NO-JIRA: Bump openshift/api and openshift/client-go#2319
Closed
ardaguclu wants to merge 1 commit into
Closed
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@ardaguclu: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
/lgtm |
WalkthroughTwo OpenShift Go module dependencies in ChangesOpenShift Dependency Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
@ardaguclu: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 21: The go.mod file pins github.com/openshift/api and
github.com/openshift/client-go to master-branch pseudo-versions
(v0.0.0-20260618181827-d22a47a846dc and similar), which are unvetted pre-release
commits that violate supply chain stability requirements. Replace these
master-branch pseudo-versions with actual stable release versions (e.g., vX.Y.Z
tags) that include the required KMS changes. If stable releases with the
necessary functionality are unavailable, document in a comment why these
specific pre-release commits are necessary and what validation has been
performed against them.
- Line 21: The dependency bump for openshift/api to a master-branch
pseudo-version (v0.0.0-20260618181827-d22a47a846dc) in go.mod lacks required
justification and supply chain security documentation. Either revert the
openshift/api dependency to the latest released stable version if the unreleased
commit is not essential, or if the master-branch version is necessary, document
the justification by adding a detailed commit message or PR description that
includes links to upstream CNTRLPLANE tracking issues or PRs corresponding to
this specific commit, a summary of the API changes that necessitate this
unreleased version, and references to the encryption-related tests (such as
those in test/e2e-encryption/encryption_test.go) that validate compatibility
between the openshift/api and openshift/client-go versions being used.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f723bc11-160f-4d21-8bf1-957ee2a2ed1d
⛔ Files ignored due to path filters (66)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/api/.ci-operator.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/Dockerfile.ocpis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/features.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/legacyfeaturegates.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_etcd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_kmsencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_kubeapiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_openshiftapiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/route/v1/generated.protois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/security/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientcredentialconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientsecretsecretreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/customtlsprofile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalclaimssource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourceauthentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcecertificateauthorityconfigmapreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcepredicate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcetls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkobservabilityspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/oidcprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourcedclaimmapping.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourceurl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/tlsprofilespec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/tlssecurityprofile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultapproleauthentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaulttlsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/kubestatemetricsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/kubestatemetricsresourcelabels.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/retention.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierrequestloggingconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/utils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/etcdspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmsencryptionstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspluginhealthreport.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kubeapiserverstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/oauthapiserverstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/openshiftapiserverstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/operator/applyconfigurations/utils.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
| github.com/opencontainers/go-digest v1.0.0 | ||
| github.com/opencontainers/selinux v1.13.0 | ||
| github.com/openshift/api v0.0.0-20260521125114-09730f85d883 | ||
| github.com/openshift/api v0.0.0-20260618181827-d22a47a846dc |
There was a problem hiding this comment.
Using master-branch pseudo-versions violates supply chain stability expectations.
Lines 21 and 23 pin github.com/openshift/api and github.com/openshift/client-go to recent master-branch pseudo-versions (both from 2026-06-18). These are unvetted pre-release commits, not stable releases. Per the coding guidelines, production dependencies must not use pre-release or yanked versions. Master branch is inherently unstable and lacks the stability guarantees of tagged releases.
Consider identifying a stable release version that includes the required KMS changes, or document why stable releases are unavailable and what testing/validation has been performed against these specific commits.
Also applies to: 23-23
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 21, The go.mod file pins github.com/openshift/api and
github.com/openshift/client-go to master-branch pseudo-versions
(v0.0.0-20260618181827-d22a47a846dc and similar), which are unvetted pre-release
commits that violate supply chain stability requirements. Replace these
master-branch pseudo-versions with actual stable release versions (e.g., vX.Y.Z
tags) that include the required KMS changes. If stable releases with the
necessary functionality are unavailable, document in a comment why these
specific pre-release commits are necessary and what validation has been
performed against them.
Source: Coding guidelines
🧩 Analysis chain
🏁 Script executed:
# First, find and read the go.mod file
fd -name go.mod -type fRepository: openshift/library-go
Length of output: 295
🏁 Script executed:
# Also check the git history for recent changes to go.mod
git log --oneline -20 -- go.mod 2>/dev/null || echo "No git history available"Repository: openshift/library-go
Length of output: 116
🏁 Script executed:
# Look for PR context or commit messages that mention KMS
git log --all --oneline --grep="KMS" 2>/dev/null | head -20 || echo "No matching commits"Repository: openshift/library-go
Length of output: 1499
🏁 Script executed:
# Read the go.mod file to see the actual version pinning
cat go.modRepository: openshift/library-go
Length of output: 6826
🏁 Script executed:
# Get the commit details for the bump
git show a5c48f6f --statRepository: openshift/library-go
Length of output: 50377
🏁 Script executed:
# Get more details about the specific PR mentioned in the commit
git log a5c48f6f -1 --format=fullerRepository: openshift/library-go
Length of output: 332
🏁 Script executed:
# Look for any PR references or upstream links in the recent git history
git log --all --format="%B" --grep="KMS\|openshift/api\|openshift/client-go" -i | head -100Repository: openshift/library-go
Length of output: 3821
🏁 Script executed:
# Check if there are test files related to KMS in this repository
find . -type f -name "*kms*test*" -o -name "*test*kms*" | head -20Repository: openshift/library-go
Length of output: 135
🏁 Script executed:
# Look for any evidence of testing these upgraded versions
rg -l "kms|KMS" test/ --type go | head -20Repository: openshift/library-go
Length of output: 309
🏁 Script executed:
# Check the go.sum file for version information and verify if hashes match expected format
grep "github.com/openshift/api\|github.com/openshift/client-go" go.sumRepository: openshift/library-go
Length of output: 522
🏁 Script executed:
# Check for CVE information for these specific commits
# First, let's look for any CHANGELOG or release notes references
git log --all --oneline --grep="changelog\|release\|CHANGELOG" -i | head -20Repository: openshift/library-go
Length of output: 1339
🏁 Script executed:
# Search for licensing information in go.mod comments or documentation
head -50 go.mod | grep -A2 -B2 "license\|License\|LICENSE"Repository: openshift/library-go
Length of output: 46
🏁 Script executed:
# Verify if there are actual test cases validating KMS functionality with these dependencies
grep -r "openshift/api\|openshift/client-go" test/library/encryption/ | head -20Repository: openshift/library-go
Length of output: 706
🏁 Script executed:
# Check if there's any documentation about the specific commits being used
git show a5c48f6f:go.mod | grep -A2 -B2 "openshift"Repository: openshift/library-go
Length of output: 469
🏁 Script executed:
# Check the commit dates to verify they're genuinely from the same time
git log -1 --format="%H %ai" a5c48f6fRepository: openshift/library-go
Length of output: 131
🏁 Script executed:
# Look for any upstream repository references or KMS issue tracker information
git log a5c48f6f^..a5c48f6f --format="%B" | grep -i "fixes\|closes\|resolves\|#[0-9]\|openshift/"Repository: openshift/library-go
Length of output: 264
🏁 Script executed:
# Check if there's a CHANGELOG or similar documenting the KMS changes
find . -type f \( -name "CHANGELOG*" -o -name "CHANGES*" -o -name "RELEASE*" \) | head -10Repository: openshift/library-go
Length of output: 549
🏁 Script executed:
# Verify: are these versions pinned exactly or are they floating references?
cat go.mod | grep -A5 "require ("Repository: openshift/library-go
Length of output: 621
🏁 Script executed:
# Let me verify the actual hashes are valid and check for any go.sum inconsistencies
wc -l go.sum && grep -c "github.com/openshift/api\|github.com/openshift/client-go" go.sumRepository: openshift/library-go
Length of output: 77
🏁 Script executed:
# Check if there's any PR description or context we can access
git log --oneline -30 | grep -i "kms\|api\|client"Repository: openshift/library-go
Length of output: 116
🏁 Script executed:
# Verify the pseudo-versions follow Go module conventions (v0.0.0-YYYYMMDDHHMMSS-COMMITHASH)
echo "openshift/api pseudo-version: v0.0.0-20260618181827-d22a47a846dc"
echo "openshift/client-go pseudo-version: v0.0.0-20260618131434-17fd91ed6167"
echo "Format check: YYYYMMDD matches commit dates"Repository: openshift/library-go
Length of output: 244
🏁 Script executed:
# Let me check if there are actual integration/e2e tests that would validate KMS functionality
grep -r "kms\|KMS" test/e2e-encryption/encryption_test.go | head -20Repository: openshift/library-go
Length of output: 1468
🏁 Script executed:
# Check what scenarios are being tested with these dependencies
grep -r "scenario\|Scenario" test/library/encryption/scenarios.go | head -15Repository: openshift/library-go
Length of output: 1654
🏁 Script executed:
# Verify licensing is documented anywhere in the dependencies
grep -i "license\|COPYING" go.modRepository: openshift/library-go
Length of output: 46
🏁 Script executed:
# Check if there are specific test cases that validate the new API/client-go versions work together
grep -r "TestKMS\|TestEncryptionType" test/e2e-encryption/encryption_test.go | head -10Repository: openshift/library-go
Length of output: 46
🏁 Script executed:
# Look for any references to upstream issues/PRs that might explain the KMS changes
git log --all --format="%B" | grep -i "CNTRLPLANE\|openshift/api\|openshift/client-go" | head -30Repository: openshift/library-go
Length of output: 2092
🏁 Script executed:
# Verify that the two dependencies are truly compatible versions (not from different release cycles)
git log --oneline --all | grep -E "Bump|api|client-go" | head -15Repository: openshift/library-go
Length of output: 957
Provide justification and evidence for bumping to master-branch commits.
The pseudo-versions (v0.0.0-20260618181827-d22a47a846dc and v0.0.0-20260618131434-17fd91ed6167) indicate unreleased commits from upstream master branches. While the codebase contains extensive KMS-related functionality and integration tests (test/e2e-encryption/encryption_test.go includes KMS verification), the commit message "Bump openshift/api and openshift/client-go" provides no:
- Link to upstream PRs or CNTRLPLANE tracking issues documenting these specific commits
- Changelog summary of breaking or significant changes
- Justification for why released versions cannot be used
Per supply chain security guidelines, non-release versions require explicit justification. Please provide:
- Links to upstream issues/PRs corresponding to the commits (likely CNTRLPLANE-* tickets based on your KMS work history)
- Summary of API changes in these commits requiring coordinated updates
- Reference to which tests validate compatibility between these two versions
Related commits in history
27cc62d1 Bump openshift/api and openshift/client-go
76149153 Update openshift/api and openshift/client-go for KMS
c3797459 Update openshift/api and openshift/client-go for KMS
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 21, The dependency bump for openshift/api to a master-branch
pseudo-version (v0.0.0-20260618181827-d22a47a846dc) in go.mod lacks required
justification and supply chain security documentation. Either revert the
openshift/api dependency to the latest released stable version if the unreleased
commit is not essential, or if the master-branch version is necessary, document
the justification by adding a detailed commit message or PR description that
includes links to upstream CNTRLPLANE tracking issues or PRs corresponding to
this specific commit, a summary of the API changes that necessitate this
unreleased version, and references to the encryption-related tests (such as
those in test/e2e-encryption/encryption_test.go) that validate compatibility
between the openshift/api and openshift/client-go versions being used.
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ardaguclu, bertinatto, tjungblu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Member
Author
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
Contributor
|
Superseded by #2320 |
Member
Author
|
/close |
Contributor
|
@ardaguclu: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR bumps openshift/api and openshift/client-go to master branch to get KMS related changes.
Summary by CodeRabbit