-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
4.19.0
-
None
-
None
-
False
-
Description of problem:
The compliance_operator_compliance_scan_error_total metric does not capture or update when a compliance scan enters an ERROR state Â
Version-Release number of selected component (if applicable):
compliance-operator.v1.7.0(openshift-compliance-operator-bundle-container-1.7.0-3) Â Â
How reproducible:
Always
Steps to Reproduce:
Â
- Install Compliance Operator
- Create a compliancescan as below:
% oc apply -f -<<EOF
apiVersion: compliance.openshift.io/v1alpha1
kind: ComplianceScan
metadata:
  name: worker-scan2
spec:
  profile: xccdf_org.ssgproject.content_profile_coreos-ncp
  content: ssg-rhcos4-ds.xml
  contentImage: registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:243dce9a4eebe152d8eb4055eaf29ceee855adc66122d6bd95e01703414f1c91
  debug: true
  nodeSelector:
      node-role.kubernetes.io/worker: ""
EOF
compliancescan.compliance.openshift.io/worker-scan2 created
Â
Actual results:
Â
The test scan returns ERROR. In the ERROR message, there is info " Could not check whether the Profile used by ComplianceScan is deprecated ". However, the compliance_operator_compliance_scan_error_total metric does not capture or update when a compliance scan enters an ERROR state. % oc get scan worker-scan2Â NAME Â Â Â Â Â PHASE Â RESULT worker-scan2 Â DONEÂ Â ERROR % oc run --rm -i --restart=Never --image=registry.fedoraproject.org/fedora-minimal:latest -n openshift-compliance test-metrics -- bash -c 'curl -ks -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://metrics.openshift-compliance.svc:8585/metrics-co' | grep -i worker-scan2 compliance_operator_compliance_scan_status_total{name="worker-scan2",phase="PENDING",result=""} 1
Â
% oc get scan worker-scan2 -o=jsonpath={.status} | jq -r { Â "conditions": [ Â Â { Â Â Â "lastTransitionTime": "2025-04-14T12:11:54Z", Â Â Â "message": "The compliance scan is waiting to be processed", Â Â Â "reason": "Pending", Â Â Â "status": "False", Â Â Â "type": "Ready" Â Â } Â ], Â "endTimestamp": "2025-04-14T12:11:54Z", Â "errormsg": "Could not check whether the Profile used by ComplianceScan is deprecated", Â "phase": "DONE", Â "remainingRetries": 3, Â "result": "ERROR", Â "resultsStorage": {}, Â "startTimestamp": "2025-04-14T12:11:54Z" }
Â
Expected results:
The compliance_operator_compliance_scan_error_total metric should reflect the number of compliance scans that have resulted in an ERROR state. Â Â
Additional info: