OCPBUGS-83405: remove unnecessary exceptions from monitoring test by ehearne-redhat · Pull Request #30924 · openshift/origin

ehearne-redhat · 2026-03-24T09:11:45Z

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Summary by CodeRabbit

Bug Fixes
- Enhanced default service account monitoring by removing outdated exceptions and implementing stricter enforcement across OpenShift components.
Documentation
- Updated comments clarifying when monitoring exceptions apply and how debug pods are handled during testing scenarios.

openshift-ci-robot · 2026-03-24T09:11:49Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-03-24T09:11:51Z

@ehearne-redhat: This pull request references CNTRLPLANE-3052 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note some of the items still have PRs. When they are merged I will move this out of WIP status.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-24T09:11:54Z

Walkthrough

Removed most exceptionWithJira(...) pod/namespace exceptions from the default-service-account monitor test, leaving a single openshift-multus/multus- exception; updated comments and retained the debug-pod detection logic and its explanatory comment.

Changes

Cohort / File(s)	Summary
Default Service Account Monitor `pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go`	Deleted many `exceptionWithJira(...)` entries and several namespace-specific exception handlers, kept a single `openshift-multus/multus-` exception, and updated comments; preserved debug pod detection logic and adjusted its comment.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	This pull request modifies a monitor test that implements the MonitorTest interface, not a Ginkgo-based test. The custom check applies only to Ginkgo test names using It(), Describe(), Context(), When(), and similar functions. Since this file does not use the Ginkgo test framework and contains no Ginkgo test declarations, the check is not applicable.
Test Structure And Quality	✅ Passed	The modified file implements monitor test framework patterns rather than Ginkgo test patterns, which is the standard approach for monitor tests in this codebase.
Microshift Test Compatibility	✅ Passed	PR modifies monitor test framework implementation without adding new Ginkgo e2e test declarations (It(), Describe(), Context(), When()), so MicroShift compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This pull request does not add any new Ginkgo e2e tests. The modified file is a monitoring test that implements the MonitorTest interface.
Topology-Aware Scheduling Compatibility	✅ Passed	Pull request modifies only a monitoring test file with no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	Modified file contains no OTE Binary Stdout Contract violations. No process-level code writes to stdout; fmt.Sprintf() used only for internal string formatting.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR modifies exception rules in a monitoring test analyzer, not Ginkgo e2e tests. No new Ginkgo test definitions (It(), Describe(), Context(), When()) are added.
Title check	✅ Passed	The title clearly and specifically describes the main change: removing unnecessary exceptions from a monitoring test related to the default service account monitor.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ehearne-redhat · 2026-03-24T09:22:02Z

@coderabbitai review

coderabbitai · 2026-03-24T09:23:46Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-03-24T09:24:14Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

openshift-ci-robot · 2026-03-24T09:42:57Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

ehearne-redhat · 2026-03-24T12:06:21Z

Note that the errors in the tests are due to the open PR's for those components. :)

ehearne-redhat · 2026-03-24T15:01:14Z

Tests are failing as we are waiting on the following PR's to be reviewed/merged:

OCPBUGS-65622: add controller for downloads service account deletion logic console-operator#1111
OCPBUGS-65621: add dedicated service account to crb, cvo and version pod cluster-version-operator#1266
OCPBUGS-65631: Use dedicated service accounts for multus pods cluster-network-operator#2845

ehearne-redhat · 2026-03-25T16:58:25Z

/meow

openshift-ci · 2026-03-25T16:58:33Z

@ehearne-redhat:

Details

In response to this:

/meow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ehearne-redhat · 2026-03-25T16:59:23Z

/woof

openshift-ci · 2026-03-25T16:59:29Z

@ehearne-redhat:

Details

In response to this:

/woof

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-03-26T11:59:19Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

ehearne-redhat · 2026-03-26T16:25:50Z

/retest-required

openshift-trt · 2026-03-26T22:00:28Z

Job Failure Risk Analysis for sha: fe21a1c

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-csi	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 17 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:none SecurityMode:default Topology:ha Upgrade:none] in the last week.
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 1 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:none SecurityMode:fips Topology:ha Upgrade:micro] in the last week.
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-1of2	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 7 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:serial SecurityMode:default Topology:ha Upgrade:none] in the last week.
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-2of2	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 7 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:aws Procedure:serial SecurityMode:default Topology:ha Upgrade:none] in the last week.
pull-ci-openshift-origin-main-e2e-vsphere-ovn	Low [Monitor:no-default-service-account-operator-checker][sig-auth] all pods in openshift-multus namespace must not use the default service account. This test has passed 0.00% of 21 runs on release 5.0 [Architecture:amd64 FeatureSet:default Installer:ipi JobTier:standard Network:ovn NetworkStack:ipv4 OS:rhcos9 Owner:eng Platform:vsphere Procedure:none SecurityMode:default Topology:ha Upgrade:none] in the last week.

openshift-ci-robot · 2026-04-13T15:26:43Z

@ehearne-redhat: This pull request references CNTRLPLANE-3052 which is a valid jira issue.

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-04-13T15:33:56Z

@ehearne-redhat: This pull request references CNTRLPLANE-3052 which is a valid jira issue.

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Summary by CodeRabbit

Bug Fixes

Enhanced default service account monitoring by removing outdated exceptions and implementing stricter enforcement across OpenShift components.

Documentation

Updated comments clarifying when monitoring exceptions apply and how debug pods are handled during testing scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai

🧹 Nitpick comments (1)

pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go (1)

53-54: Tighten wording in the debug-pod comment

Minor grammar cleanup to keep the rationale crisp.

Suggested wording tweak

-	// debug pod has showed up in some e2e tests. In order to
+	// debug pods have shown up in some e2e tests. In order to

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go`
around lines 53 - 54, Update the two-line comment that starts with "debug pod
has showed up in some e2e tests..." to a tighter, grammatically correct
phrasing; locate the comment near the debug-pod handling in monitortest.go (the
block describing why the debug pod is included) and replace it with a concise
line such as stating that the debug pod appears in some e2e tests and is
included here to prevent those tests from failing, keeping tense and word choice
correct ("appears" instead of "has showed up", "to prevent failures" instead of
"to stop these tests from failing").

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In
`@pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go`:
- Around line 53-54: Update the two-line comment that starts with "debug pod has
showed up in some e2e tests..." to a tighter, grammatically correct phrasing;
locate the comment near the debug-pod handling in monitortest.go (the block
describing why the debug pod is included) and replace it with a concise line
such as stating that the debug pod appears in some e2e tests and is included
here to prevent those tests from failing, keeping tense and word choice correct
("appears" instead of "has showed up", "to prevent failures" instead of "to stop
these tests from failing").

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a94a50f-96a8-4a3c-90b5-b3398d140877

📥 Commits

Reviewing files that changed from the base of the PR and between 2443300 and efb9f17.

📒 Files selected for processing (1)

pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

openshift-merge-bot · 2026-04-13T16:12:22Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

openshift-trt · 2026-04-13T21:43:15Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: efb9f17

"Find all of the input images from ocp/5.0 and tag them into the stable-initial stream" [Total: 7, Pass: 7, Fail: 0, Flake: 0]

ehearne-redhat · 2026-04-14T08:19:29Z

/retest-required

kevinrizza · 2026-04-14T12:59:19Z

/retitle OCPBUGS-83405: remove unnecessary exceptions from monitoring test

openshift-ci-robot · 2026-04-14T12:59:41Z

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-83405, which is invalid:

expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR removes unnecessary exceptions from the default service account monitoring test. Now that OCPSTRAT-2401 is nearing completion, we need to look at removing these exceptions since they are now complete.

Note that openshift/cluster-network-operator#2845 is still open which is why that exception is being kept.

Summary by CodeRabbit

Bug Fixes

Enhanced default service account monitoring by removing outdated exceptions and implementing stricter enforcement across OpenShift components.

Documentation

Updated comments clarifying when monitoring exceptions apply and how debug pods are handled during testing scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

everettraven · 2026-04-15T12:03:07Z

/lgtm

neisw · 2026-04-15T17:03:18Z

/approve
/retest-required

openshift-ci · 2026-04-15T17:03:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ehearne-redhat, everettraven, neisw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [neisw]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ehearne-redhat · 2026-04-17T12:02:37Z

/retest-required

neisw · 2026-04-20T14:25:59Z

/override ci/prow/e2e-vsphere-ovn-upi

openshift-ci · 2026-04-20T14:26:06Z

@neisw: Overrode contexts on behalf of neisw: ci/prow/e2e-vsphere-ovn-upi

Details

In response to this:

/override ci/prow/e2e-vsphere-ovn-upi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-04-20T14:26:07Z

@ehearne-redhat: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ehearne-redhat · 2026-04-20T14:30:38Z

/verified by ehearne-redhat

openshift-ci-robot · 2026-04-20T14:30:52Z

@ehearne-redhat: This PR has been marked as verified by ehearne-redhat.

Details

In response to this:

/verified by ehearne-redhat

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 24, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 24, 2026

openshift-ci bot requested review from deads2k and p0lyn0mial March 24, 2026 09:12

ehearne-redhat commented Mar 24, 2026

View reviewed changes

Comment thread pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

ehearne-redhat commented Mar 24, 2026

View reviewed changes

Comment thread pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch from 5e35609 to 2443300 Compare March 24, 2026 09:21

ehearne-redhat commented Mar 25, 2026

View reviewed changes

Comment thread pkg/monitortests/authentication/nodefaultserviceaccountoperatortests/monitortest.go Outdated

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch 2 times, most recently from 911ed49 to fe21a1c Compare March 26, 2026 11:35

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch from fe21a1c to 6b65db2 Compare April 13, 2026 15:25

remove unnecessary exceptions from monitoring test

efb9f17

ehearne-redhat force-pushed the ocpstrat-2401-remove-unnecessary-exceptions branch from 6b65db2 to efb9f17 Compare April 13, 2026 15:28

ehearne-redhat changed the title ~~[WIP] CNTRLPLANE-3052: remove unnecessary exceptions from monitoring test~~ CNTRLPLANE-3052: remove unnecessary exceptions from monitoring test Apr 13, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 13, 2026

coderabbitai bot reviewed Apr 13, 2026

View reviewed changes

openshift-ci bot changed the title ~~CNTRLPLANE-3052: remove unnecessary exceptions from monitoring test~~ OCPBUGS-83405: remove unnecessary exceptions from monitoring test Apr 14, 2026

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Apr 14, 2026

openshift-ci bot assigned everettraven Apr 15, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 15, 2026

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 15, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Apr 20, 2026

Conversation

ehearne-redhat commented Mar 24, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Mar 24, 2026

Uh oh!

openshift-ci-robot commented Mar 24, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

Uh oh!

Uh oh!

ehearne-redhat commented Mar 24, 2026

Uh oh!

coderabbitai bot commented Mar 24, 2026

Uh oh!

coderabbitai bot commented Mar 24, 2026

Uh oh!

openshift-ci-robot commented Mar 24, 2026

Uh oh!

ehearne-redhat commented Mar 24, 2026

Uh oh!

ehearne-redhat commented Mar 24, 2026

Uh oh!

Uh oh!

ehearne-redhat commented Mar 25, 2026

Uh oh!

openshift-ci bot commented Mar 25, 2026

Uh oh!

ehearne-redhat commented Mar 25, 2026

Uh oh!

openshift-ci bot commented Mar 25, 2026

Uh oh!

openshift-ci-robot commented Mar 26, 2026

Uh oh!

ehearne-redhat commented Mar 26, 2026

Uh oh!

openshift-trt bot commented Mar 26, 2026

Uh oh!

openshift-ci-robot commented Apr 13, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Apr 13, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot bot commented Apr 13, 2026

Uh oh!

openshift-trt bot commented Apr 13, 2026

Uh oh!

ehearne-redhat commented Apr 14, 2026

Uh oh!

kevinrizza commented Apr 14, 2026

Uh oh!

openshift-ci-robot commented Apr 14, 2026

Summary by CodeRabbit

Uh oh!

everettraven commented Apr 15, 2026

Uh oh!

neisw commented Apr 15, 2026

Uh oh!

openshift-ci bot commented Apr 15, 2026

Uh oh!

ehearne-redhat commented Apr 17, 2026

Uh oh!

neisw commented Apr 20, 2026

Uh oh!

openshift-ci bot commented Apr 20, 2026

Uh oh!

openshift-ci bot commented Apr 20, 2026

Uh oh!

ehearne-redhat commented Mar 24, 2026 •

edited by coderabbitai bot

Loading

openshift-ci-robot commented Mar 24, 2026 •

edited by openshift-ci bot

Loading

coderabbitai bot commented Mar 24, 2026 •

edited

Loading

openshift-ci-robot commented Apr 13, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Apr 13, 2026 •

edited by openshift-ci bot

Loading