Skip to content

WIP: Rebase 1.35#2578

Open
jacobsee wants to merge 7 commits intoopenshift:masterfrom
jacobsee:rebase-1.35
Open

WIP: Rebase 1.35#2578
jacobsee wants to merge 7 commits intoopenshift:masterfrom
jacobsee:rebase-1.35

Conversation

@jacobsee
Copy link
Member

@jacobsee jacobsee commented Nov 11, 2025

No description provided.

@openshift-ci-robot
Copy link

Pipeline controller notification
This repository is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. Review these jobs and use /test <job> to manually trigger optional jobs most likely to be impacted by the proposed changes.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 11, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 11, 2025

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 11, 2025

Hello @jacobsee! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@openshift-ci openshift-ci bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Nov 11, 2025
@jacobsee jacobsee marked this pull request as ready for review November 11, 2025 19:15
@jacobsee
Copy link
Member Author

/test all

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 12, 2025
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 15, 2025
@coderabbitai
Copy link

coderabbitai bot commented Nov 19, 2025

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This pull request updates the Go toolchain and build images from Go 1.24 to 1.25, bumps numerous module versions (including Kubernetes modules to v0.35.0 and multiple golang.org/x packages), and updates container base images to use golang-1.25. Several CRD OpenAPI descriptions are edited to add toleration operators Lt and Gt (noting they perform numeric comparisons and require the TaintTolerationComparisonOperators feature gate) and to remove RecoverVolumeExpansionFailure feature-gate wording from PVC/resource descriptions. Codegen now loads boilerplate via gengo with error handling.

🚥 Pre-merge checks | ✅ 1 | ❌ 2
❌ Failed checks (2 inconclusive)
Check name Status Explanation Resolution
Title check ❓ Inconclusive The title 'WIP: Rebase 1.35' is vague and uses non-descriptive generic language that doesn't convey what the actual changes are, despite this being a complex PR with multiple Go version and dependency updates. Replace with a specific title describing the main changes, such as 'Update Go toolchain to 1.25 and bump dependencies' or similar.
Description check ❓ Inconclusive No pull request description was provided by the author, making it impossible to evaluate whether it relates to the changeset. Add a description explaining the purpose of the rebase, the Go version update to 1.25, and other significant dependency updates included in this PR.
✅ Passed checks (1 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.


Comment @coderabbitai help to get the list of available commands and usage tips.

@jacobsee
Copy link
Member Author

/test all

@jacobsee jacobsee force-pushed the rebase-1.35 branch 3 times, most recently from ae1d8fc to 9a02b63 Compare December 4, 2025 20:07
@jacobsee jacobsee force-pushed the rebase-1.35 branch 2 times, most recently from fef37d6 to e980854 Compare December 11, 2025 22:21
@jacobsee jacobsee force-pushed the rebase-1.35 branch 4 times, most recently from e5e4e13 to 6736e67 Compare January 29, 2026 19:14
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@tools/go.mod`:
- Line 36: The replace directive for sigs.k8s.io/controller-tools in go.mod
points to an OpenShift fork at v0.12.1-0.20260129094627-81028d02e14a which is
incompatible with Kubernetes v0.35.0 dependencies; update the replace or module
target referenced in the replace line to a fork/version of controller-tools that
matches or is compatible with upstream v0.18.0 (or remove the replace to use
sigs.k8s.io/controller-tools v0.18.0), ensuring k8s.io/apiextensions-apiserver,
k8s.io/apimachinery, k8s.io/code-generator and k8s.io/kube-openapi versions
align with Kubernetes v0.35.0; if the downgrade is intentional, add a clear
comment in go.mod and the PR explaining why this specific OpenShift fork/version
is required and which downstream compatibility constraints were validated.
🧹 Nitpick comments (1)
tools/go.mod (1)

21-21: Note: golang.org/x/tools version differs from root go.mod.

The tools module uses golang.org/x/tools v0.41.0 while the root module uses v0.38.0. This version difference may be intentional if the tools module has different requirements, but worth confirming this is expected.

)

replace sigs.k8s.io/controller-tools => github.com/openshift/controller-tools v0.12.1-0.20260120141914-b0865777b142
replace sigs.k8s.io/controller-tools => github.com/openshift/controller-tools v0.12.1-0.20260129094627-81028d02e14a
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# Check if the pseudo-version resolves via Go proxy
curl -s "https://proxy.golang.org/github.com/openshift/controller-tools/@v/v0.12.1-0.20260129094627-81028d02e14a.info" | jq . 2>/dev/null || curl -s "https://proxy.golang.org/github.com/openshift/controller-tools/@v/v0.12.1-0.20260129094627-81028d02e14a.info"

Repository: openshift/api

Length of output: 299


🏁 Script executed:

# Check the format of the pseudo-version (date part: 20260129 = Jan 29, 2026)
# This appears to be a future date; let's check what's actually available
echo "Pseudo-version breakdown:"
echo "- Base version: v0.12.1"
echo "- Timestamp: 20260129 (January 29, 2026)"
echo "- Short commit: 81028d02e14a"
echo ""
echo "Checking Go module proxy for available versions:"
curl -s "https://proxy.golang.org/github.com/openshift/controller-tools/@v/list" | head -20

Repository: openshift/api

Length of output: 384


🏁 Script executed:

# Also check the base module that's being replaced
echo "Checking upstream controller-tools available versions:"
curl -s "https://proxy.golang.org/sigs.k8s.io/controller-tools/@v/list" | head -20

Repository: openshift/api

Length of output: 280


🏁 Script executed:

cat -n tools/go.mod | head -60

Repository: openshift/api

Length of output: 2834


Address critical version mismatch: controller-tools fork v0.12.1 is incompatible with Kubernetes v0.35.0 dependencies.

The go.mod requires sigs.k8s.io/controller-tools v0.18.0 (upstream) but replaces it with the OpenShift fork at v0.12.1-0.20260129094627-81028d02e14a. This is a 6 minor version downgrade applied to Kubernetes v0.35.0 dependencies (k8s.io/apiextensions-apiserver, k8s.io/apimachinery, k8s.io/code-generator, k8s.io/kube-openapi). The fork version is significantly older than what the upstream K8s libraries expect and will cause API incompatibilities. Upgrade the OpenShift fork to a version compatible with K8s v0.35.0, or document why this downgrade is intentional.

🤖 Prompt for AI Agents
In `@tools/go.mod` at line 36, The replace directive for
sigs.k8s.io/controller-tools in go.mod points to an OpenShift fork at
v0.12.1-0.20260129094627-81028d02e14a which is incompatible with Kubernetes
v0.35.0 dependencies; update the replace or module target referenced in the
replace line to a fork/version of controller-tools that matches or is compatible
with upstream v0.18.0 (or remove the replace to use sigs.k8s.io/controller-tools
v0.18.0), ensuring k8s.io/apiextensions-apiserver, k8s.io/apimachinery,
k8s.io/code-generator and k8s.io/kube-openapi versions align with Kubernetes
v0.35.0; if the downgrade is intentional, add a clear comment in go.mod and the
PR explaining why this specific OpenShift fork/version is required and which
downstream compatibility constraints were validated.

@jacobsee
Copy link
Member Author

/test all

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 11, 2026
@qodo-code-review
Copy link

qodo-code-review bot commented Feb 11, 2026

PR-Agent: could not fine a component named all in a supported language in this PR.

@JoelSpeed
Copy link
Contributor

Changes look good here
/approve

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 11, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 11, 2026
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
Dockerfile.ocp (1)

1-23: ⚠️ Potential issue | 🟠 Major

Run the runtime stage as a non-root user.
The image currently runs as root, which is a security posture gap.

🔒 Suggested change
 FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
@@
-COPY --from=builder /go/src/github.com/openshift/api/render /usr/bin/
-COPY --from=builder /go/src/github.com/openshift/api/write-available-featuresets /usr/bin/
+COPY --from=builder --chown=1001:0 /go/src/github.com/openshift/api/render /usr/bin/
+COPY --from=builder --chown=1001:0 /go/src/github.com/openshift/api/write-available-featuresets /usr/bin/
@@
-RUN mkdir -p /usr/share/bootkube/manifests/manifests
+RUN mkdir -p /usr/share/bootkube/manifests/manifests /manifests \
+    && chown -R 1001:0 /usr/share/bootkube/manifests /manifests
@@
 COPY payload-command/empty-resources /manifests
+
+USER 1001
🤖 Fix all issues with AI agents
In `@Dockerfile.ocp`:
- Line 1: The runtime stage currently runs as root; add a non-root USER
directive (e.g., USER nobody) in the runtime stage before the final LABEL
instruction to enforce least-privilege at container runtime—update the
Dockerfile runtime stage that begins after the builder stage and insert the USER
directive immediately prior to the existing final LABEL line so all subsequent
container processes run as that non-root user.

@@ -1,4 +1,4 @@
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22 AS builder
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Explore repository structure to understand the Dockerfile context
git ls-files | grep -i dockerfile | head -20

Repository: openshift/api

Length of output: 799


🏁 Script executed:

# Check if there are any references to this specific image tag in the codebase
rg "rhel-9-golang-1.25-openshift-4.22" --type dockerfile

Repository: openshift/api

Length of output: 91


🏁 Script executed:

# Look for OpenShift or builder-related files
fd -i dockerfile

Repository: openshift/api

Length of output: 799


🏁 Script executed:

# Check if there are any release notes, docs, or CI configs that might reference this tag
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.yaml" -o -name "*.yml" \) | head -20

Repository: openshift/api

Length of output: 1498


🏁 Script executed:

# Read the Dockerfile.ocp to see the context
cat -n Dockerfile.ocp

Repository: openshift/api

Length of output: 1167


🏁 Script executed:

# Check the .ci-operator.yaml for build configuration
cat -n .ci-operator.yaml | head -100

Repository: openshift/api

Length of output: 190


🏁 Script executed:

# Search for any references to the builder image or related tags
rg "ocp/builder" -A 2 -B 2

Repository: openshift/api

Length of output: 239


🏁 Script executed:

# Check for any documentation about OpenShift builder images
rg "rhel-9-golang" -A 2 -B 2

Repository: openshift/api

Length of output: 239


🏁 Script executed:

# Search for any git history or comments about this image update
git log --oneline --all -- Dockerfile.ocp | head -10

Repository: openshift/api

Length of output: 1342


🏁 Script executed:

# Check if there are any build/release documentation
find . -type f -name "*.md" | xargs grep -l "builder\|openshift-4.22" 2>/dev/null | head -5

Repository: openshift/api

Length of output: 148


🏁 Script executed:

# Look for any CI/CD workflows or scripts that might reference these images
find . -type f \( -name "*.sh" -o -name "Makefile" \) | xargs grep -l "builder\|4.22" 2>/dev/null | head -10

Repository: openshift/api

Length of output: 111


🏁 Script executed:

# Check the specific commits that updated Dockerfile.ocp
git show 183d7c65:Dockerfile.ocp 2>/dev/null | head -5
git show 8d996d52:Dockerfile.ocp 2>/dev/null | head -5

Repository: openshift/api

Length of output: 496


🏁 Script executed:

# Check the README to understand the project and build context
cat README.md | head -50

Repository: openshift/api

Length of output: 2064


🏁 Script executed:

# Look at the build_root_image more closely in ci-operator config
cat .ci-operator.yaml | grep -A 10 "build_root"

Repository: openshift/api

Length of output: 162


🏁 Script executed:

# Check if there's a recent change to the Dockerfile that updated the version
git diff HEAD~3 HEAD -- Dockerfile.ocp 2>/dev/null || git show --stat Dockerfile.ocp 2>/dev/null | head -20

Repository: openshift/api

Length of output: 313


🏁 Script executed:

# Look for any additional references to the 1.25 golang version or 4.22 release
rg "1.25.*4.22|4.22.*1.25" -i

Repository: openshift/api

Length of output: 50371


🏁 Script executed:

# Check if the runtime image also matches this version pattern
rg "ocp/4.22" -A 1 -B 1

Repository: openshift/api

Length of output: 154


🏁 Script executed:

# Check if there's a USER directive in the runtime stage of the Dockerfile
cat -n Dockerfile.ocp | tail -15

Repository: openshift/api

Length of output: 838


🏁 Script executed:

# Check for any recent changes or related configuration about the image tag
git log --oneline -5 -- Dockerfile.ocp .ci-operator.yaml

Repository: openshift/api

Length of output: 88


Add a non-root USER directive to the runtime stage for container security.

The runtime stage (starting at line 7) runs all processes as root. Add a USER instruction before the final LABEL to follow security best practices.

Suggested change
LABEL io.openshift.release.operator true
+USER nobody
🧰 Tools
🪛 Trivy (0.69.1)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents
In `@Dockerfile.ocp` at line 1, The runtime stage currently runs as root; add a
non-root USER directive (e.g., USER nobody) in the runtime stage before the
final LABEL instruction to enforce least-privilege at container runtime—update
the Dockerfile runtime stage that begins after the builder stage and insert the
USER directive immediately prior to the existing final LABEL line so all
subsequent container processes run as that non-root user.

@jacobsee
Copy link
Member Author

/test integration

@qodo-code-review
Copy link

qodo-code-review bot commented Feb 11, 2026

PR-Agent: could not fine a component named integration in a supported language in this PR.

Copy link
Contributor

@JoelSpeed JoelSpeed left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 18, 2026
@openshift-ci-robot
Copy link

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 18, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jacobsee
Copy link
Member Author

/retest

1 similar comment
@jacobsee
Copy link
Member Author

/retest

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 19, 2026

@jacobsee: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-upgrade 7f6dfdc link true /test e2e-upgrade
ci/prow/e2e-aws-serial-techpreview-1of2 7f6dfdc link true /test e2e-aws-serial-techpreview-1of2
ci/prow/e2e-aws-serial-2of2 7f6dfdc link true /test e2e-aws-serial-2of2
ci/prow/e2e-aws-ovn-techpreview 7f6dfdc link true /test e2e-aws-ovn-techpreview
ci/prow/e2e-aws-ovn 7f6dfdc link true /test e2e-aws-ovn
ci/prow/e2e-aws-ovn-hypershift 7f6dfdc link true /test e2e-aws-ovn-hypershift
ci/prow/e2e-upgrade-out-of-change 7f6dfdc link true /test e2e-upgrade-out-of-change
ci/prow/e2e-gcp 7f6dfdc link true /test e2e-gcp
ci/prow/e2e-aws-ovn-hypershift-conformance 7f6dfdc link true /test e2e-aws-ovn-hypershift-conformance
ci/prow/verify-deps 7f6dfdc link true /test verify-deps
ci/prow/verify-client-go 7f6dfdc link true /test verify-client-go
ci/prow/e2e-azure 7f6dfdc link true /test e2e-azure
ci/prow/e2e-aws-serial-1of2 7f6dfdc link true /test e2e-aws-serial-1of2
ci/prow/e2e-aws-serial-techpreview-2of2 7f6dfdc link true /test e2e-aws-serial-techpreview-2of2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. lgtm Indicates that a PR is ready to be merged. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

Comments