SSCSI-259: Rebase openshift/main to upstream v1.5.6 for OCP 4.22#62
Open
chiragkyal wants to merge 26 commits intoopenshift:mainfrom
Open
SSCSI-259: Rebase openshift/main to upstream v1.5.6 for OCP 4.22#62chiragkyal wants to merge 26 commits intoopenshift:mainfrom
chiragkyal wants to merge 26 commits intoopenshift:mainfrom
Conversation
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…-pick-of-#1949-upstream-release-1.5 chore: update to go 1.24.9
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
….11_release_1.5 chore: update to go 1.24.11 and bump golang.org/x/crypto to v0.46.0
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…elease_1.5_v1.5.5 chore: bump version to v1.5.5 in release-1.5
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…-pick-of-#1972-upstream-release-1.5 release: update manifest and helm charts for v1.5.5
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…-pick-of-#1980-upstream-release-1.5 chore: update to go 1.24.12 and kubectl v1.34.3
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
security: bump to go 1.24.13 to resolve CVE-2025-68121
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…elease_1.5_v1.5.6 chore: bump version to v1.5.6 in release-1.5
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…-pick-of-#1999-upstream-release-1.5 release: update manifest and helm charts for v1.5.6
Signed-off-by: chiragkyal <ckyal@redhat.com>
- Add .ci-operator.yaml, .snyk, Dockerfile.* - Update OWNERS and OWNERS_ALIASES - Add '-mod=vendor' in Makefile build targets - Add required go build flags for FIPS Signed-off-by: chiragkyal <ckyal@redhat.com>
Signed-off-by: chiragkyal <ckyal@redhat.com>
…age to be consistent with ART for 4.22 Reconciling with https://github.com/openshift/ocp-build-data/tree/087d1930e36b609f77d73bd8a313d85c940cff4d/images/ose-secrets-store-csi-driver.yml
Signed-off-by: chiragkyal <ckyal@redhat.com>
Signed-off-by: chiragkyal <ckyal@redhat.com>
Signed-off-by: chiragkyal <ckyal@redhat.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@chiragkyal: This pull request references SSCSI-259 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: chiragkyal The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
WalkthroughRelease bump v1.5.4 → v1.5.6, update Go toolchain to 1.24.11, upgrade builder images to golang:1.24.13, OpenShift base images 4.21 → 4.22, kubectl v1.34.1 → v1.34.3, dependency refresh, and add automountServiceAccountToken Helm option for pods. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~30 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.5.0)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Comment |
|
@chiragkyal: This pull request references SSCSI-259 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docker/crd.Dockerfile (1)
16-21:⚠️ Potential issue | 🟠 MajorAdd checksum validation for
kubectlbinary downloadLines 19-21 download and execute
kubectlwithout signature or checksum verification, creating a supply-chain integrity risk. The Kubernetes release endpoints provide checksums for all supported architectures—add validation to prevent tampering or mismatched artifacts.Suggested fix
RUN apk add --no-cache curl && \ - curl -LO https://dl.k8s.io/release/${KUBE_VERSION}/bin/linux/${TARGETARCH}/kubectl && \ + curl -fsSLO https://dl.k8s.io/release/${KUBE_VERSION}/bin/linux/${TARGETARCH}/kubectl && \ + curl -fsSLO https://dl.k8s.io/release/${KUBE_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256 && \ + echo "$(cat kubectl.sha256) kubectl" | sha256sum -c - && \ chmod +x kubectl🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker/crd.Dockerfile` around lines 16 - 21, Add integrity verification for the kubectl download by fetching the corresponding checksum file from the Kubernetes release (using KUBE_VERSION and TARGETARCH) and verifying the downloaded kubectl binary before making it executable; update the RUN block that downloads kubectl to also curl the release's checksum (or kubectl.sha256), compute the downloaded binary's checksum (e.g., sha256sum), compare it to the expected value, and abort (remove the binary and exit non‑zero) if the check fails, then only run chmod +x kubectl after successful verification.
🧹 Nitpick comments (2)
Dockerfile.e2eprovider (1)
6-6: Drop root privileges in the runtime stage.At Line 6, the runtime stage does not set
USER, so the container runs as root by default. Set a non-root UID before entrypoint.Suggested patch
FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 COPY --from=builder /go/src/github.com/openshift/secrets-store-csi-driver/test/e2eprovider/e2e-provider /e2e-provider +USER 65532:65532 LABEL description="Mock provider for Secrets Store CSI Driver"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.e2eprovider` at line 6, The runtime stage in Dockerfile.e2eprovider currently runs as root; set a non-root user by adding a USER instruction with a non-root UID (e.g., 1000) in the runtime stage before the ENTRYPOINT/CMD, and ensure any required files/directories are chown'd to that UID in the Dockerfile (or created with proper permissions) so the process can run without root; update the Dockerfile runtime stage around the FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 line to create or use a non-root UID and then add USER <uid> prior to the container start instructions.Dockerfile.bats (1)
1-1: Run the final image as a non-root user.At Line 1, this file still builds a runtime image with no
USERset, so it defaults to root. Add a non-root user at the end of the Dockerfile after package installs.Suggested patch
RUN dnf install -y gettext less && dnf clean all +RUN useradd --create-home --uid 10001 csi +USER 10001🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.bats` at line 1, The final image currently runs as root because there is no USER set; after you finish package installs and file ownership setup in the Dockerfile (the image built from FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22 AS builder), create a dedicated non-root account (e.g., adduser/groupadd or useradd) and chown any app/runtime directories to that user, then add a USER <username> directive at the end of the Dockerfile so the container runs as the non-root account instead of root.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@docker/crd.Dockerfile`:
- Around line 16-21: Add integrity verification for the kubectl download by
fetching the corresponding checksum file from the Kubernetes release (using
KUBE_VERSION and TARGETARCH) and verifying the downloaded kubectl binary before
making it executable; update the RUN block that downloads kubectl to also curl
the release's checksum (or kubectl.sha256), compute the downloaded binary's
checksum (e.g., sha256sum), compare it to the expected value, and abort (remove
the binary and exit non‑zero) if the check fails, then only run chmod +x kubectl
after successful verification.
---
Nitpick comments:
In `@Dockerfile.bats`:
- Line 1: The final image currently runs as root because there is no USER set;
after you finish package installs and file ownership setup in the Dockerfile
(the image built from FROM
registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22 AS
builder), create a dedicated non-root account (e.g., adduser/groupadd or
useradd) and chown any app/runtime directories to that user, then add a USER
<username> directive at the end of the Dockerfile so the container runs as the
non-root account instead of root.
In `@Dockerfile.e2eprovider`:
- Line 6: The runtime stage in Dockerfile.e2eprovider currently runs as root;
set a non-root user by adding a USER instruction with a non-root UID (e.g.,
1000) in the runtime stage before the ENTRYPOINT/CMD, and ensure any required
files/directories are chown'd to that UID in the Dockerfile (or created with
proper permissions) so the process can run without root; update the Dockerfile
runtime stage around the FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 line
to create or use a non-root UID and then add USER <uid> prior to the container
start instructions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: dc497e7c-464b-439e-ad54-128798607271
⛔ Files ignored due to path filters (194)
go.sumis excluded by!**/*.sumtest/e2eprovider/go.sumis excluded by!**/*.sumtest/e2eprovider/vendor/golang.org/x/net/http2/config.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/config_go124.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/config_go125.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/config_go126.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/config_pre_go124.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/gotrack.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/writesched.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/writesched_priority_rfc9218.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/fdset.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ifreq_linux.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/mkall.shis excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/syscall_netbsd.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.sis excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.sis excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**test/e2eprovider/vendor/golang.org/x/text/unicode/bidi/core.gois excluded by!**/vendor/**test/e2eprovider/vendor/modules.txtis excluded by!**/vendor/**vendor/golang.org/x/crypto/cryptobyte/asn1.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/pkcs12/pkcs12.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/escape.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/parse.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/render.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config_go124.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config_go125.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config_go126.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/config_pre_go124.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/gotrack.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc9218.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/plan9/pwd_go15_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/plan9/pwd_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/fdset.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ifreq_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkall.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_netbsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/registry/key.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/registry/value.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/registry/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/term_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/term/terminal.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/japanese/eucjp.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/japanese/iso2022jp.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/japanese/shiftjis.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/korean/euckr.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/simplifiedchinese/gbk.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/simplifiedchinese/hzgb2312.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/traditionalchinese/big5.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/encoding/unicode/unicode.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/text/unicode/bidi/core.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (23)
Dockerfile.batsDockerfile.e2eproviderMakefilecharts/secrets-store-csi-driver/Chart.yamlcharts/secrets-store-csi-driver/README.mdcharts/secrets-store-csi-driver/templates/secrets-store-csi-driver-windows.yamlcharts/secrets-store-csi-driver/templates/secrets-store-csi-driver.yamlcharts/secrets-store-csi-driver/values.yamldeploy/secrets-store-csi-driver-windows.yamldeploy/secrets-store-csi-driver.yamldocker/Dockerfiledocker/Makefiledocker/crd.Dockerfiledocker/windows.Dockerfilego.modhack/tools/go.modmanifest_staging/charts/secrets-store-csi-driver/Chart.yamlmanifest_staging/charts/secrets-store-csi-driver/README.mdmanifest_staging/charts/secrets-store-csi-driver/values.yamlmanifest_staging/deploy/secrets-store-csi-driver-windows.yamlmanifest_staging/deploy/secrets-store-csi-driver.yamltest/e2eprovider/Dockerfiletest/e2eprovider/go.mod
To fix the Prow CI issue go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local) Signed-off-by: chiragkyal <ckyal@redhat.com>
|
@chiragkyal: This pull request references SSCSI-259 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@hack/tools/go.mod`:
- Line 3: The go version in hack/tools/go.mod is set to 1.24.11 but your CI
Docker images use golang:1.24.13; update the three go.mod files (root go.mod,
hack/tools/go.mod, test/e2eprovider/go.mod) to declare "go 1.24.13" so they
match the CI images, or alternatively change the Dockerfiles in
test/e2eprovider/, docker/, and docker/windows.Dockerfile to use golang:1.24.11;
pick one approach, apply the change consistently across the mentioned files
(root go.mod, hack/tools/go.mod, test/e2eprovider/go.mod OR the three
Dockerfiles), and run `go mod tidy`/rebuild CI to verify no regressions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 18a4ed8d-21a2-4b9b-a586-b9b1928cb1da
⛔ Files ignored due to path filters (1)
test/e2eprovider/vendor/modules.txtis excluded by!**/vendor/**
📒 Files selected for processing (3)
go.modhack/tools/go.modtest/e2eprovider/go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
- go.mod
| module sigs.k8s.io/secrets-store-csi-driver/hack/tools | ||
|
|
||
| go 1.24.6 | ||
| go 1.24.11 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod version declarations =="
fd '^go\.mod$' -t f | while read -r f; do
echo "--- $f"
rg -n '^\s*(go|toolchain)\s+' "$f"
done
echo
echo "== CI/tooling references to Go versions =="
rg -n '1\.24\.(11|13)|go1\.24\.(11|13)|golang:1\.24\.(11|13)|GO_VERSION|toolchain' \
-g '!**/vendor/**' -g '!**/.git/**'Repository: openshift/secrets-store-csi-driver
Length of output: 1053
Update Go version in go.mod files to match Docker image version, or update Dockerfiles to test against declared minimum.
All go.mod files declare go 1.24.11, but CI Dockerfiles use golang:1.24.13. This inconsistency means the declared minimum version is not validated by CI. Either update the three go.mod files (root, hack/tools, test/e2eprovider) to go 1.24.13, or update the Dockerfiles in test/e2eprovider/, docker/, and docker/windows.Dockerfile to test against golang:1.24.11.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@hack/tools/go.mod` at line 3, The go version in hack/tools/go.mod is set to
1.24.11 but your CI Docker images use golang:1.24.13; update the three go.mod
files (root go.mod, hack/tools/go.mod, test/e2eprovider/go.mod) to declare "go
1.24.13" so they match the CI images, or alternatively change the Dockerfiles in
test/e2eprovider/, docker/, and docker/windows.Dockerfile to use golang:1.24.11;
pick one approach, apply the change consistently across the mentioned files
(root go.mod, hack/tools/go.mod, test/e2eprovider/go.mod OR the three
Dockerfiles), and run `go mod tidy`/rebuild CI to verify no regressions.
Member
Author
There was a problem hiding this comment.
Those are upstream Dockerfiles. We have separate Dockerfiles are downstream builds whose base images are maintained by ART team.
There was a problem hiding this comment.
@chiragkyal, understood — thanks for the clarification. Since the upstream Dockerfiles are not used for the downstream OpenShift CI builds, and the base images for the downstream Dockerfiles (Dockerfile.bats, Dockerfile.e2eprovider) are managed by the ART team, the version mismatch concern does not apply here. I'll disregard this finding.
📝 Learnings were identified and not saved (knowledge base disabled). Enable
|
@chiragkyal: This pull request references SSCSI-259 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Member
Author
|
/cc @mytreya-rh |
Member
Author
|
/retest |
1 similar comment
Member
Author
|
/retest |
Member
Author
|
/retest-required |
|
@chiragkyal: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR rebases the driver on the v.1.5.6 upstream release, bringing the following changes since v.1.5.4 (last rebase)
Changes between v.1.5.4 and v1.5.6:
kubernetes-sigs/secrets-store-csi-driver@v1.5.4...v1.5.6
File Changes
https://github.com/kubernetes-sigs/secrets-store-csi-driver/compare/v1.5.4..v1.5.6
$ git diff v1.5.4 v1.5.6$ git log v1.5.4...v1.5.6 --oneline --reverse --no-mergesChange logs after v1.5.4
Diff to upstream v1.5.6
kubernetes-sigs/secrets-store-csi-driver@v1.5.6...chiragkyal:rebase-1.5.6
Steps Followed
git log --oneline $(git merge-base openshift/main v1.5.6)..openshift/main --reverse --ancestry-path --no-mergesThe above command will list all the commits from the common merge base, but we want to pick only the
carrycommits which were added after our last rebase pointVendor update
Perform vendor updates in root and add the changes with
<drop>commitPerform vendor updates in
test/e2eproviderand add the changes with<drop>commitUpdate Dockerfile.{bats,e2eprovider} to 4.22
After initial reviews, the carry commits were squashed accordingly.
Update the golang version to
1.24.11since ART's golang builder image doesnot supprot1.24.13Issue
https://issues.redhat.com//browse/SSCSI-259
Summary by CodeRabbit
New Features
Chores