:seedling: Migrate E2e NetworkPolicy tests to static analysis with `kube-score` and `conftest` by pedjak · Pull Request #2393 · operator-framework/operator-controller

pedjak · 2025-12-18T17:15:20Z

Replace the e2e NetworkPolicy tests with static analysis tools that validate
NetworkPolicy configurations at build time rather than runtime.

Tools:

kube-score: https://github.com/zegl/kube-score
conftest: https://www.conftest.dev/
OPA (Open Policy Agent): https://www.openpolicyagent.org/docs/latest/policy-language/

Changes:

Add kube-score for validating deployed NetworkPolicy resources
Add conftest for OPA-based policy validation of Helm charts
Add OPA policies to enforce NetworkPolicy requirements:
- Deny-all default policy must exist
- catalogd-controller-manager must allow ingress on ports 7443, 8443, 9443
- operator-controller-controller-manager must allow ingress on port 8443
- Both controllers must have general egress enabled
- Prometheus NetworkPolicy must allow ingress/egress (when deployed)
Add lint-helm target integration with conftest policy checks
Add lint-deployed-resources target for runtime validation with kube-score
Add conftest validation to manifest generation
Add CI workflow to detect NetworkPolicy changes in PRs and post a comment
Remove network_policy_test.go as tests are now covered by static analysis

This approach provides faster feedback by catching NetworkPolicy issues during
helm linting and manifest generation rather than requiring a full e2e test run.

Co-Authored-By: Claude noreply@anthropic.com

Reviewer Checklist

API Go Documentation
Tests: Unit Tests (and E2E Tests, if appropriate)
Comprehensive Commit Messages
Links to related GitHub Issue(s)

netlify · 2025-12-18T17:15:25Z

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	`bbe274b`
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/6945611a78aa5f0008bf337e
😎 Deploy Preview	https://deploy-preview-2393--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

This PR replaces runtime E2E NetworkPolicy tests with static analysis tools that validate NetworkPolicy configurations at build time, providing faster feedback during development.

Key changes:

Removes test/e2e/network_policy_test.go (413 lines of runtime test code)
Adds OPA policies for conftest to validate NetworkPolicy requirements
Integrates kube-score and conftest into Makefile lint targets and manifest generation

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test/e2e/network_policy_test.go	Removed E2E runtime tests (now covered by static analysis)
hack/conftest/policy/olm-networkpolicies.rego	OPA policy validating deny-all, catalogd, and operator-controller NetworkPolicies
hack/conftest/policy/prometheus-networkpolicies.rego	OPA policy validating Prometheus NetworkPolicy
hack/conftest/policy/README.md	Documentation for OPA policies and usage
Makefile	Integrated conftest into lint-helm and manifest generation; added lint-deployed-resources target
.github/workflows/files-diff.yaml	CI workflow to detect and alert on NetworkPolicy changes
.bingo/*	Added conftest, kube-score, and kube-linter tools via bingo

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-18T17:19:23Z

+ - name: Fail if NetworkPolicy files changed
+ if: steps.filter.outputs.networkpolicy == 'true'
+ run: |
+ echo "::error::NetworkPolicy files have been modified. See PR comment for details."
+ exit 1


This workflow step will always fail when NetworkPolicy files change, blocking PRs that legitimately need to modify NetworkPolicies. Consider removing the hard failure (exit 1) and instead rely on the PR comment to alert reviewers. Alternatively, add a way to bypass this check (e.g., with a specific label) for intentional NetworkPolicy changes.

Covered by previous step

So, do we want the comment, or do we want to fail? I'm not sure we should do both.

My idea is to leave a comment + fail the job, so it clearer to author/reviewer.

Copilot · 2025-12-18T17:19:24Z

+KUBE_LINTER := $(GOBIN)/kube-linter-v0.7.1
+$(KUBE_LINTER): $(BINGO_DIR)/kube-linter.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/kube-linter-v0.7.1"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kube-linter.mod -o=$(GOBIN)/kube-linter-v0.7.1 "golang.stackrox.io/kube-linter/cmd/kube-linter"


kube-linter is added to the bingo dependencies but is not mentioned in the PR description and doesn't appear to be used in any Makefile targets or documentation. If it's not needed for this PR, it should be removed. If it is needed, the PR description and documentation should be updated to mention it.

Copilot · 2025-12-18T17:19:24Z

+deny[msg] {
+	count(catalogd_policies) == 1
+	not catalogd_has_egress
+	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


The error message incorrectly states "enables operator-controller to pull bundle images" but this is for the catalogd-controller-manager policy. The message should describe catalogd's need for egress, not operator-controller's needs. Consider: "General egress is required to permit catalogd to fetch catalog images from arbitrary container registries and communicate with the Kubernetes API server for its operational needs."
Suggested change
msg :="Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
msg :="Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to permit catalogd to fetch catalog images from arbitrary container registriesand communicate with the Kubernetes API server for its operational needs."

Copilot · 2025-12-18T17:19:24Z

+deny[msg] {
+	count(operator_controller_policies) == 1
+	not operator_controller_ingress_port_numbers[8443]
+	msg := "Allow traffic to port 8443 to allow Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health."


The error message incorrectly states "to allow Prometheus to scrape metrics from catalogd" but this is for operator-controller-controller-manager on port 8443. The message should be: "Allow traffic to port 8443 to allow Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health."
Suggested change
msg :="Allow traffic to port 8443 to allow Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health."
msg :="Allow traffic to port 8443 to allow Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health."

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-18T20:56:34Z

+deny[msg] {
+	count(catalogd_policies) == 1
+	not catalogd_has_egress
+	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


Grammar error: "to enables" should be "to enable" (singular form).
Suggested change
msg :="Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
msg :="Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enable operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

should be fine without connect to catalogd's HTTPS server for metadata

Copilot · 2025-12-18T20:56:35Z

+deny[msg] {
+	count(operator_controller_policies) == 1
+	not operator_controller_has_egress
+	msg := "Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


Grammar error: "to enables" should be "to enable" (singular form).
Suggested change
msg :="Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
msg :="Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enable operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

Might want to fix this if other changes are required.

Copilot · 2025-12-18T20:56:35Z

+KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"
+


KUBE_LINTER is declared in variables.env but is not used anywhere in the project (not found in Makefile or Variables.mk). This appears to be an unused dependency that should either be integrated into the build or removed to avoid confusion.
Suggested change
KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-18T21:59:22Z


 .PHONY: run-internal
-run-internal: docker-build kind-cluster kind-load kind-deploy wait
+run-internal: docker-build kind-cluster kind-load kind-deploy lint-deployed-resources wait


Adding lint-deployed-resources to the run-internal target means that every local development run will now attempt to lint all resources in the cluster. This could slow down the development workflow and may fail if the cluster is not fully ready or if resources don't exist yet. Consider moving this to a separate verification step or making it optional for development workflows.

Copilot · 2025-12-18T21:59:23Z

+KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"
+


The KUBE_LINTER variable is declared in variables.env but there's no corresponding kube-linter.mod, kube-linter.sum, or Variables.mk entry to actually install this tool. Either this tool should be removed from variables.env if it's not needed, or the full bingo configuration should be added (including .mod, .sum files and Variables.mk target).
Suggested change
KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"

codecov · 2025-12-18T22:04:23Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.97%. Comparing base (cc8ed2b) to head (bbe274b).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #2393 +/- ##
==========================================
+ Coverage 68.79% 72.97% +4.17% 
==========================================
Files 100 100 Lines 7641 7641 ==========================================
+ Hits 5257 5576 +319 + Misses 1948 1626 -322 - Partials 436 439 +3

Flag	Coverage Δ
e2e	`43.78% <ø> (-0.12%)`	⬇️
experimental-e2e	`48.65% <ø> (+34.97%)`	⬆️
unit	`57.11% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

pedjak · 2025-12-18T22:26:04Z

 image: busybox:1.36
 name: tar
 securityContext:
+ readOnlyRootFilesystem: true


note to reviewers: kube-score detected this while working on this PR and was needed to add it.

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

perdasilva · 2025-12-19T12:58:35Z

+ ${{ steps.filter.outputs.networkpolicy_files }}
+ ```
+
+ **Please ensure:**


Nice! Thank you!

perdasilva · 2025-12-19T13:00:47Z

+ --ignore-test container-resources \
+ --ignore-test container-image-pull-policy \
+ --ignore-test container-ephemeral-storage-request-and-limit \
+ --ignore-test container-security-context-user-group-id


is it worth calling out why we're ignoring these tests?

perdasilva · 2025-12-19T13:06:28Z

@@ -0,0 +1,160 @@
+package main


just a tangent: rego seems really cool and could provide a nice basis for policy-based approval of revisions...

I haven't looked at rego in a while... Open Policy Agent...

perdasilva · 2025-12-19T14:20:23Z

+ echo "---" ; \
+ done \
+	done) | $(KUBE_SCORE) score - \
+ `# TODO: currently these checks are failing, decide if resources should be fixed those to pass` \


Let me create a ticket here

…d conftest Replace the e2e NetworkPolicy tests with static analysis tools that validate NetworkPolicy configurations at build time rather than runtime. Tools: - kube-score: https://github.com/zegl/kube-score - conftest: https://www.conftest.dev/ - OPA (Open Policy Agent): https://www.openpolicyagent.org/docs/latest/policy-language/ Changes: - Add kube-score via bingo for validating deployed NetworkPolicy resources - Add conftest via bingo for OPA-based policy validation of Helm charts - Add OPA policies to enforce NetworkPolicy requirements: - Deny-all default policy must exist - catalogd-controller-manager must allow ingress on ports 7443, 8443, 9443 - operator-controller-controller-manager must allow ingress on port 8443 - Both controllers must have general egress enabled - Prometheus NetworkPolicy must allow ingress/egress (when deployed) - Add lint-helm target integration with conftest policy checks - Add lint-deployed-resources target for runtime validation with kube-score - Add conftest validation to manifest generation - Add CI workflow to detect NetworkPolicy changes in PRs and post a comment - Remove network_policy_test.go as tests are now covered by static analysis This approach provides faster feedback by catching NetworkPolicy issues during helm linting and manifest generation rather than requiring a full e2e test run. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-19T14:34:29Z

+lint-helm: $(HELM) $(CONFTEST) #HELP Run helm linter
 	helm lint helm/olmv1
 	helm lint helm/prometheus
+	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -


The subshell combining helm templates from both charts could fail silently if the first command succeeds but the second fails. Consider using set -o pipefail within the subshell or separating into individual commands to ensure both helm template operations complete successfully before piping to conftest.
Suggested change
(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -
( set -euo pipefail; helm template olmv1 helm/olmv1 && helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -

perdasilva · 2025-12-19T14:40:53Z

/approve

tmshort · 2025-12-19T21:35:31Z

+
+.PHONY: lint-deployed-resources
+lint-deployed-resources: $(KUBE_SCORE) #HELP Lint deployed resources.
+	(for ns in $$(printf "olmv1-system\n%s\n" "$(CATD_NAMESPACE)" | uniq); do \


This seems to be overloading this variable (CATD_NAMESPACE), which is defined several hundred lines below this. I'm also noticing the definition of a NAMESPACE variable elsewhere, and I think we just need to clean up our use of namespaces in the Makefile... so probably not this PR, but something I noticed during the review of this.

ankitathomas

Great work! Looks mostly good, just a few small suggestions

ankitathomas · 2025-12-19T21:15:52Z

+ - name: Fail if NetworkPolicy files changed
+ if: steps.filter.outputs.networkpolicy == 'true'
+ run: |
+ echo "::error::NetworkPolicy files have been modified. See PR comment for details."
+ exit 1


Covered by previous step

ankitathomas · 2025-12-19T21:18:05Z

+lint-helm: $(HELM) $(CONFTEST) #HELP Run helm linter
 	helm lint helm/olmv1
 	helm lint helm/prometheus
+	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -


ankitathomas · 2025-12-19T21:30:23Z

+
+```bash
+# Run all policies (main + prometheus namespaces)
+helm template olmv1 helm/olmv1 | conftest test --policy hack/conftest/policy/ --combine -n main -n prometheus -


Does this require templating helm/prometheus as well?

correct, gonna remove -n prometheus from this line.

ankitathomas · 2025-12-19T21:36:46Z

+deny[msg] {
+	count(catalogd_policies) == 1
+	not catalogd_has_egress
+	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


should be fine without connect to catalogd's HTTPS server for metadata

openshift-ci · 2025-12-19T21:39:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ankitathomas, perdasilva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [perdasilva]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tmshort · 2025-12-19T21:50:12Z

+- `make lint-helm` - Validates both helm/olmv1 and helm/prometheus charts (runs `main` and `prometheus` packages)
+- `make manifests` - Generates and validates core OLM manifests using only `main` package policies 
+ (Prometheus policies are intentionally skipped here, even if manifests include Prometheus resources; 
+ they are validated via `make lint-helm`)


No mention of make lint-deployed-resources?

lint-deployed-resources uses kube-score to lint the resources.

tmshort · 2025-12-19T21:50:43Z

+	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -
+
+.PHONY: lint-deployed-resources
+lint-deployed-resources: $(KUBE_SCORE) #HELP Lint deployed resources.


This should probably be in extended help...
Suggested change
lint-deployed-resources: $(KUBE_SCORE)#HELP Lint deployed resources.
lint-deployed-resources: $(KUBE_SCORE)#EXHELP Lint deployed resources.

CopilotAI review requested due to automatic review settings December 18, 2025 17:15

openshift-ciBot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 18, 2025

Copilotstarted reviewing on behalf of pedjak December 18, 2025 17:15 View session

pedjak changed the title ~~Migrate E2e NetworkPolicy tests to static analysis with kube-score and conftest~~🌱 Migrate E2e NetworkPolicy tests to static analysis with kube-score and conftestDec 18, 2025

CopilotAI reviewed Dec 18, 2025
View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 26f3f91 to 0d17f25Compare December 18, 2025 20:47

CopilotAI review requested due to automatic review settings December 18, 2025 20:49

pedjak force-pushed the migrate-network-policy-tests branch from 0d17f25 to 3f2af72Compare December 18, 2025 20:49

Copilotstarted reviewing on behalf of pedjak December 18, 2025 20:49 View session

CopilotAI reviewed Dec 18, 2025
View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 3f2af72 to 12252d5Compare December 18, 2025 21:03

CopilotAI review requested due to automatic review settings December 18, 2025 21:50

pedjak force-pushed the migrate-network-policy-tests branch from 12252d5 to 0f0027dCompare December 18, 2025 21:50

Copilotstarted reviewing on behalf of pedjak December 18, 2025 21:50 View session

CopilotAI reviewed Dec 18, 2025
View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 0f0027d to 7fa3d04Compare December 18, 2025 22:04

pedjak commented Dec 18, 2025
View reviewed changes

pedjak marked this pull request as ready for review December 18, 2025 22:26

pedjak requested a review from a team as a code owner December 18, 2025 22:26

CopilotAI review requested due to automatic review settings December 18, 2025 22:26

openshift-ciBot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 18, 2025

openshift-ciBot requested review from ankitathomas and tmshort December 18, 2025 22:26

Copilotstarted reviewing on behalf of pedjak December 18, 2025 22:27 View session

pedjak requested review from perdasilva and removed request for tmshort December 18, 2025 22:27

CopilotAI reviewed Dec 18, 2025
View reviewed changes

Comment threadMakefile Outdated

pedjak requested a review from joelanford December 18, 2025 22:46

perdasilva reviewed Dec 19, 2025
View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 7fa3d04 to 65b1c29Compare December 19, 2025 14:00

perdasilva reviewed Dec 19, 2025
View reviewed changes

perdasilva mentioned this pull request Dec 19, 2025
Address failing kube-score tests #2398
Closed

perdasilva reviewed Dec 19, 2025
View reviewed changes

Comment threadMakefile Outdated

CopilotAI review requested due to automatic review settings December 19, 2025 14:27

Copilotstarted reviewing on behalf of pedjak December 19, 2025 14:28 View session

pedjak force-pushed the migrate-network-policy-tests branch from 54eb789 to bbe274bCompare December 19, 2025 14:28

CopilotAI reviewed Dec 19, 2025
View reviewed changes

openshift-ciBot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 19, 2025

tmshort reviewed Dec 19, 2025
View reviewed changes

ankitathomas approved these changes Dec 19, 2025
View reviewed changes

openshift-ciBot assigned ankitathomas Dec 19, 2025

openshift-ciBot added the lgtm Indicates that a PR is ready to be merged. label Dec 19, 2025

openshift-merge-botBot merged commit 08436e0 into operator-framework:mainDec 19, 2025
28 checks passed

tmshort reviewed Dec 19, 2025
View reviewed changes

pedjak added a commit to pedjak/operator-controller that referenced this pull request Dec 22, 2025
Fix unaddressed comments on PRoperator-framework#2393
b7fcacd

pedjak mentioned this pull request Dec 22, 2025
🌱 Improve Makefile error handling and fix policy message typos #2402
Merged
4 tasks

openshift-merge-botBot pushed a commit that referenced this pull request Jan 2, 2026
Fix unaddressed comments on PR#2393(#2402)
a6296ab

	msg :="Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
	msg :="Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to permit catalogd to fetch catalog images from arbitrary container registriesand communicate with the Kubernetes API server for its operational needs."

	msg :="Allow traffic to port 8443 to allow Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health."
	msg :="Allow traffic to port 8443 to allow Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health."

	msg :="Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
	msg :="Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enable operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) \| $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -
	( set -euo pipefail; helm template olmv1 helm/olmv1 && helm template prometheus helm/prometheus) \| $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -

	lint-deployed-resources: $(KUBE_SCORE)#HELP Lint deployed resources.
	lint-deployed-resources: $(KUBE_SCORE)#EXHELP Lint deployed resources.

Uh oh!

Conversation

pedjak commented Dec 18, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Uh oh!

netlifyBot commented Dec 18, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for olmv1 ready!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

CopilotAIDec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecovBot commented Dec 18, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

pedjakDec 18, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

pedjak commented Dec 18, 2025•
edited
Loading

netlifyBot commented Dec 18, 2025•
edited
Loading

codecovBot commented Dec 18, 2025•
edited
Loading

pedjakDec 18, 2025•
edited
Loading