NE-2765: Bump Kubernetes to 1.36.2 and Go to 1.26#483
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
openshift-ci-robot
added
the
jira/valid-reference
|
@aswinsuryan: This pull request references NE-2765 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe module targets Go 1.26 with refreshed Kubernetes, OpenShift, controller-runtime, and transitive dependencies. The CRD update script now installs the base DNSNameResolver CRD manifest instead of NoUpgrade variants. ChangesDependency and CRD updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)go.modTraceback (most recent call last): Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/jira refresh |
|
@aswinsuryan: This pull request references NE-2765 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
66b91cd to
6235989
Compare
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
go.mod (1)
3-22: 📐 Maintainability & Code Quality | 🔵 TrivialEnsure SBOM generation and artifact signing.
As per path instructions for supply chain security, ensure that the build pipeline is configured to produce provenance attestations (SBOM) and that all produced artifacts are signed with Sigstore/cosign.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 3 - 22, Update the build and release pipeline configuration associated with the Go module dependencies to generate provenance/SBOM attestations for every build artifact and sign all produced artifacts using Sigstore/cosign. Ensure both steps run as part of the existing artifact publication flow and fail the pipeline when attestation or signing fails.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 98-100: Remove the replace directive for
github.com/openshift/library-go that points to the personal fork and unreleased
pseudo-version. Restore dependency resolution to the official upstream module,
using an approved released version or the upstream merged changes instead.
In `@manifests/0000_70_dns_00_dnsnameresolvers.crd.yaml`:
- Line 9: Update the root openAPIV3Schema description in the DNSNameResolvers
CustomResourceDefinition to document DevPreviewNoUpgrade alongside the existing
TechPreviewNoUpgrade and CustomNoUpgrade feature sets, matching the supported
values in the release.openshift.io/feature-set annotation.
In `@manifests/0000_70_dns-operator_00.crd.yaml`:
- Around line 174-177: Update the taint toleration operator schema near the
documented “Valid operators” text to add an OpenAPI enum constraint for Exists,
Equal, Lt, and Gt, and set its default to Equal. Keep the field type as string
and preserve the existing feature-gate documentation.
---
Nitpick comments:
In `@go.mod`:
- Around line 3-22: Update the build and release pipeline configuration
associated with the Go module dependencies to generate provenance/SBOM
attestations for every build artifact and sign all produced artifacts using
Sigstore/cosign. Ensure both steps run as part of the existing artifact
publication flow and fail the pipeline when attestation or signing fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
/test e2e-aws-ovn |
|
/assign @bentito |
6235989 to
b262859
Compare
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
|
@coderabbitai full-review |
|
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 7 minutes. |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
|
/retest-required |
|
Were the manifest changes in this PR required by the bumps? Maybe a PR description note so we have some documentation on why. |
Yes, the manifest changes were required by the bumps. The new openshift/api restructured how CRDs are delivered, the 3 separate feature-gated DNSNameResolver CRD files were consolidated into a single file. The hack scripts had to be updated to point to the new paths. The PR description is updated. |
|
/test e2e-aws-ovn |
1 similar comment
|
/test e2e-aws-ovn |
|
/retest-required |
b262859 to
54f1f6e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 81: Update the go.opentelemetry.io/otel/sdk dependency in go.mod from
v1.40.0 to v1.43.0 or later, ensuring the resolved module version is outside the
affected vulnerability range.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Bump k8s.io modules to v0.36.2, controller-runtime to v0.24.1, and Go to 1.26. Update openshift/api, openshift/client-go, and openshift/library-go to latest upstream. Update CRD hack script for consolidated DNSNameResolver CRD. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
54f1f6e to
802ce9a
Compare
|
/lgtm |
|
/retest |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bentito The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/test e2e-aws-ovn |
|
@aswinsuryan: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 101: Update the google.golang.org/grpc dependency from v1.79.3 to v1.82.1
or later, then regenerate the vendored module graph and go.sum so all dependency
metadata reflects the upgraded version, and rescan the resulting graph.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| google.golang.org/protobuf v1.36.8 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect | ||
| google.golang.org/grpc v1.79.3 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
go list -m all | grep '^google.golang.org/grpc '
govulncheck ./...Repository: openshift/cluster-dns-operator
Length of output: 263
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '\n== go.mod excerpt ==\n'
cat -n go.mod | sed -n '90,110p'
printf '\n== grpc references in module files ==\n'
rg -n '^(\s*google\.golang\.org/grpc\b|# google\.golang\.org/grpc\b)' go.mod go.sum vendor/modules.txt || true
printf '\n== module graph view (ignoring vendor) ==\n'
go list -mod=mod -m all | rg '^google\.golang\.org/grpc\b' || trueRepository: openshift/cluster-dns-operator
Length of output: 5734
Upgrade gRPC past the affected range.
google.golang.org/grpc v1.79.3 is still selected here, and the vendored graph and go.sum match it. Upgrade to v1.82.1 or later, then rescan the module graph.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 101-101: google.golang.org/grpc 1.79.3: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 101, Update the google.golang.org/grpc dependency from
v1.79.3 to v1.82.1 or later, then regenerate the vendored module graph and
go.sum so all dependency metadata reflects the upgraded version, and rescan the
resulting graph.
Sources: Coding guidelines, Linters/SAST tools
5 participants
Summary by CodeRabbit
Chores
Bug Fixes