Skip to content

CMP-4116: Fix platform scan pod stuck when RawResultStorage is disabled #1097

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Vincent056 wants to merge 3 commits into
base: master
Choose a base branch
from
Open

CMP-4116: Fix platform scan pod stuck when RawResultStorage is disabled #1097

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ab504ea
Fix platform scan pod stuck when RawResultStorage is disabled
Vincent056 Feb 26, 2026
c31c6c6
Add e2e test for platform scan with RawResultStorage disabled
Vincent056 Feb 26, 2026
58bc304
Move PVC check after scan completes to avoid race condition
Vincent056 Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 5 additions & 14 deletions pkg/controller/compliancescan/scan.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -516,18 +516,7 @@ func addResultsCollectionPods(scanInstance *compv1alpha1.ComplianceScan, pod *co
corev1.ResourceCPU: resource.MustParse("100m"),
},
},
VolumeMounts: []corev1.VolumeMount{
{
Name: "report-dir",
MountPath: "/reports",
ReadOnly: true,
},
{
Name: "tls",
MountPath: "/etc/pki/tls",
ReadOnly: true,
},
},
VolumeMounts: getLogCollectorVolumeMounts(scanInstance),
},
}

Expand All @@ -549,14 +538,16 @@ func addResultsCollectionPods(scanInstance *compv1alpha1.ComplianceScan, pod *co
},
},
},
{
}
if scanInstance.Spec.RawResultStorage.Enabled != nil && *scanInstance.Spec.RawResultStorage.Enabled {
podVolumes = append(podVolumes, corev1.Volume{
Name: "tls",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: ClientCertPrefix + scanInstance.Name,
},
},
},
})
}

pod.Spec.Volumes = append(pod.Spec.Volumes, podVolumes...)
Expand Down
61 changes: 61 additions & 0 deletions tests/e2e/parallel/main_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2303,6 +2303,67 @@ func TestScheduledSuiteNoStorage(t *testing.T) {
}
}

func TestScheduledSuitePlatformNoStorage(t *testing.T) {
t.Parallel()
f := framework.Global
suiteName := "test-scheduled-suite-platform-no-storage"
platformScanName := fmt.Sprintf("%s-platform-scan", suiteName)

falseValue := false
testSuite := &compv1alpha1.ComplianceSuite{
ObjectMeta: metav1.ObjectMeta{
Name: suiteName,
Namespace: f.OperatorNamespace,
},
Spec: compv1alpha1.ComplianceSuiteSpec{
ComplianceSuiteSettings: compv1alpha1.ComplianceSuiteSettings{
AutoApplyRemediations: false,
},
Scans: []compv1alpha1.ComplianceScanSpecWrapper{
{
Name: platformScanName,
ComplianceScanSpec: compv1alpha1.ComplianceScanSpec{
ContentImage: contentImagePath,
Profile: "xccdf_org.ssgproject.content_profile_cis",
Content: framework.OcpContentFile,
Rule: "xccdf_org.ssgproject.content_rule_cluster_version_operator_exists",
ScanType: compv1alpha1.ScanTypePlatform,
ComplianceScanSettings: compv1alpha1.ComplianceScanSettings{
RawResultStorage: compv1alpha1.RawResultStorageSettings{
Enabled: &falseValue,
},
Debug: true,
},
},
},
},
},
}

err := f.Client.Create(context.TODO(), testSuite, nil)
if err != nil {
t.Fatal(err)
}
defer f.Client.Delete(context.TODO(), testSuite)

// Ensure that all the scans in the suite have finished and are marked as Done
err = f.WaitForSuiteScansStatus(f.OperatorNamespace, suiteName, compv1alpha1.PhaseDone, compv1alpha1.ResultCompliant)
if err != nil {
t.Fatal(err)
}

pvcList := &corev1.PersistentVolumeClaimList{}
err = f.Client.List(context.TODO(), pvcList, client.InNamespace(f.OperatorNamespace), client.MatchingLabels(map[string]string{
Copy link
Collaborator

@rhmdnd rhmdnd Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to happen really fast after the scan is created, where the reconcilation loop might not have picked up the change yet and even had the opportunity to test the conditional.

Would it make sense to move this to after the scan completes?

compv1alpha1.ComplianceScanLabel: platformScanName,
}))
if err != nil {
t.Fatal(err)
}
for _, pvc := range pvcList.Items {
t.Fatalf("Found unexpected PVC %s", pvc.Name)
}
}

func TestScheduledSuiteInvalidPriorityClass(t *testing.T) {
t.Parallel()
f := framework.Global
Expand Down
Loading