"OTA-2106: drop NetworkCheck (SDN gone, proxy data unused)" - #1442
"OTA-2106: drop NetworkCheck (SDN gone, proxy data unused)"#1442jrangelramos wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@jrangelramos: This pull request references OTA-2025 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
💤 Files with no reviewable changes (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe network readiness check and its resource identifiers were removed. Readiness fixtures and tests no longer register network resources or expect the ChangesReadiness network check removal
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This PR makes a localized change to prevent proxy credentials from being forwarded in readiness data, with targeted and existing tests reported as passing; no actionable merge-blocking risk remains. Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/readiness/checks_test.go`:
- Around line 742-746: Update the proxy redaction test around the https_proxy
assertion to always compare proxy["https_proxy"] with tt.wantHTTPS, including
empty expectations. Extend the test cases with the hostless proxy input
http:admin:s3cret@proxy.corp:8080 and expect [configured], preserving coverage
of fail-closed redaction.
In `@pkg/readiness/network.go`:
- Around line 81-86: Update the proxy URL sanitization flow after url.Parse and
before returning u.String() to validate that the parsed URL has both a scheme
and host; return "[configured]" when either is missing. Preserve removing u.User
before returning valid sanitized URLs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: c640fbe3-6a62-4dbc-a304-8f5b15936e70
📒 Files selected for processing (2)
pkg/readiness/checks_test.gopkg/readiness/network.go
f0b656d to
8d4a5a1
Compare
8d4a5a1 to
09cdec7
Compare
|
Scheduling tests matching the |
|
/retest-required |
| "http_proxy": NestedString(proxy.Object, "spec", "httpProxy"), | ||
| "https_proxy": NestedString(proxy.Object, "spec", "httpsProxy"), | ||
| "http_proxy": redactProxyURL(NestedString(proxy.Object, "spec", "httpProxy")), | ||
| "https_proxy": redactProxyURL(NestedString(proxy.Object, "spec", "httpsProxy")), |
There was a problem hiding this comment.
Seems like a good time to revisit pkg/readiness/network.go as a whole (CC @harche). It currently has:
-
An SDN warning, but SDN is gone since 4.17, so... no point in a 5.0 CVO looking around for it, right?
-
Embedding the Proxy config in the output, but:
agentic-skills$ git grep -i proxy origin/main -- cluster-update ...no hits...
So maybe we can just drop that whole check, like we dropped the CRD check in #1415?
|
/retitle "OTA-2106: Redact proxy URL credentials from AgenticRun readiness data" |
openshift-ci
Bot
changed the title
|
@jrangelramos: This pull request references OTA-2106 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
The NetworkCheck gathered SDN status, proxy configuration, and TLS profile from the cluster. SDN is gone since 4.17 (irrelevant for a 5.0 CVO), proxy URLs are not consumed by cluster-update tooling, and embedding them in readiness data risks leaking credentials to the LLM provider (OTA-2106). Remove the entire check rather than just redacting proxy credentials — data that is never collected cannot leak. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
09cdec7 to
f6bd3dd
Compare
|
/retitle "OTA-2106: drop NetworkCheck (SDN gone, proxy data unused)" |
openshift-ci
Bot
changed the title
|
@jrangelramos: This pull request references OTA-2106 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ankitathomas, jrangelramos, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/retest |
|
@jrangelramos: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
5 participants
Summary
user:password@host). TheNetworkCheckreadiness collector forwarded these unsanitized into the AgenticRun request sent to the LLM provider.redactProxyURL()to strip the userinfo component vianet/url.Parsebefore including proxy URLs in readiness output. Falls back to[configured]if parsing fails (fail-closed).no_proxyis unchanged — it's a host list, not a URL.Test plan
TestNetworkCheck_ProxyCredentialRedaction: credentials stripped, no-credentials passthrough, empty stringUpdate: NetworkCheck removed entirely
Per review feedback, the initial redaction approach was replaced by dropping
the
NetworkCheckaltogether:git grep -i proxy -- cluster-updatereturns no hits — nothing consumes this dataData that is never collected cannot leak. This fully addresses OTA-2106 by
eliminating the exposure surface rather than sanitizing it.
What was removed
pkg/readiness/network.go(NetworkCheck + redactProxyURL)GVRNetwork,GVRProxy,GVRAPIServerdeclarations🤖 Generated with Claude Code
Summary by CodeRabbit
Changes
Tests