Skip to content
This repository was archived by the owner on Aug 25, 2026. It is now read-only.

openshift/v4_23_exp validate: report CEX kernel arg error once - #732

Closed
deepak0x wants to merge 2 commits into
coreos:mainfrom
deepak0x:fix/731-dup-cex-error
Closed

openshift/v4_23_exp validate: report CEX kernel arg error once#732
deepak0x wants to merge 2 commits into
coreos:mainfrom
deepak0x:fix/731-dup-cex-error

Conversation

@deepak0x

@deepak0x deepak0x commented Aug 5, 2026

Copy link
Copy Markdown

Summary

Config.Validate in config/openshift/v4_23_exp/validate.go emitted ErrMissingKernelArgumentCex twice at $.openshift.kernel_arguments when both boot_device.luks.cex.enabled: true and a storage.luks root entry with cex.enabled: true were set.

Two independent if-blocks each called r.AddOnError(c.Append("openshift", "kernel_arguments"), common.ErrMissingKernelArgumentCex) when the rd.luks.key=/etc/luks/cex.key kernel argument was absent, so both fired and the identical error was reported twice.

Fix

Consolidate the two checks into a single cex flag (set when either the boot-device CEX is enabled or any root storage.luks entry has CEX enabled) and emit the error exactly once when the flag is set and the kernel argument is missing. Behavior and error path are unchanged.

Test plan

  • Added a TestValidateConfig case that sets both CEX sources and an empty kernel argument list, asserting exactly one ErrMissingKernelArgumentCex at $.openshift.kernel_arguments.
  • Verified the new test fails on the old code (two entries) and passes on the fixed code (one entry).
  • ./test (gofmt, go vet, go test ./..., doc validation) passes.

Fixes #731

Summary by CodeRabbit

  • Bug Fixes

    • Improved configuration validation when CEX is enabled for both the boot device and encrypted root storage.
    • Ensured missing required OpenShift kernel arguments produce a single, accurate validation error.
    • Correctly handled CEX-enabled encrypted storage that is not used as root storage.
  • Tests

    • Added coverage for combined CEX configurations, required kernel arguments, and non-root encrypted storage.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0bc0a375-7bc2-4e09-b18e-3990df72dd00

📥 Commits

Reviewing files that changed from the base of the PR and between ec3c4fd and 2213a9f.

📒 Files selected for processing (1)
  • config/openshift/v4_23_exp/validate_test.go

Included review availability: Your plan includes up to 2 reviews per rolling hour; 1 remains after this review.


📝 Walkthrough

Walkthrough

Config.Validate combines boot-device and root-storage CEX detection before checking the required kernel argument. Regression tests cover duplicate-error prevention, valid arguments, and non-root storage.

Changes

CEX validation

Layer / File(s) Summary
Consolidate CEX validation
config/openshift/v4_23_exp/validate.go, config/openshift/v4_23_exp/validate_test.go
Config.Validate initializes CEX detection from the boot-device configuration and performs one final kernel-argument check after storage validation. Tests cover combined CEX settings, the required argument, and non-root storage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 2213a

The change makes the validator report the existing CEX kernel-argument error once instead of twice, with no intended behavior or error-path change. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly states that validation now reports the CEX kernel argument error once.
Linked Issues check ✅ Passed The change fixes issue #731 by deduplicating the missing CEX kernel argument error and adding regression coverage.
Out of Scope Changes check ✅ Passed All code and test changes directly support issue #731 and the stated validation behavior.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
config/openshift/v4_23_exp/validate_test.go (1)

233-268: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add positive and edge cases to the validation table.

The new row checks only the missing-argument case. Add one row with both CEX sources enabled and rd.luks.key=/etc/luks/cex.key present. Add one edge row with a non-root storage.luks CEX entry. These rows verify the valid path and the Name == "root" boundary.

As per coding guidelines, **/*_test.go files must use table-driven tests with positive, negative, and edge cases.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/openshift/v4_23_exp/validate_test.go` around lines 233 - 268, Extend
the validation table around the existing CEX missing-kernel-argument case with a
positive row where both CEX sources are enabled and KernelArguments contains
rd.luks.key=/etc/luks/cex.key, expecting no error. Add an edge-case row with a
CEX-enabled storage.luks entry whose Name is not "root", verifying the
root-specific validation boundary and expected result.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@config/openshift/v4_23_exp/validate_test.go`:
- Around line 233-268: Extend the validation table around the existing CEX
missing-kernel-argument case with a positive row where both CEX sources are
enabled and KernelArguments contains rd.luks.key=/etc/luks/cex.key, expecting no
error. Add an edge-case row with a CEX-enabled storage.luks entry whose Name is
not "root", verifying the root-specific validation boundary and expected result.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb3318bc-1b17-4ae4-a399-c73ab382bc2c

📥 Commits

Reviewing files that changed from the base of the PR and between cb34e12 and effc182.

📒 Files selected for processing (2)
  • config/openshift/v4_23_exp/validate.go
  • config/openshift/v4_23_exp/validate_test.go

When both boot_device.luks.cex.enabled and a storage.luks root entry
with cex.enabled are set, the missing 'rd.luks.key=/etc/luks/cex.key'
kernel argument was reported twice at $.openshift.kernel_arguments.

Consolidate the two independent checks into a single CEX-enabled flag
and emit the error a single time.

Fixes coreos#731

Signed-off-by: Deepak Bhagat <deepak988088@gmail.com>
@deepak0x
deepak0x force-pushed the fix/731-dup-cex-error branch from effc182 to ec3c4fd Compare August 5, 2026 15:33
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@deepak0x

deepak0x commented Aug 5, 2026

Copy link
Copy Markdown
Author

@bgilbert could you review this? It fixes #731 — a duplicate ErrMissingKernelArgumentCex when both boot_device CEX and a root storage.luks CEX entry are set. Consolidated into a single check; added a regression test (fails on old code with 2 entries, passes with 1).

…rg validation

Exercise the valid path (CEX enabled with the kernel argument present) and
the root-only boundary (non-root CEX luks entry) so the table covers
positive, negative, and edge cases.

Signed-off-by: Deepak Bhagat <deepak988088@gmail.com>
@deepak0x

Copy link
Copy Markdown
Author

Superseded by coreos/ignition#2294, which ports this fix now that butane lives in the ignition repo. Closing in favor of the ignition PR that fixes coreos/ignition#2285.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: Duplicate ErrMissingKernelArgumentCex error when boot_device and storage.luks both configure CEX root

1 participant