Skip to content

Automated rebase to K8s 1.36.2 #305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dfarrell07 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Automated rebase to K8s 1.36.2 #305

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9d3ac3c
Rebase multus-cni to k8s 1.36
dfarrell07 Jun 28, 2026
2c23036
Update version references for k8s 1.36
dfarrell07 Jun 28, 2026
71e707a
Fix Eventf vet errors for k8s 1.36 compatibility
dfarrell07 Jun 28, 2026
8f9a283
Disable new default-true feature gates for k8s 1.36
dfarrell07 Jun 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .ci-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
build_root_image:
name: release
namespace: openshift
tag: rhel-9-release-golang-1.25-openshift-4.22
tag: rhel-9-release-golang-1.26-openshift-5.0
2 changes: 1 addition & 1 deletion .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ jobs:
build:
strategy:
matrix:
go-version: [1.25.x]
go-version: [1.26.x]
goarch: [386, amd64, arm, arm64, ppc64le, s390x]
os: [ubuntu-latest] #, macos-latest, windows-latest]
runs-on: ${{ matrix.os }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: 1.25.x
go-version: 1.26.x

- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v5
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ jobs:
test:
strategy:
matrix:
go-version: [1.25.x]
go-version: [1.26.x]
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
steps:
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile.microshift
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# This dockerfile is specific to building Multus for MicroShift
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS rhel9
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS rhel9

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Search for other Dockerfiles to check if registry.ci.openshift.org is a standard pattern in this repository

# Check all Dockerfiles for base image registries
echo "=== Checking base image registries in all Dockerfiles ==="
rg -n "^FROM " -g "Dockerfile*" -C 1

Repository: openshift/multus-cni

Length of output: 2548

🏁 Script executed:

#!/bin/bash
set -euo pipefail
# Show FROM lines with context for Dockerfile.microshift
echo "=== Dockerfile.microshift FROM lines ==="
nl -ba Dockerfile.microshift | sed -n '1,160p' | rg -n "^( *[0-9]+\\s+)FROM|^( *[0-9]+\\s+)ARG|^( *[0-9]+\\s+)HEALTHCHECK|^( *[0-9]+\\s+)USER" || true

echo
echo "=== All Dockerfile.* FROM lines (repo-local) ==="
for f in $(fd -t f 'Dockerfile*' .); do
  if rg -q '^FROM ' "$f"; then
    echo "--- $f ---"
    nl -ba "$f" | rg 'FROM ' | head -n 5
  fi
done | head -n 200

Repository: openshift/multus-cni

Length of output: 288

🏁 Script executed:

#!/bin/bash
set -euo pipefail
# Show FROM lines with context for Dockerfile.microshift
echo "=== Dockerfile.microshift FROM lines ==="
nl -ba Dockerfile.microshift | sed -n '1,160p' | rg -n "^( *[0-9]+\\s+)FROM|^( *[0-9]+\\s+)ARG|^( *[0-9]+\\s+)HEALTHCHECK|^( *[0-9]+\\s+)USER" || true

echo
echo "=== All Dockerfile* FROM lines (first few matches) ==="
fd -t f 'Dockerfile*' . | while read -r f; do
  if rg -q '^FROM ' "$f"; then
    echo "--- $f ---"
    nl -ba "$f" | rg 'FROM ' | head -n 8
  fi
done | head -n 250

Repository: openshift/multus-cni

Length of output: 294

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Dockerfile.microshift (lines 1-80) ==="
cat -n Dockerfile.microshift | sed -n '1,80p' | sed -n '/^\\s*[0-9]\\+\\s\\+FROM/p' || true
echo
echo "=== Dockerfile.microshift: all FROM lines (with numbers) ==="
cat -n Dockerfile.microshift | rg '^[[:space:]]*[0-9]+[[:space:]]+FROM ' || true

echo
echo "=== Base image registries across Dockerfile* (FROM lines only, first 20 matches each) ==="
fd -t f 'Dockerfile*' . | while read -r f; do
  if rg -q '^FROM ' "$f"; then
    echo "--- $f ---"
    rg '^FROM ' "$f" | head -n 20
  fi
done | head -n 250

Repository: openshift/multus-cni

Length of output: 1279

🌐 Web query:

prodsec-skills base image catalog.redhat.com registry.ci.openshift.org exempt OpenShift CI

💡 Result:

The terms in your query relate to distinct components of the Red Hat and OpenShift ecosystems. There is no singular documented "prodsec-skills base image catalog" that ties all these components together. Instead, they function as follows: 1. prodsec-skills: This refers to a repository by Red Hat Product Security designed for AI coding assistants and agentic systems, focusing on security skills for AI [1]. It is not a base image registry. 2. catalog.redhat.com: This is the official Red Hat Ecosystem Catalog, which serves as the authoritative source for certified container images, operators, and other software [https://catalog.redhat.com]. 3. registry.ci.openshift.org: This is a CI-specific internal image registry used by the OpenShift CI system (often referred to as 'app.ci'). It hosts images required for CI build and test processes, including "builder" images used for compiling components [2][3]. Images here are typically mirrored from authorized sources and are not intended for general production use by external consumers [3]. 4. Exemption in OpenShift CI: OpenShift CI utilizes configuration files (e.g., in the openshift/release repository) to manage image mirroring and CI operations [4][3]. There is no standard "exemption" mechanism for bypassing security policies in the CI registry itself in the way one might exempt a workload from a runtime policy (like UDS/Kyverno) [5]. If an image is needed in CI that is not currently present, the standard process is to mirror it to the central CI registry (QCI) by submitting a configuration change to the openshift/release repository [4][3]. If you are attempting to secure a build process or integrate AI agent skills, the recommended approach is to use certified base images from catalog.redhat.com and follow the official OpenShift CI documentation for image management, rather than seeking a cross-platform exemption [2][4].

Citations:

Fix base image registry compliance in Dockerfile.microshift.

Container security guidelines require base images to come from catalog.redhat.com (UBI minimal or distroless). Dockerfile.microshift instead uses registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 (line 2) and registry.ci.openshift.org/ocp/4.22:base-rhel9 (line 11). There’s no documented exemption for using the OpenShift CI registry for this requirement.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.microshift` at line 2, The Dockerfile.microshift uses CI registry
base images
("registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0" and
"registry.ci.openshift.org/ocp/4.22:base-rhel9"); replace both FROM lines to use
the approved Red Hat catalog images (e.g., catalog.redhat.com UBI minimal or an
appropriate distroless image) so they comply with container security guidelines,
updating tags to the matching RHEL/Go versions and verifying the resulting image
works with the existing build steps in Dockerfile.microshift.

Source: Coding guidelines

ADD . /usr/src/multus-cni
WORKDIR /usr/src/multus-cni
ENV CGO_ENABLED=1
Expand All @@ -8,7 +8,7 @@ ENV VERSION=rhel9 COMMIT=unset
RUN ./hack/build-go.sh
WORKDIR /

FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
RUN dnf install -y util-linux && dnf clean all && \
mkdir -p /usr/src/multus-cni/bin
COPY --from=rhel9 \
Expand Down
8 changes: 4 additions & 4 deletions Dockerfile.openshift
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# This dockerfile is specific to building Multus for OpenShift
# rhel10 golang builders don't exist yet, so use rhel9 for now
# replace with rhel10 golang builder when it is released
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS rhel10
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS rhel10
ADD . /usr/src/multus-cni
WORKDIR /usr/src/multus-cni
ENV CGO_ENABLED=1
Expand All @@ -11,7 +11,7 @@ RUN ./hack/build-go.sh && \
cd /usr/src/multus-cni/bin
WORKDIR /

FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS rhel9
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS rhel9
ADD . /usr/src/multus-cni
WORKDIR /usr/src/multus-cni
ENV CGO_ENABLED=1
Expand All @@ -21,7 +21,7 @@ RUN ./hack/build-go.sh && \
cd /usr/src/multus-cni/bin
WORKDIR /

FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.25-openshift-4.22 AS rhel8
FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.26-openshift-5.0 AS rhel8
ADD . /usr/src/multus-cni
WORKDIR /usr/src/multus-cni
ENV CGO_ENABLED=1
Expand All @@ -31,7 +31,7 @@ RUN ./hack/build-go.sh && \
cd /usr/src/multus-cni/bin
WORKDIR /

FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
RUN dnf install -y util-linux && dnf clean all && \
mkdir -p /usr/src/multus-cni/images && \
mkdir -p /usr/src/multus-cni/bin && \
Expand Down
2 changes: 1 addition & 1 deletion cmd/cert-approver/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,7 +338,7 @@ func (c *CertController) denyCSR(ctx context.Context, csr *certificatesv1.Certif
},
)

c.recorder.Eventf(csr, corev1.EventTypeWarning, "CSRDenied", "The CSR %q has been denied by: %s", csr.Name, ControllerName, message)
c.recorder.Eventf(csr, corev1.EventTypeWarning, "CSRDenied", "The CSR %q has been denied by %s: %s", csr.Name, ControllerName, message)
_, err := c.clientset.CertificatesV1().CertificateSigningRequests().Update(ctx, csr, metav1.UpdateOptions{})
return err
}
Expand Down
60 changes: 34 additions & 26 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module gopkg.in/k8snetworkplumbingwg/multus-cni.v4

go 1.25.7
go 1.26.0

require (
github.com/blang/semver v3.5.1+incompatible
Expand All @@ -11,66 +11,74 @@ require (
github.com/onsi/ginkgo/v2 v2.27.2
github.com/onsi/gomega v1.38.2
github.com/prometheus/client_golang v1.23.2
github.com/spf13/pflag v1.0.9
github.com/spf13/pflag v1.0.10
github.com/vishvananda/netlink v1.3.1
golang.org/x/net v0.48.0
golang.org/x/sys v0.39.0
golang.org/x/net v0.50.0
golang.org/x/sys v0.41.0
google.golang.org/grpc v1.79.3
gopkg.in/natefinch/lumberjack.v2 v2.2.1
k8s.io/api v0.35.2
k8s.io/apimachinery v0.35.2
k8s.io/client-go v0.35.2
k8s.io/api v0.36.2
k8s.io/apimachinery v0.36.2
k8s.io/client-go v0.36.2
k8s.io/klog v1.0.0
k8s.io/klog/v2 v2.140.0
k8s.io/kubelet v0.35.2
k8s.io/kubelet v0.36.2
)

require (
github.com/Masterminds/semver/v3 v3.4.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.66.1 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/vishvananda/netns v0.0.5 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/mod v0.30.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/term v0.38.0 // indirect
golang.org/x/text v0.32.0 // indirect
golang.org/x/time v0.9.0 // indirect
golang.org/x/tools v0.39.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/protobuf v1.36.10 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.34.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.42.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
k8s.io/kube-openapi v0.0.0-20260624041617-8f3fa4921821 // indirect
k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
Loading