NO-ISSUE: [master] Bump OCP versions: 4.20, 4.22, 4.21, 5.0, 4.18, 4.16, 4.19#10506
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@danmanor: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughTwo sets of artifact version updates are propagated across all deployment manifests: the OpenShift 5.0 RHCOS ISO URLs are corrected from reused 4.22/4.22.0 paths to pre-release/5.0.0-ec.3 paths for all CPU architectures, and release image tags are bumped for OCP 4.16 through 4.22 across x86_64, arm64, and multi-arch entries. ChangesOS Image and Release Image Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
Suggested reviewers
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
size/L
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: danmanor The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
config/manager/manager.yaml (1)
59-77: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffSecurity context improvements recommended.
While not introduced by this PR, the manager container is missing:
- Resource limits (cpu, memory)
runAsNonRoot: true- Capability dropping (
drop: [ALL])As per path instructions, Kubernetes manifests should enforce these security best practices.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@config/manager/manager.yaml` around lines 59 - 77, The manager container's securityContext block is missing critical security hardening settings. Add `runAsNonRoot: true` and a `capabilities` section with `drop: [ALL]` to the existing securityContext configuration that currently has allowPrivilegeEscalation and readOnlyRootFilesystem settings. Additionally, the resources section contains requests for cpu and memory but is missing corresponding limits for both cpu and memory under a limits subsection, which should be added at the same level as the requests configuration to enforce resource constraints.Source: Path instructions
deploy/olm-catalog/manifests/assisted-service-operator.clusterserviceversion.yaml (1)
946-952: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffSecurity context improvements recommended.
The manager container in the CSV deployment spec (similar to manager.yaml) is missing resource limits,
runAsNonRoot: true, and capability dropping. As per path instructions, these should be enforced for operator workloads.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@deploy/olm-catalog/manifests/assisted-service-operator.clusterserviceversion.yaml` around lines 946 - 952, The securityContext block in the manager container is missing two important security configurations: add `runAsNonRoot: true` to prevent the container from running as root, and add a `capabilities` field with `drop: ["ALL"]` to remove all Linux capabilities. Additionally, the resources section currently only defines requests but is missing limits; add a `limits` subsection under resources with appropriate cpu and memory limits to match the security posture of the manager.yaml configuration. These additions should be made directly in the securityContext and resources sections of the manager container specification in the deployment spec.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@config/manager/manager.yaml`:
- Around line 59-77: The manager container's securityContext block is missing
critical security hardening settings. Add `runAsNonRoot: true` and a
`capabilities` section with `drop: [ALL]` to the existing securityContext
configuration that currently has allowPrivilegeEscalation and
readOnlyRootFilesystem settings. Additionally, the resources section contains
requests for cpu and memory but is missing corresponding limits for both cpu and
memory under a limits subsection, which should be added at the same level as the
requests configuration to enforce resource constraints.
In
`@deploy/olm-catalog/manifests/assisted-service-operator.clusterserviceversion.yaml`:
- Around line 946-952: The securityContext block in the manager container is
missing two important security configurations: add `runAsNonRoot: true` to
prevent the container from running as root, and add a `capabilities` field with
`drop: ["ALL"]` to remove all Linux capabilities. Additionally, the resources
section currently only defines requests but is missing limits; add a `limits`
subsection under resources with appropriate cpu and memory limits to match the
security posture of the manager.yaml configuration. These additions should be
made directly in the securityContext and resources sections of the manager
container specification in the deployment spec.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ae04857a-09a1-4f03-bba5-b703b48914ac
📒 Files selected for processing (7)
config/manager/manager.yamlconfig/samples/agent-install.openshift.io_v1beta1_agentserviceconfig.yamldata/default_os_images.jsondata/default_release_images.jsondeploy/olm-catalog/manifests/assisted-service-operator.clusterserviceversion.yamldeploy/podman/configmap.ymlopenshift/template.yaml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #10506 +/- ##
=======================================
Coverage 44.33% 44.34%
=======================================
Files 423 423
Lines 73512 73512
=======================================
+ Hits 32595 32597 +2
+ Misses 37985 37984 -1
+ Partials 2932 2931 -1 🚀 New features to boost your workflow:
|
|
@danmanor: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
OpenShift updates: 4.19.33-multi -> 4.19.34-multi, 4.20.24 -> 4.20.26, 4.21.19-multi -> 4.21.21-multi, 4.19.33 -> 4.19.34, 4.16.63-multi -> 4.16.64-multi, 4.16.63 -> 4.16.64, 4.18.43-multi -> 4.18.44-multi, 4.21.19 -> 4.21.21, 4.20.24-multi -> 4.20.26-multi, 4.22.0-multi -> 4.22.2-multi, 4.22.0 -> 4.22.2, 4.18.43 -> 4.18.44
RHCOS updates: 4.22.0 -> 5.0.0-ec.3
/test edge-e2e-metal-assisted-4-20 edge-e2e-metal-assisted-4-22 edge-e2e-metal-assisted-4-21 edge-e2e-metal-assisted-5-0 edge-e2e-metal-assisted-4-18 edge-e2e-metal-assisted-4-16 edge-e2e-metal-assisted-4-19
/cc @rccrdpccl @gamli75
Summary by CodeRabbit