NO-ISSUE: [Manual] rebase-release-5.0.0-0.nightly-2026-08-03-043516_amd64-2026-08-03_arm64-2026-08-03 - #7147
Conversation
|
@copejon: This pull request explicitly references no jira issue. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (7)
📒 Files selected for processing (55)
WalkthroughThe pull request advances nightly release assets, updates rebase automation, changes admission rules, adds SELinux conflict reporting, and updates volume group snapshot resources and CSI test components. ChangesPlatform release and manifest updates
Kubernetes workflow and controller updates
Storage snapshot test updates
Estimated code review effort: 5 (Critical) | ~120 minutes Suggested reviewers: Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: copejon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test |
|
/test e2e-aws-tests-bootc-periodic-arm-el10 |
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (1)
deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go (1)
90-90: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd an empty-node admission case.
The updated fixtures prove that node allocatable capacity no longer controls the result. They do not prove that
CPUPartitioningAllNodesadmits and mutates a Pod when the node list is empty. Add anodes: nilcase with the expected mutation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go` at line 90, Add a test case in the admission test fixtures using nodes: nil, with CPUPartitioningAllNodes enabled, and assert that the Pod is admitted and receives the expected mutation. Keep the existing populated-node cases unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@assets/optional/operator-lifecycle-manager/0000_50_olm_01-networkpolicies.yaml`:
- Around line 129-151: Restrict the Egress rules in the bundle-unpack
NetworkPolicy selected by the bundle-unpack-ref and olm.managed match
expressions instead of allowing all destinations with an empty rule. Permit only
the registry, DNS, and Kubernetes API destinations and required ports; if
unrestricted access is genuinely required, document that justification in the
manifest.
In `@deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh`:
- Line 131: Update the tag extraction command in rebase.sh to match the
top-level tag: definition at column zero instead of requiring two leading
spaces, ensuring the following Podman commands receive a non-empty release image
tag.
- Around line 96-100: Update rebase.sh to satisfy ShellCheck: remove or use the
unused go_mod_go_ver variable, brace variable expansions in the affected
commands, and replace sed-based character removal with Bash parameter
substitution. Apply these changes throughout the changed sections, including the
commands around the upstream tag check and lines covered by the review.
In
`@deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.go`:
- Around line 118-138: Update requiresNodeSelectorAdjustment so both CRO and CMA
paths require a toleration covering the node-role.kubernetes.io/control-plane
NoSchedule taint before returning true. Apply the same control-plane toleration
check to CRO and replace CMA’s master-only check, while preserving the existing
label, namespace, and empty-node-selector conditions.
In `@deps/github.com/openshift/kubernetes/REBASE.openshift.md`:
- Around line 415-417: Update the fenced blocks in
deps/github.com/openshift/kubernetes/REBASE.openshift.md:415-417 and 569-571
with the bash language identifier, and mark the blocks at 425-434 and 440-448 as
text so all changed fences satisfy Markdownlint MD040.
- Around line 414-417: Update the tag-listing command in the upstream tag-fetch
instructions so each tag includes its creation timestamp before the awk filter
evaluates $2. Preserve the existing semantic-version filtering and 31-day
cutoff, ensuring recent matching tags are returned.
In `@scripts/auto-rebase/last_rebase.sh`:
- Around line 1-2: Update the script header to use the required /usr/bin/bash
shebang, add set -euo pipefail before the rebase.sh invocation, and remove the
existing -x shebang option while preserving the current command arguments.
---
Nitpick comments:
In
`@deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go`:
- Line 90: Add a test case in the admission test fixtures using nodes: nil, with
CPUPartitioningAllNodes enabled, and assert that the Pod is admitted and
receives the expected mutation. Keep the existing populated-node cases
unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: e575b9fd-1c6a-402b-b2fd-f0543ffd58fc
⛔ Files ignored due to path filters (7)
vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/features/openshift_features.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (54)
Makefile.kube_git.varMakefile.version.aarch64.varMakefile.version.x86_64.varassets/components/multus/kustomization.aarch64.yamlassets/components/multus/kustomization.x86_64.yamlassets/components/multus/release-multus-aarch64.jsonassets/components/multus/release-multus-x86_64.jsonassets/components/service-ca/controller-config.yamlassets/components/service-ca/deployment.yamlassets/optional/operator-lifecycle-manager/0000_50_olm_01-networkpolicies.yamlassets/optional/operator-lifecycle-manager/kustomization.aarch64.yamlassets/optional/operator-lifecycle-manager/kustomization.x86_64.yamlassets/optional/operator-lifecycle-manager/release-olm-aarch64.jsonassets/optional/operator-lifecycle-manager/release-olm-x86_64.jsonassets/release/release-aarch64.jsonassets/release/release-x86_64.jsondeps/github.com/openshift/kubernetes/REBASE.openshift.mddeps/github.com/openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext/disabled_tests.godeps/github.com/openshift/kubernetes/openshift-hack/rebase.shdeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission_test.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.godeps/github.com/openshift/kubernetes/pkg/features/openshift_features.godeps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.godeps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yamldeps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.mddeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshot-metadata.godeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable.godeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable_stress.godeps/github.com/openshift/kubernetes/test/e2e/storage/utils/volume_group_snapshot.godeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/csi-hostpath-plugin.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/run_group_snapshot_e2e.shdeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/controller_ss.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/node_ds.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-plugin.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-attacher.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-resizer.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-snapshotter.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-proxy.yamlpackaging/crio.conf.d/10-microshift_amd64.confpackaging/crio.conf.d/10-microshift_arm64.confscripts/auto-rebase/assets.yamlscripts/auto-rebase/changelog.txtscripts/auto-rebase/commits.txtscripts/auto-rebase/last_rebase.sh
💤 Files with no reviewable changes (1)
- deps/github.com/openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
|
/coderabbit help |
c2d654b to
a19f7c3
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh (1)
127-129: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSecurity Misconfiguration (CWE-494): Download of Code Without Integrity Check
Reachability: External
Pin the Alpine image to an immutable digest.
deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh:127usesdocker.io/library/alpine:latestwithsed -iinside a container that mounts the checkout. If the mutable tag is retagged or compromised, unreviewed image content can alterDockerfile.rhelor other mounted files. Pin an approved digest in the rebase source; do not editdeps/directly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh` around lines 127 - 129, Update the Alpine image reference in the rebase script’s podman command to use the approved immutable digest instead of the mutable latest tag. Make this change in the rebase source that generates the vendored deps content, not directly under deps/, while preserving the existing mounted-workspace and sed behavior.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh`:
- Around line 134-143: The rebase script’s post-command $? checks are
unreachable under set -e. Add set -euo pipefail and wrap each podman invocation
in the affected vendor-update blocks with if ! podman run ...; then, preserving
the existing failure messages and exits while removing the separate status
checks.
- Around line 99-101: Update the Kubernetes tag validation in the rebase source
to use an exact tag reference check, such as verifying refs/tags/${k8s_tag},
instead of git tag -l pattern matching. Preserve the existing error message and
exit behavior, and ensure the generated vendored script reflects the source
change rather than editing it directly.
In `@deps/github.com/openshift/kubernetes/REBASE.openshift.md`:
- Around line 410-411: Correct the procedure wording in the rebase source that
generates REBASE.openshift.md: update the sentence around the ship-help-bot
description to use “is an internal tool that has been given instructions,” and
revise the patch-release check to say “whether any patch releases have
occurred.” Do not edit the generated file under deps/ directly.
---
Nitpick comments:
In `@deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh`:
- Around line 127-129: Update the Alpine image reference in the rebase script’s
podman command to use the approved immutable digest instead of the mutable
latest tag. Make this change in the rebase source that generates the vendored
deps content, not directly under deps/, while preserving the existing
mounted-workspace and sed behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 4514a0d5-d405-417e-afd7-d39cf716156f
⛔ Files ignored due to path filters (7)
vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/features/openshift_features.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (54)
Makefile.kube_git.varMakefile.version.aarch64.varMakefile.version.x86_64.varassets/components/multus/kustomization.aarch64.yamlassets/components/multus/kustomization.x86_64.yamlassets/components/multus/release-multus-aarch64.jsonassets/components/multus/release-multus-x86_64.jsonassets/components/service-ca/controller-config.yamlassets/components/service-ca/deployment.yamlassets/optional/operator-lifecycle-manager/0000_50_olm_01-networkpolicies.yamlassets/optional/operator-lifecycle-manager/kustomization.aarch64.yamlassets/optional/operator-lifecycle-manager/kustomization.x86_64.yamlassets/optional/operator-lifecycle-manager/release-olm-aarch64.jsonassets/optional/operator-lifecycle-manager/release-olm-x86_64.jsonassets/release/release-aarch64.jsonassets/release/release-x86_64.jsondeps/github.com/openshift/kubernetes/REBASE.openshift.mddeps/github.com/openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext/disabled_tests.godeps/github.com/openshift/kubernetes/openshift-hack/rebase.shdeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission_test.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.godeps/github.com/openshift/kubernetes/pkg/features/openshift_features.godeps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.godeps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yamldeps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.mddeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshot-metadata.godeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable.godeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable_stress.godeps/github.com/openshift/kubernetes/test/e2e/storage/utils/volume_group_snapshot.godeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/csi-hostpath-plugin.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/run_group_snapshot_e2e.shdeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/controller_ss.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/node_ds.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-plugin.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-attacher.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-resizer.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-snapshotter.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-proxy.yamlpackaging/crio.conf.d/10-microshift_amd64.confpackaging/crio.conf.d/10-microshift_arm64.confscripts/auto-rebase/assets.yamlscripts/auto-rebase/changelog.txtscripts/auto-rebase/commits.txtscripts/auto-rebase/last_rebase.sh
💤 Files with no reviewable changes (1)
- deps/github.com/openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
🚧 Files skipped from review as they are similar to previous changes (50)
- scripts/auto-rebase/assets.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-resizer.yaml
- deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
- deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
- deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md
- assets/optional/operator-lifecycle-manager/0000_50_olm_01-networkpolicies.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-proxy.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-attacher.yaml
- scripts/auto-rebase/last_rebase.sh
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-snapshotter.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver.yaml
- Makefile.version.x86_64.var
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/controller_ss.yaml
- scripts/auto-rebase/changelog.txt
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/node_ds.yaml
- assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission_test.go
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go
- deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable_stress.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/run_group_snapshot_e2e.sh
- deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go
- assets/components/service-ca/controller-config.yaml
- packaging/crio.conf.d/10-microshift_amd64.conf
- assets/components/service-ca/deployment.yaml
- assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yaml
- assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.go
- deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshot-metadata.go
- packaging/crio.conf.d/10-microshift_arm64.conf
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go
- Makefile.version.aarch64.var
- assets/components/multus/release-multus-x86_64.json
- deps/github.com/openshift/kubernetes/test/e2e/storage/utils/volume_group_snapshot.go
- assets/release/release-aarch64.json
- assets/release/release-x86_64.json
- assets/components/multus/kustomization.aarch64.yaml
- assets/components/multus/kustomization.x86_64.yaml
- assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
- assets/components/multus/release-multus-aarch64.json
- scripts/auto-rebase/commits.txt
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yaml
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-plugin.yaml
- deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/csi-hostpath-plugin.yaml
- Makefile.kube_git.var
| if [ -z "$(git tag -l "$k8s_tag")" ]; then | ||
| echo "No such tag exists in upstream for: $k8s_tag" | ||
| exit 1 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/bash
set -euo pipefail
echo "== locate file =="
fd -a 'rebase\.sh$' . | sed 's#^\./##'
echo "== relevant file excerpt =="
if [ -f deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh ]; then
sed -n '1,180p' deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh | cat -n
fi
echo "== k8s_tag usages =="
rg -n "k8s_tag|git tag -l|git show-ref|Branch|CHANGE|Dockerfile|dockerfile" deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh || true
echo "== git check behavior for glob vs exact refs =="
tmp="$(mktemp -d)"
cd "$tmp"
git init -q
git config user.email test@example.com
git config user.name test
git commit --allow-empty -m init -q
git tag -a v1.35.0 -m msg
git tag -a v1.35.0-beta.1 -m msg
git tag -a v1.35.1 -m msg
git tag -a v1.35.* -m msg
for pattern in "$tmp/repo" "v1.35.*" "v1.35.3" "v1.35.0"; do
printf 'pattern=%s git tag -l count=%s refs=%s\n' "$pattern" "$(git -C "$tmp/repo" tag -l "$pattern" | wc -l)" "$(git -C "$tmp/repo" tag -l "$pattern" | tr '\n' ' ')"
done
git -C "$tmp/repo" show-ref --verify --quiet "refs/tags/v1.35.*" && echo show-ref=v1.35.*=true || echo show-ref=v1.35.*=false
git -C "$tmp/repo" show-ref --verify --quiet "refs/tags/v1.35.3" && echo show-ref=v1.35.3=3=true || echo show-ref=v1.35.3=3=false
git -C "$tmp/repo" show-ref --verify --quiet "refs/tags/v1.35.0" && echo show-ref=v1.35.0=0=true || echo show-ref=v1.35.0=0=false
rm -rf "$tmp"Repository: openshift/microshift
Length of output: 8394
🏁 Script executed:
#!/usr/bin/bash
set -euo pipefail
tmp="$(mktemp -d)"
cd "$tmp"
git init -q
cat >/tmp/test-tag.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
for pattern in v1.35.* v1.35.3 v1.35.0; do
git tag -l "$pattern" >/tmp/tag-l-output
printf '%s\n' "${pattern}: git tag -l output: [$(< /tmp/tag-l-output)] count=$(git tag -l "$pattern" | wc -l)"
done
git show-ref --verify --quiet "refs/tags/v1.35.*" && echo show-ref:v1.35.*=true || echo show-ref:v1.35.*=false
git show-ref --verify --quiet "refs/tags/v1.35.3" && echo show-ref:v1.35.3=3=true || echo show-ref:v1.35.3=3=false
git show-ref --verify --quiet "refs/tags/v1.35.0" && echo show-ref:v1.35.0=0=true || echo show-ref:v1.35.0=0=false
EOF
git config user.email test@example.com
git config user.name test
git commit --allow-empty -m init -q
git tag -a v1.35.0 -m msg
git tag -a v1.35.1 -m msg
chmod +x /tmp/test-tag.sh
/tmp/test-tag.sh
rm -rf "$tmp"Repository: openshift/microshift
Length of output: 369
Require an exact Kubernetes tag match.
git tag -l "$k8s_tag" accepts glob patterns, so values like v1.35.* can pass the check without naming a single tag. That pattern later flows into git merge, the branch name, and the changelog link. Switch the validation to an exact ref check such as git show-ref --verify --quiet "refs/tags/${k8s_tag}".
As per deps/** instructions, carry this fix through the rebase source instead of editing the vendored script.
🧰 Tools
🪛 Shellcheck (0.11.0)
[style] 99-99: Prefer putting braces around variable references even when not strictly required.
(SC2250)
[style] 100-100: Prefer putting braces around variable references even when not strictly required.
(SC2250)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh` around lines
99 - 101, Update the Kubernetes tag validation in the rebase source to use an
exact tag reference check, such as verifying refs/tags/${k8s_tag}, instead of
git tag -l pattern matching. Preserve the existing error message and exit
behavior, and ensure the generated vendored script reflects the source change
rather than editing it directly.
Source: Path instructions
| podman run --rm -v "$(pwd):/go/k8s.io/kubernetes:Z" \ | ||
| --workdir=/go/k8s.io/kubernetes \ | ||
| "registry.ci.openshift.org/openshift/release:$tag" \ | ||
| go mod tidy && hack/update-vendor.sh | ||
| /bin/bash -c "go mod tidy && hack/update-vendor.sh" | ||
|
|
||
| # shellcheck disable=SC2181 | ||
| if [ $? -ne 0 ]; then | ||
| echo "updating the vendor folder failed, is any dependency missing?" | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the failure handlers reachable with set -e.
With the required set -e, a failed podman run exits before the following $? test. The custom error messages never run. Use if ! podman run ...; then ... fi for each invocation instead of checking $? afterward.
As per coding guidelines, shell scripts must use set -euo pipefail.
Also applies to: 145-154, 156-164
🧰 Tools
🪛 Shellcheck (0.11.0)
[style] 136-136: Prefer putting braces around variable references even when not strictly required.
(SC2250)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh` around lines
134 - 143, The rebase script’s post-command $? checks are unreachable under set
-e. Add set -euo pipefail and wrap each podman invocation in the affected
vendor-update blocks with if ! podman run ...; then, preserving the existing
failure messages and exits while removing the separate status checks.
Source: Coding guidelines
| [chai-bot](slack://app?team=T027F3GAJ&id=A0AJUKWDUR1&tab=messages) (ship-help-bot) is an internal tool has been given instructions to | ||
| periodically check for upstream patch releases and complete the rebase autonomously. The steps taken are outlined below: |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the grammar in the new procedure text.
Line 410 should say is an internal tool that has been given instructions. Line 420 should say whether any patch releases have occurred.
As per path instructions, do not manually edit files under deps/; apply the wording change in the rebase source.
Also applies to: 420-421
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deps/github.com/openshift/kubernetes/REBASE.openshift.md` around lines 410 -
411, Correct the procedure wording in the rebase source that generates
REBASE.openshift.md: update the sentence around the ship-help-bot description to
use “is an internal tool that has been given instructions,” and revise the
patch-release check to say “whether any patch releases have occurred.” Do not
edit the generated file under deps/ directly.
Source: Path instructions
|
/test e2e-aws-tests-bootc-periodic-arm-el9 |
a19f7c3 to
6295fb1
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deps/github.com/openshift/kubernetes/REBASE.openshift.md`:
- Line 579: The rebase documentation incorrectly states that a pull request is
always created. Update the corresponding wording in the rebase source, not under
deps/, to state that creation requires the gh CLI and to document the manual
fallback when gh is unavailable.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 39711ee7-5eb1-4fc8-8600-23a6b13a2d6e
⛔ Files ignored due to path filters (7)
vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/pkg/features/openshift_features.gois excluded by!**/vendor/**,!vendor/**vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (55)
Makefile.kube_git.varMakefile.version.aarch64.varMakefile.version.x86_64.varassets/components/multus/kustomization.aarch64.yamlassets/components/multus/kustomization.x86_64.yamlassets/components/multus/release-multus-aarch64.jsonassets/components/multus/release-multus-x86_64.jsonassets/components/service-ca/controller-config.yamlassets/components/service-ca/deployment.yamlassets/optional/operator-lifecycle-manager/0000_50_olm_01-networkpolicies.yamlassets/optional/operator-lifecycle-manager/kustomization.aarch64.yamlassets/optional/operator-lifecycle-manager/kustomization.x86_64.yamlassets/optional/operator-lifecycle-manager/release-olm-aarch64.jsonassets/optional/operator-lifecycle-manager/release-olm-x86_64.jsonassets/release/release-aarch64.jsonassets/release/release-x86_64.jsondeps/github.com/openshift/kubernetes/REBASE.openshift.mddeps/github.com/openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext/disabled_tests.godeps/github.com/openshift/kubernetes/openshift-hack/rebase.shdeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.godeps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission_test.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.godeps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.godeps/github.com/openshift/kubernetes/pkg/features/openshift_features.godeps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.godeps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yamldeps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.mddeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshot-metadata.godeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable.godeps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable_stress.godeps/github.com/openshift/kubernetes/test/e2e/storage/utils/volume_group_snapshot.godeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/csi-hostpath-plugin.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/run_group_snapshot_e2e.shdeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/controller_ss.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/node_ds.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-plugin.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-attacher.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-resizer.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-snapshotter.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver.yamldeps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-proxy.yamlpackaging/crio.conf.d/10-microshift_amd64.confpackaging/crio.conf.d/10-microshift_arm64.confpkg/components/controllers.goscripts/auto-rebase/assets.yamlscripts/auto-rebase/changelog.txtscripts/auto-rebase/commits.txtscripts/auto-rebase/last_rebase.sh
💤 Files with no reviewable changes (1)
- deps/github.com/openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
🚧 Files skipped from review as they are similar to previous changes (50)
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/node_ds.yaml
- packaging/crio.conf.d/10-microshift_arm64.conf
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-snapshotter.yaml
- assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
- assets/components/service-ca/deployment.yaml
- Makefile.version.aarch64.var
- Makefile.version.x86_64.var
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver.yaml
- assets/components/multus/kustomization.aarch64.yaml
- assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
- deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go
- assets/optional/operator-lifecycle-manager/0000_50_olm_01-networkpolicies.yaml
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission.go
- assets/components/multus/kustomization.x86_64.yaml
- deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable_stress.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/run_group_snapshot_e2e.sh
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/gce-pd/controller_ss.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-resizer.yaml
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go
- assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
- assets/components/multus/release-multus-x86_64.json
- deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
- assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
- scripts/auto-rebase/assets.yaml
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-driver-attacher.yaml
- assets/components/service-ca/controller-config.yaml
- deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshot-metadata.go
- packaging/crio.conf.d/10-microshift_amd64.conf
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/csi-hostpath-plugin.yaml
- deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/snapshottable.go
- scripts/auto-rebase/last_rebase.sh
- deps/github.com/openshift/kubernetes/test/e2e/storage/utils/volume_group_snapshot.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/mock/csi-mock-proxy.yaml
- deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go
- assets/release/release-aarch64.json
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go
- deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md
- Makefile.kube_git.var
- scripts/auto-rebase/commits.txt
- assets/release/release-x86_64.json
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeselectoradjuster/admission_test.go
- deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yaml
- assets/components/multus/release-multus-aarch64.json
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/external-snapshotter/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yaml
- deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go
- deps/github.com/openshift/kubernetes/test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-plugin.yaml
- scripts/auto-rebase/changelog.txt
| 5. In case of conflicts, it will ask you to step into another shell to resolve those. The script will continue by committing the resolution with `UPSTREAM: <drop>`. | ||
| 6. At the end, there will be a "rebase-$VERSION" branch pushed to your fork. | ||
| 7. If you have `gh` installed and are logged in, it will attempt to create a PR for you by opening a web browser. | ||
| 7. A pull request will be created with the title `$jira_id: Rebase $k8s_tag in $openshift_release` against the corresponding openshift branch. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Document the conditional pull-request creation.
deps/github.com/openshift/kubernetes/openshift-hack/rebase.sh runs gh pr create only when gh is installed. Line 579 says that a pull request will always be created. State the gh requirement and document the manual fallback.
As per path instructions, do not manually edit files under deps/; apply the wording change in the rebase source.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deps/github.com/openshift/kubernetes/REBASE.openshift.md` at line 579, The
rebase documentation incorrectly states that a pull request is always created.
Update the corresponding wording in the rebase source, not under deps/, to state
that creation requires the gh CLI and to document the manual fallback when gh is
unavailable.
Source: Path instructions
|
@copejon: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Includes fix for USHIFT-7434 /jira refresh |
|
This is blocked until the network interface truncation bug is resolved in upstream ovn-k |
Summary by CodeRabbit
New Features
Updates