OCPBUGS-77760: verify FIPS mode after installation completes#10348
OCPBUGS-77760: verify FIPS mode after installation completes#10348zaneb wants to merge 3 commits intoopenshift:mainfrom
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@zaneb: This pull request references AGENT-1455 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test e2e-aws-ovn-fips |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: andfasano The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/retitle OCPBUGS-77760: verify FIPS mode after installation completes |
openshift-ci
bot
changed the title
openshift-ci-robot
added
the
jira/invalid-bug
|
@zaneb: This pull request references Jira Issue OCPBUGS-77760, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@zaneb: This pull request references Jira Issue OCPBUGS-77760, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
zaneb
force-pushed
the
verify-fips
branch
2 times, most recently
from
cfd5509 to
1d1b6aa
Compare
Move install-config loading from inside WaitForInstallComplete to each call site, and introduce a WaitOptions struct to pass configuration instead of the entire asset store. Note that ABI uses an OptionalInstallConfig rather than an InstallConfig asset, so it has never used an extended timeout for baremetal. Assisted-by: Claude Code
When install-config specifies fips: true, the agent-based installer now verifies that FIPS mode was actually enabled on the cluster before declaring installation successful. The verification queries both worker and master MachineConfigPools to retrieve their rendered MachineConfigs (the combined configs that machine-config-operator actually applies to nodes), and verifies that FIPS is enabled in each. This verification only runs for the agent wait-for install-complete command. Other installations are unchanged. Assisted-by: Claude Code
NewCluster() and FindRendezvousIPAndSSHKeyFromAssetStore() now accept an asset.Store parameter directly instead of a directory path string. This allows callers to reuse an existing Store instance and makes the API more explicit about its dependencies. Also fixed typo in function name: FindRendezvouIPAndSSHKeyFromAssetStore -> FindRendezvousIPAndSSHKeyFromAssetStore. Assisted-by: Claude Code
|
@zaneb: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
When install-config specifies fips: true, verify
that FIPS mode was actually enabled on the cluster before declaring an ABI
installation successful.
The verification queries both worker and master MachineConfigPools to
retrieve their rendered MachineConfigs (the combined configs that
machine-config-operator actually applies to nodes), and verifies that
FIPS is enabled in each.
This verification only runs for the agent wait-for install-complete
command. Regular installations are unchanged.