-
Notifications
You must be signed in to change notification settings - Fork 293
CORENET-7046: Bump Kubernetes to 1.36.1 and OCP to 5.0 #3017
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
miheer
wants to merge
1
commit into
openshift:master
Choose a base branch
from
miheer:CORENET-7046
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| build_root_image: | ||
| name: release | ||
| namespace: openshift | ||
| tag: rhel-9-release-golang-1.25-openshift-4.22 | ||
| # Keep CNO on the release build-root stream while moving to the Go 1.26/OCP 5.0 tag. | ||
| tag: rhel-9-release-golang-1.26-openshift-5.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| # Kubernetes 1.36.1 and OCP 5.0 bump | ||
|
|
||
| This update rebases cluster-network-operator onto Kubernetes 1.36.1 and the | ||
| OCP 5.0 build/runtime images. It follows the recent dependency-bump pattern in | ||
| the repository: update the Kubernetes modules, refresh related OpenShift and | ||
| controller dependencies, run `go mod tidy`, regenerate `vendor`, and run | ||
| codegen. | ||
|
|
||
| ## What changed | ||
|
|
||
| - `go.mod` now uses Go 1.26.0 because Kubernetes 1.36.1 modules require Go | ||
| 1.26 or newer. | ||
| - Kubernetes modules such as `k8s.io/api`, `k8s.io/apimachinery`, | ||
| `k8s.io/client-go`, `k8s.io/code-generator`, `k8s.io/component-base`, | ||
| `k8s.io/kube-proxy`, `k8s.io/apiextensions-apiserver`, `k8s.io/apiserver`, | ||
| and `k8s.io/kube-aggregator` were bumped to `v0.36.1`. | ||
| - OpenShift modules were refreshed without a `release-5.0` suffix for the | ||
| normal module queries, matching the newer 1.34/1.35 bump style. | ||
| `github.com/openshift/build-machinery-go`, `github.com/openshift/api`, and | ||
| `github.com/openshift/client-go` moved to newer pseudo-versions. | ||
| - `github.com/openshift/library-go` is temporarily replaced with | ||
| `github.com/jubittajohn/library-go` at the head of | ||
| `openshift/library-go#2171`, because that PR carries the Kubernetes 1.36 fake | ||
| informer compatibility and Go 1.26 vet fixes needed by this bump. | ||
| - `github.com/openshift/machine-config-operator` did not move because the | ||
| normal module query did not resolve a newer compatible version. | ||
| - `Dockerfile` now uses the Go 1.26/OCP 5.0 builder and OCP 5.0 runtime base. | ||
| - `.ci-operator.yaml` uses the in-repository `build_root_image` shape expected | ||
| by CNO's CI loader, with | ||
| `openshift/release:rhel-9-release-golang-1.26-openshift-5.0`. That keeps CNO | ||
| on the same release build-root stream shape it used before, while matching the | ||
| Go 1.26/OCP 5.0 tag pattern found in `openshift/release` for | ||
| `osac-project/fulfillment-service`. | ||
| - `vendor` and generated CRD output were refreshed. The PKI CRD annotation now | ||
| reflects controller-gen `v0.21.0`. | ||
|
|
||
| ## Controller-gen build path | ||
|
|
||
| The codegen script remains on the original vendor-mode build: | ||
|
|
||
| ```sh | ||
| GO111MODULE=on GOFLAGS=-mod=vendor go build -tags=tools -o _output/bin/controller-gen sigs.k8s.io/controller-tools/cmd/controller-gen | ||
| ``` | ||
|
|
||
| During the first run this failed because codegen was attempted before the final | ||
| `go mod vendor` result was available. After regenerating `vendor`, the same | ||
| vendor-mode command builds successfully, so the script does not need to switch | ||
| to module mode. | ||
|
|
||
| ## Compatibility patch | ||
|
|
||
| Kubernetes 1.36 added `HasSyncedChecker()` to the `cache.SharedIndexInformer` | ||
| interface. The current upstream `openshift/library-go` `master`, `release-5.0`, | ||
| and `release-5.1` refs all point at a revision that does not yet implement that | ||
| method in its fake informer. | ||
|
|
||
| CI's `verify-deps` job rejects direct edits under `vendor/` because it runs | ||
| `go mod tidy; go mod vendor` and expects no diff. To keep vendor generated-only, | ||
| this update uses `openshift/library-go#2171` through a `replace` directive: | ||
| `github.com/openshift/library-go => github.com/jubittajohn/library-go | ||
| v0.0.0-20260529005742-3c9df83aa03b`. `go mod vendor` then copies that PR state | ||
| into `vendor`, so dependency verification can reproduce the checked-in vendor | ||
| tree. | ||
|
|
||
| ## Validation | ||
|
|
||
| - `hack/update-codegen.sh` ran successfully after the final vendor refresh. | ||
| - `make build` passed. | ||
| - `make test` passed. | ||
| - `make verify` can still require local tool bootstrap retries on Darwin arm64 | ||
| when GitHub downloads are interrupted. Those local bootstrap workarounds are | ||
| intentionally not committed under `vendor/` because `verify-deps` would reject | ||
| hand-edited vendored files. | ||
| - After the dependency fix, local `make verify` reaches the final | ||
| `git diff --exit-code`. | ||
| That final step fails while the bump is still uncommitted because the working | ||
| tree intentionally contains this patch. In CI, the patch is already checked | ||
| out as the baseline, so this step only fails if verify/codegen produces | ||
| additional uncommitted changes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/cluster-network-operator
Length of output: 306
🏁 Script executed:
Repository: openshift/cluster-network-operator
Length of output: 3252
Flag vulnerable Go dependency: bump
github.com/containernetworking/cni v0.8.0In
go.mod, the dependencygithub.com/containernetworking/cni v0.8.0is affected by OSV advisories GHSA-xjqr-g762-pxwp and GO-2022-0230; OSV indicates the fix isv0.8.1.Please bump to
github.com/containernetworking/cni v0.8.1(or newer) and regeneratevendor/updatego.sum(e.g., viago mod tidy+go mod vendor).🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 8-8: github.com/containernetworking/cni 0.8.0: Improper limitation of path name in github.com/containernetworking/cni
(GO-2022-0230)
[HIGH] 8-8: github.com/containernetworking/cni 0.8.0: containernetworking/cni improper limitation of path name
(GHSA-xjqr-g762-pxwp)
🤖 Prompt for AI Agents