USHIFT-7408: Add kernel-modules-extra dependency for RHEL 10

[pacevedom]

RHEL 10.2 kernel 6.12.0-211.34.1 moved iptables compat modules (nft_compat, xt_CT) from kernel-modules-core to kernel-modules-extra. Without these modules, both ovnkube-master and kubelet fail to create iptables rules, preventing MicroShift from starting.

Add an explicit Requires on kernel-modules-extra gated on RHEL 10+ to ensure the correct package is always installed. RHEL 9 is unaffected as the modules remain in kernel-modules-core there.

Summary by CodeRabbit

• Bug Fixes
  • Added the required kernel modules package dependency to ensure networking compatibility on RHEL 10.
  • Maintained compatibility with RHEL 9, where the dependency has no effect.

[openshift-ci-robot]

@pacevedom: This pull request references USHIFT-7408 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

RHEL 10.2 kernel 6.12.0-211.34.1 moved iptables compat modules (nft_compat, xt_CT) from kernel-modules-core to kernel-modules-extra. Without these modules, both ovnkube-master and kubelet fail to create iptables rules, preventing MicroShift from starting.

Add an explicit Requires on kernel-modules-extra gated on RHEL 10+ to ensure the correct package is always installed. RHEL 9 is unaffected as the modules remain in kernel-modules-core there.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a5147d36-6fb5-4fed-a66d-0dacb3ea1561

📥 Commits

Reviewing files that changed from the base of the PR and between c9062c6 and fed91fa.

📒 Files selected for processing (1)

• packaging/rpm/microshift.spec

---

Walkthrough

The RPM specification now unconditionally requires kernel-modules-extra and documents its role in providing iptables compatibility modules on RHEL 10 while supporting cross-installation.

Changes

RPM dependency update

Layer / File(s)	Summary
Kernel module dependency packaging/rpm/microshift.spec	Adds Requires: kernel-modules-extra with comments explaining the RHEL 10 module relocation and cross-installation behavior.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ggiguash, copejon, kasturinarra

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding the kernel-modules-extra dependency for RHEL 10.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only packaging/rpm/microshift.spec changed; no Ginkgo tests or titles were added or modified.
Test Structure And Quality	✅ Passed	HEAD only changes packaging/rpm/microshift.spec; no Ginkgo test files were touched, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes packaging/rpm/microshift.spec; no new Ginkgo tests or test APIs were added, so MicroShift compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only packaging/rpm/microshift.spec changed; no Ginkgo e2e tests were added or modified.
Topology-Aware Scheduling Compatibility	✅ Passed	Only packaging/rpm/microshift.spec changed; it adds an RPM dependency and no manifests, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	Only packaging/rpm/microshift.spec changed; no main/init/TestMain/suite code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only packaging/rpm/microshift.spec changed; no new Ginkgo tests or network-sensitive code were added.
No-Weak-Crypto	✅ Passed	The only change adds an RPM dependency/comment in microshift.spec; no weak-crypto, custom crypto, or secret-comparison code is introduced.
Container-Privileges	✅ Passed	Only packaging/rpm/microshift.spec changed; no container/K8s manifests or privilege settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	Only an RPM dependency and explanatory comments were added; no logging, secrets, IDs, or customer data appear in the diff.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 372ca294-0f7b-48df-a4c4-c8c5c88436cd

📥 Commits

Reviewing files that changed from the base of the PR and between c9062c6 and f249f2f.

📒 Files selected for processing (1)

• packaging/rpm/microshift.spec

---

Walkthrough

The RPM spec now conditionally requires kernel-modules-extra on RHEL 10 and newer systems to provide required iptables compatibility kernel modules.

Changes

RPM dependency

Layer / File(s)	Summary
Conditional kernel module requirement packaging/rpm/microshift.spec	Adds kernel-modules-extra as a requirement when rhel >= 10.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: ggiguash, copejon

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: adding a kernel-modules-extra dependency for RHEL 10.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only packaging/rpm/microshift.spec changed; no Ginkgo tests or test titles were added or modified, so this check is not applicable.
Test Structure And Quality	✅ Passed	Only packaging/rpm/microshift.spec changed; no Ginkgo test code was touched, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only packaging/rpm/microshift.spec changed; no new Ginkgo e2e tests or MicroShift-incompatible APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only packaging/rpm/microshift.spec changed; no new Ginkgo/e2e tests or test assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only an RPM dependency in microshift.spec changed; no manifests, controllers, or scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	Only packaging/rpm/microshift.spec changed; no main/init/TestMain/suite code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only packaging/rpm/microshift.spec changed; no new Ginkgo tests or network-using test code were added.
No-Weak-Crypto	✅ Passed	Changed spec only adds kernel-modules-extra for RHEL 10; no weak-crypto primitives, custom crypto, or secret comparisons appear in the diff.
Container-Privileges	✅ Passed	Only packaging/rpm/microshift.spec changed, and it adds no container/K8s privilege fields or manifests.
No-Sensitive-Data-In-Logs	✅ Passed	Only a spec dependency/comment was added; no logging code or sensitive data (tokens, passwords, PII, hostnames) appears in the diff.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@pacevedom: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pacevedom]

/verified by CI

[openshift-ci-robot]

@pacevedom: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[pmtk]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pacevedom, pmtk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pacevedom,pmtk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[agullon]

/cherrypick release-4.22

[openshift-cherrypick-robot]

@agullon: new pull request created: #7115

Details

In response to this:

/cherrypick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.