Skip to content

[SANDBOX-1700] chore: upgrade to OCP 4.21 dependencies#501

Open
metlos wants to merge 2 commits intocodeready-toolchain:masterfrom
metlos:upgrade-ocp-4.21
Open

[SANDBOX-1700] chore: upgrade to OCP 4.21 dependencies#501
metlos wants to merge 2 commits intocodeready-toolchain:masterfrom
metlos:upgrade-ocp-4.21

Conversation

@metlos
Copy link
Contributor

@metlos metlos commented Mar 17, 2026

Update openshift/api to release-4.21, k8s.io deps to v0.34.1, controller-runtime to v0.22.0, and controller-tools to v0.19.0.

https://redhat.atlassian.net/browse/SANDBOX-1700

Checks

  1. Did you run make generate target? no
    This would only change controller-gen.kubebuilder.io/version annotation to from 0.18.0 to 0.19.0. No actual changes to the CRDs.

  2. Did make generate change anything in other projects (host-operator, member-operator)? no
    See above

Summary by CodeRabbit

  • Chores
    • Updated core dependencies to newer releases for Kubernetes, OpenShift, controller-runtime, YAML and related tooling to improve compatibility, security, and alignment with upstream changes. No functional or public API changes were made.

Update openshift/api to release-4.21, k8s.io deps to v0.34.1,
controller-runtime to v0.22.0, and controller-tools to v0.19.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link

coderabbitai bot commented Mar 17, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3412bd87-41b1-4755-bb5a-c57256888438

📥 Commits

Reviewing files that changed from the base of the PR and between f94bc6f and 237e681.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • go.mod

Walkthrough

Updated Go module dependencies in go.mod: bumped Kubernetes (k8s.io/) to v0.34.1, updated OpenShift API pseudo-version, controller-runtime/tools, kube-openapi and many transitive/indirect modules (protobuf, yaml, structured-merge-diff, x/). No source code or API surface changes.

Changes

Cohort / File(s) Summary
Dependency Version Updates
go.mod
Comprehensive dependency bumps in go.mod: k8s.io/api, k8s.io/apimachinery, k8s.io/code-generator → v0.34.1; openshift/api → newer pseudo-version; controller-runtime/controller-tools, kube-openapi replacements; updates to indirects (protobuf, yaml v3, structured-merge-diff v6, x/* packages, and other transitive modules). No code changes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically identifies the main change: upgrading to OCP 4.21 dependencies, which aligns with the go.mod updates.
Description check ✅ Passed The description covers the key dependency updates and addresses most required template checks, but check #2 is missing and check #4 is not applicable since no new CRDs were added.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
go.mod (1)

3-5: ⚠️ Potential issue | 🟡 Minor

Document the toolchain version intent if it diverges from CI expectations.

The go 1.24.4 declaration will be used by CI workflows (actions/setup-go reads the go directive), while the toolchain go1.24.13 suggestion only applies locally if toolchain auto-selection is enabled. This creates a potential build environment inconsistency: developers may build and test with Go 1.24.13 while CI validates with Go 1.24.4. If this is intentional for reproducibility/standardization, document it; if unintentional, align the versions.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 3 - 5, The go.mod declares "go 1.24.4" while the
toolchain line is "toolchain go1.24.13", causing CI vs local toolchain mismatch;
either make them identical (update "go 1.24.4" to "go 1.24.13" or change
"toolchain go1.24.13" to match 1.24.4) or add a short comment in the repo README
or a new TOOLCHAIN.md explaining the intentional divergence and which version CI
(go directive) and local toolchain (toolchain directive) should use; update the
go.mod and documentation consistently and mention the authoritative source (CI
uses the go directive).
🧹 Nitpick comments (1)
go.mod (1)

9-10: Update the OpenShift branch comment to match the actual upgrade target.

The inline comment says release-4.20 while this PR upgrades to OCP 4.21 and bumps github.com/openshift/api accordingly. Keeping this stale comment will mislead future dependency updates.

As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 9 - 10, Update the inline comment above the
github.com/openshift/api dependency in go.mod so it reflects the actual target
branch release-4.21 (instead of stale release-4.20) to match the bumped
dependency version; locate the comment near the github.com/openshift/api
v0.0.0-20260304172252-b0658d22beea entry and change the branch name text to
release-4.21.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@go.mod`:
- Around line 3-5: The go.mod declares "go 1.24.4" while the toolchain line is
"toolchain go1.24.13", causing CI vs local toolchain mismatch; either make them
identical (update "go 1.24.4" to "go 1.24.13" or change "toolchain go1.24.13" to
match 1.24.4) or add a short comment in the repo README or a new TOOLCHAIN.md
explaining the intentional divergence and which version CI (go directive) and
local toolchain (toolchain directive) should use; update the go.mod and
documentation consistently and mention the authoritative source (CI uses the go
directive).

---

Nitpick comments:
In `@go.mod`:
- Around line 9-10: Update the inline comment above the github.com/openshift/api
dependency in go.mod so it reflects the actual target branch release-4.21
(instead of stale release-4.20) to match the bumped dependency version; locate
the comment near the github.com/openshift/api v0.0.0-20260304172252-b0658d22beea
entry and change the branch name text to release-4.21.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d0eebf58-f13f-4c9d-95ae-d5753bc60056

📥 Commits

Reviewing files that changed from the base of the PR and between 4ff0e6b and f94bc6f.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • go.mod

@@ -7,54 +7,56 @@ toolchain go1.24.13
require (
github.com/go-bindata/go-bindata v3.1.2+incompatible
// using latest commit from 'github.com/openshift/api branch release-4.20'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// using latest commit from 'github.com/openshift/api branch release-4.20'
// using latest commit from 'github.com/openshift/api branch release-4.21'

@sonarqubecloud
Copy link

Comment on lines +11 to +13
k8s.io/api v0.34.1
k8s.io/apimachinery v0.34.1
k8s.io/code-generator v0.34.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

out of curiosity, why not using v0.34.4 version?
Also these seems to be a mismatch between this repo and the other ones. I know that it's a z-stream, so it should be just a detail, but let's try to keep it consistent

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 regarding keeping the same version in each repo

However, I have a concern. Openshift 4.21 uses k8s 1.34 but operator-sdk latest tag 1.42.1 still uses 1.33.

According to Kanika's guideline:

In the case that the Kubernetes version is not the same in the above two projects, then either use the smaller version of the two in which case the dependencies may not be the most up to date or wait for a version of the project that both support the same Kubernetes version.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep, I noticed this, too. Should be fixed now and everything should be using the exact versions as the versions in OCP 4.21. That uses k8s* v0.34.1, so I wanted to be exact to limit the possibility of surprise.

sigs.k8s.io/controller-runtime v0.21.0
sigs.k8s.io/controller-tools v0.18.0
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
sigs.k8s.io/controller-runtime v0.22.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you "pick" this version? (Asking for learning purposes, I usually align with operator-sdk)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants