OCPBUGS-65633: add network-check-target + networking-console-plugin service accounts #2868
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Excluded labels (none allowed) (1)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughAdds two new ServiceAccount manifests (network-check-target in openshift-network-diagnostics; networking-console-plugin in openshift-network-console). Updates the network-check-target DaemonSet and the networking-console-plugin Deployment pod specs to use their respective ServiceAccounts. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Comment |
openshift-ci-robot
added
jira/severity-critical
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65633, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
requested review from
anuragthehatter,
arkadeepsen and
kyrtapz
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ehearne-redhat The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @bindata/network-diagnostics/001-rbac.yaml:
- Around line 132-138: Change the ServiceAccount manifest to use the correct
core API group by replacing apiVersion: rbac.authorization.k8s.io with
apiVersion: v1 for the ServiceAccount named network-check-target in namespace
openshift-network-diagnostics, and remove the trailing whitespace on the blank
line after namespace (line containing only whitespace) to ensure the YAML is
accepted by Kubernetes.
In @bindata/networking-console-plugin/001-rbac.yaml:
- Around line 1-5: The manifest declares a ServiceAccount with the wrong
apiVersion; change the apiVersion for the ServiceAccount resource from
"rbac.authorization.k8s.io" to "v1" so Kubernetes accepts it; update the
apiVersion field at the top of the ServiceAccount definition (metadata.name:
networking-console-plugin, metadata.namespace: openshift-network-console) to
"v1" and keep the rest of the ServiceAccount spec unchanged.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (6)
bindata/network-diagnostics/001-rbac.yamlbindata/network-diagnostics/network-check-target.yamlbindata/networking-console-plugin/001-rbac.yamlbindata/networking-console-plugin/002-config-map.yamlbindata/networking-console-plugin/003-deployment.yamlbindata/networking-console-plugin/005-service.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/networking-console-plugin/001-rbac.yamlbindata/network-diagnostics/001-rbac.yamlbindata/network-diagnostics/network-check-target.yamlbindata/networking-console-plugin/003-deployment.yaml
🔇 Additional comments (2)
bindata/networking-console-plugin/003-deployment.yaml (1)
58-58: LGTM!The serviceAccount assignment correctly references the networking-console-plugin ServiceAccount defined in
001-rbac.yaml. The namespace alignment is correct, and the configuration withautomountServiceAccountToken: falseindicates this is used for pod security context rather than API access.bindata/network-diagnostics/network-check-target.yaml (1)
66-66: LGTM!The serviceAccount assignment correctly references the network-check-target ServiceAccount defined in
bindata/network-diagnostics/001-rbac.yaml. The namespace alignment is correct.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
/retest |
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65633, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test hypershift-e2e-aks |
ehearne-redhat
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/test e2e-aws-ovn-hypershift-conformance |
|
@ehearne-redhat: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
This PR adds a service account to
openshift-network-diagnostics/network-check-target-andopenshift-network-console/networking-console-plugin-pods. It also includes a change to render_test as the number14for number of YAMLs to check for is now15due to added RBAC manifest. The ordering of the manifests have been changed to allow for the correct application of manifests.The reason for this change is that these pods should use their own bespoke service account, not default.