Skip to content

Mc/rox 33465 openshift autosensing 5#19937

Draft
mclasmeier wants to merge 28 commits intomasterfrom
mc/ROX-33465-openshift-autosensing-5
Draft

Mc/rox 33465 openshift autosensing 5#19937
mclasmeier wants to merge 28 commits intomasterfrom
mc/ROX-33465-openshift-autosensing-5

Conversation

@mclasmeier
Copy link
Copy Markdown
Contributor

Description

change me!

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

change me!

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 10, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Copy link
Copy Markdown
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 10, 2026

📝 Walkthrough

Summary by CodeRabbit

  • Deprecated

    • OpenShift 3 cluster type is no longer supported. Only OpenShift 4 is now supported going forward.
  • Documentation

    • Updated cluster configuration guidance and Helm templates to reflect OpenShift 4 as the only supported OpenShift version.
    • Revised compatibility detection logic to exclusively support OpenShift 4.
  • Chores

    • Updated Helm test configurations to use OpenShift 4.12 schema references.
    • Updated helmtest dependency to v0.0.9.

Walkthrough

This pull request removes OpenShift 3 support across the entire codebase, including Helm charts, cluster validation logic, roxctl tools, and test suites. OpenShift 3 clusters are now rejected during validation, while OpenShift 4 becomes the only supported OpenShift variant. Test schema references are updated from OpenShift 4.1.0 to 4.12.

Changes

Cohort / File(s) Summary
Proto & Type Definitions
proto/storage/cluster.proto
Marked OPENSHIFT_CLUSTER enum value as deprecated; no value changes.
Cluster Validation
pkg/cluster/validation.go, pkg/cluster/validation_test.go
Updated OpenShift 3 validation to unconditionally reject OPENSHIFT_CLUSTER with a "not supported anymore" message, replacing prior conditional checks.
Helm Template: OpenShift Version Detection
image/templates/helm/shared/templates/_openshift.tpl
Removed Kubernetes version parsing and OpenShift 3 auto-detection; now infers OpenShift exclusively via config.openshift.io/v1 API; boolean true sets OpenShift 4; validation fails for non-0/non-4 values.
Helm Template: Cluster Type & Configuration
image/templates/helm/stackrox-secured-cluster/internal/cluster-config.yaml.tpl.htpl, image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml, image/templates/helm/stackrox-secured-cluster/values.yaml.htpl, image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl
Hard-coded OPENSHIFT4_CLUSTER in cluster config; removed conditional SCC and admission controller logic for OpenShift 3; unconditional listenOnEvents: true.
Helm Template: Webhook Configuration
image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml
Expanded SCC annotation to any truthy OpenShift value; removed v1beta1 API version selection; unconditionally include webhook fields previously gated to non-3 versions.
Helm Template: Compatibility & Documentation
image/templates/helm/stackrox-secured-cluster/internal/compatibility-translation.yaml, image/templates/helm/stackrox-secured-cluster/sensor-chart-upgrade.md.htpl, image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl
Simplified compatibility translation to check only OPENSHIFT4_CLUSTER; updated documentation to reference OpenShift 4; removed OpenShift 3 validation constraint.
Image Build & Rendering
image/embed_charts.go
Changed script selection to only match OPENSHIFT4_CLUSTER (removed OPENSHIFT_CLUSTER branch).
Telemetry
central/telemetry/centralclient/client.go
Added inline comment documenting continued use of OPENSHIFT_CLUSTER for production compatibility (no functional change).
Central Cluster Datastore Tests
central/cluster/datastore/datastore_impl_postgres_test.go, central/clusters/zip/render_test.go
Removed OpenShift 3 mapping from audit logs test; updated test to use OPENSHIFT4_CLUSTER instead of generic OPENSHIFT_CLUSTER.
Central Services Helm Tests
pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml, pkg/helm/charts/tests/centralservices/testdata/helmtest/injected-cabundle-cm.test.yaml, pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-auth.test.yaml, pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-autosense.test.yaml, pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-monitoring.test.yaml, pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner*.test.yaml
Removed OpenShift 3 test cases; updated OpenShift schema references from openshift-4.1.0 to openshift-4.12; added validation for env.openshift: 3 rejection.
Secured Cluster Services Helm Tests
pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/admission-control.test.yaml, pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/audit-logs.test.yaml, pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/env.test.yaml, pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/injected-cabundle-cm.test.yaml, pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/legacy-settings.test.yaml, pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/openshift-monitoring.test.yaml, pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner*.test.yaml
Removed OpenShift 3 scenarios; updated schema version from openshift-4.1.0 to openshift-4.12; removed legacy mode OpenShift 3 detection tests.
Secured Cluster Feature-Flag Tests
pkg/helm/charts/tests/securedclusterservices/feature-flags/testdata/helmtest/admission-controller-config-disabled/admission-control.test.yaml, pkg/helm/charts/tests/securedclusterservices/feature-flags/testdata/helmtest/admission-controller-config/admission-control.test.yaml
Removed OpenShift 3 admission controller test; updated schema to openshift-4.12.
Secured Cluster Flavor Tests
pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/*/development_build.test.yaml, pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/*/opensource.test.yaml, pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/*/override.test.yaml, pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/*/rhacs.test.yaml, pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/*/stackrox.test.yaml
Updated scanner image test schema from openshift-4.1.0 to openshift-4.12 across all build flavors.
Renderer Tests
pkg/renderer/central_db_test.go, pkg/renderer/kubernetes_test.go
Removed OPENSHIFT_CLUSTER from bundle rendering tests; added explicit tests that verify OpenShift 3 rejection with error message.
roxctl Central Generation
roxctl/central/generate/generate_test.go, roxctl/central/generate/k8s.go
Removed OpenShift 3 test cases; updated error handling to use errox.InvalidArgs; changed help text and error messages to state only version 4 is supported.
roxctl Sensor Generation
roxctl/sensor/generate/openshift.go, tests/roxctl/bats-tests/cluster/sensor-generate-bundle.bats
Removed OpenShift 3 constant handling; updated version validation to reject 3; simplified audit log collection logic; replaced integration test success case with rejection case for OpenShift 3.
Dependencies & Documentation
go.mod, CHANGELOG.md
Updated github.com/stackrox/helmtest from v0.0.8 to v0.0.9; added changelog entry for OpenShift 3 removal.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (3 warnings)

Check name Status Explanation Resolution
Title check ⚠️ Warning The title 'Mc/rox 33465 openshift autosensing 5' is a branch name that does not clearly describe the main changes—removing OpenShift 3 support across the codebase. Revise the title to something descriptive like 'Remove OpenShift 3 support and deprecate OPENSHIFT_CLUSTER enum' or similar, clearly indicating the primary change.
Description check ⚠️ Warning The PR description contains only the template with placeholder text ('change me!') and incomplete checklists; no actual implementation details, rationale, or validation information are provided. Fill in the Description section with details of the changes, explain why OpenShift 3 support is being removed, confirm CHANGELOG.md is updated, and document testing/validation performed.
Docstring Coverage ⚠️ Warning Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch mc/ROX-33465-openshift-autosensing-5

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Trivy (0.69.3)

Failed to read Trivy output file: ENOENT: no such file or directory, open '/inmem/1274/nsjail-3a766c9a-c8d9-4f4f-aeac-d6c27dc3e0a2/merged/.trivy-output.json'


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (3)
central/telemetry/centralclient/client.go (1)

117-119: Inconsistency: code rejects OpenShift 3.x clusters but telemetry still reports deprecated enum value.

OpenShift 3.x is explicitly rejected in validation logic (pkg/cluster/validation.go rejects clusters with this type, stating "OpenShift 3.x is not supported anymore"). However, telemetry here continues using the deprecated OPENSHIFT_CLUSTER enum instead of OPENSHIFT4_CLUSTER.

This same pattern appears in sensor/kubernetes/telemetry/gatherers/cluster.go and other codebase locations still referencing the deprecated enum. Since OpenShift 3.x clusters won't be accepted by the system, the telemetry can safely migrate to OPENSHIFT4_CLUSTER to:

  • Provide accurate metrics (no confusion about OpenShift 3 vs 4)
  • Align with the system's actual support scope
  • Remove deprecated enum usage across the codebase

Update to OPENSHIFT4_CLUSTER and audit other locations using the deprecated enum value for consistency.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@central/telemetry/centralclient/client.go` around lines 117 - 119, Telemetry
is reporting the deprecated enum value OPENSHIFT_CLUSTER while validation
rejects OpenShift 3.x; change the value assigned to orchestrator from
storage.ClusterType_OPENSHIFT_CLUSTER.String() to
storage.ClusterType_OPENSHIFT4_CLUSTER.String() in the client.go code (update
the orchestrator assignment), and audit other usages such as
sensor/kubernetes/telemetry/gatherers/cluster.go to replace
storage.ClusterType_OPENSHIFT_CLUSTER with
storage.ClusterType_OPENSHIFT4_CLUSTER so telemetry accurately reflects
OpenShift 4.x and removes the deprecated enum.
image/embed_charts.go (1)

272-279: Return a specific error for deprecated OPENSHIFT_CLUSTER.

OPENSHIFT_CLUSTER currently falls through to a generic “invalid cluster type” message. An explicit branch improves operator diagnostics and aligns with the new OpenShift 3 deprecation messaging.

Proposed patch
 func (i *Image) addScripts(values *charts.MetaValues) ([]*loader.BufferedFile, error) {
 	if values.ClusterType == storage.ClusterType_KUBERNETES_CLUSTER.String() {
 		return i.scripts(values, k8sScriptsFileMap)
 	} else if values.ClusterType == storage.ClusterType_OPENSHIFT4_CLUSTER.String() {
 		return i.scripts(values, osScriptsFileMap)
+	} else if values.ClusterType == storage.ClusterType_OPENSHIFT_CLUSTER.String() {
+		return nil, errors.Errorf("unable to create sensor bundle for cluster %s: OpenShift 3.x is not supported anymore",
+			values.ClusterName)
 	}
 	return nil, errors.Errorf("unable to create sensor bundle, invalid cluster type for cluster %s",
 		values.ClusterName)
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@image/embed_charts.go` around lines 272 - 279, The current branch logic
treats storage.ClusterType_OPENSHIFT_CLUSTER as falling through to a generic
"invalid cluster type" error; update the branching in the function handling
values.ClusterType to add an explicit else-if for
storage.ClusterType_OPENSHIFT_CLUSTER.String() that returns a clear, specific
deprecation error (e.g., indicating OpenShift 3 is deprecated and directing
operators to upgrade), while keeping the existing OPENSHIFT4 and KUBERNETES
branches (references: values.ClusterType, storage.ClusterType_OPENSHIFT_CLUSTER,
storage.ClusterType_OPENSHIFT4_CLUSTER, storage.ClusterType_KUBERNETES_CLUSTER,
and the error return at the end).
pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml (1)

20-22: Add a negative case asserting OpenShift 3 is rejected.

This block now only tests OpenShift 4. Given the de-support change, keep a regression test that env.openshift: 3 fails.

Proposed patch
   tests:
   - name: "on openshift 4"
+  - name: "on openshift 3 should fail"
+    set:
+      env.openshift: 3
+    expectError: true
+    expect: |
+      .error | assertThat(contains("OpenShift 3"))
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml`
around lines 20 - 22, Add a negative test case next to the existing "on
openshift 4" entry that sets env.openshift: 3 and asserts the chart/template
fails validation; specifically, under the same tests: array add an entry with
name "on openshift 3" and a values block containing env.openshift: 3 and an
expectation that rendering or validation fails (e.g., expectFailure /
shouldRender: false / an assert that error is returned) so the test suite
verifies OpenShift 3 is rejected. Ensure the new test mirrors the structure of
the "on openshift 4" entry but uses env.openshift: 3 and the negative assertion.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@image/templates/helm/stackrox-secured-cluster/internal/cluster-config.yaml.tpl.htpl`:
- Around line 7-11: The template currently treats any truthy ._rox.env.openshift
as OPENSHIFT4_CLUSTER; change the conditional in cluster-config.yaml.tpl.htpl to
explicitly check for the OpenShift 4 value (e.g. eq ._rox.env.openshift "4" or
the exact token your config uses) and render type: OPENSHIFT4_CLUSTER only in
that case; if ._rox.env.openshift is set to any other non-empty/unsupported
value, fail fast with a clear error (use the template fail function) instead of
coercing, otherwise render type: KUBERNETES_CLUSTER when ._rox.env.openshift is
unset/false.

In
`@image/templates/helm/stackrox-secured-cluster/internal/compatibility-translation.yaml`:
- Around line 13-16: The current template env.openshift only tests eq .rawValue
"OPENSHIFT4_CLUSTER", which silently treats any other value (including legacy
"OPENSHIFT_CLUSTER") as false and yields KUBERNETES manifests; update the
template to explicitly validate .rawValue against allowed values and fail-fast
on unsupported inputs: change the env.openshift logic to a conditional that
returns true only for "OPENSHIFT4_CLUSTER", returns false only for the explicit
"KUBERNETES_CLUSTER" token (if used), and calls the template fail/required
helper with a clear error message when .rawValue is "OPENSHIFT_CLUSTER" or any
other unsupported string so the build errors instead of generating incorrect
manifests (refer to env.openshift, .rawValue and the
cluster-config.yaml.tpl.htpl usage).

In `@pkg/renderer/central_db_test.go`:
- Around line 209-210: The test is asserting the wrong error substring; update
the assertion in central_db_test.go (the failing block around
require.Error(suite.T(), err) / assert.Contains(...)) to look for the new
message from pkg/cluster/validation.go — e.g., assert that err.Error() contains
"OpenShift 3.x is not supported anymore" (or assert exact equality against the
full error string returned by the validation function) so the test matches the
updated validation text for storage.ClusterType_OPENSHIFT_CLUSTER.

In `@pkg/renderer/kubernetes_test.go`:
- Around line 133-134: The test in kubernetes_test.go is asserting the wrong
error message for storage.ClusterType_OPENSHIFT_CLUSTER; update the assertion to
match the actual rejection text emitted by pkg/cluster/validation.go (e.g.
assert.Contains(suite.T(), err.Error(), "OpenShift 3.x is not supported
anymore") or a substring like "OpenShift 3.x") so the negative test checks the
real error message produced by the validation path.

---

Nitpick comments:
In `@central/telemetry/centralclient/client.go`:
- Around line 117-119: Telemetry is reporting the deprecated enum value
OPENSHIFT_CLUSTER while validation rejects OpenShift 3.x; change the value
assigned to orchestrator from storage.ClusterType_OPENSHIFT_CLUSTER.String() to
storage.ClusterType_OPENSHIFT4_CLUSTER.String() in the client.go code (update
the orchestrator assignment), and audit other usages such as
sensor/kubernetes/telemetry/gatherers/cluster.go to replace
storage.ClusterType_OPENSHIFT_CLUSTER with
storage.ClusterType_OPENSHIFT4_CLUSTER so telemetry accurately reflects
OpenShift 4.x and removes the deprecated enum.

In `@image/embed_charts.go`:
- Around line 272-279: The current branch logic treats
storage.ClusterType_OPENSHIFT_CLUSTER as falling through to a generic "invalid
cluster type" error; update the branching in the function handling
values.ClusterType to add an explicit else-if for
storage.ClusterType_OPENSHIFT_CLUSTER.String() that returns a clear, specific
deprecation error (e.g., indicating OpenShift 3 is deprecated and directing
operators to upgrade), while keeping the existing OPENSHIFT4 and KUBERNETES
branches (references: values.ClusterType, storage.ClusterType_OPENSHIFT_CLUSTER,
storage.ClusterType_OPENSHIFT4_CLUSTER, storage.ClusterType_KUBERNETES_CLUSTER,
and the error return at the end).

In
`@pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml`:
- Around line 20-22: Add a negative test case next to the existing "on openshift
4" entry that sets env.openshift: 3 and asserts the chart/template fails
validation; specifically, under the same tests: array add an entry with name "on
openshift 3" and a values block containing env.openshift: 3 and an expectation
that rendering or validation fails (e.g., expectFailure / shouldRender: false /
an assert that error is returned) so the test suite verifies OpenShift 3 is
rejected. Ensure the new test mirrors the structure of the "on openshift 4"
entry but uses env.openshift: 3 and the negative assertion.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: f1f523e8-18f5-42e9-bd9e-440fd30dc2d6

📥 Commits

Reviewing files that changed from the base of the PR and between 4a1e342 and d65dd89.

⛔ Files ignored due to path filters (3)
  • generated/storage/cluster.pb.go is excluded by !**/*.pb.go, !**/generated/**
  • go.sum is excluded by !**/*.sum
  • proto/storage/proto.lock is excluded by !**/*.lock
📒 Files selected for processing (48)
  • CHANGELOG.md
  • central/cluster/datastore/datastore_impl_postgres_test.go
  • central/clusters/zip/render_test.go
  • central/telemetry/centralclient/client.go
  • go.mod
  • image/embed_charts.go
  • image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml
  • image/templates/helm/shared/templates/_openshift.tpl
  • image/templates/helm/stackrox-secured-cluster/internal/cluster-config.yaml.tpl.htpl
  • image/templates/helm/stackrox-secured-cluster/internal/compatibility-translation.yaml
  • image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl
  • image/templates/helm/stackrox-secured-cluster/sensor-chart-upgrade.md.htpl
  • image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl
  • image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml
  • image/templates/helm/stackrox-secured-cluster/values.yaml.htpl
  • pkg/cluster/validation.go
  • pkg/cluster/validation_test.go
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/injected-cabundle-cm.test.yaml
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-auth.test.yaml
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-autosense.test.yaml
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/openshift-monitoring.test.yaml
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner-v4.test.yaml
  • pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/feature-flags/testdata/helmtest/admission-controller-config-disabled/admission-control.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/feature-flags/testdata/helmtest/admission-controller-config/admission-control.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-non-release/development_build.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/development_build-release/development_build.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-non-release/opensource.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/opensource-release/opensource.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/override/override.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/rhacs/rhacs.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/flavor/testdata/helmtest/stackrox/stackrox.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/admission-control.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/audit-logs.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/env.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/injected-cabundle-cm.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/legacy-settings.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/openshift-monitoring.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-slim.test.yaml
  • pkg/helm/charts/tests/securedclusterservices/testdata/helmtest/scanner-v4.test.yaml
  • pkg/renderer/central_db_test.go
  • pkg/renderer/kubernetes_test.go
  • proto/storage/cluster.proto
  • roxctl/central/generate/generate_test.go
  • roxctl/central/generate/k8s.go
  • roxctl/sensor/generate/openshift.go
  • tests/roxctl/bats-tests/cluster/sensor-generate-bundle.bats
💤 Files with no reviewable changes (6)
  • image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl
  • central/cluster/datastore/datastore_impl_postgres_test.go
  • image/templates/helm/stackrox-secured-cluster/values.yaml.htpl
  • image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl
  • roxctl/central/generate/generate_test.go
  • pkg/helm/charts/tests/securedclusterservices/feature-flags/testdata/helmtest/admission-controller-config/admission-control.test.yaml

Comment on lines 7 to 11
{{- if not ._rox.env.openshift }}
type: KUBERNETES_CLUSTER
{{- else }}
type: {{ if eq (int ._rox.env.openshift) 4 -}} OPENSHIFT4_CLUSTER {{- else -}} OPENSHIFT_CLUSTER {{ end }}
type: OPENSHIFT4_CLUSTER
{{- end }}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid silently coercing non-4 OpenShift values to OPENSHIFT4_CLUSTER.

Current logic treats any truthy ._rox.env.openshift as OpenShift 4. That can mask unsupported values instead of failing fast.

Proposed patch
 {{- if ._rox.clusterName }}
 clusterName: {{ ._rox.clusterName }}
 {{- end }}
 managedBy: {{ ._rox.managedBy }}
 clusterConfig:
   staticConfig:
     {{- if not ._rox.env.openshift }}
     type: KUBERNETES_CLUSTER
-    {{- else }}
+    {{- else if eq (toString ._rox.env.openshift) "4" }}
     type: OPENSHIFT4_CLUSTER
+    {{- else }}
+    {{- fail (printf "Unsupported env.openshift value %v: OpenShift 3.x is not supported anymore" ._rox.env.openshift) }}
     {{- end }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
{{- if not ._rox.env.openshift }}
type: KUBERNETES_CLUSTER
{{- else }}
type: {{ if eq (int ._rox.env.openshift) 4 -}} OPENSHIFT4_CLUSTER {{- else -}} OPENSHIFT_CLUSTER {{ end }}
type: OPENSHIFT4_CLUSTER
{{- end }}
{{- if not ._rox.env.openshift }}
type: KUBERNETES_CLUSTER
{{- else if eq (toString ._rox.env.openshift) "4" }}
type: OPENSHIFT4_CLUSTER
{{- else }}
{{- fail (printf "Unsupported env.openshift value %v: OpenShift 3.x is not supported anymore" ._rox.env.openshift) }}
{{- end }}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@image/templates/helm/stackrox-secured-cluster/internal/cluster-config.yaml.tpl.htpl`
around lines 7 - 11, The template currently treats any truthy
._rox.env.openshift as OPENSHIFT4_CLUSTER; change the conditional in
cluster-config.yaml.tpl.htpl to explicitly check for the OpenShift 4 value (e.g.
eq ._rox.env.openshift "4" or the exact token your config uses) and render type:
OPENSHIFT4_CLUSTER only in that case; if ._rox.env.openshift is set to any other
non-empty/unsupported value, fail fast with a clear error (use the template fail
function) instead of coercing, otherwise render type: KUBERNETES_CLUSTER when
._rox.env.openshift is unset/false.

Comment on lines 13 to 16
type: |
env:
openshift: {{ if eq .rawValue "OPENSHIFT4_CLUSTER" }} 4 {{ else }} {{ eq .rawValue "OPENSHIFT_CLUSTER" }} {{ end }}
openshift: {{ eq .rawValue "OPENSHIFT4_CLUSTER" }}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Unsupported OPENSHIFT_CLUSTER is now silently translated to Kubernetes.

Line 15 maps every non-OPENSHIFT4_CLUSTER value to false. In image/templates/helm/stackrox-secured-cluster/internal/cluster-config.yaml.tpl.htpl (Lines 5-11), that resolves to type: KUBERNETES_CLUSTER.
This means legacy OPENSHIFT_CLUSTER input can produce incorrect manifests instead of a hard failure.

Proposed fail-fast fix
 cluster:
   name: |
     clusterName: {{ .value }}
   type: |
-    env:
-      openshift: {{ eq .rawValue "OPENSHIFT4_CLUSTER" }}
+    {{- if eq .rawValue "OPENSHIFT4_CLUSTER" }}
+    env:
+      openshift: true
+    {{- else if eq .rawValue "OPENSHIFT_CLUSTER" }}
+    {{- fail "cluster.type=OPENSHIFT_CLUSTER is no longer supported; use OPENSHIFT4_CLUSTER" }}
+    {{- else }}
+    env:
+      openshift: false
+    {{- end }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
type: |
env:
openshift: {{ if eq .rawValue "OPENSHIFT4_CLUSTER" }} 4 {{ else }} {{ eq .rawValue "OPENSHIFT_CLUSTER" }} {{ end }}
openshift: {{ eq .rawValue "OPENSHIFT4_CLUSTER" }}
type: |
{{- if eq .rawValue "OPENSHIFT4_CLUSTER" }}
env:
openshift: true
{{- else if eq .rawValue "OPENSHIFT_CLUSTER" }}
{{- fail "cluster.type=OPENSHIFT_CLUSTER is no longer supported; use OPENSHIFT4_CLUSTER" }}
{{- else }}
env:
openshift: false
{{- end }}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@image/templates/helm/stackrox-secured-cluster/internal/compatibility-translation.yaml`
around lines 13 - 16, The current template env.openshift only tests eq .rawValue
"OPENSHIFT4_CLUSTER", which silently treats any other value (including legacy
"OPENSHIFT_CLUSTER") as false and yields KUBERNETES manifests; update the
template to explicitly validate .rawValue against allowed values and fail-fast
on unsupported inputs: change the env.openshift logic to a conditional that
returns true only for "OPENSHIFT4_CLUSTER", returns false only for the explicit
"KUBERNETES_CLUSTER" token (if used), and calls the template fail/required
helper with a clear error message when .rawValue is "OPENSHIFT_CLUSTER" or any
other unsupported string so the build errors instead of generating incorrect
manifests (refer to env.openshift, .rawValue and the
cluster-config.yaml.tpl.htpl usage).

Comment on lines +209 to +210
require.Error(suite.T(), err)
assert.Contains(suite.T(), err.Error(), "You have specified OpenShift version 3")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Assertion is checking the wrong error message.

pkg/cluster/validation.go now reports OpenShift 3.x is not supported anymore for storage.ClusterType_OPENSHIFT_CLUSTER, so this substring check is brittle and likely fails against the current renderer path.

Proposed fix
-	require.Error(suite.T(), err)
-	assert.Contains(suite.T(), err.Error(), "You have specified OpenShift version 3")
+	require.ErrorContains(suite.T(), err, "OpenShift 3.x is not supported anymore")
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
require.Error(suite.T(), err)
assert.Contains(suite.T(), err.Error(), "You have specified OpenShift version 3")
require.ErrorContains(suite.T(), err, "OpenShift 3.x is not supported anymore")
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/renderer/central_db_test.go` around lines 209 - 210, The test is
asserting the wrong error substring; update the assertion in central_db_test.go
(the failing block around require.Error(suite.T(), err) / assert.Contains(...))
to look for the new message from pkg/cluster/validation.go — e.g., assert that
err.Error() contains "OpenShift 3.x is not supported anymore" (or assert exact
equality against the full error string returned by the validation function) so
the test matches the updated validation text for
storage.ClusterType_OPENSHIFT_CLUSTER.

Comment on lines +133 to +134
require.Error(suite.T(), err)
assert.Contains(suite.T(), err.Error(), "You have specified OpenShift version 3")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

This negative test is pinned to the wrong error text.

For storage.ClusterType_OPENSHIFT_CLUSTER, pkg/cluster/validation.go currently emits OpenShift 3.x is not supported anymore, so this assertion is likely to fail even though the rejection path is working.

Proposed fix
-	require.Error(suite.T(), err)
-	assert.Contains(suite.T(), err.Error(), "You have specified OpenShift version 3")
+	require.ErrorContains(suite.T(), err, "OpenShift 3.x is not supported anymore")
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
require.Error(suite.T(), err)
assert.Contains(suite.T(), err.Error(), "You have specified OpenShift version 3")
require.ErrorContains(suite.T(), err, "OpenShift 3.x is not supported anymore")
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/renderer/kubernetes_test.go` around lines 133 - 134, The test in
kubernetes_test.go is asserting the wrong error message for
storage.ClusterType_OPENSHIFT_CLUSTER; update the assertion to match the actual
rejection text emitted by pkg/cluster/validation.go (e.g.
assert.Contains(suite.T(), err.Error(), "OpenShift 3.x is not supported
anymore") or a substring like "OpenShift 3.x") so the negative test checks the
real error message produced by the validation path.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

🚀 Build Images Ready

Images are ready for commit 993ba4f. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-642-g993ba4fc6b

@mclasmeier mclasmeier force-pushed the mc/ROX-33465-openshift-autosensing-5 branch from d65dd89 to 993ba4f Compare April 10, 2026 07:19
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 10, 2026

Codecov Report

❌ Patch coverage is 25.00000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.56%. Comparing base (4a1e342) to head (993ba4f).

Files with missing lines Patch % Lines
central/telemetry/centralclient/client.go 0.00% 2 Missing ⚠️
roxctl/central/generate/k8s.go 0.00% 2 Missing ⚠️
image/embed_charts.go 0.00% 1 Missing ⚠️
roxctl/sensor/generate/openshift.go 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #19937      +/-   ##
==========================================
- Coverage   49.56%   49.56%   -0.01%     
==========================================
  Files        2764     2764              
  Lines      208346   208330      -16     
==========================================
- Hits       103271   103260      -11     
+ Misses      97423    97420       -3     
+ Partials     7652     7650       -2     
Flag Coverage Δ
go-unit-tests 49.56% <25.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mclasmeier
Copy link
Copy Markdown
Contributor Author

/test all

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant