fix noschedule rules for hcp

[sluetze]

Description:

This PR rewrites the master_taint_noschedule test in a way that is compatible with Hypershift.

Rationale:

When running the bsi-profile on a hosted cluster in hypershift, the api-checks failed:

FATAL:Error fetching resources: couldn't filter '{"kind":"NodeList","apiVersion":"v1","metadata":{"resourceVersion":"34917081"},"items":[{"metadata":{"name":"stormshift-ocp3-nodepool1-wvz52-9p4gq","uid":"c3d27502-3df5-4eae-b4d4-7fa92013514e","resourceVersion":"34917071","creationTimestamp":"2025-05-20T16:11:45Z","labels":{"beta.kubernetes.io/arch":"amd64","beta.kubernetes.io/os":"linux","hypershift.openshift.io/managed":"true","hypershift.openshift.io/nodePool":"stormshift-ocp3-nodepool1","kubernetes.io/arch":"amd64","kubernetes.io/hostname":"stormshift-ocp3-nodepool1-wvz52-9p4gq","kubernetes.io/os":"linux","node-role.kubernetes.io/worker":"","node.openshift.io/os_id":"rhcos"},"annotations":{"alpha.kubernetes.io/provided-node-ip":"10.129.20.68","cluster.x-k8s.io/cluster-name":"ocp3","cluster.x-k8s.io/cluster-namespace":"clusters-stormshift-ocp3","cluster.x-k8s.io/labels-from-machine":"","cluster.x-k8s.io/machine":"stormshift-ocp3-nodepool1-wvz52-9p4gq","cluster.x-k8s.io/owner-kind":"MachineSet","cluster.x-...

thus the whole profile wasnt finishing. By rewriting the check, it executes now on hypershift and on regular clusters.

Review Hints:

[sluetzen@wirt CaC-content]$ oc get ccr | grep taint
ocp4-bsi-master-taint-noschedule                                                                    PASS     medium
[sluetzen@wirt CaC-content]$ oc patch  schedulers.config.openshift.io cluster --type merge --patch '{"spec": {"mastersSchedulable": true}}'
scheduler.config.openshift.io/cluster patched
[sluetzen@wirt CaC-content]$ oc get --raw /api/v1/nodes | jq '[ .items[] | select(.spec.taints[]?.key == "node-role.kubernetes.io/master" and .spec.taints[]?.effect == "NoSchedule") | .metadata.name ]
> '
[]
[sluetzen@wirt CaC-content]$ oc compliance rerun-now compliancesuite/bsi-ocp
Rerunning scans from 'bsi-ocp': ocp4-bsi
Re-running scan 'openshift-compliance/ocp4-bsi'
[sluetzen@wirt CaC-content]$ oc get ccr | grep taint
ocp4-bsi-master-taint-noschedule                                                                    FAIL     medium
[sluetzen@wirt CaC-content]$ oc patch  schedulers.config.openshift.io cluster --type merge --patch '{"spec": {"mastersSchedulable": false}}'
scheduler.config.openshift.io/cluster patched
[sluetzen@wirt CaC-content]$ oc compliance rerun-now compliancesuite/bsi-ocp
Rerunning scans from 'bsi-ocp': ocp4-bsi
Re-running scan 'openshift-compliance/ocp4-bsi'
[sluetzen@wirt CaC-content]$ oc get ccr | grep taint
ocp4-bsi-master-taint-noschedule                                                                    PASS     medium

hcp

bash-5.1 ~ $ oc get ccr | grep taint
upstream-ocp4-bsi-master-taint-noschedule                                       FAIL     medium

[openshift-ci[bot]]

Hi @sluetze. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[qlty-cloud-legacy[bot]]

Code Climate has analyzed commit f12bc082 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.7% (0.0% change).

View more on Code Climate.