OCPBUGS-83405: remove unnecessary exceptions from monitoring test by ehearne-redhat · Pull Request #30924 · openshift/origin

ehearne-redhat · 2026-03-24T09:11:45Z

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Summary by CodeRabbit

Bug Fixes
- Enhanced default service account monitoring by removing outdated exceptions and implementing stricter enforcement across OpenShift components.
Documentation
- Updated comments clarifying when monitoring exceptions apply and how debug pods are handled during testing scenarios.

openshift-ci-robot · 2026-03-24T09:11:49Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-03-24T09:11:51Z

@ehearne-redhat: This pull request references CNTRLPLANE-3052 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note some of the items still have PRs. When they are merged I will move this out of WIP status.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-24T09:11:54Z

Walkthrough

Removed most exceptionWithJira(...) pod/namespace exceptions from the default-service-account monitor test, leaving a single openshift-multus/multus- exception; updated comments and retained the debug-pod detection logic and its explanatory comment.

Changes

Cohort / File(s)	Summary
Default Service Account Monitor `pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go`	Deleted many `exceptionWithJira(...)` entries and several namespace-specific exception handlers, kept a single `openshift-multus/multus-` exception, and updated comments; preserved debug pod detection logic and adjusted its comment.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	This pull request modifies a monitor test that implements the MonitorTest interface, not a Ginkgo-based test. The custom check applies only to Ginkgo test names using It(), Describe(), Context(), When(), and similar functions. Since this file does not use the Ginkgo test framework and contains no Ginkgo test declarations, the check is not applicable.
Test Structure And Quality	✅ Passed	The modified file implements monitor test framework patterns rather than Ginkgo test patterns, which is the standard approach for monitor tests in this codebase.
Microshift Test Compatibility	✅ Passed	PR modifies monitor test framework implementation without adding new Ginkgo e2e test declarations (It(), Describe(), Context(), When()), so MicroShift compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This pull request does not add any new Ginkgo e2e tests. The modified file is a monitoring test that implements the MonitorTest interface.
Topology-Aware Scheduling Compatibility	✅ Passed	Pull request modifies only a monitoring test file with no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	Modified file contains no OTE Binary Stdout Contract violations. No process-level code writes to stdout; fmt.Sprintf() used only for internal string formatting.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR modifies exception rules in a monitoring test analyzer, not Ginkgo e2e tests. No new Ginkgo test definitions (It(), Describe(), Context(), When()) are added.
Title check	✅ Passed	The title clearly and specifically describes the main change: removing unnecessary exceptions from a monitoring test related to the default service account monitor.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ehearne-redhat · 2026-03-24T09:22:02Z

@coderabbitai review

coderabbitai · 2026-03-24T09:23:46Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-03-24T09:24:14Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

openshift-ci-robot · 2026-03-24T09:42:57Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

ehearne-redhat · 2026-03-24T12:06:21Z

Note that the errors in the tests are due to the open PR's for those components. :)

ehearne-redhat · 2026-03-24T15:01:14Z

Tests are failing as we are waiting on the following PR's to be reviewed/merged:

OCPBUGS-65622: add controller for downloads service account deletion logic console-operator#1111
OCPBUGS-65621: add dedicated service account to crb, cvo and version pod cluster-version-operator#1266
OCPBUGS-65631: Use dedicated service accounts for multus pods cluster-network-operator#2845

ehearne-redhat · 2026-03-25T16:58:25Z

/meow

openshift-ci · 2026-03-25T16:58:33Z

@ehearne-redhat:

Details

In response to this:

/meow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ehearne-redhat · 2026-03-25T16:59:23Z

/woof

openshift-ci · 2026-03-25T16:59:29Z

@ehearne-redhat:

Details

In response to this:

/woof

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-03-26T11:59:19Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

ehearne-redhat · 2026-03-26T16:25:50Z

/retest-required

openshift-trt · 2026-03-26T22:00:28Z

Job Failure Risk Analysis for sha: fe21a1c

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-csi	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 17 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:none SecurityMode:default Topology:ha Upgrade:none] in the last week.
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 1 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:none SecurityMode:fips Topology:ha Upgrade:micro] in the last week.
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-1of2	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 7 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:serial SecurityMode:default Topology:ha Upgrade:none] in the last week.
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-2of2	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 7 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:serial SecurityMode:default Topology:ha Upgrade:none] in the last week.
pull-ci-openshift-origin-main-e2e-vsphere-ovn	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 21 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:vsphere Procedure:none SecurityMode:default Topology:ha Upgrade:none] in the last week.

openshift-ci-robot · 2026-04-13T15:26:43Z

@ehearne-redhat: This pull request references CNTRLPLANE-3052 which is a valid jira issue.

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

neisw · 2026-04-20T14:25:59Z

/override ci/prow/e2e-vsphere-ovn-upi

openshift-ci · 2026-04-20T14:26:06Z

@neisw: Overrode contexts on behalf of neisw: ci/prow/e2e-vsphere-ovn-upi

Details

In response to this:

/override ci/prow/e2e-vsphere-ovn-upi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ehearne-redhat · 2026-04-20T14:30:38Z

/verified by ehearne-redhat

openshift-ci-robot · 2026-04-20T14:30:52Z

@ehearne-redhat: This PR has been marked as verified by ehearne-redhat.

Details

In response to this:

/verified by ehearne-redhat

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-04-22T10:04:39Z

/jira refresh

openshift-ci-robot · 2026-04-22T10:04:44Z

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-83405, which is invalid:

expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.22.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-04-22T10:05:40Z

/jira refresh

openshift-ci-robot · 2026-04-22T10:05:44Z

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-83405, which is invalid:

expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.22.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-04-22T10:06:25Z

/jira refresh

openshift-ci-robot · 2026-04-22T10:06:32Z

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-83405, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-04-22T10:09:12Z

/refresh

openshift-merge-bot · 2026-04-22T10:39:19Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

openshift-merge-bot · 2026-04-22T12:24:17Z

/retest-required

Remaining retests: 0 against base HEAD 90131c2 and 2 for PR HEAD efb9f17 in total

openshift-trt · 2026-04-22T15:10:07Z

Job Failure Risk Analysis for sha: efb9f17

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	IncompleteTests Tests for this run (29) are below the historical average (1338): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	IncompleteTests Tests for this run (29) are below the historical average (686): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)

openshift-merge-bot · 2026-04-22T16:04:18Z

/retest-required

Remaining retests: 0 against base HEAD cad1b7a and 1 for PR HEAD efb9f17 in total

openshift-trt · 2026-04-22T16:13:49Z

Job Failure Risk Analysis for sha: efb9f17

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	IncompleteTests Tests for this run (29) are below the historical average (1331): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	IncompleteTests Tests for this run (29) are below the historical average (679): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)

openshift-trt · 2026-04-22T19:16:29Z

Job Failure Risk Analysis for sha: efb9f17

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	IncompleteTests Tests for this run (28) are below the historical average (1224): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	IncompleteTests Tests for this run (29) are below the historical average (628): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)

openshift-merge-bot · 2026-04-22T19:44:03Z

/retest-required

Remaining retests: 0 against base HEAD ea97fb6 and 0 for PR HEAD efb9f17 in total

openshift-merge-bot · 2026-04-22T23:07:17Z

/hold

Revision efb9f17 was retested 3 times: holding

ehearne-redhat · 2026-04-23T08:55:27Z

/retest-required

ehearne-redhat · 2026-04-23T11:16:53Z

/unhold

infra issues resolved.

openshift-ci · 2026-04-23T12:02:34Z

@ehearne-redhat: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-04-23T12:03:54Z

@ehearne-redhat: Jira Issue Verification Checks: Jira Issue OCPBUGS-83405
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-83405 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Summary by CodeRabbit

Bug Fixes

Enhanced default service account monitoring by removing outdated exceptions and implementing stricter enforcement across OpenShift components.

Documentation

Updated comments clarifying when monitoring exceptions apply and how debug pods are handled during testing scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2026-04-24T19:42:02Z

Fix included in release 5.0.0-0.nightly-2026-04-24-121336

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 24, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 24, 2026

openshift-ci Bot requested review from deads2k and p0lyn0mial March 24, 2026 09:12

ehearne-redhat commented Mar 24, 2026

View reviewed changes

Comment thread pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

ehearne-redhat commented Mar 24, 2026

View reviewed changes

Comment thread pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch from 5e35609 to 2443300 Compare March 24, 2026 09:21

ehearne-redhat commented Mar 25, 2026

View reviewed changes

Comment thread pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go Outdated

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch 2 times, most recently from 911ed49 to fe21a1c Compare March 26, 2026 11:35

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch from fe21a1c to 6b65db2 Compare April 13, 2026 15:25

remove unnecessary exceptions from monitoring test

efb9f17

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch from 6b65db2 to efb9f17 Compare April 13, 2026 15:28

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Apr 20, 2026

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 22, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 22, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 23, 2026

openshift-merge-bot Bot merged commit bb6d043 into openshift:main Apr 23, 2026
21 checks passed

Conversation

ehearne-redhat commented Mar 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Mar 24, 2026

Uh oh!

openshift-ci-robot commented Mar 24, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

Uh oh!

Uh oh!

ehearne-redhat commented Mar 24, 2026

Uh oh!

coderabbitai Bot commented Mar 24, 2026

Uh oh!

coderabbitai Bot commented Mar 24, 2026

Uh oh!

openshift-ci-robot commented Mar 24, 2026

Uh oh!

ehearne-redhat commented Mar 24, 2026

Uh oh!

ehearne-redhat commented Mar 24, 2026

Uh oh!

Uh oh!

ehearne-redhat commented Mar 25, 2026

Uh oh!

openshift-ci Bot commented Mar 25, 2026

Uh oh!

ehearne-redhat commented Mar 25, 2026

Uh oh!

openshift-ci Bot commented Mar 25, 2026

Uh oh!

openshift-ci-robot commented Mar 26, 2026

Uh oh!

ehearne-redhat commented Mar 26, 2026

Uh oh!

openshift-trt Bot commented Mar 26, 2026

Uh oh!

openshift-ci-robot commented Apr 13, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

neisw commented Apr 20, 2026

Uh oh!

openshift-ci Bot commented Apr 20, 2026

Uh oh!

ehearne-redhat commented Apr 20, 2026

Uh oh!

openshift-ci-robot commented Apr 20, 2026

Uh oh!

ehearne-redhat commented Apr 22, 2026

Uh oh!

openshift-ci-robot commented Apr 22, 2026

Uh oh!

ehearne-redhat commented Apr 22, 2026

Uh oh!

openshift-ci-robot commented Apr 22, 2026

Uh oh!

ehearne-redhat commented Apr 22, 2026

Uh oh!

openshift-ci-robot commented Apr 22, 2026

Uh oh!

ehearne-redhat commented Apr 22, 2026

Uh oh!

openshift-merge-bot Bot commented Apr 22, 2026

Uh oh!

openshift-merge-bot Bot commented Apr 22, 2026

Uh oh!

openshift-trt Bot commented Apr 22, 2026

Uh oh!

openshift-merge-bot Bot commented Apr 22, 2026

Uh oh!

openshift-trt Bot commented Apr 22, 2026

Uh oh!

ehearne-redhat commented Mar 24, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Mar 24, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Mar 24, 2026 •

edited

Loading

openshift-ci-robot commented Apr 13, 2026 •

edited by openshift-ci Bot

Loading