Uploaded image for project: 'OpenShift Virtualization'
  1. OpenShift Virtualization
  2. CNV-40281

Don't allow default VM container-disk images in realtime checkup

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • CNV Network
    • 0.42
    • False
    • Hide

      None

      Show
      None
    • False
    • v4.16.0-120
    • ---
    • ---
    • No

      Description of problem:

      In realtime checkup, if the user doesn't specify vmUnderTestContainerDiskImage, a default image is used. This should be avoided due to the risk of pulling an image version which doesn't fit the cluster/CNV versions.

      Version-Release number of selected component (if applicable):

      OCP 4.16.0-ec.4
      CNV 4.16.0 (brew.registry.redhat.io/rh-osbs/iib:697727)
      kubevirt-realtime-checkup-rhel9:v4.16.0-103   

      How reproducible:

      100%

      Steps to Reproduce:

      1.
      The cluster should be configured for RT checkup, including MCP, PerformanceProfile and permissions.
      If needed - follow the U/S instructions (D/S is not available yet) in https://github.com/kiagnose/kubevirt-realtime-checkup?tab=readme-ov-file#configuration
      
      2.
      Apply a RT checkup ConfigMap without specifying the traffic-gen VM and the VM under-test images:  apiVersion: v1
      kind: ConfigMap
      metadata:
        name: realtime-checkup-config
      data:
        spec.timeout: 10m
        spec.param.oslatDuration: 1m
      
      3. Start the job by applying the Job resource:  apiVersion: batch/v1
      
      kind: Job
      metadata:
        name: realtime-checkup
      spec:
        backoffLimit: 0
        template:
          spec:
            serviceAccountName: realtime-checkup-sa
            restartPolicy: Never
            containers:
              - name: realtime-checkup
                image: quay.io/kiagnose/kubevirt-realtime-checkup:main
                imagePullPolicy: Always
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop: [ "ALL" ]
                  runAsNonRoot: true
                  seccompProfile:
                    type: "RuntimeDefault"
                env:
                  - name: CONFIGMAP_NAMESPACE
                    value: yoss-ns
                  - name: CONFIGMAP_NAME
                    value: realtime-checkup-config
                  - name: POD_UID
                    valueFrom:
                      fieldRef:
                        fieldPath: metadata.uid
        

      Actual results:

      The job starts (and can end successfully)

      Expected results:

      The job should immediately fail due to the absence of the spec.param.vmUnderTestContainerDiskImage parameter in the ConfigMap.

      Additional info:

       

       

            omisan@redhat.com Orel Misan
            ysegev@redhat.com Yossi Segev
            Nir Rozen Nir Rozen
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: