fix(check-cluster-profiles-config): read secrets from config file

[psalajova]

check-cluster-profiles-config presubmit queried the live config resolver for secret names, which fails with 404 for newly introduced profiles. Fix: Read secret names from the config file under validation instead, since every non-set profile already declares secret: there.

https://redhat.atlassian.net/browse/DPTP-5051

---

Updates the check-cluster-profiles-config CI validation tool to look up referenced Kubernetes Secret names directly from the cluster profile configuration being validated, rather than resolving them against the live config-resolver. This prevents false 404 validation failures when newly introduced profiles declare their secrets only in the config under test. The validator now also produces a clear validation error when a profile omits the required Secret field. Added table-driven test coverage for successful Secret lookup, skipping profiles with SetMembers, missing Secrets, and missing/empty Secret declarations.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: b419023e-a7f2-4a16-a2e2-f3bf3fbdea42

📥 Commits

Reviewing files that changed from the base of the PR and between b4cc950 and 409271b.

📒 Files selected for processing (2)

• cmd/check-cluster-profiles-config/main.go
• cmd/check-cluster-profiles-config/main_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift/release (manual)
• openshift/ci-docs (manual)
• openshift/release-controller (manual)
• openshift/ci-chat-bot (manual)

🚧 Files skipped from review as they are similar to previous changes (2)

• cmd/check-cluster-profiles-config/main_test.go
• cmd/check-cluster-profiles-config/main.go

---

📝 Walkthrough

Walkthrough

The validator now reads each cluster profile’s secret name directly, reports missing secret fields, and checks referenced Kubernetes Secrets in the ci namespace. Table-driven tests cover successful, skipped, missing, and invalid profile configurations.

Changes

Cluster Secret Validation

Layer / File(s)	Summary
Direct profile secret validation cmd/check-cluster-profiles-config/main.go	checkCISecrets uses profile.Secret, rejects empty values, and verifies the referenced Secret in the ci namespace without consulting the config resolver.
Secret validation test coverage cmd/check-cluster-profiles-config/main_test.go	Tests cover existing secrets, SetMembers profiles, missing cluster secrets, and profiles without a secret field.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: pruan-rht, prucek

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Ote Binary Stdout Contract	❌ Error	cmd/check-cluster-profiles-config/main.go:101 still calls fmt.Print(diff) inside main(), writing to stdout from process-level code.	Move that output to stderr/logging or remove it; process-level stdout must stay JSON-only for openshift-tests.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: reading cluster profile secrets from the config file.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	Changed code checks returned errors, wraps client failures with %w, and introduces no panic or nil-deref risk in the touched paths.
Test Coverage For New Features	✅ Passed	The new checkCISecrets behavior is covered by a dedicated table-driven TestCheckCISecrets, including the regression case for missing/lookup secrets.
Stable And Deterministic Test Names	✅ Passed	All added test titles are static, descriptive table-driven names; no dynamic data or unstable identifiers appear.
Test Structure And Quality	✅ Passed	No Ginkgo here; the new table-driven unit tests isolate one behavior, use fake-client setup only, need no cleanup/timeouts, and include clear failure messages.
Microshift Test Compatibility	✅ Passed	The PR adds only a Go unit test using a fake client; no Ginkgo e2e test or unsupported MicroShift API usage is introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The added test is a plain Go unit test, not Ginkgo e2e, and it contains no SNO-relevant multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a CLI validator and its tests changed; no deployment, controller, affinity, PDB, or node-selection code was added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added; the new test is a unit test using a fake client with no IPv4 assumptions or external connectivity.
No-Weak-Crypto	✅ Passed	Changed files only read Kubernetes Secrets and add tests; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges	✅ Passed	Only Go code and tests changed; no container/K8s manifests or privileged settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	No passwords/tokens/PII are logged; the new errors only mention profile and Secret names, not Secret contents.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[psalajova]

/override ci/prow/images

[openshift-ci]

@psalajova: Overrode contexts on behalf of psalajova: ci/prow/images

Details

In response to this:

/override ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007, psalajova

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [deepsm007,psalajova]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 38013b8 and 2 for PR HEAD 409271b in total

[danilo-gemoli]

/override ci/prow/integration

[openshift-ci]

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/integration

Details

In response to this:

/override ci/prow/integration

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD a88eab5 and 1 for PR HEAD 409271b in total

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[openshift-ci]

@psalajova: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.