fix: ensure FEDRAMP env var is passed to operator deployment through PKO template#462
Merged
openshift-merge-bot[bot] merged 2 commits intoMay 27, 2026
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (16)
📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThis PR introduces FEDRAMP as a configurable option for the certman-operator, replacing a hardcoded value with a templated configuration property. It also includes updates to pre-commit setup, team ownership in OWNERS_ALIASES, and Docker build context filtering. ChangesFEDRAMP Configuration Feature
Infrastructure and Administrative Updates
🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Ajpantuso
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
deploy_pko/manifest.yaml (1)
35-38: ⚡ Quick winConstrain
fedrampto valid values in the schema.The controller only enables FedRAMP on exact
"true", so a free-form string here can silently misconfigure behavior. Prefertype: booleanor a stringenum("true"|"false").🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@deploy_pko/manifest.yaml` around lines 35 - 38, The manifest's fedramp field is currently a free-form string which can silently misconfigure the controller (it only enables FedRAMP on exact "true"); change the schema for the fedramp property to a constrained type—either set type: boolean with default: false, or keep type: string and add enum: ["true","false"] and default: "false"—so the controller receives only valid values; update the fedramp declaration (and its default) accordingly in manifest.yaml.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy_pko/Deployment-certman-operator.yaml.gotmpl`:
- Line 45: The template currently enables FedRAMP via value: '{{ .config.fedramp
}}' but does not propagate HOSTED_ZONE_ID, causing reconciles to fail when
fedramp is true; update the Deployment-certman-operator.yaml.gotmpl to set the
HOSTED_ZONE_ID environment variable from the config (e.g. value: '{{
.config.hosted_zone_id }}'), and add a hosted_zone_id config field/schema and
propagation in your package manifests so the cluster/package YAMLs expose and
pass hosted_zone_id through to the rendered template; ensure this matches the
controller expectation for HOSTED_ZONE_ID used in
certificaterequest_controller.go.
---
Nitpick comments:
In `@deploy_pko/manifest.yaml`:
- Around line 35-38: The manifest's fedramp field is currently a free-form
string which can silently misconfigure the controller (it only enables FedRAMP
on exact "true"); change the schema for the fedramp property to a constrained
type—either set type: boolean with default: false, or keep type: string and add
enum: ["true","false"] and default: "false"—so the controller receives only
valid values; update the fedramp declaration (and its default) accordingly in
manifest.yaml.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 91d823b5-573a-472c-9a40-b5c19ecd03d5
⛔ Files ignored due to path filters (24)
boilerplate/_data/last-boilerplate-commitis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/OWNERS_ALIASESis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/dependabot.ymlis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/docs/pre-commit.mdis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/olm_pko_migration.pyis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/pre-commit-config.yamlis excluded by!boilerplate/**build/Dockerfileis excluded by!build/**build/Dockerfile.olm-registryis excluded by!build/**deploy_pko/.test-fixtures/default/Cleanup-OLM-Job.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/ClusterRole-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/ClusterRoleBinding-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/CustomResourceDefinition-certificaterequests.certman.managed.openshift.io.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/Deployment-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/Role-prometheus-k8s.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/RoleBinding-prometheus-k8s.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/default/ServiceAccount-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/Cleanup-OLM-Job.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/ClusterRole-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/ClusterRoleBinding-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/CustomResourceDefinition-certificaterequests.certman.managed.openshift.io.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/Deployment-certman-operator.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/Role-prometheus-k8s.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/RoleBinding-prometheus-k8s.yamlis excluded by!**/.test-fixtures/**deploy_pko/.test-fixtures/fedramp/ServiceAccount-certman-operator.yamlis excluded by!**/.test-fixtures/**
📒 Files selected for processing (6)
.pre-commit-config.yamlOWNERS_ALIASESdeploy_pko/.dockerignoredeploy_pko/Deployment-certman-operator.yaml.gotmpldeploy_pko/manifest.yamlhack/pko/clusterpackage.yaml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #462 +/- ##
=======================================
Coverage 57.15% 57.15%
=======================================
Files 29 29
Lines 2138 2138
=======================================
Hits 1222 1222
Misses 802 802
Partials 114 114 🚀 New features to boost your workflow:
|
Ajpantuso
force-pushed
the
apantuso/fix_pko_fedramp
branch
from
May 27, 2026 16:21
3d5e1e4 to
6976c2f
Compare
Member
|
/retest |
Ajpantuso
force-pushed
the
apantuso/fix_pko_fedramp
branch
from
May 27, 2026 16:38
6976c2f to
558b6b2
Compare
Member
|
/lgtm |
Member
|
/approve |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Ajpantuso, dustman9000, tnierman The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/retest-required |
Contributor
|
@Ajpantuso: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Properly passed
FEDRAMPenv var through PKO template to operator deployment.Summary by CodeRabbit
New Features
Tests
Chores