Skip to content

OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads#302

Merged
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
damdo:OCPBUGS-85337-imagepullpolicy-ifnotpresent
Jul 8, 2026
Merged

OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads#302
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
damdo:OCPBUGS-85337-imagepullpolicy-ifnotpresent

Conversation

@damdo

@damdo damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

Summary

Depends on: openshift/cluster-capi-operator#618

TODO

Test plan

  • Run upgrade in a techpreview disconnected cluster using only pinned image sets and verify capi-controller-manager pods no longer crash with ImagePullBackOff
  • Verify capi-controller-manager Deployment has imagePullPolicy: IfNotPresent

Summary by CodeRabbit

  • Bug Fixes

    • Reduced unnecessary container image pulls when pods restart or reschedule, helping improve startup reliability and efficiency.
  • Chores

    • Updated an internal tooling dependency to a newer version.

@openshift-ci-robot openshift-ci-robot added the jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. label Jul 3, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 3, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 3, 2026
@openshift-ci

openshift-ci Bot commented Jul 3, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci-robot openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jul 3, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This pull request references Jira Issue OCPBUGS-85337, which is invalid:

  • expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Depends on: openshift/cluster-capi-operator#618

Test plan

  • Run upgrade in a techpreview disconnected cluster using only pinned image sets and verify capi-controller-manager pods no longer crash with ImagePullBackOff
  • Verify capi-controller-manager Deployment has imagePullPolicy: IfNotPresent

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 3, 2026

Copy link
Copy Markdown

Walkthrough

This PR updates the cluster-capi-controllers manifest image pull policy and bumps the manifests-gen dependency version in openshift/tools/go.mod.

Changes

Manifest and tool module update

Layer / File(s) Summary
Manifest image pull policy
openshift/capi-operator-manifests/default/manifests.yaml
Changes imagePullPolicy for cluster-capi-controllers from Always to IfNotPresent.
Tools module version bump
openshift/tools/go.mod
Updates the required pseudo-version of github.com/openshift/cluster-capi-operator/manifests-gen in the tools module.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only a manifest file changed; no Ginkgo test titles were added or modified, so this check is not applicable.
Test Structure And Quality ✅ Passed The PR only changes a manifest file; no Ginkgo test files or test directories were modified, so the test-structure check is not applicable.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only changes manifests and vendored manifest-generation files, so the MicroShift test check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR only changes a manifest imagePullPolicy; no new Ginkgo/e2e tests or SNO-sensitive test code were added.
Topology-Aware Scheduling Compatibility ✅ Passed Only change is imagePullPolicy Always→IfNotPresent; no replicas, affinity, nodeSelector, spread, or PDB scheduling constraints were added.
Ote Binary Stdout Contract ✅ Passed Only a manifest imagePullPolicy change was made; no Go/process-level code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo/e2e tests were added or modified in the PR; only manifest/go.mod updates are present, so the IPv4/disconnected-network check is not applicable.
No-Weak-Crypto ✅ Passed The diff only changes imagePullPolicy in a manifest; no weak crypto, custom crypto, or secret/token comparisons are present.
Container-Privileges ✅ Passed The changed manifest only flips imagePullPolicy; the container securityContext is non-privileged with allowPrivilegeEscalation:false, privileged:false, drop ALL, and non-root runAsUser.
No-Sensitive-Data-In-Logs ✅ Passed Patch only changes imagePullPolicy in a manifest; no log statements or sensitive-data-bearing strings were added.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: setting imagePullPolicy to IfNotPresent for provider workloads.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 3, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@openshift/tools/go.mod`:
- Around line 78-79: The go.mod entry for
github.com/openshift/cluster-capi-operator/manifests-gen still uses a local
absolute-path replace, which must be removed before merge. Update the module
dependency in go.mod to a pinned upstream require version instead of the
filesystem path, then refresh the module metadata and vendored contents as
needed so the dependency is portable for CI and other contributors.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0375059b-4454-4439-a184-fbcc31efbda6

📥 Commits

Reviewing files that changed from the base of the PR and between 4917d86 and f0c5a2e.

⛔ Files ignored due to path filters (5)
  • openshift/tools/go.sum is excluded by !**/*.sum
  • openshift/tools/vendor/github.com/openshift/cluster-capi-operator/manifests-gen/LICENSE is excluded by !**/vendor/**
  • openshift/tools/vendor/github.com/openshift/cluster-capi-operator/manifests-gen/kustomization.yaml is excluded by !**/vendor/**
  • openshift/tools/vendor/github.com/openshift/cluster-capi-operator/manifests-gen/kustomize-values.yaml is excluded by !**/vendor/**
  • openshift/tools/vendor/modules.txt is excluded by !**/vendor/**
📒 Files selected for processing (2)
  • openshift/capi-operator-manifests/default/manifests.yaml
  • openshift/tools/go.mod

Comment thread openshift/tools/go.mod Outdated
Comment on lines +78 to +79

replace github.com/openshift/cluster-capi-operator/manifests-gen => /Users/ddonati/src/cluster-capi-operator/manifests-gen

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win

Remove local filesystem replace directive before merge.

This replace points to an absolute path (/Users/ddonati/...) on a specific developer machine, which will break builds for every other contributor and CI. Per the PR description, this is meant to vendor a fix pending merge of openshift/cluster-capi-operator#618 — once that PR merges, this should be replaced with a pinned upstream require version (with go mod tidy/vendor updated), not a local path replace.

🐛 Proposed fix
-replace github.com/openshift/cluster-capi-operator/manifests-gen => /Users/ddonati/src/cluster-capi-operator/manifests-gen
+// TODO: remove once github.com/openshift/cluster-capi-operator#618 merges and
+// the manifests-gen require is bumped to the released version.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
replace github.com/openshift/cluster-capi-operator/manifests-gen => /Users/ddonati/src/cluster-capi-operator/manifests-gen
// TODO: remove once github.com/openshift/cluster-capi-operator#618 merges and
// the manifests-gen require is bumped to the released version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/tools/go.mod` around lines 78 - 79, The go.mod entry for
github.com/openshift/cluster-capi-operator/manifests-gen still uses a local
absolute-path replace, which must be removed before merge. Update the module
dependency in go.mod to a pinned upstream require version instead of the
filesystem path, then refresh the module metadata and vendored contents as
needed so the dependency is portable for CI and other contributors.

@damdo damdo force-pushed the OCPBUGS-85337-imagepullpolicy-ifnotpresent branch from f0c5a2e to 993b05a Compare July 3, 2026 14:20
@damdo damdo changed the title OCPBUGS-85337: Set imagePullPolicy IfNotPresent on provider Deployments OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads Jul 3, 2026
@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member Author

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 3, 2026

@mdbooth mdbooth left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

/hold for openshift/cluster-capi-operator#618 and revendor

fieldPath: metadata.uid
image: registry.ci.openshift.org/openshift:cluster-capi-controllers
imagePullPolicy: Always
imagePullPolicy: IfNotPresent

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

damdo added 2 commits July 3, 2026 17:17
…gePullPolicy fix

Vendor manifests-gen from openshift/cluster-capi-operator#618 which
sets imagePullPolicy: IfNotPresent on all containers in all provider
workloads via kustomize, fixing disconnected cluster upgrades using
pinned image sets (OCPBUGS-85337).
Regenerated via `make ocp-manifests` after vendoring the manifests-gen
fix. The capi-controller-manager Deployment container now has
imagePullPolicy: IfNotPresent instead of Always, fixing disconnected
cluster upgrades using pinned image sets (OCPBUGS-85337).
@damdo damdo force-pushed the OCPBUGS-85337-imagepullpolicy-ifnotpresent branch from 993b05a to 86aabf0 Compare July 3, 2026 15:17
@openshift-ci-robot openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jul 3, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This pull request references Jira Issue OCPBUGS-85337, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

Summary

Depends on: openshift/cluster-capi-operator#618

TODO

Test plan

  • Run upgrade in a techpreview disconnected cluster using only pinned image sets and verify capi-controller-manager pods no longer crash with ImagePullBackOff
  • Verify capi-controller-manager Deployment has imagePullPolicy: IfNotPresent

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jul 3, 2026
@damdo damdo marked this pull request as ready for review July 3, 2026 15:18
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 3, 2026
@openshift-ci openshift-ci Bot requested review from RadekManak and mdbooth July 3, 2026 15:18
@damdo

damdo commented Jul 4, 2026

Copy link
Copy Markdown
Member Author

/retest

@openshift-ci

openshift-ci Bot commented Jul 6, 2026

Copy link
Copy Markdown

@damdo: This PR was included in a payload test run from openshift/cluster-api-provider-aws#619
trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

@damdo

damdo commented Jul 7, 2026

Copy link
Copy Markdown
Member Author

@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/verified by @damdo

In https://qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/view/gs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-5.0-automated-release-nightly-5.0-upgrade-from-stable-5.0-aws-ipi-disc-priv-tp-pin-mco-f14/2074494747283558400

I can see no ImagePullBackoff anymore: https://gcsweb-qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-5.0-automated-release-nightly-5.0-upgrade-from-stable-5.0-aws-ipi-disc-priv-tp-pin-mco-f14/2074494747283558400/artifacts/aws-ipi-disc-priv-tp-pin-mco-f14/gather-extra/artifacts/oc_cmds/pods

openshift-cluster-api-operator                     capi-installer-947c6c4-mpblz                                                    1/1     Running     0              117m   10.128.0.21   ip-10-0-79-36.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api-operator                     capi-operator-b778879f9-g97xg                                                   1/1     Running     0              121m   10.129.0.24   ip-10-0-86-94.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api                              capa-controller-manager-66fc446bd9-v4q7j                                        1/1     Running     1 (105m ago)   115m   10.128.0.37   ip-10-0-79-36.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api                              capi-controller-manager-d99686c46-64dbw                                         1/1     Running     1 (105m ago)   115m   10.128.0.36   ip-10-0-79-36.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api                              capi-controllers-7765fc96bf-jzpq6                                               2/2     Running     0              121m   10.129.0.40   ip-10-0-86-94.ap-northeast-1.compute.internal    <none>           <none>

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 8, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: This PR has been marked as verified by @damdo.

Details

In response to this:

/verified by @damdo

In https://qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/view/gs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-5.0-automated-release-nightly-5.0-upgrade-from-stable-5.0-aws-ipi-disc-priv-tp-pin-mco-f14/2074494747283558400

I can see no ImagePullBackoff anymore: https://gcsweb-qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-5.0-automated-release-nightly-5.0-upgrade-from-stable-5.0-aws-ipi-disc-priv-tp-pin-mco-f14/2074494747283558400/artifacts/aws-ipi-disc-priv-tp-pin-mco-f14/gather-extra/artifacts/oc_cmds/pods

openshift-cluster-api-operator                     capi-installer-947c6c4-mpblz                                                    1/1     Running     0              117m   10.128.0.21   ip-10-0-79-36.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api-operator                     capi-operator-b778879f9-g97xg                                                   1/1     Running     0              121m   10.129.0.24   ip-10-0-86-94.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api                              capa-controller-manager-66fc446bd9-v4q7j                                        1/1     Running     1 (105m ago)   115m   10.128.0.37   ip-10-0-79-36.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api                              capi-controller-manager-d99686c46-64dbw                                         1/1     Running     1 (105m ago)   115m   10.128.0.36   ip-10-0-79-36.ap-northeast-1.compute.internal    <none>           <none>
openshift-cluster-api                              capi-controllers-7765fc96bf-jzpq6                                               2/2     Running     0              121m   10.129.0.40   ip-10-0-86-94.ap-northeast-1.compute.internal    <none>           <none>

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/hold

@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/unhold

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 8, 2026
@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/retest-required

@damdo damdo added the lgtm Indicates that a PR is ready to be merged. label Jul 8, 2026
@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/tide refresh

@mdbooth mdbooth left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: damdo, mdbooth

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/test e2e-azure-capi-techpreview e2e-aws-serial-2of2 e2e-aws-ovn-techpreview e2e-aws-ovn

@damdo

damdo commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

/retest

@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot Bot merged commit af15b10 into openshift:main Jul 8, 2026
20 checks passed
@openshift-ci-robot

Copy link
Copy Markdown

@damdo: Jira Issue Verification Checks: Jira Issue OCPBUGS-85337
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-85337 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

Depends on: openshift/cluster-capi-operator#618

TODO

Test plan

  • Run upgrade in a techpreview disconnected cluster using only pinned image sets and verify capi-controller-manager pods no longer crash with ImagePullBackOff
  • Verify capi-controller-manager Deployment has imagePullPolicy: IfNotPresent

Summary by CodeRabbit

  • Bug Fixes

  • Reduced unnecessary container image pulls when pods restart or reschedule, helping improve startup reliability and efficiency.

  • Chores

  • Updated an internal tooling dependency to a newer version.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants