[redhat-chai-bot]

The example Content-Security-Policy header in the contentSecurityPolicy field doc comment shows object-src 'none', but the console server implementation (BuildCSPDirectives in openshift/console pkg/utils/utils.go) initializes object-src with 'self'.

This corrects the example to match the implementation.

Fixes: OCPBUGS-133500

---

AI-generated. Review for accuracy.

@rhamilto requested from Slack

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[openshift-ci-robot]

@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-133500, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

The example Content-Security-Policy header in the contentSecurityPolicy field doc comment shows object-src 'none', but the console server implementation (BuildCSPDirectives in openshift/console pkg/utils/utils.go) initializes object-src with 'self'.

This corrects the example to match the implementation.

Fixes: OCPBUGS-133500

---

AI-generated. Review for accuracy.

@rhamilto requested from Slack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @redhat-chai-bot! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: openshift/api
• Branch: master
• File: .coderabbit.yaml
• Commit: 085ebf4
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: cd03c4a7-4a7e-4677-b2d7-bb7064a20632

Commits

Reviewing files that changed from the base of the PR and between 085ebf4 and 7d76fcc.

Files selected for processing: 1

• console/v1/types_console_plugin.go

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

Walkthrough

The documented Content-Security-Policy response header example changes object-src 'none' to object-src 'self'. No runtime code or declarations changed.

Suggested reviewers: jhadvig

Priority: Low

Merge Risk: Minimal · previous review 7d76f

No actionable merge-blocking risk remains.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title clearly identifies the documentation correction and specifies the change from 'none' to 'self'.
Description check		The description explains the documentation mismatch, identifies the matching implementation, and links the change to OCPBUGS-133500.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		PASS: The pull request changes only one documentation comment in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds or changes no Ginkgo test titles,…
Test Structure And Quality		PASS: The pull request changes only one documentation example in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds or changes no Ginkgo tests, clust…
Microshift Test Compatibility		The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds no Ginkgo tests and does not reference any…
Single Node Openshift (Sno) Test Compatibility		The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. No Ginkgo e2e tests or test behavior changed, so t…
Topology-Aware Scheduling Compatibility		The pull request changes only one documentation line in console/v1/types_console_plugin.go, updating the example CSP value from object-src 'none' to object-src 'self'. It does not add or modify …
Ote Binary Stdout Contract		The pull request changes only a Go documentation example in console/v1/types_console_plugin.go. It adds no process-level code and no stdout writes. The OTE binary stdout contract is not affected.
Ipv6 And Disconnected Network Test Compatibility		The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds no Ginkgo e2e tests and introduces no IPv4…
No-Weak-Crypto		PASS. The pull request changes one documentation line in console/v1/types_console_plugin.go, replacing CSP object-src 'none' with object-src 'self'. It introduces no MD5, SHA1, DES, RC4, 3DES, B…
Container-Privileges		The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self' in an example CSP header. It does not change a cont…
No-Sensitive-Data-In-Logs		The pull request changes one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds no logging or runtime code and does not expose …

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only one documentation comment in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds or changes no Ginkgo test titles, so no unstable or overly specific test name is introduced.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only one documentation example in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds or changes no Ginkgo tests, cluster operations, waits, assertions, setup, or cleanup. The test-structure requirements are therefore not applicable.

Full details: Microshift Test Compatibility

Explanation

The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds no Ginkgo tests and does not reference any MicroShift-incompatible API, namespace, or feature.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. No Ginkgo e2e tests or test behavior changed, so the SNO compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

The pull request changes only one documentation line in console/v1/types_console_plugin.go, updating the example CSP value from object-src 'none' to object-src 'self'. It does not add or modify deployment manifests, operator code, controllers, replicas, affinity, topology spread, node selection, tolerations, or PDBs. The topology-aware scheduling check is not applicable.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds no Ginkgo e2e tests and introduces no IPv4 assumptions or external connectivity requirements.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request changes one documentation line in console/v1/types_console_plugin.go, replacing CSP object-src 'none' with object-src 'self'. It introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret-comparison logic.

Full details: Container-Privileges

Explanation

The pull request changes only one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self' in an example CSP header. It does not change a container or Kubernetes manifest, and it introduces none of the listed privilege conditions.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request changes one documentation line in console/v1/types_console_plugin.go, replacing object-src 'none' with object-src 'self'. It adds no logging or runtime code and does not expose sensitive data.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[redhat-chai-bot]

/jira refresh

[openshift-ci-robot]

@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-133500, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[redhat-chai-bot]

For context: the original console implementation used object-src 'none' (hardcoded). This was changed to object-src 'self' by @jhadvig in commit 43c9c36f009c (April 28, 2025) as part of OCPBUGS-49291 — a refactor that restructured how CSP directives are built. The example CSP header in this doc comment was never updated to reflect that change, so this PR aligns it with the current implementation.

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

Adding context on the object-src value change.

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

For context: the original console implementation used object-src 'none' (hardcoded). @jhadvig changed it to 'self' in commit 43c9c36f009c (April 2025) as part of OCPBUGS-49291, which restructured how CSP directives are built. This example was never updated to match, so this PR aligns the doc comment with the implementation.

---

AI-generated. Review for accuracy.

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[spadgett]

/lgtm
/hold
Hold for an API reviewer (in case I still am an approver in the repo)

I do worry this doc will continue to drift. If we don't, I think it's at least worth a comment in the openshift/console repo where we build the CSP header that openshift/api should be updated when we change it.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: spadgett
Once this PR has been reviewed and has the lgtm label, please assign everettraven for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[redhat-chai-bot]

Chai test selection for 61de2e0408c2ffa1df916082d3a4ea53d2cc80a0 → master

None.

Reason: All changes are non-functional documentation corrections. The PR changes a single string — object-src 'none' → object-src 'self' — in a doc comment example of a CSP response header on the contentSecurityPolicy field of ConsolePluginSpec (console/v1/types_console_plugin.go). The other 5 files are generated from that source and carry the identical description-text change in CRD manifests, swagger docs, and OpenAPI specs. No Go code, type definitions, kubebuilder markers, validation logic, or schema structure is modified. CRD description fields and OpenAPI description values are informational metadata with no runtime effect. No end-to-end test can exercise a doc comment change.

[redhat-chai-bot]

/pipeline mark-pipeline-gate 61de2e0

[redhat-chai-bot]

Thanks @spadgett! Good suggestion about the code comment — I'll add a note in openshift/console near where we build the CSP header in BuildCSPDirectives to remind future contributors to update the openshift/api doc comment when changing directives.

---

AI-generated. Review for accuracy.

[rhamilto]

I do worry this doc will continue to drift. If we don't, I think it's at least worth a comment in the openshift/console repo where we build the CSP header that openshift/api should be updated when we change it.

Done.

[spadgett]

/hold cancel

[rhamilto]

/hold

The correct value should be none. The docs are right, the code is wrong.

[redhat-chai-bot]

Acknowledged — holding this PR.

If the correct value is object-src 'none' and the console code should be changed back from 'self' to 'none', then this PR is going in the wrong direction and should likely be closed.

Note that console PR openshift/console#17430 also references object-src 'self' in the README — that would need to be updated as well if the code is corrected.

---

AI-generated. Review for accuracy.

[everettraven]

Feel free to ping me if this is decided as the right direction and we still need to merge this PR.

[openshift-ci-robot]

@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-133500. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

The example Content-Security-Policy header in the contentSecurityPolicy field doc comment shows object-src 'none', but the console server implementation (BuildCSPDirectives in openshift/console pkg/utils/utils.go) initializes object-src with 'self'.

This corrects the example to match the implementation.

Fixes: OCPBUGS-133500

---

AI-generated. Review for accuracy.

@rhamilto requested from Slack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.