fix(check-cluster-profiles-config): read secrets from config file

[psalajova]

check-cluster-profiles-config presubmit queried the live config resolver for secret names, which fails with 404 for newly introduced profiles. Fix: Read secret names from the config file under validation instead, since every non-set profile already declares secret: there.

https://redhat.atlassian.net/browse/DPTP-5051

---

Updates check-cluster-profiles-config to validate Kubernetes Secret references directly from the cluster profile configuration being checked (instead of resolving against the live config-resolver). This avoids spurious 404 failures when new profiles are introduced that declare their secrets only in the config under validation, and it now flags an explicit validation error when a profile omits the secret field. Added test coverage for the success path (Secret exists), skipped profiles, missing Secrets, and missing/empty secret declarations.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 674c7560-b587-4f8d-8978-f709f7907e58

📥 Commits

Reviewing files that changed from the base of the PR and between 2ef37b8 and b4cc950.

📒 Files selected for processing (2)

• cmd/check-cluster-profiles-config/main.go
• cmd/check-cluster-profiles-config/main_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift/release (manual)
• openshift/ci-docs (manual)
• openshift/release-controller (manual)
• openshift/ci-chat-bot (manual)

🚧 Files skipped from review as they are similar to previous changes (2)

• cmd/check-cluster-profiles-config/main_test.go
• cmd/check-cluster-profiles-config/main.go

---

📝 Walkthrough

Walkthrough

The validator now reads each cluster profile’s secret name directly, reports missing secret fields, and checks referenced Kubernetes Secrets in the ci namespace. Table-driven tests cover successful, skipped, missing, and invalid profile configurations.

Changes

Cluster Secret Validation

Layer / File(s)	Summary
Direct profile secret validation cmd/check-cluster-profiles-config/main.go	checkCISecrets uses profile.Secret, rejects empty values, and verifies the referenced Secret in the ci namespace without consulting the config resolver.
Secret validation test coverage cmd/check-cluster-profiles-config/main_test.go	Tests cover existing secrets, SetMembers profiles, missing cluster secrets, and profiles without a secret field.

Estimated code review effort: 3 (Moderate) | ~20 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Ote Binary Stdout Contract	❌ Error	cmd/check-cluster-profiles-config/main.go still writes cmp.Diff to stdout via fmt.Print(diff) inside main(), which violates the OTE stdout contract.	Move the diff output to stderr (e.g. fmt.Fprint(os.Stderr, diff)) or remove the stdout write from main().
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: reading cluster profile secrets from the config file instead of the config resolver.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	Touched Go code wraps returned errors with %w, has no panic or ignored errors, and checks profile.Secret before dereferencing client state.
Test Coverage For New Features	✅ Passed	A new table-driven TestCheckCISecrets covers the modified secret lookup, missing-secret error, and set-skipping behavior.
Stable And Deterministic Test Names	✅ Passed	The added tests use static table-driven names and no Ginkgo-style titles or dynamic identifiers were introduced.
Test Structure And Quality	✅ Passed	No Ginkgo patterns here; the new table-driven test has one behavior per case, uses a fake client (no cleanup/timeouts needed), and matches repo testing style.
Microshift Test Compatibility	✅ Passed	The PR adds only Go unit tests; no Ginkgo e2e tests, OpenShift-only APIs, or MicroShift-unsupported assumptions were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the only added test is a standard Go unit test, so SNO multi-node assumptions are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	This PR only changes a CLI validator and tests; it adds no manifests, controllers, or scheduling constraints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the new test is a unit test with a fake client and no IPv4-only or external connectivity assumptions.
No-Weak-Crypto	✅ Passed	No MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token constant-time issues appear in the changed files.
Container-Privileges	✅ Passed	This PR only changes Go code and tests; no container/K8s manifests or privilege settings (privileged, hostPID, SYS_ADMIN, etc.) are introduced.
No-Sensitive-Data-In-Logs	✅ Passed	No new logs print secret contents, tokens, or PII; the only added error text mentions secret/profile names already used as identifiers.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: psalajova

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [psalajova]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@psalajova: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	b4cc950	link	true	/test images
ci/prow/codegen	b4cc950	link	true	/test codegen

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.