OCPBUGS-83863: Remove rhel8 build stage, strip debug info

[sdodson]

Remove the rhel8 build stage and strip debug symbols from binaries.

The rhel9/rhel10 version-specific subdirectories are no longer needed
since openshift/cluster-network-operator#2967 removed the OS detection
logic and now copies binaries directly from the base directory.

Summary by CodeRabbit

• Chores
  • Consolidated the container build to a single builder stage for simpler, more maintainable images.
  • Unified runtime binary placement to a single location with compatibility symlinks for consistent deployments.
  • Optimized compilation to strip symbol/debug information, reducing binary and image size and improving startup performance.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@sdodson: This pull request references Jira Issue OCPBUGS-83863, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Remove the rhel8 builder stage and its COPY — rhel8 builds are no longer needed.
• Replace the duplicate COPY for the rhel9 binary with a hardlink so /bondcni/bond and /bondcni/rhel9/bond share the same inode, reducing image layer size.
• Add a /bondcni/rhel10/bond hardlink to the rhel9-built binary, since the statically linked Go binary is compatible with rhel10.

Test plan

• Verify the image builds successfully with podman build -f Dockerfile.openshift .
• Confirm /bondcni/bond, /bondcni/rhel9/bond, and /bondcni/rhel10/bond all exist and share the same inode
• Confirm /bondcni/rhel8/bond no longer exists in the built image

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Dockerfile.openshift consolidates the final image to one /bondcni/bond (with rhel9/rhel10 symlinks) and switches the base to ocp/4.21:base-rhel9. build.sh now builds bond with linker flags -ldflags '-s -w' to produce a stripped ./bin/bond.

Changes

Image + build changes

Layer / File(s)	Summary
Runtime image copy target updated Dockerfile.openshift	Final runtime stage base changed to ocp/4.21:base-rhel9; final image copies bond only to /bondcni/bond and creates /bondcni/rhel9/bond and /bondcni/rhel10/bond symlinks; previous rhel8/rhel9 direct copies were removed.
Build invocation adds linker flags build.sh	go build for bond now includes -ldflags '-s -w', producing a stripped binary at ./bin/bond; --mod=vendor and output path remain unchanged.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• openshift/bond-cni#117: Related Dockerfile.openshift changes touching base image tags and bond binary placement.

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the two main changes: removing the rhel8 build stage and stripping debug info from binaries.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	All Ginkgo test names in the repository are static and deterministic with no dynamic content, generated identifiers, or values that change between test runs.
Test Structure And Quality	✅ Passed	PR modifies only Dockerfile.openshift and build.sh; no Ginkgo test files are added or modified, making the test structure check not applicable.
Microshift Test Compatibility	✅ Passed	PR does not add new Ginkgo e2e tests. Changes are only to Dockerfile.openshift and build.sh (build configuration files). No test code is modified.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only modifies Dockerfile.openshift and build.sh for build configuration and binary optimization. No new Ginkgo e2e tests are being added, so SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only Dockerfile.openshift and build.sh (build infrastructure). No deployment manifests, operator code, or controllers are added or modified.
Ote Binary Stdout Contract	✅ Passed	PR adds build strip flags and Dockerfile changes only; no stdout writes introduced. Bond-cni is a CNI plugin, not an OTE binary, so check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR contains only infrastructure changes (Dockerfile.openshift, build.sh) with no new Ginkgo e2e tests. IPv6/disconnected network check does not apply.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch OCPBUGS-83863-remove-rhel8-add-rhel10

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Dockerfile.openshift`:
- Around line 12-14: Combine the two hardlink commands into a single RUN layer
so the links share the same inode instead of being duplicated across layers:
update the Dockerfile so one RUN creates both directories and performs both ln
operations (referencing the existing /bondcni/bond and target paths
/bondcni/rhel9/bond and /bondcni/rhel10/bond) in the same shell invocation,
ensuring mkdir -p for /bondcni/rhel9 and /bondcni/rhel10 and then creating both
hardlinks with ln so deduplication is preserved.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9cf49389-60f4-4f6e-bb06-203698fa1129

📥 Commits

Reviewing files that changed from the base of the PR and between 297eeb4 and 0fad46d.

📒 Files selected for processing (1)

• Dockerfile.openshift

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sdodson
Once this PR has been reviewed and has the lgtm label, please assign schseba for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sdodson]

/retest-required

[openshift-ci]

@sdodson: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[karampok]

thanks! Can you please have a single commit that starts with "Openshift Only".

[karampok]

The build.sh is planned to be removed since is single line and if changed we should be change upstream (https://github.com/k8snetworkplumbingwg/bond-cni).
So for this PR can you make no changes here and simply replace the RUN ./build.sh in the Dockerfile.openshift instead?