CMP-3930: Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy #960

xiaojiey · 2025-11-12T04:41:42Z

In newer OpenShift versions(4.21) have a ValidatingAdmissionPolicy that rejects MCPs without proper selectors. As a result it's no longer testable via e2e because you can't create such MCPs anymore due to ValidatingAdmissionPolicy enforcement.

% oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.21.0-0.nightly-2025-11-22-193140   True        False         5h48m   Cluster version is 4.21.0-0.nightly-2025-11-22-193140
% oc get ValidatingAdmissionPolicy custom-machine-config-pool-selector -o=jsonpath={.spec.validations} | jq -r
[
  {
    "expression": "( has(object.spec.machineConfigSelector.matchLabels) && ( (object.spec.machineConfigSelector.matchLabels[\"machineconfiguration.openshift.io/role\"] == \"master\") || (object.spec.machineConfigSelector.matchLabels[\"machineconfiguration.openshift.io/role\"] == \"worker\") || (object.spec.machineConfigSelector.matchLabels[\"machineconfiguration.openshift.io/role\"] == \"arbiter\") ) ) || ( has(object.spec.machineConfigSelector.matchExpressions) && ( (object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == \"machineconfiguration.openshift.io/role\" && e.operator == \"In\" && \"worker\" in e.values) ) || (object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == \"machineconfiguration.openshift.io/role\" && e.operator == \"NotIn\" && !(\"worker\" in e.values)) ) ) )",
    "message": "All custom MachineConfigPools must inherit from the worker pool and must have a machineConfigSelector that matches for a 'machineconfiguration.openshift.io/role: worker' label"
  }
]

This PR means to include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy.
Without this PR, for the make e2e-serial, you will get the below error:

creating Machine Config Pool e2e-invalid: machineconfigpools.machineconfiguration.openshift.io "e2e-invalid" is forbidden: ValidatingAdmissionPolicy 
'custom-machine-config-pool-selector' with binding 'custom-machine-config-pool-selector-binding' denied request: expression '( has(object.spec.machineConfigSelector.matchLabels) && ( 
(object.spec.machineConfigSelector.matchLabels["machineconfiguration.openshift.io/role"] == "master") || (object.spec.machineConfigSelector.matchLabels["machineconfiguration.openshift.io/role"] == "worker") 
|| (object.spec.machineConfigSelector.matchLabels["machineconfiguration.openshift.io/role"] == "arbiter") ) ) || ( has(object.spec.machineConfigSelector.matchExpressions) && ( 
(object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == "machineconfiguration.openshift.io/role" && e.operator == "In" && "worker" in e.values) ) || 
(object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == "machineconfiguration.openshift.io/role" && e.operator == "NotIn" && !("worker" in e.values)) ) ) )' resulted in error: no such key: 
machineConfigSelector... retrying after 351.247769ms

Solution: consider the backward compatibility, in this PR, it will check for the ValidatingAdmissionPolicy named "custom-machine-config-pool-selector" before creating the pool

If the policy exists: Adds minimal selectors (NodeSelector + MachineConfigSelector) to pass the validation
If the policy doesn't exist: Creates the pool without selectors (legacy mode for backward compatibility)

github-actions · 2025-11-12T04:48:56Z

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:960-eb093931238b7aaf6d4a39deb2326c298eeef881

xiaojiey · 2025-11-12T07:26:36Z

/retest-required

openshift-ci-robot · 2025-11-12T07:57:53Z

@xiaojiey: This pull request references CMP-3930 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

This PR means to include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy.
Without this PR, for the make e2e-serial, you will get the below error:

creating Machine Config Pool e2e-invalid: machineconfigpools.machineconfiguration.openshift.io "e2e-invalid" is forbidden: ValidatingAdmissionPolicy 
'custom-machine-config-pool-selector' with binding 'custom-machine-config-pool-selector-binding' denied request: expression '( has(object.spec.machineConfigSelector.matchLabels) && ( 
(object.spec.machineConfigSelector.matchLabels["machineconfiguration.openshift.io/role"] == "master") || (object.spec.machineConfigSelector.matchLabels["machineconfiguration.openshift.io/role"] == "worker") 
|| (object.spec.machineConfigSelector.matchLabels["machineconfiguration.openshift.io/role"] == "arbiter") ) ) || ( has(object.spec.machineConfigSelector.matchExpressions) && ( 
(object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == "machineconfiguration.openshift.io/role" && e.operator == "In" && "worker" in e.values) ) || 
(object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == "machineconfiguration.openshift.io/role" && e.operator == "NotIn" && !("worker" in e.values)) ) ) )' resulted in error: no such key: 
machineConfigSelector... retrying after 351.247769ms

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

xiaojiey · 2025-11-24T09:42:53Z

/test e2e-aws-serial

rhmdnd · 2025-12-01T23:01:14Z

tests/e2e/framework/common.go

+			// This pool is still "invalid" for testing as no nodes match this selector
+			NodeSelector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"node-role.kubernetes.io/e2e-invalid": "",


@Vincent056 I think we need NodeSelector to be empty to exercise the additional logic you added in 4961d0f correct?

In newer OpenShift versions(4.21) have a ValidatingAdmissionPolicy that rejects MCPs without proper selectors. As a result it's no longer testable via e2e because you can't create such MCPs anymore due to ValidatingAdmissionPolicy enforcement.

% oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.21.0-0.nightly-2025-11-22-193140 True False 5h48m Cluster version is 4.21.0-0.nightly-2025-11-22-193140 % oc get ValidatingAdmissionPolicy custom-machine-config-pool-selector -o=jsonpath={.spec.validations} | jq -r [ { "expression": "( has(object.spec.machineConfigSelector.matchLabels) && ( (object.spec.machineConfigSelector.matchLabels[\"machineconfiguration.openshift.io/role\"] == \"master\") || (object.spec.machineConfigSelector.matchLabels[\"machineconfiguration.openshift.io/role\"] == \"worker\") || (object.spec.machineConfigSelector.matchLabels[\"machineconfiguration.openshift.io/role\"] == \"arbiter\") ) ) || ( has(object.spec.machineConfigSelector.matchExpressions) && ( (object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == \"machineconfiguration.openshift.io/role\" && e.operator == \"In\" && \"worker\" in e.values) ) || (object.spec.machineConfigSelector.matchExpressions.exists( e, e.key == \"machineconfiguration.openshift.io/role\" && e.operator == \"NotIn\" && !(\"worker\" in e.values)) ) ) )", "message": "All custom MachineConfigPools must inherit from the worker pool and must have a machineConfigSelector that matches for a 'machineconfiguration.openshift.io/role: worker' label" } ]

The logic from commit 4961d0f is still valuable for production environments where legacy/invalid MCPs without selectors might exist.

How about we check whether ValidatingAdmissionPolicy exists or not, If not exists, use the legacy way without selectors; if exists use the minimal selectors.

How about we check whether ValidatingAdmissionPolicy exists or not, If not exists, use the legacy way without selectors; if exists use the minimal selectors.

That seems like the best option.

github-actions · 2025-12-03T02:10:16Z

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:960-5ad04b70337f58cfb96024b8fe35b949e60bc8e7

xiaojiey · 2025-12-03T08:51:30Z

/test e2e-aws-serial

rhmdnd · 2025-12-04T21:11:51Z

Cluster provisioning failed.

/test e2e-aws-serial

rhmdnd · 2025-12-04T21:14:30Z

Looks like this worked as expected on a 4.17 cluster in CI:

2025/12/03 03:18:36 e2e Machine Config Pool has not updated... retrying
2025/12/03 03:18:46 successfully created Machine Config Pool e2e
2025/12/03 03:18:46 ValidatingAdmissionPolicy 'custom-machine-config-pool-selector' not found, creating MachineConfigPool e2e-invalid without selectors (legacy mode)
=== RUN   TestProfileVersion
=== PAUSE TestProfileVersion
=== RUN   TestProfileModification

rhmdnd

/lgtm

rhmdnd · 2025-12-08T17:47:23Z

The profile bundle problem is affecting these test results, but we're chasing that down in a separate PR.

#1019

rhmdnd

/lgtm

openshift-ci · 2025-12-08T17:47:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhmdnd, xiaojiey

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [rhmdnd,xiaojiey]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

xiaojiey · 2025-12-09T01:17:14Z

/test e2e-aws-serial

…gAdmissionPolicy Creates the pool with the appropriate selectors based on whether the validation policy exists Add ValidatingAdmissionPolicy scheme registration

openshift-ci · 2025-12-09T08:05:43Z

New changes are detected. LGTM label has been removed.

xiaojiey · 2025-12-09T08:11:40Z

/retest-required

github-actions · 2025-12-09T08:12:46Z

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:960-a1c0b1dd2e7c757df27fa1d5371a46f1b2c5b145

xiaojiey · 2025-12-25T00:54:45Z

/retest

openshift-ci · 2025-12-25T04:20:07Z

@xiaojiey: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-rosa	`a1c0b1d`	link	true	`/test e2e-rosa`
ci/prow/e2e-aws-serial	`a1c0b1d`	link	true	`/test e2e-aws-serial`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot requested review from Vincent056 and mrogers950 November 12, 2025 04:41

openshift-ci bot added the approved label Nov 12, 2025

xiaojiey changed the title ~~Include the required selectors to machineconfig to pass the Validatin…~~ Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy Nov 12, 2025

xiaojiey changed the title ~~Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy~~ [NO-JIRA]Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy Nov 12, 2025

xiaojiey changed the title ~~[NO-JIRA]Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy~~ [CMP-3930]Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy Nov 12, 2025

xiaojiey changed the title ~~[CMP-3930]Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy~~ CMP-3930: Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy Nov 12, 2025

openshift-ci-robot added the jira/valid-reference label Nov 12, 2025

xiaojiey requested a review from rhmdnd November 24, 2025 09:43

Anna-Koudelkova mentioned this pull request Nov 24, 2025

CMP-3776: Enhance TestSingleTailoredScanSucceeds to cover 33398 logic #996

Merged

xiaojiey mentioned this pull request Nov 25, 2025

CMP-3775,CMP-3783: Add exit-code check for Compliance/NonCompliance test result #994

Open

taimurhafeez mentioned this pull request Nov 25, 2025

CMP-3805: Add test for configurable access modes and Storage class (34928) #999

Open

xiaojiey mentioned this pull request Nov 28, 2025

CMP-3867: Add RapidDast test for Compliance Operator #1010

Open

Anna-Koudelkova mentioned this pull request Dec 1, 2025

CMP-3859: Add e2e test (60342) for disabled timeout with zero value #982

Open

rhmdnd reviewed Dec 1, 2025

View reviewed changes

taimurhafeez mentioned this pull request Dec 2, 2025

CMP-3846: Add test for successful compliance operator deletion (54055) #1007

Open

Anna-Koudelkova mentioned this pull request Dec 2, 2025

CMP-3788: Enhance TestTolerations to cover 33610 logic [WIP] #1014

Closed

xiaojiey force-pushed the add-mc-selectors branch from eb09393 to 5ad04b7 Compare December 3, 2025 02:03

Anna-Koudelkova mentioned this pull request Dec 3, 2025

CMP-3789: Enhance TestScanProducesRemediations to cover remaining 28949 logic [WIP] #1015

Closed

rhmdnd approved these changes Dec 4, 2025

View reviewed changes

openshift-ci bot assigned rhmdnd Dec 4, 2025

openshift-ci bot added the lgtm label Dec 4, 2025

taimurhafeez mentioned this pull request Dec 8, 2025

CMP-3863: Added new test TestMustGatherImageWorksAsExpected to cover 75670 test from downstream #1023

Open

rhmdnd added this to the 1.9.0 milestone Dec 8, 2025

rhmdnd approved these changes Dec 8, 2025

View reviewed changes

xiaojiey added qe-approved docs-approved labels Dec 9, 2025

Include the required selectors to machineconfig to pass the Validatin…

a1c0b1d

…gAdmissionPolicy Creates the pool with the appropriate selectors based on whether the validation policy exists Add ValidatingAdmissionPolicy scheme registration

xiaojiey force-pushed the add-mc-selectors branch from 5ad04b7 to a1c0b1d Compare December 9, 2025 08:05

openshift-ci bot removed the lgtm label Dec 9, 2025

taimurhafeez mentioned this pull request Dec 10, 2025

CMP-3803: Add multiple rhcos4 profiles to TestScanSettingBinding #1028

Open

CMP-3930: Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy #960

Are you sure you want to change the base?

CMP-3930: Include the required selectors to machineconfig to pass the ValidatingAdmissionPolicy #960

Uh oh!

Conversation

xiaojiey commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 12, 2025

Uh oh!

xiaojiey commented Nov 12, 2025

Uh oh!

openshift-ci-robot commented Nov 12, 2025

Uh oh!

xiaojiey commented Nov 24, 2025

Uh oh!

rhmdnd Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

xiaojiey Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xiaojiey Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

rhmdnd Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

xiaojiey commented Dec 3, 2025

Uh oh!

rhmdnd commented Dec 4, 2025

Uh oh!

rhmdnd commented Dec 4, 2025

Uh oh!

rhmdnd left a comment

Choose a reason for hiding this comment

Uh oh!

rhmdnd commented Dec 8, 2025

Uh oh!

rhmdnd left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 8, 2025

Uh oh!

xiaojiey commented Dec 9, 2025

Uh oh!

openshift-ci bot commented Dec 9, 2025

Uh oh!

xiaojiey commented Dec 9, 2025

Uh oh!

github-actions bot commented Dec 9, 2025

Uh oh!

xiaojiey commented Dec 25, 2025

Uh oh!

openshift-ci bot commented Dec 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

xiaojiey commented Nov 12, 2025 •

edited

Loading

xiaojiey Dec 2, 2025 •

edited

Loading