[rhcos-4.15] kola/tests: Add failing test for FIPS & LUKS #4263
Conversation
Ensure that setting up a LUKS device with FIPS incompatible algorithms will fail when FIPS mode is enabled. Only run this on QEMU as it should behave the same way on all platforms.
|
Hi @openshift-cherrypick-robot. Thanks for your PR. I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new test case to verify that cryptsetup fails with non-FIPS-compliant algorithms when FIPS mode is enabled. The overall approach and implementation are sound. I have a couple of suggestions to improve code readability and maintainability by refactoring two functions for conciseness and clarity.
| // Read file and verify if it contains a pattern | ||
| // 1. Read file, make sure it exists | ||
| // 2. regex for pattern | ||
| func fileContainsPattern(path string, searchPattern string) (bool, error) { | ||
| file, err := os.ReadFile(path) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| // File has content, but the pattern is not present | ||
| match := regexp.MustCompile(searchPattern).Match(file) | ||
| if match { | ||
| // Pattern found | ||
| return true, nil | ||
| } | ||
| // Pattern not found | ||
| return false, nil | ||
| } |
There was a problem hiding this comment.
The fileContainsPattern function can be made more concise. The current comments are not very descriptive, and the logic can be simplified. A clearer function comment and a more direct implementation would improve readability.
// fileContainsPattern reads a file and reports whether it contains a match for a regex.
func fileContainsPattern(path string, searchPattern string) (bool, error) {
file, err := os.ReadFile(path)
if err != nil {
return false, err
}
return regexp.MustCompile(searchPattern).Match(file), nil
}| resultingError := inst.WaitAll(ctx) | ||
| if resultingError == nil { | ||
| resultingError = fmt.Errorf("ignition unexpectedly succeeded") | ||
| } else if resultingError == platform.ErrInitramfsEmergency { | ||
| // Expected initramfs failure, checking the console file to ensure | ||
| // that it failed the expected way | ||
| found, err := fileContainsPattern(builder.ConsoleFile, searchPattern) | ||
| if err != nil { | ||
| resultingError = errors.Wrapf(err, "looking for pattern '%s' in file '%s' failed", searchPattern, builder.ConsoleFile) | ||
| } else if !found { | ||
| resultingError = fmt.Errorf("pattern '%s' in file '%s' not found", searchPattern, builder.ConsoleFile) | ||
| } else { | ||
| // The expected case | ||
| resultingError = nil | ||
| } | ||
| } else { | ||
| resultingError = errors.Wrapf(resultingError, "expected initramfs emergency.target error") | ||
| } | ||
| errchan <- resultingError |
There was a problem hiding this comment.
The error handling logic within this goroutine can be simplified. Using guard clauses with early returns for error conditions would make the code flatter and easier to follow, which is a common practice in Go for improving readability.
resultingError := inst.WaitAll(ctx)
if resultingError == nil {
errchan <- fmt.Errorf("ignition unexpectedly succeeded")
return
}
if resultingError != platform.ErrInitramfsEmergency {
errchan <- errors.Wrap(resultingError, "expected initramfs emergency.target error")
return
}
// Expected initramfs failure, checking the console file to ensure
// that it failed the expected way
found, err := fileContainsPattern(builder.ConsoleFile, searchPattern)
if err != nil {
errchan <- errors.Wrapf(err, "looking for pattern '%s' in file '%s' failed", searchPattern, builder.ConsoleFile)
return
}
if !found {
errchan <- fmt.Errorf("pattern '%s' in file '%s' not found", searchPattern, builder.ConsoleFile)
return
}
// The expected case
errchan <- nil
|
/ok-to-test |
|
Hmm, Prow CI is failing on the new test. But because test result archiving is/was not setup properly, we don't actually have logs. Were you able to sanity-check that this new test passes locally against 4.15? |
|
/retest |
|
@openshift-cherrypick-robot: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
I will test this locally and confirm |
This is an automated cherry-pick of #4181
/assign aaradhak