OCPBUGS-79591: Update FBCs v4.12-v4.22 with v1.3.4 prod bundle#453
Conversation
Add the `v1.3.4` release to all FBC catalog templates (v4.12-v4.22) and regenerate the catalogs. Steps performed: - Updated `catalog-template.yaml` for all OCP versions (v4.12-v4.22) with the `v1.3.4` bundle entry in `stable-v1` and `stable-v1.3` channels - Regenerated catalogs with `OCP_VERSION=4.x make generate-catalog`
openshift-ci-robot
added
jira/severity-important
|
@alebedev87: This pull request references Jira Issue OCPBUGS-79591, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughThis pull request adds support for Suggested reviewers
🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@catalog/v4.15/catalog.yaml`:
- Around line 871-876: The RBAC in the generated bundle is wrong: update the
source role definitions/markers for the ClusterRoles named externaldns-editor
and externaldns-viewer so they use apiGroup "externaldns.olm.openshift.io" (not
"operator.openshift.io") and reference the plural resource name "externaldnses"
(not singular "externaldns"), then re-run your bundle/catalog generation to
produce new base64-encoded olm.bundle.object entries rather than hand-editing
the data; look for the ClusterRole/marker declarations that produce
externaldns-editor and externaldns-viewer to make these fixes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0acbf225-a46b-4628-815c-b603e84c0c84
📒 Files selected for processing (22)
catalog/v4.12/catalog-template.yamlcatalog/v4.12/catalog.yamlcatalog/v4.13/catalog-template.yamlcatalog/v4.13/catalog.yamlcatalog/v4.14/catalog-template.yamlcatalog/v4.14/catalog.yamlcatalog/v4.15/catalog-template.yamlcatalog/v4.15/catalog.yamlcatalog/v4.16/catalog-template.yamlcatalog/v4.16/catalog.yamlcatalog/v4.17/catalog-template.yamlcatalog/v4.17/catalog.yamlcatalog/v4.18/catalog-template.yamlcatalog/v4.18/catalog.yamlcatalog/v4.19/catalog-template.yamlcatalog/v4.19/catalog.yamlcatalog/v4.20/catalog-template.yamlcatalog/v4.20/catalog.yamlcatalog/v4.21/catalog-template.yamlcatalog/v4.21/catalog.yamlcatalog/v4.22/catalog-template.yamlcatalog/v4.22/catalog.yaml
| - type: olm.bundle.object | ||
| value: | ||
| data: eyJhcGlWZXJzaW9uIjoicmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSIsImtpbmQiOiJDbHVzdGVyUm9sZSIsIm1ldGFkYXRhIjp7ImNyZWF0aW9uVGltZXN0YW1wIjpudWxsLCJuYW1lIjoiZXh0ZXJuYWxkbnMtZWRpdG9yIn0sInJ1bGVzIjpbeyJhcGlHcm91cHMiOlsiZXh0ZXJuYWxkbnMub2xtLm9wZW5zaGlmdC5pbyJdLCJyZXNvdXJjZXMiOlsiZXh0ZXJuYWxkbnMiXSwidmVyYnMiOlsiY3JlYXRlIiwiZGVsZXRlIiwiZ2V0IiwibGlzdCIsInBhdGNoIiwidXBkYXRlIiwid2F0Y2giXX0seyJhcGlHcm91cHMiOlsiZXh0ZXJuYWxkbnMub2xtLm9wZW5zaGlmdC5pbyJdLCJyZXNvdXJjZXMiOlsiZXh0ZXJuYWxkbnMvc3RhdHVzIl0sInZlcmJzIjpbImdldCJdfV19 | ||
| - type: olm.bundle.object | ||
| value: | ||
| data: eyJhcGlWZXJzaW9uIjoicmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSIsImtpbmQiOiJDbHVzdGVyUm9sZSIsIm1ldGFkYXRhIjp7ImNyZWF0aW9uVGltZXN0YW1wIjpudWxsLCJuYW1lIjoiZXh0ZXJuYWxkbnMtdmlld2VyIn0sInJ1bGVzIjpbeyJhcGlHcm91cHMiOlsib3BlcmF0b3Iub3BlbnNoaWZ0LmlvIl0sInJlc291cmNlcyI6WyJleHRlcm5hbGRucyJdLCJ2ZXJicyI6WyJnZXQiLCJsaXN0Iiwid2F0Y2giXX0seyJhcGlHcm91cHMiOlsib3BlcmF0b3Iub3BlbnNoaWZ0LmlvIl0sInJlc291cmNlcyI6WyJleHRlcm5hbGRucy9zdGF0dXMiXSwidmVyYnMiOlsiZ2V0Il19XX0= |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
python - <<'PY'
from pathlib import Path
import re, base64, json
text = Path("catalog/v4.15/catalog.yaml").read_text()
for m in re.finditer(r'data:\s*([A-Za-z0-9+/=]+)', text):
payload = m.group(1)
obj = json.loads(base64.b64decode(payload).decode())
if obj.get("kind") == "ClusterRole" and obj.get("metadata", {}).get("name") in {"externaldns-editor", "externaldns-viewer"}:
print(f'\n{obj["metadata"]["name"]}')
for rule in obj.get("rules", []):
print(" apiGroups:", rule.get("apiGroups"))
print(" resources:", rule.get("resources"))
print("\nExpected for both roles:")
print(" apiGroups: ['externaldns.olm.openshift.io']")
print(" resources: ['externaldnses'] / ['externaldnses/status']")
PYRepository: openshift/external-dns-operator
Length of output: 239
🏁 Script executed:
#!/bin/bash
python3 - <<'PY'
from pathlib import Path
import re, base64, json, gzip
text = Path("catalog/v4.15/catalog.yaml").read_text()
for m in re.finditer(r'data:\s*([A-Za-z0-9+/=]+)', text):
payload = m.group(1)
try:
# Decompress gzip first, then decode JSON
compressed = base64.b64decode(payload)
decompressed = gzip.decompress(compressed)
obj = json.loads(decompressed.decode())
if obj.get("kind") == "ClusterRole" and obj.get("metadata", {}).get("name") in {"externaldns-editor", "externaldns-viewer"}:
print(f'\n{obj["metadata"]["name"]}')
for rule in obj.get("rules", []):
print(" apiGroups:", rule.get("apiGroups"))
print(" resources:", rule.get("resources"))
except gzip.BadGzipFile:
# If not gzip, try direct JSON decode
try:
obj = json.loads(base64.b64decode(payload).decode())
if obj.get("kind") == "ClusterRole" and obj.get("metadata", {}).get("name") in {"externaldns-editor", "externaldns-viewer"}:
print(f'\n{obj["metadata"]["name"]}')
for rule in obj.get("rules", []):
print(" apiGroups:", rule.get("apiGroups"))
print(" resources:", rule.get("resources"))
except:
pass
print("\nExpected for both roles:")
print(" apiGroups: ['externaldns.olm.openshift.io']")
print(" resources: ['externaldnses'] / ['externaldnses/status']")
PYRepository: openshift/external-dns-operator
Length of output: 4285
The generated editor/viewer roles have mismatched RBAC configurations.
The externaldns-editor role uses the correct apiGroup (externaldns.olm.openshift.io) but targets the singular resource externaldns instead of the plural externaldnses. The externaldns-viewer role has two errors: it targets the wrong apiGroup (operator.openshift.io instead of externaldns.olm.openshift.io) and also uses the singular externaldns instead of externaldnses. These misconfigurations prevent the aggregate roles from granting proper access to ExternalDNS objects. Fix the source RBAC definitions/markers and regenerate the bundle/catalog rather than hand-patching the base64.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@catalog/v4.15/catalog.yaml` around lines 871 - 876, The RBAC in the generated
bundle is wrong: update the source role definitions/markers for the ClusterRoles
named externaldns-editor and externaldns-viewer so they use apiGroup
"externaldns.olm.openshift.io" (not "operator.openshift.io") and reference the
plural resource name "externaldnses" (not singular "externaldns"), then re-run
your bundle/catalog generation to produce new base64-encoded olm.bundle.object
entries rather than hand-editing the data; look for the ClusterRole/marker
declarations that produce externaldns-editor and externaldns-viewer to make
these fixes.
|
/lgtm |
|
@alebedev87: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: grzpiotrowski The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/jira refresh |
openshift-ci-robot
added
the
jira/valid-bug
|
@grzpiotrowski: This pull request references Jira Issue OCPBUGS-79591, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
jira/invalid-bug
|
@alebedev87: Jira Issue OCPBUGS-79591: All pull requests linked via external trackers have merged:
Jira Issue OCPBUGS-79591 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
4 participants
Summary
v1.3.4release to all FBC catalog templates (v4.12-v4.22) with the bundle entry instable-v1andstable-v1.3channelsOCP_VERSION=4.x make generate-catalog