CNTRLPLANE-3889: Bump k8s dependencies to 1.36 along with openshift - #2318
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@ardaguclu: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe PR updates the project to Go 1.26, Kubernetes 1.36.2, and OpenShift 5.0. It refreshes module dependencies and container images, adapts CLI API signatures, updates rollout and KubeRC wiring, adjusts ImageStream graph logging, and adds a describer coverage exception. ChangesRelease and dependency refresh
CLI compatibility updates
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
pkg/cli/rollout/rollout.go (1)
42-42: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd documentation comments to the changed exported functions and methods.
pkg/cli/rollout/rollout.go#L42-L42: documentNewCmdRollout.pkg/cli/rollout/rollout.go#L151-L152: documentNewCmdRolloutUndo.pkg/cli/deployer/deployer_test.go#L237-L243: document the exportedFakeScaler.ScaleandFakeScaler.ScaleSimplemethods.As per coding guidelines: “Add descriptive comments to all exported and unexported Go types, functions, and methods.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/cli/rollout/rollout.go` at line 42, Add descriptive Go documentation comments for NewCmdRollout and NewCmdRolloutUndo in pkg/cli/rollout/rollout.go, and for the exported FakeScaler.Scale and FakeScaler.ScaleSimple methods in pkg/cli/deployer/deployer_test.go; each comment should begin with the documented symbol’s name and describe its behavior.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@images/cli/Dockerfile.rhel`:
- Around line 7-11: Add a supported non-root USER directive after privileged
setup in images/cli/Dockerfile.rhel; this change also covers its derived
images/cli-artifacts/Dockerfile.rhel and images/recycler/Dockerfile.rhel. In
images/tools/Dockerfile, add the same non-root runtime identity after package
installation. Ensure both Dockerfiles never run as root.
In `@Makefile`:
- Around line 16-17: Update the image output references in the build-image calls
to use ocp/5.0, matching the OpenShift 5.0 CI root and Dockerfile bases; only
retain ocp/4.2 if the compatibility tagging is explicitly intentional and
documented.
---
Nitpick comments:
In `@pkg/cli/rollout/rollout.go`:
- Line 42: Add descriptive Go documentation comments for NewCmdRollout and
NewCmdRolloutUndo in pkg/cli/rollout/rollout.go, and for the exported
FakeScaler.Scale and FakeScaler.ScaleSimple methods in
pkg/cli/deployer/deployer_test.go; each comment should begin with the documented
symbol’s name and describe its behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| FROM registry.ci.openshift.org/ocp/5.0:base-rhel9 | ||
| COPY --from=builder /go/src/github.com/openshift/oc/oc /usr/bin/ | ||
| COPY --from=builder /go/src/github.com/openshift/oc/oc-tests-ext.gz /usr/bin/oc-tests-ext.gz | ||
| RUN dnf install -y subscription-manager && dnf clean all && rm -rf /var/cache/dnf/* | ||
| RUN for i in kubectl openshift-deploy openshift-docker-build openshift-sti-build openshift-git-clone openshift-manage-dockerfile openshift-extract-image-content openshift-recycle; do ln -sf /usr/bin/oc /usr/bin/$i; done |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Use non-root runtime identities for the refreshed images.
Both runtime stages still default to root. Add a supported non-root USER after privileged setup.
images/cli/Dockerfile.rhel#L7-L11: add the runtime user; this also covers derivedimages/cli-artifacts/Dockerfile.rhelandimages/recycler/Dockerfile.rhel.images/tools/Dockerfile#L1-L6: add the runtime user after package installation.
As per path instructions, Dockerfiles must use a non-root USER and never run as root.
📍 Affects 2 files
images/cli/Dockerfile.rhel#L7-L11(this comment)images/tools/Dockerfile#L1-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@images/cli/Dockerfile.rhel` around lines 7 - 11, Add a supported non-root
USER directive after privileged setup in images/cli/Dockerfile.rhel; this change
also covers its derived images/cli-artifacts/Dockerfile.rhel and
images/recycler/Dockerfile.rhel. In images/tools/Dockerfile, add the same
non-root runtime identity after package installation. Ensure both Dockerfiles
never run as root.
Sources: Path instructions, Linters/SAST tools
| KUBE_GIT_MINOR_VERSION := "36" | ||
| KUBE_GIT_VERSION := "v1.36.2" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Update the image output references with the 5.0 refresh.
The build-image calls at Lines 62-64 and Lines 70-74 still publish images under ocp/4.2, while the CI root and Dockerfile bases now use OpenShift 5.0. This can produce 5.0-based images under stale 4.2 tags. Update those references to ocp/5.0, or document why the compatibility tags are intentional.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` around lines 16 - 17, Update the image output references in the
build-image calls to use ocp/5.0, matching the OpenShift 5.0 CI root and
Dockerfile bases; only retain ocp/4.2 if the compatibility tagging is explicitly
intentional and documented.
There was a problem hiding this comment.
Those lines are replaced by ART. ocp/4.2 is just a placeholder in that manner. So there is no issue here.
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
|
okd-scos-images failure will be fixed by #2317 |
|
/pipeline |
|
/pipeline required |
|
Scheduling required tests: Scheduling tests matching the |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pkg/cli/kubectlwrappers/wrappers.go (1)
232-234: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a Go doc comment for
NewCmdKubeRC.This exported function should document that it wraps kubectl’s KubeRC command for the
ocCLI.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/cli/kubectlwrappers/wrappers.go` around lines 232 - 234, Add a Go doc comment immediately before NewCmdKubeRC describing that the exported function wraps kubectl’s KubeRC command for the oc CLI, with the comment beginning with NewCmdKubeRC.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pkg/cli/kubectlwrappers/wrappers.go`:
- Around line 232-234: Add a Go doc comment immediately before NewCmdKubeRC
describing that the exported function wraps kubectl’s KubeRC command for the oc
CLI, with the comment beginning with NewCmdKubeRC.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 3f2c02af-6292-4be9-b476-ad8e7ee5ee0c
📒 Files selected for processing (2)
pkg/cli/cli.gopkg/cli/kubectlwrappers/wrappers.go
🚧 Files skipped from review as they are similar to previous changes (1)
- pkg/cli/cli.go
|
/pipeline required |
|
Scheduling required tests: Scheduling tests matching the |
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
/payload nightly blocking |
|
@ardaguclu: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info. |
|
/payload 5.0 nightly blocking |
1 similar comment
|
/payload 5.0 nightly blocking |
|
@ardaguclu: trigger 14 job(s) of type blocking for the nightly release of OCP 5.0
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/50da4340-84e3-11f1-8b9c-5e89ee86d8f4-0 |
|
unrelated |
|
/retest |
|
/payload 5.0 nightly blocking |
|
@ardaguclu: trigger 14 job(s) of type blocking for the nightly release of OCP 5.0
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/16981580-8511-11f1-8034-1590db382642-0 |
|
/retest |
|
@atiratree @tchap I think, this is ready for your review, whenever you have some time. |
|
According to the results of https://pr-payload-tests.ci.openshift.org/runs/ci/16981580-8511-11f1-8034-1590db382642-0 |
openshift-ci-robot
added
the
verified
|
@ardaguclu: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ardaguclu, tchap The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@ardaguclu: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
cd086f9
into
openshift:main
|
/retitle CNTRLPLANE-3889: Bump k8s dependencies to 1.36 along with openshift |
openshift-ci
Bot
changed the title
3 participants
This PR bumps k8s to 1.36 in oc.
This PR also covers these PRs;
Summary by CodeRabbit
kube rccommand integration when it isn’t disabled.