CMP-4142: Add e2e test for TailoredProfile extending a CEL Profile#1207
CMP-4142: Add e2e test for TailoredProfile extending a CEL Profile#1207Vincent056 wants to merge 1 commit into
Conversation
Adds TestTailoredProfileExtendsCELProfile to parallel e2e tests. The test creates a ProfileBundle with CEL content, then creates a TailoredProfile that extends the resulting CEL profile while disabling one rule. It verifies that a scan via ScanSettingBinding completes successfully, enabled rules produce ComplianceCheckResults, and the disabled rule does not.
|
@Vincent056: This pull request references CMP-4142 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "5.0." or "openshift-5.0.", but it targets "compliance-operator-1.9.0" instead. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Vincent056 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
🤖 To deploy this PR, run the following command: |
|
@Vincent056: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| t.Log("ScanSettingBinding is ready") | ||
|
|
||
| suiteName := ssbName | ||
| err = f.WaitForSuiteScansStatus(testNamespace, suiteName, compv1alpha1.PhaseDone, compv1alpha1.ResultNonCompliant) |
There was a problem hiding this comment.
Can we use WaitForSuiteScansStatusAnyResult instead of chaining two WaitForSuiteScansStatus?
| suiteName := ssbName | ||
| err = f.WaitForSuiteScansStatus(testNamespace, suiteName, compv1alpha1.PhaseDone, compv1alpha1.ResultNonCompliant) | ||
| if err != nil { | ||
| err = f.WaitForSuiteScansStatus(testNamespace, suiteName, compv1alpha1.PhaseDone, compv1alpha1.ResultCompliant) |
There was a problem hiding this comment.
can we use f.OperatorNamespace instead?
There was a problem hiding this comment.
Looks great. Tested on OCP 4.22 and passed. However, a couple of minor comments.
=== RUN TestTailoredProfileExtendsCELProfile
=== PAUSE TestTailoredProfileExtendsCELProfile
=== CONT TestTailoredProfileExtendsCELProfile
2026/05/20 18:02:46 Creating ProfileBundle test-tailored-profile-extends-c-e-l-profile-pb with CEL content cel-content.yaml
2026/05/20 18:02:53 waiting ProfileBundle test-tailored-profile-extends-c-e-l-profile-pb to become VALID (PENDING)
2026/05/20 18:02:58 waiting ProfileBundle test-tailored-profile-extends-c-e-l-profile-pb to become VALID (PENDING)
2026/05/20 18:03:03 waiting ProfileBundle test-tailored-profile-extends-c-e-l-profile-pb to become VALID (PENDING)
2026/05/20 18:03:08 ProfileBundle ready (VALID)
main_test.go:6078: ProfileBundle is VALID
2026/05/20 18:03:13 TailoredProfile ready (READY)
main_test.go:6111: TailoredProfile test-tailored-profile-extends-c-e-l-profile-tp is ready
2026/05/20 18:03:19 ScanSettingBinding status READY
main_test.go:6141: ScanSettingBinding is ready
2026/05/20 18:03:30 ComplianceScan ready (DONE)
2026/05/20 18:03:30 All scans in ComplianceSuite have finished (test-tailored-profile-extends-c-e-l-profile-ssb)
main_test.go:6152: CEL scan via TailoredProfile completed as NON-COMPLIANT
main_test.go:6173: check test-tailored-profile-extends-c-e-l-profile-tp-check-default-namespace-has-no-pods: status=PASS
main_test.go:6173: check test-tailored-profile-extends-c-e-l-profile-tp-check-default-sa-exists-in-kube-system: status=PASS
main_test.go:6173: check test-tailored-profile-extends-c-e-l-profile-tp-check-namespaces-have-network-policies: status=FAIL
main_test.go:6186: disabled rule test-tailored-profile-extends-c-e-l-profile-tp-check-no-privileged-containers correctly has no ComplianceCheckResult
main_test.go:6188: TailoredProfile extending CEL profile test completed successfully
--- PASS: TestTailoredProfileExtendsCELProfile (44.97s)
PASS
3 participants
Summary
TestTailoredProfileExtendsCELProfileto parallel e2e testsTest plan
TestTailoredProfileExtendsCELProfile)TestCELProfileBundle,TestCELProfileScan,TestCELWithXCCDFProfileScan) still pass