OCPBUGS-84491: Remove openshift-ingress terminationMessagePolicy exemption

[gcs278]

🚧 WIP - blocked on openshift/cluster-ingress-operator#1502 Istio 1.30 bump

Summary

• Removes the openshift-ingress namespace exemption from the terminationMessagePolicy monitor test
• The upstream fix (istio/istio#60102) adding terminationMessagePolicy=FallbackToLogsOnError to the istiod pilot container has been cherry-picked into downstream openshift-service-mesh/istio release-1.30.1 (commit 25c524c), fixing the pods/istiod-openshift-gateway violation
• The Gateway API proxy containers (pods/gateway) were fixed in openshift/cluster-ingress-operator#1428
• With both fixes in place, the exemption for openshift-ingress is no longer needed

Test plan

• Verify CI passes without the exemption (the [sig-arch] all containers in ns/openshift-ingress must have terminationMessagePolicy=FallbackToLogsOnError test should now pass instead of flaking)

🤖 Generated with Claude Code

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@gcs278: This pull request references Jira Issue OCPBUGS-84491, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @melvinjoseph86

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Removes the openshift-ingress namespace exemption from the terminationMessagePolicy monitor test
• The upstream fix (istio/istio#60102) adding terminationMessagePolicy=FallbackToLogsOnError to the istiod pilot container has been cherry-picked into downstream openshift-service-mesh/istio release-1.30.1 (commit 25c524c), so the exemption for pods/gateway and pods/istiod-openshift-gateway is no longer needed

Test plan

• Verify CI passes without the exemption (the [sig-arch] all containers in ns/openshift-ingress must have terminationMessagePolicy=FallbackToLogsOnError test should now pass instead of flaking)

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The termination message policy monitor removes the openshift-ingress exemption from its existing violations map, causing violations in that namespace to follow normal failure and flaking behavior.

Changes

Termination message policy monitoring

Layer / File(s)	Summary
Remove ingress exemption pkg/monitortests/clusterversionoperator/terminationmessagepolicy/monitortest.go	Removes openshift-ingress from existingViolations, so its containers are no longer grandfathered.
Estimated code review effort: 1 (Trivial)	~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only removes an exemption map entry; it չի adds or edits any Ginkgo It/Describe/Context/When titles, so no unstable test names were introduced.
Test Structure And Quality	✅ Passed	PR only edits a monitor analyzer map; no Ginkgo specs, setup/cleanup, waits, or assertions were added/changed.
Microshift Test Compatibility	✅ Passed	This PR only removes an exemption in a monitor analyzer; it adds no new Ginkgo e2e test bodies or MicroShift-unsupported APIs/features.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the only change is a monitor exemption removal in a non-Ginkgo collector file.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a monitor-test exemption list changed; no deployment, controller, affinity, taint, or replica logic was added.
Ote Binary Stdout Contract	✅ Passed	Only the exemption map changed; no process-level code or stdout-writing APIs appear in the touched package.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Not applicable: the changed file is a monitor analyzer, not a new Ginkgo e2e test, and it contains no IPv4 or external-connectivity assumptions.
No-Weak-Crypto	✅ Passed	The only code change removes an openshift-ingress exemption; no weak-crypto, custom crypto, or secret-comparison code is present.
Container-Privileges	✅ Passed	Only a Go monitor-test file changed; no K8s/container manifests or privilege settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	The patch only removes a namespace exemption; it adds no new logging or sensitive fields beyond existing pod/container names in test failures.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing the openshift-ingress terminationMessagePolicy exemption.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gcs278
Once this PR has been reviewed and has the lgtm label, please assign miyadav for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gcs278]

I need to ensure it's fixed by running CI:
/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[openshift-ci]

@gcs278: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-ovn-upgrade	d329291	link	true	/test e2e-gcp-ovn-upgrade
ci/prow/e2e-aws-ovn-fips	d329291	link	true	/test e2e-aws-ovn-fips
ci/prow/e2e-aws-ovn-serial-1of2	d329291	link	true	/test e2e-aws-ovn-serial-1of2
ci/prow/e2e-aws-ovn-serial-2of2	d329291	link	true	/test e2e-aws-ovn-serial-2of2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-trt]

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: d329291

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (block volmode)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (default fs)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-aws-csi	Medium - "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-gcp-csi	Medium - "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-gcp-csi	Medium - "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" is a new test, and was only seen in one job.
pull-ci-openshift-origin-main-e2e-gcp-csi	Medium - "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" is a new test, and was only seen in one job.

New tests seen in this PR at sha: d329291

• "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (block volmode)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (default fs)] volume-modify [FeatureGate:VolumeAttributesClass] [Feature:VolumeAttributesClass] should recover from invalid target VAC by updating PVC to new valid VAC" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: ebs.csi.aws.com] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand Verify if offline PVC expansion works" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited and the pod is re-created on the same node after controller resize is finished" [Total: 1, Pass: 1, Fail: 0, Flake: 0]
• "External Storage [Driver: pd.csi.storage.gke.io] [Testpattern: Dynamic PV (xfs)] [Slow] volume-expand should resize volume when PVC is edited while pod is using it" [Total: 1, Pass: 1, Fail: 0, Flake: 0]

[gcs278]

Whoops - I realized I need openshift/cluster-ingress-operator#1502 to merge first. We need to bump to istio 1.30 to get this fix.

/wip