Skip to content

OCPBUGS-99229: fix(bootstrap): detect CVO render flag support before passing optional flags - #10700

Closed
jira-solve-bot wants to merge 1 commit into
openshift:mainfrom
jira-solve-bot:fix-OCPBUGS-99229
Closed

OCPBUGS-99229: fix(bootstrap): detect CVO render flag support before passing optional flags#10700
jira-solve-bot wants to merge 1 commit into
openshift:mainfrom
jira-solve-bot:fix-OCPBUGS-99229

Conversation

@jira-solve-bot

@jira-solve-bot jira-solve-bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Description

The bootkube.sh bootstrap script unconditionally passes --cluster-version-manifest-path and --feature-gate-manifest-path to the CVO render command. When a newer installer (e.g. 4.22) bootstraps with an older CVO binary (e.g. 4.21) that does not support these flags, the cvo-render container crashes with "unknown flag", causing bootstrap failure. This is a recurring version-skew pattern.

Changes

  • Probes the CVO binary's render --help output before invoking it
  • Each optional flag is only included in the render command if the binary advertises support for it
  • Forward-compatible: future flags added to CVO render can follow the same detection pattern

Jira

https://redhat.atlassian.net/browse/OCPBUGS-99229


Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin


Note: This PR was auto-generated by the jira-agent periodic CI job in response to OCPBUGS-99229. See the full report for token usage, cost breakdown, and detailed phase output.

Summary by CodeRabbit

  • Bug Fixes
    • Improved cluster bootstrapping compatibility across CVO versions.
    • The installer now checks at bootstrap time which render manifest-path options are supported and passes only the compatible flags, reducing failures when certain optional flags aren’t available.

Note: This PR was auto-generated by the jira-agent periodic CI job in response to OCPBUGS-99229. See the full report for token usage, cost breakdown, and detailed phase output.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 20, 2026
@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@jira-solve-bot: This pull request references Jira Issue OCPBUGS-99229, which is invalid:

  • expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description

The bootkube.sh bootstrap script unconditionally passes --cluster-version-manifest-path and --feature-gate-manifest-path to the CVO render command. When a newer installer (e.g. 4.22) bootstraps with an older CVO binary (e.g. 4.21) that does not support these flags, the cvo-render container crashes with "unknown flag", causing bootstrap failure. This is a recurring version-skew pattern.

Changes

  • Probes the CVO binary's render --help output before invoking it
  • Each optional flag is only included in the render command if the binary advertises support for it
  • Forward-compatible: future flags added to CVO render can follow the same detection pattern

Jira

https://redhat.atlassian.net/browse/OCPBUGS-99229


Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 20, 2026
@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Hi @jira-solve-bot. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci
openshift-ci Bot requested review from jhixson74 and rwsu July 20, 2026 22:12
@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tthvo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Changes

CVO render compatibility

Layer / File(s) Summary
Detect and apply render flags
data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
The bootstrap script captures CVO help output, conditionally builds CVO_RENDER_FLAGS for supported manifest-path options, and passes them to cvo-render.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR only changes bootkube.sh.template; no Ginkgo spec files or test titles were modified, so there are no unstable test names to flag.
Test Structure And Quality ✅ Passed Only bootkube.sh.template changed; no Ginkgo test code was added or modified in this PR.
Microshift Test Compatibility ✅ Passed No new Ginkgo tests were added; the commit only updates bootkube.sh.template and contains no MicroShift-unsafe OpenShift API usage.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR only changes bootkube.sh.template; no Ginkgo/e2e tests were added, so SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PR only changes bootkube CVO render flag probing; no pod affinity, topology spread, node selectors, replica logic, or PDBs were added.
Ote Binary Stdout Contract ✅ Passed Only a shell bootstrap template changed; no OTE binary process-level stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Diff only changes bootkube.sh.template; no new Ginkgo tests or IPv4/public-network assumptions were added.
No-Weak-Crypto ✅ Passed The patch only probes CVO help and conditionally appends render flags; no weak algorithms, custom crypto, or secret/token comparisons were added.
Container-Privileges ✅ Passed Only bootkube.sh.template changed; no container/K8s manifests or new privileged settings were added, and the new podman run is unprivileged.
No-Sensitive-Data-In-Logs ✅ Passed No new sensitive logging: the CVO help probe stays in a variable and the script does not echo or trace it.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the bootstrap change to detect CVO render flag support before passing optional flags.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@enxebre

enxebre commented Jul 20, 2026

Copy link
Copy Markdown
Member

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 20, 2026

# Detect which optional flags the CVO render command supports,
# to prevent bootstrap failure when a newer installer is paired
# with an older CVO binary that lacks recently-added flags.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a reference in the comment to the original ocpbug reporting why this is needed

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Added a reference to https://issues.redhat.com/browse/OCPBUGS-99229 in the code comment.


AI-assisted response via Claude Code

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@data/data/bootstrap/files/usr/local/bin/bootkube.sh.template`:
- Around line 208-213: Replace the echo-and-grep checks in the cvo_render_help
flag-selection block with Bash built-in substring matching against
cvo_render_help, preserving the existing CVO_RENDER_FLAGS additions for each
supported manifest-path option and eliminating the subshell.
- Around line 203-207: Update the cvo_render_help bootkube_podman_run invocation
to remove the hardcoded --name cvo-render-help option and the --volume
"$PWD:/assets:z" mount, leaving the release image digest and render --help
arguments unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ae0d5467-61a2-474a-8a01-d7bc74b34417

📥 Commits

Reviewing files that changed from the base of the PR and between d5c8a6e and e4c25ba.

📒 Files selected for processing (1)
  • data/data/bootstrap/files/usr/local/bin/bootkube.sh.template

Comment thread data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
Comment thread data/data/bootstrap/files/usr/local/bin/bootkube.sh.template Outdated
--volume "$PWD:/assets:z" \
"${RELEASE_IMAGE_DIGEST}" \
render --help 2>&1) || true
if echo "${cvo_render_help}" | grep -q -- --cluster-version-manifest-path; then

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

make this a function that takes args as the parameter

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Extracted the flag detection into a cvo_render_optional_flag() helper function that takes the flag name and value as parameters. Also adopted bash built-in [[ == *...* ]] matching and removed the unnecessary --name/--volume from the --help probe.


AI-assisted response via Claude Code

@jira-solve-bot
jira-solve-bot force-pushed the fix-OCPBUGS-99229 branch 2 times, most recently from 953e62d to 2ffa208 Compare July 21, 2026 15:51
The 4.22 installer's bootkube.sh unconditionally passes
--cluster-version-manifest-path and --feature-gate-manifest-path
to the CVO render command. When the release image contains an
older CVO binary (e.g. 4.21) that does not recognize these flags,
cvo-render crashes with "unknown flag", causing bootstrap failure.

Probe the CVO render --help output to detect which optional flags
the release image's CVO binary supports, and only pass flags that
it recognizes. This prevents version-skew breakage when a newer
installer bootstraps with an older CVO.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@enxebre

enxebre commented Jul 21, 2026

Copy link
Copy Markdown
Member

/close

@openshift-ci openshift-ci Bot closed this Jul 21, 2026
@openshift-ci

openshift-ci Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@enxebre: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot

Copy link
Copy Markdown
Contributor

@jira-solve-bot: This pull request references Jira Issue OCPBUGS-99229. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

Details

In response to this:

Description

The bootkube.sh bootstrap script unconditionally passes --cluster-version-manifest-path and --feature-gate-manifest-path to the CVO render command. When a newer installer (e.g. 4.22) bootstraps with an older CVO binary (e.g. 4.21) that does not support these flags, the cvo-render container crashes with "unknown flag", causing bootstrap failure. This is a recurring version-skew pattern.

Changes

  • Probes the CVO binary's render --help output before invoking it
  • Each optional flag is only included in the render command if the binary advertises support for it
  • Forward-compatible: future flags added to CVO render can follow the same detection pattern

Jira

https://redhat.atlassian.net/browse/OCPBUGS-99229


Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin


Note: This PR was auto-generated by the jira-agent periodic CI job in response to OCPBUGS-99229. See the full report for token usage, cost breakdown, and detailed phase output.

Summary by CodeRabbit

  • Bug Fixes
  • Improved cluster bootstrapping compatibility across CVO versions.
  • The installer now checks at bootstrap time which render manifest-path options are supported and passes only the compatible flags, reducing failures when certain optional flags aren’t available.

Note: This PR was auto-generated by the jira-agent periodic CI job in response to OCPBUGS-99229. See the full report for token usage, cost breakdown, and detailed phase output.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants