USHIFT-6978: install dracut-fips in RHEL 9 bootc FIPS images by agullon · Pull Request #6657 · openshift/microshift

agullon · 2026-05-12T15:04:53Z

Summary

Install dracut-fips in RHEL 9 bootc FIPS containerfiles (presubmit and release)
On RHEL 9, the fips dracut module is in the separate dracut-fips package — without it the initramfs lacks the module and the lsinitrd FIPS check fails
On RHEL 10+, this module was merged into the base dracut package and is always present

Test plan

Verify el98-lrel@ai-model-serving-online-fips scenario passes on RHEL 9 bootc
Verify FIPS test still passes on RHEL 10 bootc

Jira: https://issues.redhat.com/browse/USHIFT-6978

🤖 Generated with Claude Code

Summary by CodeRabbit

Tests
- Streamlined FIPS validation test by removing a supplementary verification step while maintaining core crypto policy checks.

openshift-ci-robot · 2026-05-12T15:05:25Z

@agullon: This pull request references USHIFT-6978 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Skip the lsinitrd -m | grep fips initramfs check on RHEL 9 bootc systems

On RHEL 9, the fips dracut module is in the separate dracut-fips package, which is not installed in bootc images

On RHEL 10+, this module was merged into the base dracut package and is always present

The other two checks (kernel fips flag + crypto policy) already verify FIPS is properly enabled on both versions

Test plan

Verify el98-lrel@ai-model-serving-online-fips scenario passes on RHEL 9 bootc

Verify FIPS test still passes on RHEL 10 bootc (lsinitrd check still runs)

Jira: https://issues.redhat.com/browse/USHIFT-6978

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-05-12T15:05:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: agullon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [agullon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

agullon · 2026-05-12T15:07:03Z

/test e2e-aws-tests-release
/test e2e-aws-tests-release-arm
/test e2e-aws-tests-bootc-release-el9
/test e2e-aws-tests-bootc-release-el10
/test e2e-aws-tests-bootc-release-arm-el9
/test e2e-aws-tests-bootc-release-arm-el10

agullon · 2026-05-12T15:07:19Z

/cherrypick release-4.22

openshift-cherrypick-robot · 2026-05-12T15:07:26Z

@agullon: once the present PR merges, I will cherry-pick it on top of release-4.22 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-05-12T15:09:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 16f21172-b246-4a35-8bd5-498281f57bba

📥 Commits

Reviewing files that changed from the base of the PR and between 8a3b3a5 and 6d47bb5.

📒 Files selected for processing (1)

test/suites/fips/validate-fips.robot

💤 Files with no reviewable changes (1)

test/suites/fips/validate-fips.robot

Walkthrough

The PR removes the FIPS initramfs module presence verification from the Fips Should Be Enabled Bootc test keyword. After confirming system crypto policies show FIPS, the test now skips the lsinitrd module check and proceeds directly to the next step.

Changes

FIPS Validation Test Simplification

Layer / File(s)	Summary
FIPS initramfs module check removal `test/suites/fips/validate-fips.robot`	The `Fips Should Be Enabled Bootc` keyword removes the 6-line initramfs FIPS module presence check (`lsinitrd -m ... \| grep -Fxq fips`). The test now concludes after validating crypto policies without verifying the initramfs module.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

lgtm, verified

Suggested reviewers

pmtk
kasturinarra
jogeo

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title references installing dracut-fips in RHEL 9 bootc FIPS images, matching the PR's objective to install the dracut-fips package in containerfiles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Custom check is not applicable. PR modifies only Robot Framework test files (.robot), not Ginkgo tests (Go BDD framework). No Ginkgo test names exist to validate.
Test Structure And Quality	✅ Passed	Check is not applicable. The custom check requires reviewing Ginkgo test code patterns, but this PR modifies only Robot Framework test files (.robot), not Go/Ginkgo tests.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. Changes are limited to Robot Framework tests (test/suites/fips/validate-fips.robot), which are outside the scope of this check.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR modifies a Robot Framework test file (.robot), not Ginkgo e2e tests. Custom check applies only to new Ginkgo tests (It(), Describe(), Context(), When()). No Ginkgo tests found.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only test file (validate-fips.robot), removing FIPS module validation step. No deployment manifests, operator code, or scheduling constraints introduced.
Ote Binary Stdout Contract	✅ Passed	Custom check is not applicable. PR modifies only Robot Framework test file (test/suites/fips/validate-fips.robot), not OTE Go binaries that communicate via JSON stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Check does not apply—PR modifies Robot Framework tests only, not Ginkgo tests. Custom check targets Go/Ginkgo patterns (It(), Describe(), etc.).

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

agullon · 2026-05-12T17:52:59Z

/override ci/prow/e2e-aws-tests-release
/override ci/prow/e2e-aws-tests-release-arm

openshift-ci · 2026-05-12T17:53:19Z

@agullon: Overrode contexts on behalf of agullon: ci/prow/e2e-aws-tests-release, ci/prow/e2e-aws-tests-release-arm

Details

In response to this:

/override ci/prow/e2e-aws-tests-release
/override ci/prow/e2e-aws-tests-release-arm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ggiguash · 2026-05-13T07:05:09Z

+        ...    bash -c 'lsinitrd -m 2>/dev/null | grep -Fxq fips'
+        ...    sudo=False    return_rc=True    return_stdout=True    return_stderr=True
+        Should Be Equal As Integers    0    ${rc}
+    END


Can we install the missing package instead of disabling the test?

yes, we can, it's another possible approach, I thought about it
I prefer to keep the test prerequisites as small and simple as possible. I don't see a benefict of adding a new package for a small check. Also, this new package is not needed and tested for RHEL10.

Also, whit this extra if in the test we have documented in the test code the differences between RHEL9 and RHEL10 which may be useful as extra info in the future.

We should either remove the test completely, or make it work on both operating systems.
Adding OS-specific conditional code should only be a last resort.

I'll remove this check, I tried these two ideas (add an RPM and add a fips config) ideas but they didn't work.

@ggiguash all changes done, please review the PR again

openshift-ci · 2026-05-13T09:50:52Z

@agullon: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-tests-arm	`8a3b3a5`	link	true	`/test e2e-aws-tests-arm`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

The lsinitrd FIPS module presence check fails on RHEL 9 bootc images because the dracut-fips package is not installed. Rather than adding the package, remove the check entirely as the remaining validations (crypto flag and crypto policies) are sufficient to verify FIPS mode. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

agullon · 2026-05-14T14:43:18Z

/cherrypick release-4.22

openshift-cherrypick-robot · 2026-05-14T14:43:21Z

@agullon: once the present PR merges, I will cherry-pick it on top of release-4.22 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

agullon · 2026-05-14T15:14:00Z

/verified by CI

openshift-ci-robot · 2026-05-14T15:14:11Z

@agullon: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 12, 2026

openshift-ci Bot requested review from eslutsky and kasturinarra May 12, 2026 15:05

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 12, 2026

ggiguash reviewed May 13, 2026

View reviewed changes

agullon marked this pull request as draft May 13, 2026 07:30

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 13, 2026

agullon force-pushed the USHIFT-6978 branch from aab0521 to 8a3b3a5 Compare May 13, 2026 07:30

agullon changed the title ~~USHIFT-6978: skip lsinitrd FIPS check on bootc RHEL 9~~ USHIFT-6978: install dracut-fips in RHEL 9 bootc FIPS images May 13, 2026

agullon marked this pull request as ready for review May 13, 2026 07:31

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 13, 2026

openshift-ci Bot requested review from jogeo and pacevedom May 13, 2026 07:32

agullon mentioned this pull request May 13, 2026

USHIFT-6978: install dracut-fips in RHEL 9 bootc FIPS images #6662

Closed

2 tasks

agullon force-pushed the USHIFT-6978 branch from 8a3b3a5 to 6d47bb5 Compare May 14, 2026 14:42

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label May 14, 2026

Conversation

agullon commented May 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented May 12, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

openshift-ci Bot commented May 12, 2026

Uh oh!

agullon commented May 12, 2026

Uh oh!

agullon commented May 12, 2026

Uh oh!

openshift-cherrypick-robot commented May 12, 2026

Uh oh!

coderabbitai Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Suggested reviewers

Uh oh!

agullon commented May 12, 2026

Uh oh!

openshift-ci Bot commented May 12, 2026

Uh oh!

ggiguash May 13, 2026

Choose a reason for hiding this comment

Uh oh!

agullon May 13, 2026

Choose a reason for hiding this comment

Uh oh!

ggiguash May 13, 2026

Choose a reason for hiding this comment

Uh oh!

agullon May 14, 2026

Choose a reason for hiding this comment

Uh oh!

agullon May 14, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented May 13, 2026

Uh oh!

agullon commented May 14, 2026

Uh oh!

openshift-cherrypick-robot commented May 14, 2026

Uh oh!

agullon commented May 14, 2026

Uh oh!

openshift-ci-robot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

agullon commented May 12, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented May 12, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented May 12, 2026 •

edited

Loading