Add support for PriorityClass in FileIntegrity

[cturiel]

Add PriorityClass support to FileIntegrity

This PR adds a priorityClassName field to the FileIntegrity CR so you can set pod priority for the daemon pods.

Why?

In clusters under resource pressure, the file integrity daemon pods may fail to schedule because nodes don't have enough available resources. By setting a PriorityClass, these pods can preempt lower-priority workloads, ensuring they get scheduled and can run successfully on all nodes. PriorityClass documentation

Right now there's no way to control this, so file integrity monitoring can fail on busy nodes.

The compliance-operator already has this feature, so I followed the same pattern. ComplianceAsCode/compliance-operator#71

What changed

API:

• Added optional priorityClassName field to FileIntegrity spec
• Updated CRDs and bundle

Controller:

• Validates PriorityClass exists before applying it
• Clears invalid values and logs a warning + emits event
• Detects changes and restarts DaemonSet when needed
• Added RBAC to read PriorityClass resources

Tests:

• E2E tests for valid and invalid PriorityClass

Docs:

• Updated README with example usage
• Updated CRD descriptions

Example

apiVersion: fileintegrity.openshift.io/v1alpha1
kind: FileIntegrity
metadata:
  name: example-fileintegrity
  namespace: openshift-file-integrity
spec:
  priorityClassName: system-node-critical
  config: {}

[openshift-ci]

Hi @cturiel. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[xiaojiey]

/ok-to-test

[xiaojiey]

Pre-merge verification Pass. 3 test scenarios tested. All test scenarios work as expected.

1.  fileintegrity with an invlid priorityclass, the event will be raised:
$ oc get event | grep -i PriorityClass
62s         Warning   PriorityClass         fileintegrity/test-invalid-pc                          Error while getting priority class 'custom-pc-not-exists', PriorityClass not found or invalid
2. fileintegrity with an  priorityclass openshift-user-critical
$ oc get pod aide-test-invalid-pc-4dm46 -o=jsonpath={.spec.priorityClassName}
openshift-user-critical
$ oc get pod aide-test-invalid-pc-4dm46 -o=jsonpath={.spec.priority}
1000000000
3. fileintegrity with a custom priorityclass 
$ oc get pod aide-test-invalid-pc-2xnbl -o=jsonpath={.spec.priority}
1000000
$ oc get pod aide-test-invalid-pc-2xnbl -o=jsonpath={.spec.priorityClassName}
file-integrity-high

[xiaojiey]

/label qe-approved

[Vincent056]

/lgtm

[Vincent056]

/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cturiel, Vincent056

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Vincent056]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@cturiel: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-bundle-aws-upgrade	9086940	link	false	/test e2e-bundle-aws-upgrade
ci/prow/e2e-bundle-aws	9086940	link	false	/test e2e-bundle-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.