Skip to content

fix(compliance): Start TP informer after profiles have synced#19938

Merged
guzalv merged 1 commit intomasterfrom
master-base/gualvare/fix-compliance-start-tp-informer-after-oob
Apr 10, 2026
Merged

fix(compliance): Start TP informer after profiles have synced#19938
guzalv merged 1 commit intomasterfrom
master-base/gualvare/fix-compliance-start-tp-informer-after-oob

Conversation

@guzalv
Copy link
Copy Markdown
Contributor

@guzalv guzalv commented Apr 10, 2026

Description

Tailored profiles usually extend a base profile (add or remove rules from it). This PR fixes a race condition where a TP's base profile may not have synced by the time it was processed, because profiles and tailored profiles informers were started concurrently:

Error: error getting profile ocp4-e8: profiles.compliance.openshift.io "ocp4-e8" not found 

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

CI, deployed in a cluster and verified that the race is gone.

@guzalv
Copy link
Copy Markdown
Contributor Author

guzalv commented Apr 10, 2026

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 10, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Copy link
Copy Markdown
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • Several calls that previously asserted on errors now ignore them (e.g., ListComplianceScanConfigurations and DeleteComplianceScanConfiguration in tests use _ =/_ , _ :=); consider restoring explicit error checks or adding a clear justification, since silently dropping these errors can hide real regressions in the compliance API.
  • The e2e-tailored-profile identifier is now hard-coded in Go tests, e2e shell scripts, and YAML; consider centralizing this as a shared constant or adding a clear comment in each place to reduce the risk of the name drifting between components.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Several calls that previously asserted on errors now ignore them (e.g., `ListComplianceScanConfigurations` and `DeleteComplianceScanConfiguration` in tests use `_ =`/`_ , _ :=`); consider restoring explicit error checks or adding a clear justification, since silently dropping these errors can hide real regressions in the compliance API.
- The `e2e-tailored-profile` identifier is now hard-coded in Go tests, e2e shell scripts, and YAML; consider centralizing this as a shared constant or adding a clear comment in each place to reduce the risk of the name drifting between components.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

🚀 Build Images Ready

Images are ready for commit 38c2fdc. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-621-g38c2fdc69b

@guzalv guzalv force-pushed the master-base/gualvare/fix-compliance-start-tp-informer-after-oob branch from ed0f017 to d8b4493 Compare April 10, 2026 08:51
@stackrox stackrox deleted a comment from coderabbitai bot Apr 10, 2026
Copy link
Copy Markdown
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@guzalv
Copy link
Copy Markdown
Contributor Author

guzalv commented Apr 10, 2026

Hey - I've left some high level feedback:

  • Several calls that previously asserted on errors now ignore them (e.g., ListComplianceScanConfigurations and DeleteComplianceScanConfiguration in tests use _ =/_ , _ :=); consider restoring explicit error checks or adding a clear justification, since silently dropping these errors can hide real regressions in the compliance API.
  • The e2e-tailored-profile identifier is now hard-coded in Go tests, e2e shell scripts, and YAML; consider centralizing this as a shared constant or adding a clear comment in each place to reduce the risk of the name drifting between components.

Prompt for AI Agents
Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

This is about an unrelated commit I pushed accidentally. I also deleted a similar coderabbit comment

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 10, 2026

📝 Walkthrough

Walkthrough

Deferred and conditional startup of compliance tailored profiles informer. The handler registration is moved from an early startup block to after the preTopLevelDeploymentWaitGroup phase completes, remaining conditional on coAvailable being true. The startAndWait call is updated to include crdSharedInformerFactory as a parameter.

Changes

Cohort / File(s) Summary
Kubernetes Resource Event Handler
sensor/kubernetes/listener/resource_event_handler.go
Deferred initialization of compliance tailored profiles informer from early coAvailable block to post-preTopLevelDeploymentWaitGroup phase. CRD shared informer factory added to startAndWait call parameters.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~35 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 17.65% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main fix: deferring the Tailored Profile informer startup to occur after base profiles have synced, addressing the core race condition.
Description check ✅ Passed The pull request description is comprehensive and well-structured, following the template with all required sections completed.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch master-base/gualvare/fix-compliance-start-tp-informer-after-oob

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@guzalv guzalv marked this pull request as ready for review April 10, 2026 09:09
@guzalv guzalv requested a review from a team as a code owner April 10, 2026 09:09
@guzalv guzalv requested a review from lvalerom April 10, 2026 09:11
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 10, 2026

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.56%. Comparing base (4a1e342) to head (d8b4493).
⚠️ Report is 4 commits behind head on master.

Files with missing lines Patch % Lines
...nsor/kubernetes/listener/resource_event_handler.go 0.00% 5 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #19938      +/-   ##
==========================================
- Coverage   49.56%   49.56%   -0.01%     
==========================================
  Files        2764     2764              
  Lines      208346   208348       +2     
==========================================
- Hits       103271   103268       -3     
- Misses      97423    97429       +6     
+ Partials     7652     7651       -1     
Flag Coverage Δ
go-unit-tests 49.56% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

@lvalerom lvalerom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 10, 2026

@guzalv: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/gke-qa-e2e-tests d8b4493 link false /test gke-qa-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@guzalv guzalv merged commit 38c2fdc into master Apr 10, 2026
105 of 107 checks passed
@guzalv guzalv deleted the master-base/gualvare/fix-compliance-start-tp-informer-after-oob branch April 10, 2026 11:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants