SDCICD-1721 create dynamic e2e secrets as secret#472
SDCICD-1721 create dynamic e2e secrets as secret#472ritmun wants to merge 1 commit intoopenshift:masterfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to data retention organization setting 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds an OpenShift secret template and updates the e2e job template to mount that secret as a read-only volume and pass its path to the osde2e container via args. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@test/e2e/rmo_configmap.yml`:
- Around line 1-2: The Template manifest uses an incorrect apiVersion
(apiVersion: v1) for kind: Template which fails on OpenShift 4.x; update the
apiVersion value to the canonical group "template.openshift.io/v1" so the
Template resource (kind: Template) is recognized (matching the existing
e2e-template.yml and OpenShift 4.x API).
- Around line 10-13: The ConfigMap is storing a sensitive value
(EXTERNAL_SECRET_OIDC_CLIENT_SECRET); remove EXTERNAL_SECRET_OIDC_CLIENT_SECRET
from the ConfigMap data and instead create a Kubernetes Secret resource
containing that key/value, keep EXTERNAL_SECRET_OIDC_CLIENT_ID and
EXTERNAL_SECRET_OIDC_ISSUER_URL in the ConfigMap, and update any consumers
(e.g., Deployment/Pod manifest or env specs) to read the secret via
secretKeyRef/secretRef (referencing the new Secret name and key) rather than
from the ConfigMap. Ensure the Secret uses the same environment variable key
(EXTERNAL_SECRET_OIDC_CLIENT_SECRET) so consumers need only switch to
secretKeyRef in their env or volume mount.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (2)
test/e2e/e2e-template.ymltest/e2e/rmo_configmap.yml
There was a problem hiding this comment.
♻️ Duplicate comments (1)
test/e2e/rmo_configmap.yml (1)
10-13:⚠️ Potential issue | 🟠 MajorMove OIDC client secret out of ConfigMap.
Line 12 still places
EXTERNAL_SECRET_OIDC_CLIENT_SECRETin aConfigMap, which is inappropriate for sensitive credentials. This appears to be the same unresolved issue from earlier review.Proposed fix
objects: - apiVersion: v1 kind: ConfigMap metadata: name: route-monitor-operator-cm data: EXTERNAL_SECRET_OIDC_CLIENT_ID: ${EXTERNAL_SECRET_OIDC_CLIENT_ID} - EXTERNAL_SECRET_OIDC_CLIENT_SECRET: ${EXTERNAL_SECRET_OIDC_CLIENT_SECRET} EXTERNAL_SECRET_OIDC_ISSUER_URL: ${EXTERNAL_SECRET_OIDC_ISSUER_URL} +- apiVersion: v1 + kind: Secret + metadata: + name: route-monitor-operator-secret + stringData: + EXTERNAL_SECRET_OIDC_CLIENT_SECRET: ${EXTERNAL_SECRET_OIDC_CLIENT_SECRET}And update the e2e job template to consume that secret:
envFrom: - configMapRef: name: route-monitor-operator-cm - secretRef: name: route-monitor-operator-secret🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@test/e2e/rmo_configmap.yml` around lines 10 - 13, Remove EXTERNAL_SECRET_OIDC_CLIENT_SECRET from the ConfigMap data and instead place it into a Kubernetes Secret (e.g., route-monitor-operator-secret) so sensitive credentials are not stored in plain text; update the e2e job template to load environment variables from both the ConfigMap (route-monitor-operator-cm) and the new Secret via envFrom with secretRef pointing to the secret, and ensure any code or manifests that reference EXTERNAL_SECRET_OIDC_CLIENT_SECRET now read it from the Secret rather than the ConfigMap.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@test/e2e/rmo_configmap.yml`:
- Around line 10-13: Remove EXTERNAL_SECRET_OIDC_CLIENT_SECRET from the
ConfigMap data and instead place it into a Kubernetes Secret (e.g.,
route-monitor-operator-secret) so sensitive credentials are not stored in plain
text; update the e2e job template to load environment variables from both the
ConfigMap (route-monitor-operator-cm) and the new Secret via envFrom with
secretRef pointing to the secret, and ensure any code or manifests that
reference EXTERNAL_SECRET_OIDC_CLIENT_SECRET now read it from the Secret rather
than the ConfigMap.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (2)
test/e2e/e2e-template.ymltest/e2e/rmo_configmap.yml
ritmun
force-pushed
the
SDCICD-1721
branch
2 times, most recently
from
c1dcc70 to
8ab08f0
Compare
ritmun
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@test/e2e/rmo_secret.yml`:
- Around line 10-13: Replace the Secret's `data` map with `stringData` so that
plaintext template-substituted parameters like EXTERNAL_SECRET_OIDC_CLIENT_ID,
EXTERNAL_SECRET_OIDC_CLIENT_SECRET, and EXTERNAL_SECRET_OIDC_ISSUER_URL are
accepted and Kubernetes handles base64 encoding; locate the block containing the
keys EXTERNAL_SECRET_OIDC_CLIENT_ID / EXTERNAL_SECRET_OIDC_CLIENT_SECRET /
EXTERNAL_SECRET_OIDC_ISSUER_URL (currently under `data`) and rename the field to
`stringData`, leaving the parameter references unchanged.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (2)
test/e2e/e2e-template.ymltest/e2e/rmo_secret.yml
ritmun
force-pushed
the
SDCICD-1721
branch
2 times, most recently
from
040134b to
ae2a043
Compare
helping to boilerplate the template
|
@ritmun: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #472 +/- ##
=======================================
Coverage 55.91% 55.91%
=======================================
Files 31 31
Lines 2749 2749
=======================================
Hits 1537 1537
Misses 1120 1120
Partials 92 92 🚀 New features to boost your workflow:
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ritmun, YiqinZhang The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
3 participants
helping to boilerplate the template
Summary by CodeRabbit