denis256 notes and projects

OpenShift Origin saw a focused week of test infrastructure hardening and node level configuration verification. The standout changes include a deep refactoring of TLS observation tests and the migration of container runtime configuration tests to the extended suite.

The openshift/origin repository is the upstream foundation for the OpenShift Container Platform and OKD. This week, the activity centered on refining how the system validates security configurations and ensuring that node level settings remain stable during complex rollouts. For engineers running large scale clusters, these changes signal a push toward more modular and resilient test patterns as the project prepares for upcoming platform shifts.

TLS Observation Test Refactoring

A significant portion of the recent activity involved a series of refactors by Jan Chaloupka targeting the TLS observation tests. These tests are critical for verifying that the API server and other components correctly observe and enforce the security profiles defined by the cluster operator.

The maintainers introduced a generic validation function in test/extended/tls/tls_observed_config.go that accepts a minimum TLS version, a list of allowed ciphers, and the API server custom resource. This change moves away from monolithic test blocks toward a more functional approach where specific checks can be invoked independently.

Additional refinements included moving TLS config checks under dedicated functions to allow for better reuse across different test scenarios. The team also replaced simple error returns with maps to help developers quickly identify exactly which security check failed during a run. This level of granularity is essential when debugging complex cipher suite negotiations or protocol version mismatches in a live cluster environment.

Container Runtime Configuration Migration

On the node management side, Chandan Maurya migrated several ContainerRuntimeConfig tests into a dedicated file located at test/extended/node/node_e2e/container_runtime_config.go. This migration is not just a file move; it includes updated validation for pidsLimit and overlaySize settings.

The new test suite verifies that settings applied via the Machine Config Operator (MCO) are correctly reflected on the worker nodes. One particularly useful test case checks the MCO overwrite behavior. It manually edits crio.conf on a node and then verifies that the MCO correctly restores the desired state, overwriting the manual drift.

// From the new test suite
g.By("Verify the manual crio.conf edit took effect")
editedConf, err := nodeutils.ExecOnNodeWithChroot(oc, workerNode, "cat", "/etc/crio/crio.conf")
o.Expect(editedConf).To(o.ContainSubstring(`log_level = "debug"`))

g.By("Wait for custom MCP rollout to complete")
imagepolicy.WaitForMCPConfigSpecChangeAndUpdated(oc, mcpName, initialSpec)

g.By("Verify pidsLimit and manual edit overwrite")
o.Expect(crioConfig).NotTo(o.ContainSubstring(`log_level = "debug"`))

This focus on declarative configuration integrity is vital for operators who need to ensure that their node tuning remains consistent even after emergency manual interventions.

Test Gating and RHEL 10 Preparation

Infrastructure stability often requires knowing when to skip a test. Stephen Benjamin updated the job name tests to use e2eskipper.Skipf for OS version matching. This change is a temporary measure as the project prepares for the RHEL 10 switchover.

By using the official skipper instead of just commenting out code or using an ignored test tag, the CI system can properly report the skip status. This maintains visibility into the test coverage while preventing false positives caused by the evolving operating system landscape. The change is linked to the internal tracking item MCO-2371.

Similarly, Pablo Rodriguez Nava temporarily disabled a stream test in the MCO context, though a later bot commit reverted a related merge. This indicates active churn and rapid iteration in the machine configuration layer as the team works through complex dependency updates.

Base Image Maintenance and Registry Pruning

A practical reality of maintaining a large project like OpenShift is dealing with registry lifecycle events. Anurag Saxena updated the hello-openshift base images from versions 4.16 and 4.17 to 4.22.

The update was necessitated by the pruning of older image versions from the CI registry. Without this fix, various payload jobs were failing with PullBuilderImageFailed errors. The builder images were also bumped to use Go 1.25, ensuring that the project benefits from the latest compiler optimizations and security fixes.

In a related move, Jacob See mapped the glibc-dns-testing image to support payload testing for the 1.36 release cycle. These small but critical maintenance tasks keep the massive CI machinery running smoothly, allowing the larger development teams to focus on feature work.

What to watch

The activity this week suggests a few key areas for operators and contributors to monitor in the coming months:

• Tighter TLS Auditing: The refactoring of TLS observation tests indicates a more systematic approach to auditing security profiles. Expect more rigorous validation of ciphers and protocol versions in future releases.
• RHEL 10 Transition: The explicit skips in the test suites confirm that the platform is actively preparing for the next major Red Hat Enterprise Linux release.
• Node Config Stability: The migration of ContainerRuntimeConfig tests reinforces the importance of the Machine Config Operator as the source of truth for node level settings.

For those interested in the low level details, checking the recent refactors in the test/extended/tls/ directory is a great way to understand how the project handles security configuration at scale.