OCPBUGS-84692: UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master#286
Conversation
…bot/cherry-pick-13559-to-release-1.12 [release-1.12] 📖 Fix upgrade plan hooks documentation
…bot/cherry-pick-13558-to-release-1.12 [release-1.12] 🐛 KCP deletion should tolerate missing InfraTemplates
…bot/cherry-pick-13564-to-release-1.12 [release-1.12] 🌱 Start testing with Kubernetes v1.36.0-rc.0
Signed-off-by: sivchari <shibuuuu5@gmail.com>
…9883-release-1.12 🐛 Fix CVE 2026 39883 release 1.12
…bot/cherry-pick-13585-to-release-1.12 [release-1.12] 🌱 Start testing with Kubernetes v1.36.0-rc.1
Signed-off-by: Troy Connor <troy0820@users.noreply.github.com>
…bot/cherry-pick-13583-to-release-1.12 [release-1.12] 🌱 Bump Cert-manager v1.20.2
Signed-off-by: Prajyot-Parab <prajyot.parab2@ibm.com>
[release-1.12] 🌱 Bump cloudbuild to use gcb-docker-gcloud image with Go v1.25.5
Squash follow-up OWNERS sync into the initial OpenShift-specific carry since it updates the same initial ownership surface.
Squash the OWNERS-only carries into a single update to keep ownership churn in one focused commit.
Squash adjacent changes that iterate on OpenShift manifest tooling and metadata sync behavior in the same Makefile-driven flow.
Squash adjacent Dockerfile updates that refine the 4.21 image carry and manager binary naming.
Squash adjacent toolchain updates touching openshift/tools so kustomize alignment and IPAM pinning are applied together.
…olicy: Ignore Add functions to set the failurePolicy to Ignore for both mutating and validating webhooks handling IPAM resources. During bootstrap, the bootstrap node's Kube API Server receives IPAM create requests but is unable to reach the webhooks in the Cluster API namespace. This is because the bootstrap node doesn't have a route to the pods as it doesn't have access to the pod networks. If failurePolicy is set to Fail, the KAS cannot reach the webhook endpoints and the request fails, preventing creation of IPAddress and IPAddressClaim resources. This causes a chicken-and-egg problem as it prevents IPAM provisioning for the workers which won't start without their IP addresses being allocated. Setting failurePolicy to Ignore allows the resources to be created even when the webhooks are unreachable during bootstrap, matching what Machine API also does. More context: https://redhat-internal.slack.com/archives/C0A2M43S199/p1765540108488539
Squash ART image consistency updates into a single carry commit.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Squash adjacent carries that iterate over OpenShift manifests generation, IPAM kustomization, and Dockerfile image consistency.
…erRoles In an aggregated ClusterRole, the rules field is created and managed by clusterrole-aggregation-controller. It is also defined to be atomic. This means that specifying it as empty is not only redundant, it will cause a conflict when reconciling the resource with SSA.
… upstream rebase Squash the post-rebase regeneration steps into a single carry commit so the PR keeps one coherent update for generated manifests and dependency vendoring.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: damdo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughThis pull request updates cert-manager to v1.20.2, Kubernetes test versions to v1.36.0-rc.1, and Cluster API provider version to v1.12.7. It also fixes KubeadmControlPlane deletion handling to tolerate missing infrastructure machine templates, and updates build dependencies and configurations. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
damdo
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@damdo: This pull request is an upstream sync and explicitly references no jira issue. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (7)
openshift/capi-operator-manifests/default/metadata.yaml (1)
1-7: LGTM: metadata attributes.version updated consistently with provider version.The update to
attributes.version: v1.12.7is correctly placed underattributes(withtype: coreintact) and should align with the repo’s operator/manifests generation expectations.Optional: add/keep a short note in surrounding generator logic (if it exists) clarifying that versions must include the leading
vprefix, to prevent future mismatches.If there’s validation tooling or a schema that enforces a specific version string format, verify this
v1.12.7format satisfies it.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@openshift/capi-operator-manifests/default/metadata.yaml` around lines 1 - 7, Update the generator/validation to ensure the attributes.version field always includes the leading "v" and add a brief inline comment near the generator logic documenting that versions must include the leading "v" to avoid future mismatches; specifically check and, if needed, adjust the code that emits attributes.version (and any validation/schema checks that read it) so "v1.12.7" is accepted and preserved, and run the repository's schema/validation tooling against attributes.version to confirm it passes..trivyignore (1)
1-5: Suggestion: add a re-check/expiry note to avoid a stale ignore.The rationale is detailed, but this sort of ignore often needs a “re-evaluate when” marker (e.g., when the release branch picks up Go ≥ 1.25 / otel/sdk v1.43.0 backport / when image base OS changes). That helps prevent the ignore from silently persisting beyond the condition it was meant for.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.trivyignore around lines 1 - 5, Append a short “re-evaluate”/expiry note to this .trivyignore entry for CVE-2026-39883 explaining when to re-check (e.g., when the release branch upgrades to Go >= 1.25, when otel/sdk v1.43.0 is backported, or if the image base OS changes), include a target review date or version boundary and reference tools/indicators (govulncheck, Go version, otel/sdk version) so the ignore cannot remain stale.docs/book/src/tasks/experimental-features/runtime-sdk/implement-upgrade-plan-hooks.md (2)
147-147: Fix minor grammar: “comply the” → “comply with”.Line [147] reads “In all the cases above, the
GenerateUpgradePlanResponsecontent must comply the following validation rules:”. Consider changing to “must comply with the following…”.Proposed change
-In all the cases above, the `GenerateUpgradePlanResponse` content must comply the following validation rules: +In all the cases above, the `GenerateUpgradePlanResponse` content must comply with the following validation rules:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/book/src/tasks/experimental-features/runtime-sdk/implement-upgrade-plan-hooks.md` at line 147, Update the sentence at the mentioned location to correct the grammar by inserting "with" after "comply" so it reads: "In all the cases above, the `GenerateUpgradePlanResponse` content must comply with the following validation rules:"; locate the text referencing GenerateUpgradePlanResponse and make this replacement.
162-162: Remove trailing whitespace in the workersUpgrades bullet.Line [162] ends with an extra space (“
workersUpgradesshould be set and ”). Please remove the trailing whitespace to keep diffs clean and avoid lint/style issues.Proposed change
-- If instead for any reason a custom upgrade plan for workers is required, `workersUpgrades` should be set and +- If instead for any reason a custom upgrade plan for workers is required, `workersUpgrades` should be set and🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/book/src/tasks/experimental-features/runtime-sdk/implement-upgrade-plan-hooks.md` at line 162, Remove the trailing whitespace at the end of the bullet that mentions workersUpgrades so the sentence reads "...`workersUpgrades` should be set and" without the extra space; locate the bullet containing the symbol `workersUpgrades` in the document and delete the trailing space character after "and".scripts/ci-e2e-lib.sh (1)
257-269: Update cert-manager pre-pull tags to v1.20.2; consider preventing future drift.The tag bump to
v1.20.2is consistent with the other changes. To minimize future breakage, it’d be good to confirm that e2e actually references these exact tags for:
cert-manager-cainjectorcert-manager-webhookcert-manager-controllerOptional refactor: derive the cert-manager version from a single source of truth (env var or generated constant) instead of hardcoding
v1.20.2in Bash.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/ci-e2e-lib.sh` around lines 257 - 269, The cert-manager image tags are hardcoded to v1.20.2 inside kind:prepullAdditionalImages; change the three kind::prepullImage calls for cert-manager-cainjector, cert-manager-webhook, and cert-manager-controller to use a single source-of-truth variable (e.g., CERT_MANAGER_TAG) with a sensible default of "v1.20.2" so future bumps only need one change; ensure the variable is read from the environment if set and fallback to the default before calling kind::prepullImage, and leave the rest of the loop that preloads DOCKER_PRELOAD_IMAGES unchanged.cloudbuild-nightly.yaml (1)
7-16: Pinned Cloud Build image digest changed—verify digest/comment sync + alignment with cloudbuild.yaml.No other step changes here, which is good. Still, since this is a supply-chain/pinning change, please ensure:
- the
# v20251211-4c812d4cd8comment actually matches the new digest, andcloudbuild.yamluses the same digest/comment pairing (to avoid nightly/staging build drift).Optional: reduce duplication by generating both files from a shared source or validating them in CI.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cloudbuild-nightly.yaml` around lines 7 - 16, The pinned Cloud Build image digest in the steps block (image string 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:8d6a3a5b895e6776dbe9115b75db1412fbe57299b8db329d45cb54680e462b0b' and inline comment '# v20251211-4c812d4cd8') must be verified and kept in sync with cloudbuild.yaml: confirm the sha256 actually matches the referenced release tag string in the comment and update the comment to the correct tag if it doesn’t, then ensure the exact same digest+comment pairing is used in cloudbuild.yaml (or centralize generation/validation in CI) so nightly and staging builds cannot drift.docs/book/src/developer/getting-started.md (1)
81-97: Doc install URL updated—ensure it stays in sync with clusterctl defaults.The
kubectl apply -fURL bump tov1.20.2is consistent with the code change. Minor ask: confirm there are no other cert-manager install URLs in this repo still pointing atv1.20.1(especially underdocs/book/src/clusterctl/commands/init.mdand any CI/e2e config).If you want to avoid future drift, consider referencing a single generated/common value (or a documented constant) rather than duplicating the version in multiple Markdown files.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/book/src/developer/getting-started.md` around lines 81 - 97, Update any remaining hard-coded cert-manager install URLs to the new v1.20.2 URL used in the Cert-Manager section (the kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml line) by searching the repo for v1.20.1 or cert-manager.yaml (especially check docs/book/src/clusterctl/commands/init.md and CI/e2e config files) and replace them so all docs and configs are consistent; additionally, to prevent future drift, consolidate the version into a single source (e.g., a documented constant or an include/templated value used by Markdown generation) and update documentation to reference that shared value instead of duplicating the URL.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.trivyignore:
- Around line 1-5: Append a short “re-evaluate”/expiry note to this .trivyignore
entry for CVE-2026-39883 explaining when to re-check (e.g., when the release
branch upgrades to Go >= 1.25, when otel/sdk v1.43.0 is backported, or if the
image base OS changes), include a target review date or version boundary and
reference tools/indicators (govulncheck, Go version, otel/sdk version) so the
ignore cannot remain stale.
In `@cloudbuild-nightly.yaml`:
- Around line 7-16: The pinned Cloud Build image digest in the steps block
(image string
'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:8d6a3a5b895e6776dbe9115b75db1412fbe57299b8db329d45cb54680e462b0b'
and inline comment '# v20251211-4c812d4cd8') must be verified and kept in sync
with cloudbuild.yaml: confirm the sha256 actually matches the referenced release
tag string in the comment and update the comment to the correct tag if it
doesn’t, then ensure the exact same digest+comment pairing is used in
cloudbuild.yaml (or centralize generation/validation in CI) so nightly and
staging builds cannot drift.
In `@docs/book/src/developer/getting-started.md`:
- Around line 81-97: Update any remaining hard-coded cert-manager install URLs
to the new v1.20.2 URL used in the Cert-Manager section (the kubectl apply -f
https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml
line) by searching the repo for v1.20.1 or cert-manager.yaml (especially check
docs/book/src/clusterctl/commands/init.md and CI/e2e config files) and replace
them so all docs and configs are consistent; additionally, to prevent future
drift, consolidate the version into a single source (e.g., a documented constant
or an include/templated value used by Markdown generation) and update
documentation to reference that shared value instead of duplicating the URL.
In
`@docs/book/src/tasks/experimental-features/runtime-sdk/implement-upgrade-plan-hooks.md`:
- Line 147: Update the sentence at the mentioned location to correct the grammar
by inserting "with" after "comply" so it reads: "In all the cases above, the
`GenerateUpgradePlanResponse` content must comply with the following validation
rules:"; locate the text referencing GenerateUpgradePlanResponse and make this
replacement.
- Line 162: Remove the trailing whitespace at the end of the bullet that
mentions workersUpgrades so the sentence reads "...`workersUpgrades` should be
set and" without the extra space; locate the bullet containing the symbol
`workersUpgrades` in the document and delete the trailing space character after
"and".
In `@openshift/capi-operator-manifests/default/metadata.yaml`:
- Around line 1-7: Update the generator/validation to ensure the
attributes.version field always includes the leading "v" and add a brief inline
comment near the generator logic documenting that versions must include the
leading "v" to avoid future mismatches; specifically check and, if needed,
adjust the code that emits attributes.version (and any validation/schema checks
that read it) so "v1.12.7" is accepted and preserved, and run the repository's
schema/validation tooling against attributes.version to confirm it passes.
In `@scripts/ci-e2e-lib.sh`:
- Around line 257-269: The cert-manager image tags are hardcoded to v1.20.2
inside kind:prepullAdditionalImages; change the three kind::prepullImage calls
for cert-manager-cainjector, cert-manager-webhook, and cert-manager-controller
to use a single source-of-truth variable (e.g., CERT_MANAGER_TAG) with a
sensible default of "v1.20.2" so future bumps only need one change; ensure the
variable is read from the environment if set and fallback to the default before
calling kind::prepullImage, and leave the rest of the loop that preloads
DOCKER_PRELOAD_IMAGES unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1c56c861-8702-4549-a822-cc80dd280991
⛔ Files ignored due to path filters (13)
hack/tools/vendor/sigs.k8s.io/cluster-api/cmd/clusterctl/client/config/cert_manager_client.gois excluded by!**/vendor/**openshift/tools/go.sumis excluded by!**/*.sumopenshift/tools/vendor/github.com/openshift/api/config/v1/types.gois excluded by!**/vendor/**openshift/tools/vendor/github.com/openshift/api/config/v1/types_apiserver.gois excluded by!**/vendor/**openshift/tools/vendor/github.com/openshift/api/config/v1/types_authentication.gois excluded by!**/vendor/**openshift/tools/vendor/github.com/openshift/api/config/v1/types_cluster_version.gois excluded by!**/vendor/**openshift/tools/vendor/github.com/openshift/api/config/v1/types_dns.gois excluded by!**/vendor/**openshift/tools/vendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!**/vendor/**openshift/tools/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!**/zz_generated*openshift/tools/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!**/zz_generated*openshift/tools/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!**/zz_generated*openshift/tools/vendor/modules.txtis excluded by!**/vendor/**test/vendor/sigs.k8s.io/cluster-api/cmd/clusterctl/client/config/cert_manager_client.gois excluded by!**/vendor/**
📒 Files selected for processing (18)
.trivyignorecloudbuild-nightly.yamlcloudbuild.yamlcmd/clusterctl/client/config/cert_manager_client.gocontrolplane/kubeadm/internal/filters.gocontrolplane/kubeadm/internal/filters_test.godocs/book/src/clusterctl/commands/init.mddocs/book/src/developer/getting-started.mddocs/book/src/tasks/experimental-features/runtime-sdk/implement-upgrade-plan-hooks.mdopenshift/capi-operator-manifests/default/metadata.yamlopenshift/provider-version.mkopenshift/tools/go.modscripts/ci-e2e-lib.shtest/e2e/config/docker.yamltest/infrastructure/docker/examples/machine-pool.yamltest/infrastructure/docker/examples/simple-cluster-ipv6.yamltest/infrastructure/docker/examples/simple-cluster-without-kcp.yamltest/infrastructure/docker/examples/simple-cluster.yaml
|
/test e2e-hypershift |
|
@damdo: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by ci |
openshift-ci-robot
added
the
verified
|
@damdo: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
/retitle OCPBUGS-84692: UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master |
openshift-ci
Bot
changed the title
|
@damdo: Jira Issue Verification Checks: Jira Issue OCPBUGS-84692 Jira Issue OCPBUGS-84692 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
11 participants
Summary by CodeRabbit
Bug Fixes
Chores
Documentation