Prepare oadp-cli for Konflux onboarding into OADP 1.6#169
Prepare oadp-cli for Konflux onboarding into OADP 1.6#169Joeavaikath merged 2 commits intomigtools:oadp-devfrom
Conversation
Rename konflux.Containerfile.download to konflux.Dockerfile to match ocp-build-data expectations. Move FIPS flags (GOEXPERIMENT, strictfipsruntime) from global ENV to only the download-server build — CLI archives need CGO_ENABLED=0 for cross-platform portability. Change -mod=mod to -mod=readonly for hermetic Konflux builds. Signed-off-by: Joseph <jvaikath@redhat.com>
Documents the end-to-end process for adding a new image component to the OADP Konflux build pipeline: openshift-priv mirror setup, Dockerfile pattern, pyxis-repo-configs, RPAs, and ocp-build-data configuration. Signed-off-by: Joseph <jvaikath@redhat.com>
📝 WalkthroughWalkthroughThe PR adds a comprehensive onboarding guide for integrating OADP image components into the Konflux build/release pipeline and updates the download-server Dockerfile to use readonly module mode with inline FIPS configuration instead of global environment variables. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
docs/konflux-onboarding.md (3)
198-202: Add language specifier to fenced code block.The directory tree should have a language specifier to satisfy linting rules.
📝 Proposed fix
-``` +```text ocp-build-data/ oadp-1.5/ <-- all OADP 1.5 components oadp-1.6/ <-- all OADP 1.6 components</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@docs/konflux-onboarding.mdaround lines 198 - 202, The fenced code block
showing the directory tree in konflux-onboarding.md lacks a language specifier;
update that fenced block (the triple-backtick block containing "ocp-build-data/"
and the oadp-1.5/ and oadp-1.6/ lines) to include a language tag such as "text"
(e.g., changetotext) so the linter recognizes the block type.</details> --- `9-27`: **Add language specifier to fenced code block.** The ASCII diagram should have a language specifier to satisfy linting rules. Use `text` for plain text diagrams. <details> <summary>📝 Proposed fix</summary> ```diff -``` +```text Source repo (migtools/oadp-cli) ``` </details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@docs/konflux-onboarding.mdaround lines 9 - 27, In the fenced ASCII diagram
in docs/konflux-onboarding.md, add the language specifiertextto the opening
triple-backtick so the block becomes a `````text` fenced code block; locate the
diagram block (the triple-backtick block containing "Source repo
(migtools/oadp-cli)" through "Stage / Prod registries") and update the opening
fence accordingly to satisfy the linter.</details> --- `66-89`: **Template Dockerfile inconsistent with actual `konflux.Dockerfile`.** The template shows `GOEXPERIMENT=strictfipsruntime` as a global `ENV` (line 72), but the actual `konflux.Dockerfile` in this PR applies it inline only for the download-server build. This inconsistency could confuse users who reference this documentation. Consider updating the template to show the inline pattern, or add a note explaining that the global `ENV` approach is the standard pattern for single-binary builds, while multi-artifact builds (like oadp-cli) may need selective application. <details> <summary>📝 Option 1: Add clarifying note</summary> ```diff Key requirements: - **Builder image:** `brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25` - **FIPS compliance:** `CGO_ENABLED=1`, `GOEXPERIMENT=strictfipsruntime`, `-tags strictfipsruntime` + - For builds producing multiple artifacts where only some require FIPS (e.g., in-cluster server vs. cross-platform CLI), apply `GOEXPERIMENT` inline to specific `RUN` commands rather than globally. - **Build flags:** `-mod=readonly` (hermetic builds don't allow network fetches) ``` </details> <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against the current code and only fix it if needed. In `@docs/konflux-onboarding.md` around lines 66 - 89, The documentation Dockerfile shows GOEXPERIMENT=strictfipsruntime set as a global ENV, but the actual konflux.Dockerfile applies GOEXPERIMENT inline only for the download-server build; update docs to match reality by either changing the template to use the inline pattern for builds (as done for the download-server in konflux.Dockerfile) or add a brief clarifying note that GOEXPERIMENT as a global ENV is appropriate for single-binary builds while multi-artifact projects (e.g., oadp-cli) should apply GOEXPERIMENT selectively per build step; reference GOEXPERIMENT, konflux.Dockerfile, download-server, and oadp-cli in the note so readers can find the relevant examples. ``` </details> </blockquote></details> </blockquote></details> <details> <summary>🤖 Prompt for all review comments with AI agents</summary>Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In@docs/konflux-onboarding.md:
- Around line 198-202: The fenced code block showing the directory tree in
konflux-onboarding.md lacks a language specifier; update that fenced block (the
triple-backtick block containing "ocp-build-data/" and the oadp-1.5/ and
oadp-1.6/ lines) to include a language tag such as "text" (e.g., change ``` to- Around line 9-27: In the fenced ASCII diagram in docs/konflux-onboarding.md, add the language specifier `text` to the opening triple-backtick so the block becomes a `````text` fenced code block; locate the diagram block (the triple-backtick block containing "Source repo (migtools/oadp-cli)" through "Stage / Prod registries") and update the opening fence accordingly to satisfy the linter. - Around line 66-89: The documentation Dockerfile shows GOEXPERIMENT=strictfipsruntime set as a global ENV, but the actual konflux.Dockerfile applies GOEXPERIMENT inline only for the download-server build; update docs to match reality by either changing the template to use the inline pattern for builds (as done for the download-server in konflux.Dockerfile) or add a brief clarifying note that GOEXPERIMENT as a global ENV is appropriate for single-binary builds while multi-artifact projects (e.g., oadp-cli) should apply GOEXPERIMENT selectively per build step; reference GOEXPERIMENT, konflux.Dockerfile, download-server, and oadp-cli in the note so readers can find the relevant examples.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID:
8fe53acf-a38f-47ee-ad63-6f3727fd4877📒 Files selected for processing (2)
docs/konflux-onboarding.mdkonflux.Dockerfile
|
/lgtm |
|
/cherry-pick oadp-1.6 |
|
@mpryc: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Joeavaikath, kaovilai, mpryc The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@mpryc: new pull request created: #172 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
Summary
konflux.Containerfile.downloadtokonflux.Dockerfileto match ocp-build-data expectations and align with the standard OADP Konflux build patternGOEXPERIMENT=strictfipsruntimefrom global ENV to only the download-server build, keeping CLI archives asCGO_ENABLED=0for cross-platform portability (darwin/windows)-mod=modto-mod=readonlyfor hermetic Konflux buildsdocs/konflux-onboarding.md) covering the end-to-end process for adding new components to the OADP Konflux pipelineWhy
oadp-cli needs to be added to the OADP 1.6 release stream. The existing
konflux.Containerfile.downloadhad several issues that would cause failures in Konflux's hermetic build environment:konflux.Dockerfile)-mod=modfails when network is blocked during hermetic buildsGOEXPERIMENT=strictfipsruntimewould leak into cross-compilation of CLI archives and break darwin/windows buildsNote: CLI archives are served as file downloads — they run on user machines outside the FIPS boundary. Only the download-server binary (running in-cluster on RHEL) requires FIPS compliance.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Refactor