OCPBUGS-77610: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22#503
Conversation
|
Created by ART pipeline job run https://art-jenkins.apps.prod-stable-spoke1-dc-iad2.itup.redhat.com/job/scheduled-builds/job/sync-ci-images/49471 |
openshift-bot
added
jira/valid-bug
openshift-bot
changed the title
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-77610, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-bot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-77610, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-77610, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-bot: An error was encountered searching for bug OCPBUGS-77610 on the Jira server at https://issues.redhat.com. No known errors were detected, please see the full error message for details. Full error message.
No response returned: Get "https://issues.redhat.com/rest/api/2/issue/OCPBUGS-77610": GET https://issues.redhat.com/rest/api/2/issue/OCPBUGS-77610 giving up after 5 attempt(s)
Please contact an administrator to resolve this issue, then request a bug refresh with DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-77610, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-77610, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-bot
force-pushed
the
art-consistency-openshift-4.22-openshift-enterprise-builder
branch
from
1b17911 to
1ae004b
Compare
openshift-ci-robot
removed
the
verified
WalkthroughThe pull request updates the Go toolchain version from 1.24 to 1.25 across the build configuration and Docker image definitions. This affects both the CI operator configuration for the root build image and the Dockerfile for the builder stage. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
Dockerfile.rhel8 (1)
1-41: Consider security: Container runs as root user.Static analysis flagged that this container does not specify a non-root USER. While this may be intentional for a builder image that requires elevated privileges, consider whether certain operations could be performed as a non-root user to reduce the attack surface.
Note: This is a pre-existing configuration, not introduced by the current Go version update. If root access is required for the build and container runtime operations, document this requirement and ensure appropriate security controls are in place when deploying this image.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.rhel8` around lines 1 - 41, The container runs as root (no USER set) which increases risk; decide whether root is truly required for the builder and either (A) add a non-root user and switch to it (create a user/group, chown runtime directories like /var/cache/blobs, /var/lib/shared, /etc/pki/tls/certs and set USER before ENTRYPOINT so openshift-builder runs unprivileged) or (B) if root is required, add explicit documentation and labels/comments near ENTRYPOINT/openshift-builder explaining why root is needed and what external mitigations (podSecurityContext, SCC, RBAC) must be applied; update Dockerfile entries that set permissions (chmod/ln) to run as root in build stage but ensure final image switches to the non-root USER when possible (refer to ENTRYPOINT, openshift-builder binary and the directories created earlier).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.ci-operator.yaml:
- Line 4: The repo's CI is set to Go 1.25 but go.mod still declares an older Go
version; update the module's Go directive in go.mod to "1.25" (and adjust any
explicit toolchain or go version comments in go.mod or related configuration) so
the module and CI match, or if you intend to test forward-compatibility, add a
brief comment in go.mod or the repo README clarifying that go.mod intentionally
targets 1.22.x while CI uses 1.25; locate and edit the "go" directive in go.mod
to make the change.
In `@Dockerfile.rhel8`:
- Line 1: The Dockerfile's builder image uses Go 1.25 but go.mod declares go
1.22.8 (with toolchain go1.23.1); update the FROM line (the image reference
starting with
registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22) to a
builder image that matches the declared Go version (e.g., change the tag to
rhel-9-golang-1.22-openshift-4.22 or another official image aligning with go
1.22.8 / toolchain go1.23.1) so the build environment matches go.mod.
---
Nitpick comments:
In `@Dockerfile.rhel8`:
- Around line 1-41: The container runs as root (no USER set) which increases
risk; decide whether root is truly required for the builder and either (A) add a
non-root user and switch to it (create a user/group, chown runtime directories
like /var/cache/blobs, /var/lib/shared, /etc/pki/tls/certs and set USER before
ENTRYPOINT so openshift-builder runs unprivileged) or (B) if root is required,
add explicit documentation and labels/comments near ENTRYPOINT/openshift-builder
explaining why root is needed and what external mitigations (podSecurityContext,
SCC, RBAC) must be applied; update Dockerfile entries that set permissions
(chmod/ln) to run as root in build stage but ensure final image switches to the
non-root USER when possible (refer to ENTRYPOINT, openshift-builder binary and
the directories created earlier).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1c8ef371-bbf1-4b5b-bb74-7984ce8affee
📒 Files selected for processing (2)
.ci-operator.yamlDockerfile.rhel8
| name: release | ||
| namespace: openshift | ||
| tag: rhel-9-release-golang-1.24-openshift-4.22 | ||
| tag: rhel-9-release-golang-1.25-openshift-4.22 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify Go 1.25 exists and check for breaking changes
# Check if the image exists in the registry
echo "=== Checking if rhel-9-release-golang-1.25-openshift-4.22 exists ==="
oc image info registry.ci.openshift.org/ocp/release:rhel-9-release-golang-1.25-openshift-4.22 || echo "Image not found in registry"
# Search for Go version requirements in go.mod files
echo -e "\n=== Checking go.mod for Go version constraints ==="
fd -e mod -x cat {} \;
# Check for any Go 1.24 specific code or comments that might need updating
echo -e "\n=== Searching for Go 1.24 references in code ==="
rg -i "go.?1\.24" --type=go -C2 || echo "No Go 1.24 references found"
# Look for compatibility notes or upgrade documentation
echo -e "\n=== Checking for Go upgrade documentation ==="
fd -e md -e txt | xargs rg -l "golang.*upgrade|go.*version" || echo "No upgrade documentation found"Repository: openshift/builder
Length of output: 19451
🏁 Script executed:
#!/bin/bash
# Check if there are any other files that reference golang versions
# and whether go.mod needs to be updated
echo "=== Checking .ci-operator.yaml for context ==="
cat -n .ci-operator.yaml | head -20
echo -e "\n=== Checking if go.mod was modified in this PR ==="
git diff HEAD go.mod || echo "No go.mod changes in current commit"
echo -e "\n=== Searching for other golang version references ==="
rg "golang.?1\.(22|23|24|25)" -t yaml -t go --max-count=20Repository: openshift/builder
Length of output: 661
Update go.mod to match the CI Go 1.25 configuration, or clarify intent.
The CI environment is being configured for Go 1.25, but go.mod continues to specify go 1.22.8 with toolchain go1.23.1. Either update go.mod to reflect the new Go 1.25 requirement, or document if this is intentional forward-compatibility testing and should remain unchanged.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.ci-operator.yaml at line 4, The repo's CI is set to Go 1.25 but go.mod
still declares an older Go version; update the module's Go directive in go.mod
to "1.25" (and adjust any explicit toolchain or go version comments in go.mod or
related configuration) so the module and CI match, or if you intend to test
forward-compatibility, add a brief comment in go.mod or the repo README
clarifying that go.mod intentionally targets 1.22.x while CI uses 1.25; locate
and edit the "go" directive in go.mod to make the change.
| @@ -1,4 +1,4 @@ | |||
| FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22 AS builder | |||
| FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the builder image exists and check compatibility
# Check if the builder image exists in the registry
echo "=== Checking if rhel-9-golang-1.25-openshift-4.22 builder image exists ==="
oc image info registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 || echo "Builder image not found in registry"
# Check what Go version is currently expected by the codebase
echo -e "\n=== Checking for Go version in go.mod ==="
fd "go.mod" -x cat {} \;
# Search for any build scripts that might have Go version dependencies
echo -e "\n=== Checking build scripts for Go version references ==="
rg "go.?1\.\d+" hack/build.sh Makefile --no-filename -n || echo "No version references in build scripts"Repository: openshift/builder
Length of output: 13271
Update Go builder version in Dockerfile to match go.mod.
The Dockerfile specifies Go 1.25 in the builder image, but go.mod declares go 1.22.8 (with toolchain go1.23.1). Update the Dockerfile to use a builder image matching the declared Go version to ensure consistent builds and avoid compatibility issues.
🧰 Tools
🪛 Trivy (0.69.3)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile.rhel8` at line 1, The Dockerfile's builder image uses Go 1.25 but
go.mod declares go 1.22.8 (with toolchain go1.23.1); update the FROM line (the
image reference starting with
registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22) to a
builder image that matches the declared Go version (e.g., change the tag to
rhel-9-golang-1.22-openshift-4.22 or another official image aligning with go
1.22.8 / toolchain go1.23.1) so the build environment matches go.mod.
|
@openshift-bot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-bot
added
the
verified
3 participants
Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22
TLDR:
Product builds by ART can be configured for different base and builder images than corresponding CI
builds. This automated PR requests a change to CI configuration to align with ART's configuration;
please take steps to merge it quickly or contact ART to coordinate changes.
The configuration in the following ART component metadata is driving this alignment request:
openshift-enterprise-builder.yml.
Detail:
This repository is out of sync with the downstream product builds for this component. The CI
configuration for at least one image differs from ART's expected product configuration. This should
be addressed to ensure that the component's CI testing accurate reflects what customers will
experience.
Most of these PRs are opened as an ART-driven proposal to migrate base image or builder(s) to a
different version, usually prior to GA. The intent is to effect changes in both configurations
simultaneously without breaking either CI or ART builds, so usually ART builds are configured to
consider CI as canonical and attempt to match CI config until the PR merges to align both. ART may
also configure changes in GA releases with CI remaining canonical for a brief grace period to enable
CI to succeed and the alignment PR to merge. In either case, ART configuration will be made
canonical at some point (typically at branch-cut before GA or release dev-cut after GA), so it is
important to align CI configuration as soon as possible.
PRs are also triggered when CI configuration changes without ART coordination, for instance to
change the number of builder images or to use a different golang version. These changes should be
coordinated with ART; whether ART configuration is canonical or not, preferably it would be updated
first to enable the changes to occur simultaneously in both CI and ART at the same time. This also
gives ART a chance to validate the intended changes first. For instance, ART compiles most
components with the Golang version being used by the control plane for a given OpenShift release.
Exceptions to this convention (i.e. you believe your component must be compiled with a Golang
version independent from the control plane) must be granted by the OpenShift staff engineers and
communicated to the ART team.
Roles & Responsibilities:
tests OR that necessary metadata changes are reported to the ART team:
@release-artistsin
#forum-ocp-arton Slack. If necessary, the changes required by this pull request can beintroduced with a separate PR opened by the component team. Once the repository is aligned,
this PR will be closed automatically.
verify-depsis complaining. In that case, please opena new PR with the dependency issues addressed (and base images bumped). ART-9595 for reference.
any required labels to ensure the PR merges once tests are passing. In cases where ART config is
canonical, downstream builds are already being built with these changes, and merging this PR
only improves the fidelity of our CI. In cases where ART config is not canonical, this provides
a grace period for the component team to align their CI with ART's configuration before it becomes
canonical in product builds.
ART has been configured to reconcile your CI build root image (see https://docs.ci.openshift.org/docs/architecture/ci-operator/#build-root-image).
In order for your upstream .ci-operator.yaml configuration to be honored, you must set the following in your openshift/release ci-operator configuration file:
Change behavior of future PRs:
set up automatically. This means that such a PR would merge without human intervention (and awareness!) in the future.
To do so, open a PR to set the
auto_labelattribute in the image configuration. ExampleUPSTREAM: <carry>:. An example.If you have any questions about this pull request, please reach out to
@release-artistsin the#forum-ocp-artcoreos slack channel.