0].parameters.viewPolicy is not defined
           - _block_sc_result.resources[0].parameters.secretName is not defined
+          - _block_sc_result.resources[0].parameters.qos_policy is not defined
         fail_msg: "Block StorageClass parameters incorrect: {{ _block_sc_result.resources[0].parameters }}"
         success_msg: "Block StorageClass parameters correct"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/integration/targets/storage_provider_ensure_sc/tasks/main.yml` around
lines 223 - 234, The block StorageClass assertion in the
storage_provider_ensure_sc test is missing coverage for the qos_policy
regression. Update the existing assert for
_block_sc_result.resources[0].parameters to explicitly verify qos_policy is not
defined, alongside the other negative parameter checks, so this test guards
against block-tier StorageClasses accidentally inheriting qos_policy.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@tests/integration/targets/storage_provider_ensure_sc/tasks/main.yml`:
- Around line 384-411: Restore mock call log assertions in the integration test
to cover QoS policy behavior in addition to views and view policies. Update the
task sequence in main.yml to verify that `ensure_storage_class` POSTs to
`qospolicies` for the default tier that defines `qos_policy`, and also verify
that no `qospolicies` call is made for the block tier. Use the existing
`_mock_calls` / `_call_log` checks and add assertions keyed on the `path` and
`method` fields so the fixed block-tier QoS regression is directly covered.
- Around line 223-234: The block StorageClass assertion in the
storage_provider_ensure_sc test is missing coverage for the qos_policy
regression. Update the existing assert for
_block_sc_result.resources[0].parameters to explicitly verify qos_policy is not
defined, alongside the other negative parameter checks, so this test guards
against block-tier StorageClasses accidentally inheriting qos_policy.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: edfdc465-8b25-4749-90b0-b0c93d601317

📥 Commits

Reviewing files that changed from the base of the PR and between 6f3eb1f and 6e559d1.

📒 Files selected for processing (7)
  • collections/ansible_collections/osac/templates/roles/vast_storage/tasks/create_qos_policy.yaml
  • collections/ansible_collections/osac/templates/roles/vast_storage/tasks/ensure_storage_class.yaml
  • tests/integration/fixtures/storage/secret-vast-tenant-config-test.yaml
  • tests/integration/mock_vms_server.py
  • tests/integration/setup_test_env.sh
  • tests/integration/targets/storage_provider_ensure_sc/tasks/main.yml
  • tests/integration/targets/storage_provider_setup/tasks/main.yml
💤 Files with no reviewable changes (1)
  • tests/integration/targets/storage_provider_setup/tasks/main.yml

@openshift-ci

openshift-ci Bot commented Jul 7, 2026

Copy link
Copy Markdown

@wgordon17: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-vmaas 6e559d1 link true /test e2e-vmaas

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@wgordon17

Copy link
Copy Markdown
Contributor Author

/retest

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown

No failed workflow runs found for this PR at commit 6e559d1.

@wgordon17

Copy link
Copy Markdown
Contributor Author

This PR moves the state back to a previously known working state (it's a straightforward PR/commit revert). I'm proceeding with a self-merge

@wgordon17
wgordon17 merged commit 34d3683 into main Jul 7, 2026
7 of 9 checks passed

This branch was previously deployed

1 inactive deployment
e2e-test — 6e559d10 Deployed Jul 7, 2026 by wgordon17 via e2e-vmaas-full-install / e2e #126
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants