OCPBUGS-81471: lower certificate parse failure log to trace level

[savio87]

Summary

Lowers the log level for unparseable certificate files from debug! to trace! in the graph_builder's get_certs_from_dir function.

Problem

In air-gapped environments, the graph_builder logs a distracting message every time it encounters ca-bundle.trust.crt:

[DEBUG cincinnati::plugins::internal::graph_builder::commons] unable to process certificate ca-bundle.trust.crt: builder error: error:0909006C:PEM routines:get_name:no start line

This file contains TRUSTED CERTIFICATE PEM blocks (with extra trust metadata), not standard CERTIFICATE blocks, so reqwest::Certificate::from_pem() rejects them. The message is harmless but confusing — operators investigating real issues may mistake it for a problem.

Fix

Change the log macro from debug! to trace!, so the message only appears at the most verbose logging level. This keeps it available for deep troubleshooting while removing noise from normal debug output.

Testing

The change is a single log-level adjustment with no behavioral impact on certificate loading.

Summary by CodeRabbit

• Bug Fixes
  • Reduced the visibility of certificate-processing failure logs to minimize unnecessary debug-level noise.
  • Successful certificate additions continue to be logged at debug level.

[openshift-ci-robot]

@savio87: This pull request references Jira Issue OCPBUGS-81471, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Lowers the log level for unparseable certificate files from debug! to trace! in the graph_builder's get_certs_from_dir function.

Problem

In air-gapped environments, the graph_builder logs a distracting message every time it encounters ca-bundle.trust.crt:

[DEBUG cincinnati::plugins::internal::graph_builder::commons] unable to process certificate ca-bundle.trust.crt: builder error: error:0909006C:PEM routines:get_name:no start line

This file contains TRUSTED CERTIFICATE PEM blocks (with extra trust metadata), not standard CERTIFICATE blocks, so reqwest::Certificate::from_pem() rejects them. The message is harmless but confusing — operators investigating real issues may mistake it for a problem.

Fix

Change the log macro from debug! to trace!, so the message only appears at the most verbose logging level. This keeps it available for deep troubleshooting while removing noise from normal debug output.

Testing

The change is a single log-level adjustment with no behavioral impact on certificate loading.

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The graph builder now logs certificate-processing failures at trace level. Successful certificate additions remain at debug level.

Changes

Certificate logging

Layer / File(s)	Summary
Certificate failure logging cincinnati/src/plugins/internal/graph_builder/commons.rs	The module imports trace and logs certificate parsing failures at trace level. Successful certificate additions remain at debug level.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only Rust logging; the repository has no Ginkgo dependencies or Ginkgo test declarations, so this check is not applicable.
Test Structure And Quality	✅ Passed	The pull request changes only Rust logging in commons.rs and adds no Ginkgo tests or cluster operations; the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR changes only a Rust log import and macro in commons.rs; it adds no Ginkgo e2e tests or MicroShift-relevant API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only Rust logging in commons.rs; it adds no Ginkgo e2e tests or multi-node test assumptions, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only Rust logging in get_certs_from_dir; it adds no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR only changes Rust certificate logging; the repository has no Go files or OTE/Ginkgo/klog suite code, so the OTE stdout contract is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only a Rust import and log macro; it adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The only code change imports trace and changes one certificate-processing log call from debug! to trace!; no weak algorithms or custom crypto are introduced.
Container-Privileges	✅ Passed	The commit changes only Rust logging in commons.rs; no container or Kubernetes manifest changes or privilege directives appear in the changed file.
No-Sensitive-Data-In-Logs	✅ Passed	The change only moves certificate basename and generic parser error logging from debug to trace; it does not log certificate contents, credentials, tokens, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: lowering certificate parse failure logs to trace level.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @savio87. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: savio87
Once this PR has been reviewed and has the lgtm label, please assign hongkailiu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[savio87]

Hi maintainers, this is my first contribution to this repo. Could someone please set the target version on the linked Jira issue (OCPBUGS-81471) and run /ok-to-test? Thanks!