From 5d8deff1a58959771b81a21948f359b3aa250e03 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 19 Jan 2024 15:55:35 +0100 Subject: [PATCH 1/5] #238 Changed the condition for failed job to require exceding BackoffLimit BackoffLimit can be set in the values.yaml of scanners This allows that a scan is only considered as Failed if all "retries" have failed BackoffLimit is an int32; negative BackoffLimit values act like a value of 0, and non int are not allowed when the helm chart is deployed Co-authored-by: Boris Shek Signed-off-by: Ilyes Ben Dlala --- operator/controllers/execution/scans/job.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/operator/controllers/execution/scans/job.go b/operator/controllers/execution/scans/job.go index 6811ebfd4d..54a3d6c423 100644 --- a/operator/controllers/execution/scans/job.go +++ b/operator/controllers/execution/scans/job.go @@ -29,7 +29,7 @@ func checkIfAllJobsCompleted(jobs *batch.JobList) jobCompletionType { hasCompleted := true for _, job := range jobs.Items { - if job.Status.Failed > 0 { + if job.Status.Failed > *job.Spec.BackoffLimit { return failed } else if job.Status.Succeeded == 0 { hasCompleted = false From 57bf2cbd2326a06f02d84f7f140b5811a3b002ee Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 6 Feb 2024 14:19:37 +0100 Subject: [PATCH 2/5] #238 Changed Job failure requirement to equal or more the backofflimit This fits better the definition of BackOffLimit https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy Signed-off-by: Ilyes Ben Dlala --- operator/controllers/execution/scans/job.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/operator/controllers/execution/scans/job.go b/operator/controllers/execution/scans/job.go index 54a3d6c423..6cc57dcfd6 100644 --- a/operator/controllers/execution/scans/job.go +++ b/operator/controllers/execution/scans/job.go @@ -29,7 +29,7 @@ func checkIfAllJobsCompleted(jobs *batch.JobList) jobCompletionType { hasCompleted := true for _, job := range jobs.Items { - if job.Status.Failed > *job.Spec.BackoffLimit { + if job.Status.Failed >= *job.Spec.BackoffLimit { return failed } else if job.Status.Succeeded == 0 { hasCompleted = false @@ -69,7 +69,7 @@ func (r *ScanReconciler) checkIfJobIsCompleted(scan *executionv1.Scan, labels cl r.Log.V(9).Info("Got related jobs", "count", len(jobs.Items)) - return checkIfAllJobsCompleted(jobs), nil + return checkIfAllJobsCompleted(jobs, r), nil } // injectCustomCACertsIfConfigured injects CA Certificates to /etc/ssl/certs/ From 99653a9d05bf48d1aca88c55076d6b489b7d4ee6 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 6 Feb 2024 14:21:22 +0100 Subject: [PATCH 3/5] #238 set backoffLimit to 1 in makefile testing Default is 3. This avoid needless retries in jest intergration tests Signed-off-by: Ilyes Ben Dlala --- scanners.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scanners.mk b/scanners.mk index f2efef0932..c824cb97a1 100644 --- a/scanners.mk +++ b/scanners.mk @@ -88,7 +88,8 @@ deploy-with-scanner: --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ --set-string="parser.env[0].value=true" \ --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(name)" \ - --set="scanner.image.tag=$(IMG_TAG)" + --set="scanner.image.tag=$(IMG_TAG)" \ + --set="scanner.backoffLimit=1" .PHONY: integration-tests integration-tests: From de714f2d7302931dc01051743975a9da3df7f68b Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 6 Feb 2024 14:23:29 +0100 Subject: [PATCH 4/5] #238 remove parameter used for testing the backOfflimit parameter functionality Signed-off-by: Ilyes Ben Dlala --- operator/controllers/execution/scans/job.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/operator/controllers/execution/scans/job.go b/operator/controllers/execution/scans/job.go index 6cc57dcfd6..ae9457cb34 100644 --- a/operator/controllers/execution/scans/job.go +++ b/operator/controllers/execution/scans/job.go @@ -69,7 +69,7 @@ func (r *ScanReconciler) checkIfJobIsCompleted(scan *executionv1.Scan, labels cl r.Log.V(9).Info("Got related jobs", "count", len(jobs.Items)) - return checkIfAllJobsCompleted(jobs, r), nil + return checkIfAllJobsCompleted(jobs), nil } // injectCustomCACertsIfConfigured injects CA Certificates to /etc/ssl/certs/ From 50f5d2605410495af895298a390383981ccddb79 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 9 Feb 2024 17:58:20 +0100 Subject: [PATCH 5/5] #238 set scanner backoff limit to 1 in deploy-without-scanner makefile target Default is 3. This avoid needless retries in jest intergration tests Signed-off-by: Ilyes Ben Dlala --- scanners.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scanners.mk b/scanners.mk index c824cb97a1..ee72a220f5 100644 --- a/scanners.mk +++ b/scanners.mk @@ -77,7 +77,8 @@ deploy-without-scanner: --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(name)" \ --set="parser.image.tag=$(IMG_TAG)" \ --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ - --set-string="parser.env[0].value=true" + --set-string="parser.env[0].value=true" \ + --set="scanner.backoffLimit=1" .PHONY: deploy-with-scanner deploy-with-scanner: