[WIP] OCPBUGS-99920: Pre-release testing for OSSM 3.4.1 bump - #1527
[WIP] OCPBUGS-99920: Pre-release testing for OSSM 3.4.1 bump#1527gcs278 wants to merge 5 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-important
|
@gcs278: This pull request references Jira Issue OCPBUGS-98310, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
|
No actionable comments were generated in the recent review. 🎉 📝 WalkthroughWalkthroughUpdates default and deployment Gateway API and Istio versions to Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/pipeline require |
gcs278
changed the title
openshift-ci-robot
removed
jira/severity-important
|
@gcs278: No Jira issue is referenced in the title of this pull request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
gcs278
changed the title
openshift-ci-robot
added
jira/severity-important
|
@gcs278: This pull request references Jira Issue OCPBUGS-99920, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-upgrade |
|
@gcs278: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/e2b5b880-89fc-11f1-9492-901b5ac20b02-0 |
|
/pipeline require |
1 similar comment
|
/pipeline require |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@gcs278: This pull request references Jira Issue OCPBUGS-99920. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/reopn |
|
/reopen |
|
@gcs278: Reopened this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@gcs278: This pull request references Jira Issue OCPBUGS-99920, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/pipeline required |
|
Scheduling tests matching the |
gcs278
changed the title
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
/retest |
1 similar comment
|
/retest |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 225: Update the indirect istio.io/istio dependency pin in go.mod to a
non-vulnerable fixed release, or remove it if dependency analysis confirms it is
not required by any shipped or reachable build path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
/pipeline required |
|
Scheduling tests matching the |
|
/retest |
|
the 1.30.3 pre-release images are not being pulled. Going back to 1.30.1 |
|
/pipeline required |
|
Scheduling tests matching the |
|
Some failures like: /retest |
openshift-ci
Bot
added
the
needs-rebase
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
hack/override-ossm-images.sh (1)
159-170: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFail when a version lacks any required component image.
The script only checks that some related images exist. Missing
cni,ztunnel,proxy, oristiodvalues are silently emitted as empty strings, creating a deployable-but-invalid image mapping. Validate all four fields for every discovered version before writing the file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/override-ossm-images.sh` around lines 159 - 170, Validate istiod, proxy, cni, and ztunnel for each version in the VERSIONS loop before appending to TARGET. If any required image value is empty, fail the script with a clear error and do not emit that version’s mapping; preserve the existing output generation when all four values are present.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/override-ossm-images.sh`:
- Around line 118-120: Validate REGISTRY before the image-rewriting logic in the
override script, allowing only a registry hostname with an optional port and
rejecting quotes, newlines, and other characters unsafe in generated Go string
literals. Continue replacing the registry prefix only after validation succeeds.
- Around line 29-31: Update the --registry option handling in the argument
parser to validate that a following value exists before reading $2, and
otherwise print usage guidance and exit cleanly. Preserve assigning the provided
value to REGISTRY_OVERRIDE and shifting both arguments when valid.
In `@pkg/operator/controller/gatewayclass/istio_images.go`:
- Around line 12-75: Update the downstream image-registry assertion in the
relevant test for the mappings used by the image-version configuration, such as
the entries in the IstiodImage, ProxyImage, CNIImage, and ZTunnelImage map.
Accept registry.stage.redhat.io for pre-release mappings while preserving
registry.redhat.io acceptance for production mappings, so the targeted test
passes across all supported versions.
---
Outside diff comments:
In `@hack/override-ossm-images.sh`:
- Around line 159-170: Validate istiod, proxy, cni, and ztunnel for each version
in the VERSIONS loop before appending to TARGET. If any required image value is
empty, fail the script with a clear error and do not emit that version’s
mapping; preserve the existing output generation when all four values are
present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 3fee8ef6-9c0e-4c95-a3d5-64fac2bd5eb4
📒 Files selected for processing (2)
hack/override-ossm-images.shpkg/operator/controller/gatewayclass/istio_images.go
| --registry) | ||
| REGISTRY_OVERRIDE="$2" | ||
| shift 2 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Require a value after --registry.
With set -u, invoking --registry without a following value exits with an unhelpful unbound-variable error instead of usage guidance.
Proposed fix
--registry)
+ if [[ $# -lt 2 || "$2" == --* ]]; then
+ echo "error: --registry requires a registry hostname"
+ exit 1
+ fi
REGISTRY_OVERRIDE="$2"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/override-ossm-images.sh` around lines 29 - 31, Update the --registry
option handling in the argument parser to validate that a following value exists
before reading $2, and otherwise print usage guidance and exit cleanly. Preserve
assigning the provided value to REGISTRY_OVERRIDE and shifting both arguments
when valid.
| # If a registry override is set, replace the registry prefix | ||
| if [[ -n "${REGISTRY}" ]]; then | ||
| image="${image/registry.redhat.io/${REGISTRY}}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Validate the registry before generating Go source.
--registry is written into quoted Go string literals. A value containing quotes or newlines can corrupt or inject generated source. Restrict it to a registry hostname (optionally with port) before rewriting images.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/override-ossm-images.sh` around lines 118 - 120, Validate REGISTRY
before the image-rewriting logic in the override script, allowing only a
registry hostname with an optional port and rejecting quotes, newlines, and
other characters unsafe in generated Go string literals. Continue replacing the
registry prefix only after validation succeeds.
Bump OSSM version to 3.4.1 and Istio version to v1.30-latest. Override vendored images with downstream registry.redhat.io digests from the OSSM 3.4.1 pre-release IIB. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Switch from the release-3.4.0-nid branch to the official release-3.4 branch. The fixes that required the -nid branch (lifecycle mutex fix istio-ecosystem#2160 and TLS cipher suite support istio-ecosystem#2048) have landed on release-3.4. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Revert to v1.30.1 until the v1.30.3 issue is resolved. This should be changed back to v1.30-latest once OSSM 3.4.1 ships with a working v1.30.3. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
IIB images (registry-proxy.engineering.redhat.com) contain pre-release bundles whose image references point to registry.redhat.io, but the images aren't published there until GA. Automatically use registry.stage.redhat.io when an IIB catalog is detected. Also adds --registry flag for explicit override. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
openshift-ci
Bot
removed
the
needs-rebase
|
/pipeline required |
|
Scheduling tests matching the |
|
@gcs278: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
2 participants
Summary
Pre-release testing for OSSM 3.4.1. Using
v1.30-latestto confirm that thePILOT_ENABLE_GATEWAY_API_CA_CERT_ONLYregression is fixed — OSSM 3.4.0 dropped the carry patch that scopes CA root cert configmap creation to Gateway namespaces, causing theClusterResourceQuotae2e test to fail (OCPBUGS-54884).Changes
v1.28-latesttov1.30-latestregistry.redhat.iodigests from the OSSM 3.4.1 pre-release IIBhack/override-ossm-images.shfor generating image overridesRegression being validated
The
PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLYenv var was carried on OSSM release-1.28 but not carried forward to release-1.30.1. The gateway_ca_controller.go file exists on 1.30.1 but is dead code — the feature flag and bootstrap wiring were not carried over.🤖 Generated with Claude Code