René's URL Explorer Experiment

Title: ROX-29577: PoC of e2e tests for VM scanning by vikin91 · Pull Request #20168 · stackrox/stackrox · GitHub

Open Graph Title: ROX-29577: PoC of e2e tests for VM scanning by vikin91 · Pull Request #20168 · stackrox/stackrox

X Title: ROX-29577: PoC of e2e tests for VM scanning by vikin91 · Pull Request #20168 · stackrox/stackrox

Description: Description Add an end-to-end VM scanning test workflow for OpenShift/KubeVirt and wire it into CI. This branch is a synthetic combination of the split: #20213 (merged) #20127 (merged) #20128 and #20129 It was created to make sure that the changes in the split branches have not diverted from the original all-in-one branch. THIS WON'T BE MERGED! I use it to run e2e tests only. Instead, I intend the following branches to be merged: #20213 #20127 #20218 and #20129. Bird-eye view of the e2e VM tests (includes all branches) graph TD subgraph Tm1["t₋₁ — CI Pipeline: Deploy ACS"] direction LR D1["Remove existing
StackRox resources"] --> D2["Setup TLS certs"] --> D3["Deploy StackRox
(Central, Sensor,
Scanner, Collector)"] --> D4["Download virtctl"] end subgraph T0["t₀ — Configuration"] direction LR C1["Load test config
from environment"] --> C2["Create K8s clients
(REST + dynamic)"] --> C3["Connect to Central
(gRPC)"] end subgraph T1["t₁ — Cluster Preflight"] direction LR P1["Verify cluster has nodes
capable of running VMs
(K8s API: node capacity)"] --> P2["Verify VM scanning
feature flag enabled on
Central, Sensor, Compliance
(K8s API: read env vars
from Deployment/DaemonSet)"] --> P3["Verify VSOCK relay
is operational
(K8s API: KubeVirt CR
+ virt-handler pods)"] end subgraph T2["t₂ — VM Provisioning"] direction LR V1["Create isolated
test namespace
(K8s API)"] --> V2["Setup image
pull credentials
(K8s API: Secret + SA)"] --> V3["Create KubeVirt VM(s)
with cloud-init
and SSH key
(K8s API: dynamic client)"] --> V4["Wait until VM
is booted and running
(K8s API: poll VMI status)"] end subgraph T3["t₃ — Guest Preparation (per VM)"] direction LR G1["Wait until guest
accepts SSH
(virtctl ssh probe)"] --> G2["Wait for cloud-init
to finish inside guest
(SSH: cloud-init status)"] --> G3["Verify passwordless
sudo works
(SSH: sudo -n true)"] --> G4["Copy roxagent
binary into guest
(virtctl scp)"] --> G5["Verify roxagent is
installed and executable
(SSH: stat + permissions)"] end T3 -. "── above: PR #20127 (Preflight & VM Bootstrap) ──
── below: PR #20128 (Scan Pipeline Validation) ──" .-> T4 subgraph T4["t₄ — Trigger First Scan"] direction LR S1["Wait for Scanner V4
vulnerability DB
to be loaded
(Central gRPC:
GetVulnDefinitionsInfo)"] --> S2["Trigger scan:
run roxagent on guest
(collects packages,
sends via VSOCK)
(SSH: sudo roxagent)"] --> S3["If primary repo2cpe
mapping fails, retry
with fallback URL
(SSH: retry with new env)"] --> S4["Verify roxagent
did not crash
(check stderr)"] --> S5["Verify roxagent output
looks like a valid
scan report
(check stdout shape)"] end subgraph T5["t₅ — Wait for Scan Results in Central"] direction LR W1["Wait until Central
knows about the VM
(gRPC: ListVMs)"] --> W2["Wait until Central
has VM identity
(gRPC: GetVM)"] --> W3["Wait until Central
reports VM as Running
(gRPC: GetVM state)"] --> W4["Wait until Central
has scan data attached
(gRPC: GetVM scan)"] --> W5["Wait until scan
has a timestamp
(gRPC: GetVM scan_time)"] --> W6["Wait until all
components are
successfully scanned
(gRPC: GetVM components)"] end subgraph T6["t₆ — Verify VM Visible in Central with Correct Metadata"] direction LR A1["VM is discoverable
via List API
by namespace+name
(gRPC: ListVMs)"] --> A2["VM identity matches:
name, namespace,
cluster ID, cluster name
(gRPC: GetVM)"] --> A3["VM lifecycle state
is RUNNING
(gRPC: GetVM)"] --> A4["Scan result is attached
with a valid timestamp
(gRPC: GetVM)"] end subgraph T7["t₇ — Verify Scan Content is Complete"] direction LR B1["Scanned components
list is non-empty
(packages were found)
(gRPC: GetVM scan)"] --> B2["No component is marked
as UNSCANNED
(all were processed)
(gRPC: GetVM scan)"] --> B3["Operating system detected
(populated by Sensor
from guest metadata)
(gRPC: GetVM scan)"] end subgraph T8["t₈ — Rescan and Verify Idempotency"] direction LR R1["Record timestamp
of first scan
(gRPC: GetVM)"] --> R2["Trigger rescan:
run roxagent again
(SSH: sudo roxagent)"] --> R3["Verify roxagent
did not crash
(check stderr)"] --> R4["Wait until Central shows
a newer scan timestamp
than the first scan
(gRPC: poll GetVM)"] --> R5["Verify VM identity
is stable: same ID
across rescans
(gRPC: GetVM)"] end T8 -. "── above: PR #20128 (Scan Pipeline Validation) ──
── below: PR #20129 (Metrics Assertions) ──" .-> T9 subgraph T9["t₉ — Verify Scan Pipeline Metrics"] direction LR M1["Query Prometheus for
scan-started events
(Prometheus API)"] --> M2["Query Prometheus for
scan-completed events
(Prometheus API)"] --> M3["Verify counters
incremented for both
initial scan and rescan
(Prometheus API)"] end T9 -. "── above: PR #20129 (Metrics Assertions) ──
── below: shared suite teardown ──" .-> T10 subgraph T10["t₁₀ — Teardown"] direction LR TD1["Delete test VMs
(K8s API: dynamic client)"] --> TD2["Delete test namespace
(K8s API)"] --> TD3["Close Central
connection
(gRPC close)"] end Tm1 --> T0 --> T1 --> T2 --> T3 T4 --> T5 --> T6 --> T7 --> T8 Loading

Open Graph Description: Description Add an end-to-end VM scanning test workflow for OpenShift/KubeVirt and wire it into CI. This branch is a synthetic combination of the split: #20213 (merged) #20127 (merged) #20128 an...

X Description: Description Add an end-to-end VM scanning test workflow for OpenShift/KubeVirt and wire it into CI. This branch is a synthetic combination of the split: #20213 (merged) #20127 (merged) #20128 an...

Opengraph URL: https://github.com/stackrox/stackrox/pull/20168

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width