OCPCLOUD-3327: Rewrite manifests-gen to support upgrade safety #434
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
📝 WalkthroughWalkthroughThe changes add provider image metadata support by threading provider image data through the operator's reconciliation pipeline. Core additions include a new Changes
Sequence Diagram(s)sequenceDiagram
participant Operator as Cluster CAPI Operator
participant K8s as Kubernetes API
participant Registry as Container Registry
participant Disk as Local Disk Cache
participant Reconciler as CAPI Installer<br/>Reconciler
Operator->>K8s: Read pull-secret from openshift-config
K8s-->>Operator: Pull secret credentials
Operator->>Registry: Fetch provider image<br/>(with keychain auth)
Registry-->>Operator: Image layers (tar.gz)
Operator->>Operator: Extract metadata.yaml &<br/>manifests.yaml from layers
Operator->>Disk: Write manifests to<br/>providerImageDir/<sanitized-ref>/
Operator->>Operator: Compute SHA256<br/>ContentID
Operator->>Reconciler: Inject ProviderImages[]<br/>with metadata & path
Reconciler->>Disk: Read provider manifests<br/>from cache
Reconciler->>K8s: Apply manifests to cluster
K8s-->>Reconciler: Resources created/updated
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
Comment |
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
mdbooth
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@mdbooth: This pull request references OCPCLOUD-3327 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test e2e-aws-ovn-techpreview |
|
/testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 |
mdbooth
force-pushed
the
manifests-gen
branch
from
1ab7f33 to
5087e3b
Compare
|
/testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 |
|
/test e2e-aws-ovn-techpreview |
openshift-merge-robot
added
the
needs-rebase
mdbooth
force-pushed
the
manifests-gen
branch
from
dab2c52 to
7c0b761
Compare
openshift-merge-robot
removed
the
needs-rebase
mdbooth
force-pushed
the
manifests-gen
branch
3 times, most recently
from
f3ba06c to
a8a93e3
Compare
|
/test e2e-aws-ovn-techpreview |
|
/test e2e-aws-ovn-techpreview |
|
/testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 openshift/cluster-api#259 |
2 similar comments
|
/testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 openshift/cluster-api#259 |
|
/testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 openshift/cluster-api#259 |
|
The e2e-aws-ovn-techpreview pass shows the modifications to the capiinstaller controller are backwards compatible with current transport configmaps. openshift/cluster-api-provider-aws#584 and openshift/cluster-api#259 update CAPA and core CAPI to publish manifests only in the provider images. They do not publish transport configmaps. The multi-pr test pass with these 2 PRs shows that pulling manifests from images is working. |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@mdbooth: This pull request references OCPCLOUD-3327 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
manifests-gen/go.mod (1)
19-25: Consolidate require blocks for Go convention.The code uses two separate
requireblocks (lines 7–17 and 19–25). While technically valid in Go 1.17+, it's unconventional. Most Go projects consolidate all direct dependencies into a single require block for clarity and maintainability.🔎 Proposed consolidation
require ( github.com/cert-manager/cert-manager v1.18.2 k8s.io/api v0.34.1 k8s.io/apiextensions-apiserver v0.34.1 k8s.io/apimachinery v0.34.1 k8s.io/client-go v0.34.1 // Update kustomize when updating k8s sigs.k8s.io/kustomize/api v0.20.1 sigs.k8s.io/kustomize/kyaml v0.20.1 sigs.k8s.io/yaml v1.6.0 + github.com/google/go-containerregistry v0.20.7 + github.com/openshift/api v0.0.0-20251214014457-bfa868a22401 + k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d + sigs.k8s.io/controller-runtime v0.22.4 ) - -require ( - github.com/google/go-containerregistry v0.20.7 - github.com/openshift/api v0.0.0-20251214014457-bfa868a22401 - github.com/openshift/cluster-capi-operator v0.0.0-00010101000000-000000000000 - k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d - sigs.k8s.io/controller-runtime v0.22.4 -)Note:
github.com/openshift/cluster-capi-operatorshould remain in the replace block (not in require) since it's satisfied by the relative replace directive.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (274)
e2e/go.sumis excluded by!**/*.sumhack/tools/go.sumis excluded by!**/*.sumvendor/github.com/MakeNowJust/heredoc/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/heredoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/PATENTSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/ocb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/write.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/base_dirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/codecov.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/config_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/userdirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/xdg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/conv/conv.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/hashes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/keccakf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/rc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/shake.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fuzzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/integer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/power.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/primes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/wnaf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/modular.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/mult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/tables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/sign.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CODE-OF-CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/GOVERNANCE.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/MAINTAINERSis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/distribution-logo.svgis excluded by!**/*.svg,!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/normalize.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/reference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/regexp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/sort.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/client.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/command.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/and/and_closer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/gzip/zip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/redact/redact.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/wait/kubernetes_apimachinery_wait.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/verify/verify.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/zstd/zstd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/anon.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/auth.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/authn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/basic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/bearer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/keychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/multikeychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/logs/logs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/digest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/ref.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/repository.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/tag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/layer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/match/match.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/uncompressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/with.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/platform.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/progress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/catalog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/delete.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/descriptor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (3)
e2e/go.modhack/tools/go.modmanifests-gen/go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
- hack/tools/go.mod
🔇 Additional comments (5)
manifests-gen/go.mod (2)
20-20: Verify container image registry dependencies are acceptable.The dependencies on
google/go-containerregistry v0.20.7(the latest available version) introduce transitive dependencies:docker/cli,docker/distribution,docker/docker-credential-helpers,containerd/stargz-snapshotter/estargz,opencontainers/image-spec, and container-related utilities. No known security advisories exist for v0.20.7.Confirm that:
- The binary size impact is acceptable for your use case.
- Security scanning is in place for these dependencies.
- These dependencies align with the provider image feature scope.
83-83: No action needed—the relative replace directive is correct for this Go workspace setup.This repository uses Go 1.18+ workspaces (
go.work), which properly handle relative paths in replace directives across multiple modules. Themanifests-genmodule references its parent module (github.com/openshift/cluster-capi-operator) via the relative path, which is standard practice and fully compatible with CI/CD pipelines since the entire repository structure is preserved during cloning.e2e/go.mod (3)
5-10: Verify cleanup strategy for TODO replaces before merge.The comment indicates these replace directives are temporary and should be removed when external PRs (cluster-api-actuator-pkg and cluster-api-provider-azure) are merged. Ensure there's a tracking mechanism for removal—either link to tracking issues or confirm the external PRs are already merged.
1-35: Changes align well with PR objectives.The dependency updates support the new provider image metadata extraction feature:
- Updated openshift/api and openshift/client-go enable image metadata reading
- klauspost/compress (indirect) supports container image I/O
- Standard toolchain updates (oauth2, tools) are appropriate
The e2e module correctly reflects the transitive dependencies introduced by provider image handling and manifest generation changes.
19-19: Dependency versions verified as secure.All updated dependencies have been checked against known security advisories. No CVEs were found for:
- openshift/api v0.0.0-20251214014457-bfa868a22401
- klauspost/compress v1.18.1
- openshift/client-go v0.0.0-20251205093018-96a6cbc1420c
- golang.org/x/oauth2 v0.33.0 (safe from CVE-2025-22868, which was fixed in v0.27.0)
- golang.org/x/tools v0.39.0
mdbooth
force-pushed
the
manifests-gen
branch
2 times, most recently
from
fdbc9bf to
080ea0b
Compare
|
@mdbooth: This pull request references OCPCLOUD-3327 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 2
Fix all issues with AI Agents 🤖
In @pkg/controllers/capiinstaller/capi_installer_controller.go:
- Around line 181-183: When reconcileProviderImages returns an error, set the
ClusterOperator degraded condition before returning the error; call the
controller's setDegradedCondition (same pattern used earlier) with a clear
reason like "ReconcileProviderImagesFailed" and include the error message, then
return the fmt.Errorf wrapping that error from reconcileProviderImages so the
degraded status is recorded consistently with the other failure paths.
- Around line 228-250: The defer that calls reader.Close() is inside the loop
and delays closing all readers until the outer function returns, causing a
resource leak; fix by moving the per-image processing into a helper (e.g., a new
function processProviderImage or reconcileProviderImage) that takes the
providerImage and ctx, calls providerManifestReader, defers reader.Close()
inside that helper, then calls extractManifests and r.applyProviderComponents
before returning; alternatively explicitly call reader.Close() immediately after
extractManifests/applyProviderComponents within the loop (ensuring any close
errors are handled/joined) so each reader is closed at the end of its iteration
rather than at function exit.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
manifests-gen/customizations.go (1)
163-165: Typo in panic message.The panic message contains a typo:
"cert:CustomResourceDefinition"should likely be just"cert: "to match the pattern in lines 138-139 and 152-153.🔎 Proposed fix
- panic("can't find secret from cert:CustomResourceDefinition " + certNN) + panic("can't find secret from cert: " + certNN)
🧹 Nitpick comments (5)
pkg/providerimages/providerimages_test.go (1)
196-216: Verify type comparison forOCPPlatform.Line 204 compares
manifest.OCPPlatform(typeconfigv1.PlatformType) to the string"aws". This works becauseconfigv1.PlatformTypeis an alias forstring, but consider using the constantconfigv1.AWSPlatformTypefor type safety and clarity.🔎 Suggested improvement
- g.Expect(manifest.OCPPlatform).To(Equal("aws")) + g.Expect(manifest.OCPPlatform).To(Equal(configv1.AWSPlatformType))This would require adding
configv1 "github.com/openshift/api/config/v1"to imports.manifests/0000_30_cluster-api_11_deployment.yaml (1)
95-96: Consider adding a sizeLimit to the emptyDir volume.While
emptyDiris appropriate for ephemeral provider image caching, consider adding asizeLimitto prevent unbounded disk usage:- name: provider-images emptyDir: sizeLimit: "1Gi"This ensures the cache doesn't consume excessive node storage if provider images are larger than expected.
manifests-gen/util.go (2)
5-11: Consider adding nil checks to getKind and getGroup.While these helper functions are simple accessors, adding nil checks would prevent potential panics if called with nil objects:
🔎 Proposed enhancement
func getKind(obj client.Object) string { + if obj == nil { + return "" + } return obj.GetObjectKind().GroupVersionKind().Kind } func getGroup(obj client.Object) string { + if obj == nil { + return "" + } return obj.GetObjectKind().GroupVersionKind().Group }
21-25: Enhance panic message with error context.The
mustConvertfunction panics without providing context about which conversion failed. Consider wrapping the error:🔎 Proposed enhancement
func mustConvert[T client.Object](from client.Object, to T) { if err := convert(from, to); err != nil { - panic(err) + panic(fmt.Errorf("failed to convert %T to %T: %w", from, to, err)) } }This would require adding
"fmt"to the imports.manifests-gen/customizations.go (1)
219-228: Typo in function name:replaceCertMangerServiceSecret.The function name has a typo: "Manger" should be "Manager" for consistency with
replaceCertManagerAnnotations.🔎 Proposed fix
-func replaceCertMangerServiceSecret(obj client.Object, serviceSecretNames map[string]string) { +func replaceCertManagerServiceSecret(obj client.Object, serviceSecretNames map[string]string) {Also update the call site at line 69:
- replaceCertMangerServiceSecret(obj, serviceSecretNames) + replaceCertManagerServiceSecret(obj, serviceSecretNames)
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (260)
e2e/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sumhack/tools/go.sumis excluded by!**/*.summanifests-gen/go.sumis excluded by!**/*.sumvendor/github.com/MakeNowJust/heredoc/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/heredoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/PATENTSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/ocb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/write.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/base_dirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/codecov.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/config_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/userdirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/xdg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/conv/conv.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/hashes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/keccakf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/rc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/shake.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fuzzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/integer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/power.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/primes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/wnaf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/modular.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/mult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/tables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/sign.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CODE-OF-CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/GOVERNANCE.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/MAINTAINERSis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/distribution-logo.svgis excluded by!**/*.svg,!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/normalize.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/reference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/regexp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/sort.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/client.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/command.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/and/and_closer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/gzip/zip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/redact/redact.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/wait/kubernetes_apimachinery_wait.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/verify/verify.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/zstd/zstd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/anon.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/auth.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/authn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/basic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/bearer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/keychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/multikeychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/logs/logs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/digest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/ref.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/repository.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/tag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/layer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/match/match.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (24)
cmd/cluster-capi-operator/main.goe2e/go.modgo.modhack/tools/go.modmanifests-gen/customizations.gomanifests-gen/generate.gomanifests-gen/go.modmanifests-gen/kustomization.yamlmanifests-gen/main.gomanifests-gen/providercustomizations.gomanifests-gen/providers.gomanifests-gen/util.gomanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_rbac_bindings.yamlmanifests/0000_30_cluster-api_11_deployment.yamlpkg/controllers/capiinstaller/capi_installer_controller.gopkg/controllers/capiinstaller/capi_installer_controller_test.gopkg/controllers/infracluster/azure.gopkg/conversion/capi2mapi/aws.gopkg/conversion/mapi2capi/aws_fuzz_test.gopkg/providerimages/providerimages.gopkg/providerimages/providerimages_test.gopkg/providerimages/pullsecret.gopkg/util/readconfig.go
💤 Files with no reviewable changes (4)
- manifests-gen/providers.go
- pkg/util/readconfig.go
- pkg/conversion/capi2mapi/aws.go
- manifests-gen/providercustomizations.go
🚧 Files skipped from review as they are similar to previous changes (4)
- pkg/controllers/capiinstaller/capi_installer_controller_test.go
- pkg/providerimages/providerimages.go
- pkg/conversion/mapi2capi/aws_fuzz_test.go
- e2e/go.mod
🧰 Additional context used
🧬 Code graph analysis (4)
manifests-gen/generate.go (1)
pkg/providerimages/providerimages.go (1)
ProviderMetadata(66-72)
pkg/controllers/capiinstaller/capi_installer_controller.go (1)
pkg/providerimages/providerimages.go (1)
ProviderImageManifests(56-63)
cmd/cluster-capi-operator/main.go (1)
pkg/providerimages/providerimages.go (2)
ReadProviderImages(117-131)ProviderImageManifests(56-63)
pkg/providerimages/providerimages_test.go (1)
pkg/providerimages/providerimages.go (1)
ProviderImageManifests(56-63)
🪛 Checkov (3.2.334)
manifests/0000_30_cluster-api_11_deployment.yaml
[medium] 2-96: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 2-96: Minimize the admission of root containers
(CKV_K8S_23)
🔇 Additional comments (29)
manifests/0000_30_cluster-api_03_rbac_roles.yaml (1)
36-55: LGTM! Least-privilege RBAC for pull-secret access.The new Role correctly grants minimal permissions (only
geton the specificpull-secretinopenshift-config) needed for the operator to access registry credentials when pulling provider images. The use ofresourceNamesrestriction follows security best practices.manifests/0000_30_cluster-api_04_rbac_bindings.yaml (1)
38-56: LGTM! RoleBinding correctly configured for cross-namespace access.The RoleBinding is properly configured to grant the
cluster-capi-operatorServiceAccount (fromopenshift-cluster-apinamespace) access to the pull-secret Role in theopenshift-confignamespace. The role reference and subject are both correctly specified.pkg/providerimages/pullsecret.go (2)
29-40: LGTM!The
parseDockerConfigfunction correctly handles the empty input case by returning the default keychain, and properly wraps parsing errors with context.
47-75: LGTM!The
Resolvemethod correctly:
- Maps
DefaultRegistrytoDefaultAuthKeyfor docker.io compatibility- Handles empty auth configs by returning
Anonymous- Properly constructs the authenticator with all relevant credential fields
The ServerAddress clearing on line 62 is safe since
GetAuthConfigreturns a value copy.pkg/providerimages/providerimages_test.go (6)
39-60: LGTM!The
fakeImageFetcherimplementation is well-structured:
- Properly checks context cancellation before proceeding
- Supports configurable errors and images for test scenarios
- Returns a descriptive error for unknown references
62-93: LGTM!The
createTarLayerhelper correctly constructs in-memory tar layers for testing, with proper error handling and closure of the tar writer.
95-123: LGTM!The test image creation helpers are clean and follow go-containerregistry patterns correctly. Using
empty.Imageas a base withmutate.AppendLayersis the idiomatic approach.
125-162: LGTM!Good approach deriving test path constants from production constants to keep tests in sync. The
createMetadataYAMLhelper now correctly usesproviderImageRefon line 160, addressing the previously noted issue.
164-174: LGTM!The table-driven test structure is well-designed with appropriate fields for different test scenarios. The
//nolint:gocognit,funlendirective is reasonable for comprehensive test functions that cover many edge cases.
533-598: LGTM!The test runner is well-implemented:
- Uses
t.TempDir()for proper test isolation- Correctly handles optional context setup with proper defer placement
- Validates both error conditions and output directory structure
- Verifies manifest files exist and correspond to input container images
manifests/0000_30_cluster-api_11_deployment.yaml (2)
38-39: LGTM! Environment variable aligns with volume mount path.The
PROVIDER_IMAGE_DIRenvironment variable correctly points to the mounted provider-images volume path, enabling the operator to locate cached provider manifests.
58-59: LGTM! Volume mount correctly configured for provider image caching.The writable mount at
/var/lib/provider-imagesis appropriate for caching provider manifests extracted from images.pkg/controllers/infracluster/azure.go (1)
280-280: LGTM! The nolint directive removal is appropriate.The
//nolint:gosecdirective was removed from the port conversion. The inline comment on line 279 correctly explains that port numbers are always less than 65536, making theint64toint32conversion safe. Ifgosecflags this during CI, the directive can be re-added, but the conversion itself is correct.manifests-gen/util.go (1)
13-19: LGTM! GVK synchronization after conversion is correct.The
convertfunction properly copies theGroupVersionKindfrom the source to the target after conversion. This ensures type information is preserved through the conversion process, which is essential for runtime object handling.manifests-gen/go.mod (3)
29-59: LGTM! Indirect dependency additions support container image operations.The new indirect dependencies (docker/cli, docker/distribution, containerd/stargz-snapshotter, etc.) are required for provider image extraction and manifest handling. These align with the PR's goal of embedding CAPI installer manifests in provider images.
83-83: LGTM! Replace directive is appropriate for local development.The replace directive pointing to the parent directory is standard practice for a submodule that needs to reference the main module during development and builds.
20-25: All dependency versions are valid and properly resolved.The versions listed in lines 20-25 all exist and are confirmed by entries in go.sum. The placeholder version
v0.0.0-00010101000000-000000000000forcluster-capi-operatoris intentional and correct, as it uses areplacedirective pointing to the parent directory (replace github.com/openshift/cluster-capi-operator => ..). All dependencies are actively used in the codebase and have recent, stable versions.hack/tools/go.mod (1)
204-204: golang.org/x/tools v0.39.0 is available and compatible.The indirect dependency version exists and is compatible with the current toolchain (Go 1.24.10 exceeds the minimum requirement of Go 1.23 for this version).
go.mod (1)
12-12: Dependency versions are valid and free from known security vulnerabilities.
github.com/docker/cli v29.0.3+incompatibleandgithub.com/google/go-containerregistry v0.20.7have no published CVEs affecting these specific versions. No action required.cmd/cluster-capi-operator/main.go (5)
20-22: LGTM!The new imports for
mapsandslices(Go 1.21+/1.23+) are appropriate for the collection operations used below.
74-79: LGTM!New constants for provider image directory configuration follow the existing pattern in this file.
218-229: LGTM!The provider image reading logic follows established patterns in this file. Using
context.Background()is appropriate during startup before the manager's signal handler context is available.
275-309: LGTM!The function signature updates and switch cases consistently propagate
providerImagesto all platform reconcilers.
348-360: LGTM!The
CapiInstallerControllerinitialization correctly includes the newProviderImagesfield.manifests-gen/customizations.go (5)
30-32: Hardcoded registry may cause issues in different environments.The
expectedRegistryis hardcoded toregistry.ci.openshift.org, which appears to be a CI-specific registry. This could break manifest generation in other environments or when images are mirrored.Is this intentional for CI/build-time validation only? If this tool runs in other contexts, consider making this configurable or documenting the assumption.
34-99: LGTM!The refactored
processObjectsfunction is well-structured with clear group/kind-based dispatch. Error handling for deployment customization properly propagates errors instead of panicking.
173-205: LGTM!The deployment customization properly validates image references and returns errors instead of panicking, which is appropriate for recoverable validation failures.
242-308: No action required. ThecapiNamespacevariable is properly defined as a package-level constant inmanifests-gen/generate.goand is correctly accessible within thegenerateInfraClusterProtectionPolicyfunction.
310-334: Theschemevariable is properly defined and initialized inmanifests-gen/main.go(line 48) as a package-level variable. It is initialized with all required types, includingValidatingAdmissionPolicyandValidatingAdmissionPolicyBinding, viaadmissionregistration.AddToScheme(scheme)(line 54 in main.go). ThesetTypeMetadataFromSchemefunction in customizations.go correctly uses this scheme.Likely an incorrect or invalid review comment.
| if err := r.reconcileProviderImages(ctx, log); err != nil { | ||
| return ctrl.Result{}, fmt.Errorf("error reconciling CAPI provider images: %w", err) | ||
| } |
There was a problem hiding this comment.
Missing degraded condition when reconcileProviderImages fails.
When reconcileProviderImages returns an error, the code immediately returns without setting the ClusterOperator degraded condition. This is inconsistent with the error handling pattern used earlier in the reconcile function (lines 143-147, 159-164, 171-176), where setDegradedCondition is called before returning errors.
🔎 Suggested fix
if err := r.reconcileProviderImages(ctx, log); err != nil {
+ if err := r.setDegradedCondition(ctx, log); err != nil {
+ return ctrl.Result{}, fmt.Errorf("failed to set conditions for CAPI Installer controller: %w", err)
+ }
+
return ctrl.Result{}, fmt.Errorf("error reconciling CAPI provider images: %w", err)
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if err := r.reconcileProviderImages(ctx, log); err != nil { | |
| return ctrl.Result{}, fmt.Errorf("error reconciling CAPI provider images: %w", err) | |
| } | |
| if err := r.reconcileProviderImages(ctx, log); err != nil { | |
| if err := r.setDegradedCondition(ctx, log); err != nil { | |
| return ctrl.Result{}, fmt.Errorf("failed to set conditions for CAPI Installer controller: %w", err) | |
| } | |
| return ctrl.Result{}, fmt.Errorf("error reconciling CAPI provider images: %w", err) | |
| } |
🤖 Prompt for AI Agents
In @pkg/controllers/capiinstaller/capi_installer_controller.go around lines
181-183, When reconcileProviderImages returns an error, set the ClusterOperator
degraded condition before returning the error; call the controller's
setDegradedCondition (same pattern used earlier) with a clear reason like
"ReconcileProviderImagesFailed" and include the error message, then return the
fmt.Errorf wrapping that error from reconcileProviderImages so the degraded
status is recorded consistently with the other failure paths.
|
@mdbooth: This pull request references OCPCLOUD-3327 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (276)
e2e/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sumgo.work.sumis excluded by!**/*.sumhack/tools/go.sumis excluded by!**/*.summanifests-gen/go.sumis excluded by!**/*.sumvendor/github.com/MakeNowJust/heredoc/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/heredoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/PATENTSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/ocb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/write.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/base_dirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/codecov.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/config_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/userdirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/xdg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/conv/conv.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/hashes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/keccakf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/rc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/shake.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fuzzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/integer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/power.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/primes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/wnaf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/modular.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/mult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/tables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/sign.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CODE-OF-CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/GOVERNANCE.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/MAINTAINERSis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/distribution-logo.svgis excluded by!**/*.svg,!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/normalize.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/reference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/regexp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/sort.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/client.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/command.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/and/and_closer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/gzip/zip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/redact/redact.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/wait/kubernetes_apimachinery_wait.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/verify/verify.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/zstd/zstd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/anon.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/auth.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/authn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/basic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/bearer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/keychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/multikeychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/logs/logs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/digest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/ref.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/repository.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/tag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/layer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/match/match.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/uncompressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/with.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/platform.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/progress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/catalog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/delete.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/descriptor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/doc.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (4)
e2e/go.modgo.modhack/tools/go.modmanifests-gen/go.mod
🔇 Additional comments (6)
hack/tools/go.mod (1)
204-204: Aligned tooling dependency update.The minor version bump to
golang.org/x/toolsv0.39.0 is consistent across the repository modules and poses no functional risk to development tooling.e2e/go.mod (1)
80-80: E2E module dependencies properly aligned with manifests-gen changes.The addition of
klauspost/compress(line 80) and updates togolang.org/x/oauth2andgolang.org/x/toolsreflect transitive dependencies introduced by new container image handling in manifests-gen. The OpenShift API/client-go updates align with API changes needed for provider image support.Please verify that
klauspost/compressv1.18.1 is compatible with existing container image operations in the e2e test suite and that no conflicts arise from the new transitive dependency chain introduced bygoogle/go-containerregistry.Also applies to: 115-115, 121-121
manifests-gen/go.mod (2)
20-25: Container image extraction dependencies appropriately added.The new direct dependencies reflect the core functional change: manifests-gen now extracts CAPI manifests from provider container images. The choices are sound:
google/go-containerregistryis the standard library for OCI image operations.controller-runtimeandopenshift/apienable Kubernetes object handling.k8s.io/utilsprovides helper utilities.The local
replacedirective (line 83) forcluster-capi-operatoris the expected pattern for multi-module workspace organization.Please verify that:
google/go-containerregistryv0.20.7 and associated Docker/OCI libraries are actively maintained and free of known CVEs.- The
+incompatiblesuffix on Docker packages reflects legacy versioning (expected) rather than obsolete versions.
29-33: Correct line number references in dependency locations.The Docker client libraries, image handling tools, and logging dependencies are present in manifests-gen/go.mod (at lines 5–9, not 29–33), and the bump to
klauspost/compressv1.18.1 (line 23) andgolang.org/x/oauth2v0.33.0 (line 41) align with ecosystem updates.go mod verifyconfirms all modules are valid with no version conflicts detected across the container registry dependency chain.go.mod (2)
106-106: Indirect OCI/container ecosystem dependency changes are aligned with image extraction use case.The updates to indirect dependencies (containerd/stargz-snapshotter, docker/distribution, opencontainers/*, vbatts/tar-split, golang.org/x/oauth2, gopkg.in/yaml.v2) are consistent with supporting provider image metadata reading and tar extraction. These are transitively pulled by
go-containerregistryand related container tooling.Also applies to: 111-112, 220-221, 272-272, 302-302, 315-315
12-12: No concerns—docker/cli is intentionally and appropriately used for Docker configuration parsing.The direct dependency on
docker/cli v29.0.3+incompatibleis not a transitive dependency accident. The code inpkg/providerimages/pullsecret.godirectly imports Docker CLI config modules (github.com/docker/cli/cli/config*) to parse Docker credentials from the host's Docker configuration. Combined withgo-containerregistry v0.20.7for registry operations, this is the correct approach for reading pull secrets from Docker config files.Both versions are current and secure:
google/go-containerregistry v0.20.7is the latest v0.20 release (Nov 2025)docker/cli v29.0.3is well beyond the CVE-2021-41092 fix threshold (v20.10.9+incompatible)The
+incompatiblesuffix is standard for pre-module Go modules and poses no concerns.
| github.com/google/uuid v1.6.0 | ||
| github.com/gophercloud/gophercloud/v2 v2.9.0 | ||
| github.com/klauspost/compress v1.18.0 | ||
| github.com/klauspost/compress v1.18.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n go.mod | head -40Repository: openshift/cluster-capi-operator
Length of output: 1943
🏁 Script executed:
grep -n "cluster-api\|sigs.k8s.io" go.mod | head -20Repository: openshift/cluster-capi-operator
Length of output: 1358
🌐 Web query:
golang.org/x/sync v0.18.0 golang.org/x/tools v0.39.0 Kubernetes v0.34.1 cluster-api v1.11.3 compatibility
💡 Result:
Do you mean Kubernetes v1.34.1 (not v0.34.1)? If so — short answer:
- Cluster API v1.11.3 declares support for Kubernetes management clusters v1.30.x → v1.34.x (workload clusters v1.28.x → v1.34.x). [1][2]
- The Cluster API v1.11.x release notes show golang.org/x/sync was bumped to v0.18.0 in the v1.11 line; golang.org/x/tools was bumped in the v1.11 series (noting some release candidates used v0.38.x). Check the project go.mod for the exact pinned versions for v1.11.3. [2][3]
If you want I can:
- fetch the exact go.mod from the cluster-api v1.11.3 tag and confirm whether golang.org/x/tools v0.39.0 is pinned; or
- verify compatibility of golang.org/x/sync v0.18.0 and golang.org/x/tools v0.39.0 with a specific Go toolchain version you care about.
Sources:
[1] Cluster API version support docs.
[2] cluster-api v1.11.3 release notes (dependencies & Kubernetes support).
[3] Cluster API versions reference (support matrix).
🌐 Web query:
cluster-api v1.11.3 go.mod golang.org/x/tools version
💡 Result:
In v1.11.3, golang.org/x/tools is set to v0.38.0. [1]
Sources:
[1] kubernetes-sigs/cluster-api release notes (v1.11.3) — dependency list showing golang.org/x/tools: v0.37.0 → v0.38.0.
Align golang.org/x/tools with cluster-api v1.11.3 dependency.
The current go.mod pins golang.org/x/tools v0.39.0, but cluster-api v1.11.3 uses v0.38.0. Consider aligning to v0.38.0 for consistency with upstream dependencies. golang.org/x/sync v0.18.0 is confirmed compatible with cluster-api v1.11.3 and Kubernetes v0.34.1.
Also applies to: lines 32-33
|
@mdbooth: This pull request references OCPCLOUD-3327 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
manifests-gen/customizations.go (2)
101-171: Consider returning errors instead of panic.The function uses
panic()at lines 138, 152, and 164 when unable to find secrets from certificates. This can crash the entire manifests-gen tool.Additionally, line 164 has a typo in the panic message:
"cert:CustomResourceDefinition "should be"cert: ".🔎 Suggested refactor to return errors
Update the function signature to return an error:
-func findWebhookServiceSecretName(objs []client.Object) map[string]string { +func findWebhookServiceSecretName(objs []client.Object) (map[string]string, error) { serviceSecretNames := map[string]string{} certSecretNames := map[string]string{} secretFromCertNN := func(certNN string) (string, bool) { // ... existing code ... }Then replace panic calls with error returns:
if certNN, ok := crd.Annotations["cert-manager.io/inject-ca-from"]; ok { secretName, ok := secretFromCertNN(certNN) if !ok { - panic("can't find secret from cert: " + certNN) + return nil, fmt.Errorf("can't find secret from cert: %s", certNN) }Apply similar changes to lines 152 and 164, and update the caller in
processObjectsto handle the error.
219-228: Fix typo in function name.The function name
replaceCertMangerServiceSecrethas a typo: "Manger" should be "Manager" to matchreplaceCertManagerAnnotationson line 207.🔎 Proposed fix
-func replaceCertMangerServiceSecret(obj client.Object, serviceSecretNames map[string]string) { +func replaceCertManagerServiceSecret(obj client.Object, serviceSecretNames map[string]string) {Also update the call site at line 69:
- replaceCertMangerServiceSecret(obj, serviceSecretNames) + replaceCertManagerServiceSecret(obj, serviceSecretNames)
♻️ Duplicate comments (1)
pkg/controllers/capiinstaller/capi_installer_controller.go (1)
181-183: Missing degraded condition whenreconcileProviderImagesfails.When
reconcileProviderImagesreturns an error, the code returns immediately without setting the ClusterOperator degraded condition. This is inconsistent with the error handling pattern used earlier in thereconcilefunction (lines 143-147, 159-164, 171-176), wheresetDegradedConditionis called before returning errors.🔎 Suggested fix
if err := r.reconcileProviderImages(ctx, log); err != nil { + if err := r.setDegradedCondition(ctx, log); err != nil { + return ctrl.Result{}, fmt.Errorf("failed to set conditions for CAPI Installer controller: %w", err) + } + return ctrl.Result{}, fmt.Errorf("error reconciling CAPI provider images: %w", err) }
🧹 Nitpick comments (4)
manifests-gen/generate.go (2)
95-128: RedundantO_APPENDflag withO_TRUNC.The
O_APPENDflag on line 98 is redundant when used withO_TRUNC.O_TRUNCtruncates the file to zero length, and since you're writing sequentially from the beginning,O_APPENDhas no practical effect. The same applies to line 133.🔎 Suggested fix
- manifestsFile, err := os.OpenFile(manifestsPathname, os.O_CREATE|os.O_TRUNC|os.O_WRONLY|os.O_APPEND, 0600) + manifestsFile, err := os.OpenFile(manifestsPathname, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
83-89: Variable shadows imported package name.The variable
unstructuredon line 83 shadows the importedunstructuredpackage from line 13. While this works, it can cause confusion.🔎 Suggested fix
- var unstructured unstructured.Unstructured - err = json.Unmarshal(data, &unstructured) + var obj unstructured.Unstructured + err = json.Unmarshal(data, &obj) if err != nil { return nil, fmt.Errorf("error unmarshalling resource to unstructured: %w", err) } - resources = append(resources, &unstructured) + resources = append(resources, &obj)pkg/providerimages/providerimages.go (1)
139-189: Unconventional errgroup usage pattern.The code uses
errgroupbut ignores the returned error from goroutines (line 156 returns nil), collecting errors via a channel instead. While functional, this defeats the purpose of errgroup's error propagation. Consider either:
- Using errgroup properly with error returns and stopping on first error, or
- Using a simple
sync.WaitGroupsince you're collecting errors manually anyway.The current approach works but may confuse readers expecting standard errgroup semantics.
manifests-gen/customizations.go (1)
310-334: Consider error returns, but panics are acceptable for generation tools.The
stripStatusandsetTypeMetadataFromSchemehelper functions usepanic()for error handling. While this is generally discouraged, it's more acceptable in code-generation tools like manifests-gen that fail fast on invalid input.However, for consistency and better error messages, consider returning errors instead.
🔎 Optional refactor to return errors
-func stripStatus(obj client.Object) client.Object { +func stripStatus(obj client.Object) (client.Object, error) { unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj) if err != nil { - panic(err) + return nil, fmt.Errorf("failed to convert to unstructured: %w", err) } delete(unstructuredObj, "status") - return &unstructured.Unstructured{Object: unstructuredObj} + return &unstructured.Unstructured{Object: unstructuredObj}, nil } -func setTypeMetadataFromScheme(obj client.Object, version string) { +func setTypeMetadataFromScheme(obj client.Object, version string) error { gvks, _, err := scheme.ObjectKinds(obj) if err != nil { - panic(err) + return fmt.Errorf("failed to get object kinds: %w", err) } for _, gvk := range gvks { if gvk.Version == version { obj.GetObjectKind().SetGroupVersionKind(gvk) - return + return nil } } - panic("no " + version + " GVK found") + return fmt.Errorf("no %s GVK found for object type %T", version, obj) }Then update callers to handle errors.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (277)
e2e/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sumgo.work.sumis excluded by!**/*.sumhack/tools/go.sumis excluded by!**/*.summanifests-gen/go.sumis excluded by!**/*.sumvendor/github.com/MakeNowJust/heredoc/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/heredoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/PATENTSis excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/ocb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/write.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/base_dirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/codecov.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/pathutil/pathutil_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/config_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/internal/userdirs/userdirs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_plan9.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/paths_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/adrg/xdg/xdg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x25519/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/key.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/dh/x448/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/conv/conv.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/hashes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/keccakf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/rc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/shake.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.his excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/fp448/fuzzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/integer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/mlsbset/power.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/primes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/math/wnaf.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/modular.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/mult.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/point.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed25519/tables.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/ed448.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/ed448/signapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/sign.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CODE-OF-CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/GOVERNANCE.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/MAINTAINERSis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/distribution-logo.svgis excluded by!**/*.svg,!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/normalize.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/reference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/regexp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/distribution/reference/sort.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/client.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/client/command.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/docker/docker-credential-helpers/credentials/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/and/and_closer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/estargz/estargz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/gzip/zip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/redact/redact.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/retry/wait/kubernetes_apimachinery_wait.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/verify/verify.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/internal/zstd/zstd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/anon.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/auth.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/authn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/basic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/bearer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/keychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/multikeychain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/logs/logs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/digest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/ref.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/repository.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/name/tag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/empty/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/layer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/manifest.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/match/match.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/uncompressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/partial/with.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/platform.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/progress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/catalog.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/delete.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/descriptor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (23)
cmd/cluster-capi-operator/main.goe2e/go.modgo.modhack/tools/go.modmanifests-gen/customizations.gomanifests-gen/generate.gomanifests-gen/go.modmanifests-gen/kustomization.yamlmanifests-gen/main.gomanifests-gen/providercustomizations.gomanifests-gen/providers.gomanifests-gen/util.gomanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_rbac_bindings.yamlmanifests/0000_30_cluster-api_11_deployment.yamlpkg/controllers/capiinstaller/capi_installer_controller.gopkg/controllers/capiinstaller/capi_installer_controller_test.gopkg/controllers/infracluster/azure.gopkg/conversion/capi2mapi/aws.gopkg/providerimages/providerimages.gopkg/providerimages/providerimages_test.gopkg/providerimages/pullsecret.gopkg/util/readconfig.go
💤 Files with no reviewable changes (4)
- pkg/conversion/capi2mapi/aws.go
- pkg/util/readconfig.go
- manifests-gen/providercustomizations.go
- manifests-gen/providers.go
🚧 Files skipped from review as they are similar to previous changes (6)
- pkg/controllers/infracluster/azure.go
- e2e/go.mod
- manifests/0000_30_cluster-api_04_rbac_bindings.yaml
- manifests-gen/main.go
- hack/tools/go.mod
- pkg/providerimages/providerimages_test.go
🧰 Additional context used
🧬 Code graph analysis (3)
manifests-gen/generate.go (1)
pkg/providerimages/providerimages.go (1)
ProviderMetadata(66-72)
cmd/cluster-capi-operator/main.go (1)
pkg/providerimages/providerimages.go (2)
ReadProviderImages(117-131)ProviderImageManifests(56-63)
pkg/controllers/capiinstaller/capi_installer_controller.go (1)
pkg/providerimages/providerimages.go (1)
ProviderImageManifests(56-63)
🪛 Checkov (3.2.334)
manifests/0000_30_cluster-api_11_deployment.yaml
[medium] 2-96: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 2-96: Minimize the admission of root containers
(CKV_K8S_23)
🔇 Additional comments (24)
manifests-gen/kustomization.yaml (1)
1-17: LGTM! Well-structured kustomize component.The Component manifest correctly patches Secret resources to retain them locally during kustomization without emitting them. The
config.kubernetes.io/local-config: "true"annotation is the standard approach for this pattern.manifests-gen/go.mod (2)
20-25: LGTM! Dependencies align with provider image metadata support.The added dependencies correctly support the new provider image operations:
go-containerregistryfor image/manifest extractionopenshift/apiandcontroller-runtimefor typed Kubernetes objects- The placeholder version for
cluster-capi-operatoris expected given the replace directive
83-83: Replace directive correctly configured.The replace directive pointing to
..(parent directory) is the standard approach for referencing the main module from this manifests-gen submodule.pkg/controllers/capiinstaller/capi_installer_controller_test.go (1)
96-102: Properly addresses previous nil reader concern.The test now correctly handles the error case by checking
configMapReader's error return and exiting early before callingextractManifests. This prevents passing a nil reader and aligns with the reader-based extraction flow introduced in the provider image changes.manifests/0000_30_cluster-api_11_deployment.yaml (1)
38-39: LGTM! Provider image volume configuration is correct.The added environment variable, volume mount, and emptyDir volume properly support the provider image metadata functionality. The path
/var/lib/provider-imagesaligns with the provider image directory handling introduced elsewhere in the PR.Note: The static analysis warnings about privilege escalation and root containers apply to the entire deployment manifest and are not introduced by these changes.
Also applies to: 58-59, 95-96
go.mod (2)
12-12: Thegithub.com/docker/cli v29.0.3+incompatibledependency is actively used in the codebase for Docker config file parsing inpkg/providerimages/pullsecret.go. The+incompatiblesuffix is the standard Go notation for docker/cli, which doesn't follow semantic versioning conventions—not a versioning error. Version 29.0.3 is a recent stable Docker release and is compatible with the provider image operations being added.
32-33: Correct the golang.org/x/tools version reference.The original statement is incorrect: cluster-api v1.11.3 uses
golang.org/x/tools v0.34.0, not v0.38.0. The bump to v0.39.0 represents an intentional and safe update—changes between these versions are primarily gopls performance improvements and new/enhanced analyzers (unusedfunc, hostport), which do not introduce breaking changes for this project's usage ofgolang.org/x/tools/go/packages.Likely an incorrect or invalid review comment.
manifests-gen/util.go (1)
1-25: LGTM!Clean utility functions for working with
client.Object. The genericconvertfunction properly preserves GVK after scheme conversion, which is important for maintaining type information. ThemustConvertwrapper is appropriate for internal tooling where conversion failures should be fatal.pkg/providerimages/pullsecret.go (1)
29-75: LGTM!Well-structured Docker config keychain implementation. The
Resolvemethod correctly handles theDefaultRegistrytoDefaultAuthKeymapping for Docker Hub, and properly falls back to anonymous authentication when no credentials are configured. Error messages provide good context for debugging.manifests-gen/generate.go (1)
130-158: LGTM!The metadata writing function has proper error handling with the
errors.Joinpattern in the deferred close. The sameO_APPENDcleanup noted above applies to line 133.pkg/controllers/capiinstaller/capi_installer_controller.go (4)
188-235: Well-structured provider image reconciliation.The filtering by platform and priority-based sorting (core → infrastructure → other) ensures deterministic and correct ordering of provider installation. Using
slices.SortStableFuncpreserves relative order within the same priority level, and the secondary sort by name provides additional determinism.
237-262: LGTM!The extraction of provider image processing into its own function
applyProviderImageproperly addresses the resource leak concern from previous reviews. Thedefernow executes at the end of each function call, ensuring files are closed promptly.
517-541: LGTM!The refactoring to return
io.ReadCloserproperly addresses the resource leak concerns from previous reviews. Usingio.NopCloserfor the string reader andreader.IOReadCloser()for the zstd decoder ensures consistent close semantics.
358-363: Good defensive check.Skipping empty manifests after YAML splitting prevents spurious parsing errors from trailing document separators or whitespace-only sections.
cmd/cluster-capi-operator/main.go (2)
218-229: Provider image loading during startup.The operator reads provider image metadata synchronously during startup. If this fails (e.g., pull secret unavailable, image fetch fails), the operator will exit. This is a reasonable design choice for an operator that depends on provider images to function, but be aware this could delay startup in environments with slow registry access.
275-320: LGTM!Clean threading of
providerImagesthrough the reconciler setup chain. The parameter is consistently passed to all platform-specific reconciler paths and ultimately toCapiInstallerController.pkg/providerimages/providerimages.go (3)
246-306: LGTM!The layer extraction logic correctly iterates layers in reverse order (top-to-bottom) to respect OCI layer semantics where higher layers override lower layers. The early exit optimization and proper error distinction between missing directory vs. missing individual files is well implemented.
360-388: LGTM!Efficient implementation using
io.MultiWriterto simultaneously write to disk and compute the SHA256 hash in a single pass. Thestrings.Replacer.WriteStringprovides streaming replacement without materializing the entire modified content in memory.
308-347: LGTM!Good implementation of tar file extraction. Using
path.Clean(notfilepath) is correct since tar paths always use forward slashes regardless of OS. The set-based lookup and early exit optimization are efficient.manifests/0000_30_cluster-api_03_rbac_roles.yaml (1)
36-55: LGTM!The new Role follows the principle of least privilege: it grants only
getaccess to the specificpull-secretSecret in theopenshift-confignamespace. The annotations are consistent with the existing RBAC resources in this file. The corresponding RoleBinding exists inmanifests/0000_30_cluster-api_04_rbac_bindings.yamland properly binds the Role to thecluster-capi-operatorServiceAccount in theopenshift-cluster-apinamespace.manifests-gen/customizations.go (4)
4-18: LGTM: Import additions support the refactoring.The new imports correctly support the migration to typed client.Object handling and the addition of image registry validation. The go-containerregistry package is appropriate for parsing and validating container image references.
Also applies to: 30-31
34-99: Helper functions are properly defined and available.All three helpers—
getGroup(),getKind(), andmustConvert()—are defined inmanifests-gen/util.goand accessible to theprocessObjectsfunction. The refactor to typedclient.Objectwith group/kind dispatch is well-structured and all dependencies are in place.
173-205: No action needed on image registry validation.The
customizeDeploymentfunction's strict validation of the image registry is appropriate. A search of the manifests confirms all images already referenceregistry.ci.openshift.org, so the validation will not fail during the transition period.
242-308: No changes needed. Bothscheme(manifests-gen/main.go) andcapiNamespace(manifests-gen/generate.go) are properly defined as package-level variables in the manifests-gen package and are accessible to customizations.go. The code is correct and will compile without issues.Likely an incorrect or invalid review comment.
|
/override okd-scos-images This never passes and nobody knows what it does. We should stop running it. |
|
@mdbooth: /override requires failed status contexts, check run or a prowjob name to operate on.
Only the following failed contexts/checkruns were expected:
If you are trying to override a checkrun that has a space in it, you must put a double quote on the context. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override ci/prow/okd-scos-images |
|
@mdbooth: Overrode contexts on behalf of mdbooth: ci/prow/okd-scos-images DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
The existing tests will demonstrate that the PR continues to work with existing transport configmaps. The following test will demonstrate that the PR works with updated providers which use image-based manifests. /testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 openshift/cluster-api#259 |
|
/testwith openshift/cluster-capi-operator/main/e2e-aws-ovn-techpreview openshift/cluster-api-provider-aws#584 openshift/cluster-api#259 |
|
/pipeline required |
|
Scheduling tests matching the |
|
/retest-required |
1 similar comment
|
/retest-required |
|
/test e2e-azure-ovn-techpreview |
|
@mdbooth: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Rewrite manifests-gen to support embedding CAPI installer manifests in the provider image instead of in a transport configmap.
Update the CAPI installer controller to support the new embedded manifests in addition to the existing transport configmaps. This allows us to have a smooth transition period while we update all providers.
Summary by CodeRabbit
Release Notes
New Features
Infrastructure
✏️ Tip: You can customize this high-level summary in your review settings.