OCPBUGS-99229: bootstrap: guard CVO render flags for version-skew compatibility - #10704
OCPBUGS-99229: bootstrap: guard CVO render flags for version-skew compatibility#10704jira-solve-bot wants to merge 1 commit into
Conversation
The bootkube.sh script unconditionally passes --cluster-version-manifest-path and --feature-gate-manifest-path to the CVO render command. When a 4.22 installer bootstraps with a 4.21 release image whose CVO binary does not support these flags, the cvo-render container crashes with "unknown flag", causing bootstrap to fail deterministically. Probe the CVO render --help output before invoking render, and only pass flags that the release image's CVO binary actually supports. This follows the existing ADDITIONAL_FLAGS pattern used elsewhere in bootkube.sh (e.g. the config-bootstrap block) and is forward-compatible with future flag additions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/valid-reference
|
@jira-solve-bot: This pull request references Jira Issue OCPBUGS-99229, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughChangesBootstrap render compatibility
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @jira-solve-bot. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/close |
|
@enxebre: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@jira-solve-bot: This pull request references Jira Issue OCPBUGS-99229. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@data/data/bootstrap/files/usr/local/bin/bootkube.sh.template`:
- Around line 199-203: Update the CVO_RENDER_HELP compatibility probe around
bootkube_podman_run to preserve its exit status instead of appending “|| true”.
Use an if ! branch to log a warning when the probe fails, clear CVO_RENDER_HELP,
and then continue with the fallback behavior so failed probes cannot be mistaken
for successful unsupported-flag checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0d7b1be8-28a3-4fed-881c-0696cae87686
📒 Files selected for processing (1)
data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
| CVO_RENDER_HELP=$(bootkube_podman_run \ | ||
| --name cvo-render-help \ | ||
| --volume "$PWD:/assets:z" \ | ||
| "${RELEASE_IMAGE_DIGEST}" \ | ||
| render --help 2>&1) || true |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not discard a failed compatibility probe.
|| true makes a missing or broken release image look identical to a successful CVO that does not support these flags. Bootstrap then silently omits the manifest-path overrides and cannot reliably warn about the failure. Capture the status with an if ! ...; then branch, log the warning, and clear the help output before falling back.
As per the PR objective, failed probes must produce a warning.
Suggested failure handling
- CVO_RENDER_HELP=$(bootkube_podman_run \
+ if ! CVO_RENDER_HELP=$(bootkube_podman_run \
--name cvo-render-help \
--volume "$PWD:/assets:z" \
"${RELEASE_IMAGE_DIGEST}" \
- render --help 2>&1) || true
+ render --help 2>&1); then
+ echo "WARNING: failed to probe CVO render flags; continuing without overrides" >&2
+ CVO_RENDER_HELP=""
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| CVO_RENDER_HELP=$(bootkube_podman_run \ | |
| --name cvo-render-help \ | |
| --volume "$PWD:/assets:z" \ | |
| "${RELEASE_IMAGE_DIGEST}" \ | |
| render --help 2>&1) || true | |
| if ! CVO_RENDER_HELP=$(bootkube_podman_run \ | |
| --name cvo-render-help \ | |
| --volume "$PWD:/assets:z" \ | |
| "${RELEASE_IMAGE_DIGEST}" \ | |
| render --help 2>&1); then | |
| echo "WARNING: failed to probe CVO render flags; continuing without overrides" >&2 | |
| CVO_RENDER_HELP="" | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@data/data/bootstrap/files/usr/local/bin/bootkube.sh.template` around lines
199 - 203, Update the CVO_RENDER_HELP compatibility probe around
bootkube_podman_run to preserve its exit status instead of appending “|| true”.
Use an if ! branch to log a warning when the probe fails, clear CVO_RENDER_HELP,
and then continue with the fallback behavior so failed probes cannot be mistaken
for successful unsupported-flag checks.
3 participants
Description
The
bootkube.shscript unconditionally passes--cluster-version-manifest-pathand--feature-gate-manifest-pathto the CVO render command. When a 4.22 installer bootstraps with a 4.21 release image whose CVO binary does not support these flags, the cvo-render container crashes with "unknown flag", causing bootstrap to fail deterministically.This PR:
Probes the CVO render
--helpoutput before invoking render, and only passes flags that the release image's CVO binary actually supports. This follows the existingADDITIONAL_FLAGSpattern used elsewhere inbootkube.sh(e.g. the config-bootstrap block) and is forward-compatible with future flag additions.Logs a warning when the CVO render
--helpprobe fails (e.g., due to image-pull errors or podman crashes), so operators have a diagnostic breadcrumb in the journal if flags are unexpectedly skipped.Jira
https://redhat.atlassian.net/browse/OCPBUGS-99229
Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin
Summary by CodeRabbit