René's URL Explorer Experiment

Title: ROX-29577: Add VM scanning scan and rescan pipeline validation by vikin91 · Pull Request #20128 · stackrox/stackrox · GitHub

Open Graph Title: ROX-29577: Add VM scanning scan and rescan pipeline validation by vikin91 · Pull Request #20128 · stackrox/stackrox

X Title: ROX-29577: Add VM scanning scan and rescan pipeline validation by vikin91 · Pull Request #20128 · stackrox/stackrox

Description: Description Add roxagent and Central VM polling helpers, scan/rescan e2e suite flow, and guest SSH extensions to validate the end-to-end VM scanning pipeline. This PR focuses on pipeline validation without metrics assertions (deferred to #20129). Key additions: tests/vmhelpers/central.go — Central API polling helpers (wait for VM present, identity, running, scan non-nil, scan timestamp, scan-ready composite) tests/vmhelpers/roxagent.go — roxagent lifecycle helpers (copy, verify install, run with primary/fallback repo2cpe, vsock precheck) tests/vmhelpers/guest.go — vsock readiness checks and diagnostics collection tests/vmhelpers/wait.go — generic pollUntil loop with timeout, logging, and auth-expiry detection tests/vm_scanning_test.go — TestScanPipeline: trigger scan, wait for results in Central, validate metadata/components/OS, rescan, verify idempotency Unit tests for the new helpers (central_test.go, roxagent_test.go, wait_test.go) Bird-eye view (this PR covers t₄–t₈) graph TD subgraph T3["t₃ — Guest Preparation (per VM)"] direction LR G1["Wait until guest
accepts SSH
(virtctl ssh probe)"] --> G2["Wait for cloud-init
to finish inside guest
(SSH: cloud-init status)"] --> G3["Verify passwordless
sudo works
(SSH: sudo -n true)"] --> G4["Copy roxagent
binary into guest
(virtctl scp)"] --> G5["Verify roxagent is
installed and executable
(SSH: roxagent --help)"] end T3 -. "── above: PR #20127 (Preflight & VM Bootstrap) ──
── below: PR #20128 (Scan Pipeline Validation) ──" .-> T4 subgraph T4["t₄ — Trigger First Scan"] direction LR S1["Wait for Scanner V4
vulnerability DB
to be loaded
(Central gRPC:
GetVulnDefinitionsInfo)"] --> S2["Trigger scan:
run roxagent on guest
(collects packages,
sends via VSOCK)
(SSH: sudo roxagent)"] --> S3["If primary repo2cpe
mapping fails, retry
with fallback URL
(SSH: retry with new env)"] --> S4["Verify roxagent
did not crash
(check stderr)"] --> S5["Verify roxagent output
looks like a valid
scan report
(check stdout shape)"] end subgraph T5["t₅ — Wait for Scan Results in Central"] direction LR W1["Wait until Central
knows about the VM
(gRPC: ListVMs)"] --> W2["Wait until Central
has VM identity
(gRPC: GetVM)"] --> W3["Wait until Central
reports VM as Running
(gRPC: GetVM state)"] --> W4["Wait until Central
has scan data attached
(gRPC: GetVM scan)"] --> W5["Wait until scan
has a timestamp
(gRPC: GetVM scan_time)"] --> W6["Wait until all
components are
successfully scanned
(gRPC: GetVM components)"] end subgraph T6["t₆ — Verify VM Visible in Central with Correct Metadata"] direction LR A1["VM is discoverable
via List API
by namespace+name
(gRPC: ListVMs)"] --> A2["VM identity matches:
name, namespace,
cluster ID, cluster name
(gRPC: GetVM)"] --> A3["VM lifecycle state
is RUNNING
(gRPC: GetVM)"] --> A4["Scan result is attached
with a valid timestamp
(gRPC: GetVM)"] end subgraph T7["t₇ — Verify Scan Content is Complete"] direction LR B1["Scanned components
list is non-empty
(packages were found)
(gRPC: GetVM scan)"] --> B2["No component is marked
as UNSCANNED
(all were processed)
(gRPC: GetVM scan)"] --> B3["Operating system detected
(populated by Sensor
from guest metadata)
(gRPC: GetVM scan)"] end subgraph T8["t₈ — Rescan and Verify Idempotency"] direction LR R1["Record timestamp
of first scan
(gRPC: GetVM)"] --> R2["Trigger rescan:
run roxagent again
(SSH: sudo roxagent)"] --> R3["Verify roxagent
did not crash
(check stderr)"] --> R4["Wait until Central shows
a newer scan timestamp
than the first scan
(gRPC: poll GetVM)"] --> R5["Verify VM identity
is stable: same ID
across rescans
(gRPC: GetVM)"] end T8 -. "── above: PR #20128 (Scan Pipeline Validation) ──
── below: PR #20129 (Metrics Assertions) ──" .-> T9 subgraph T9["t₉ — Verify Scan Pipeline Metrics"] direction LR M1["Query Prometheus for
scan-started events
(Prometheus API)"] end T4 --> T5 --> T6 --> T7 --> T8 Loading AI-Assisted: Cursor, ~30% generated (helper scaffolding, unit tests), user reviewed logic. User-facing documentation CHANGELOG.md is updated OR update is not needed documentation PR is created and is linked above OR is not needed Testing and quality the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag CI results are inspected Automated testing added unit tests added e2e tests added regression tests added compatibility tests modified existing tests How I validated my change Ran the e2e VM scanning test on the PoC branch — 10 runs, 8 successes, 2 infra failures. Ran the e2e VM scanning tests on this branch.

Open Graph Description: Description Add roxagent and Central VM polling helpers, scan/rescan e2e suite flow, and guest SSH extensions to validate the end-to-end VM scanning pipeline. This PR focuses on pipeline validation...

X Description: Description Add roxagent and Central VM polling helpers, scan/rescan e2e suite flow, and guest SSH extensions to validate the end-to-end VM scanning pipeline. This PR focuses on pipeline validation...

Opengraph URL: https://github.com/stackrox/stackrox/pull/20128

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width