[eslutsky]

Goal

Keep MicroShift cert-manager rebases aligned with the latest released OPM manifest so the checked-in cert-manager release metadata does not drift behind the current stable-v1 bundle.

Summary

• Add a detect OPM_RELEASE_IMAGE command to rebase_cert_manager.sh that compares the checked-in cert-manager version with the latest version in the target release stream and reports whether a rebase is needed.
• Use the same OPM version lookup in the normal rebase image update path, keeping detection and rebase version selection consistent.
• Keep the detection in the existing rebase script without a separate hook or documentation file.

Validation

• bash -n scripts/auto-rebase/rebase_cert_manager.sh
• Ran detection against OPM 4.22 and 5.0 catalogs. Both reported current 1.20.0, latest 1.20.1, action rebase.

Summary by CodeRabbit

• Chores
  • Added a version check that reports the current and latest available cert-manager versions and indicates whether an update is needed.
  • Version checks now return an error if the manifest cannot be rendered or version information cannot be found.

[openshift-ci-robot]

@eslutsky: This pull request references USHIFT-7601 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

• Add a detect OPM_RELEASE_IMAGE command to rebase_cert_manager.sh that reports the checked-in cert-manager version, latest stable-v1 OPM version, and whether a rebase is needed.
• Reuse the version lookup during normal cert-manager image updates.
• Keep detection in the existing rebase script without a separate hook or documentation file.

Validation

• bash -n scripts/auto-rebase/rebase_cert_manager.sh
• Ran detection against OPM 4.22 and 5.0 catalogs. Both reported current 1.20.0, latest 1.20.1, action rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[coderabbitai]

Walkthrough

The script adds version-drift detection for cert-manager operator manifests. It renders the operator index, compares its latest bundle version with the checked-in release version, and reports whether the action is none or rebase. The download flow also uses the shared rendering and version lookup helpers.

Changes

Cert-manager version detection

Layer / File(s)	Summary
Render index and retrieve versions scripts/auto-rebase/rebase_cert_manager.sh	Adds helpers to render the operator index, select the latest stable-v1 bundle, and read versions from the index and release metadata. The download flow now uses these helpers.
Detect version drift scripts/auto-rebase/rebase_cert_manager.sh	Adds the detect command. It compares the checked-in release version with the latest rendered-index version and prints both versions and the resulting action.

Priority: Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant detect_cert_manager_version
  participant render_operator_index
  participant opm
  participant ReleaseMetadata
  CLI->>detect_cert_manager_version: pass operator manifest
  detect_cert_manager_version->>render_operator_index: render operator index
  render_operator_index->>opm: render manifest
  opm-->>render_operator_index: return rendered index
  detect_cert_manager_version->>ReleaseMetadata: read current release version
  detect_cert_manager_version->>detect_cert_manager_version: compare current and latest versions
  detect_cert_manager_version-->>CLI: print versions and action

Loading

Suggested reviewers: pmtk

Merge Risk: Minimal · up to af3eb

This PR adds a detect command that reports whether the checked-in cert-manager version differs from the latest stable-v1 bundle, and reuses shared helpers in the download flow. The one open question is whether the last channel entry is always the newest bundle. That assumption predates this PR and is unconfirmed, so it does not block merging.

Pre-merge checks: 14 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 14 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding cert-manager version detection.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		PASS: The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds shell functions and command output, but no Ginkgo test titles or test-title metadata. No dynamic test na…
Test Structure And Quality		The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. It adds no Ginkgo tests or It blocks, so the test-structure requirements do not apply.
Microshift Test Compatibility		PASS: The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds shell functions and a command; it adds no Ginkgo e2e tests or other tests that reference MicroShift-inco…
Single Node Openshift (Sno) Test Compatibility		PASS — The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. It adds shell functions and a detect command. It adds no Ginkgo e2e tests or other test code, so no SNO multi-node …
Topology-Aware Scheduling Compatibility		PASS: The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds version lookup, rendering, and command dispatch logic. It does not add or modify deployment manifests, o…
Ote Binary Stdout Contract		PASS: The pull request changes only the Bash script scripts/auto-rebase/rebase_cert_manager.sh. It does not modify an OpenShift Tests Extension binary or process-level Go suite code. Its echo outp…
Ipv6 And Disconnected Network Test Compatibility		The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. It adds no Ginkgo e2e tests, so the IPv4 and external-connectivity test compatibility criteria do not apply.
No-Weak-Crypto		The pull request changes only cert-manager rendering, version lookup, and dispatch logic. The added code does not use MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB mode. It adds no custom cryptography a…
Container-Privileges		The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds shell functions and command dispatch, not a container or Kubernetes manifest. No introduced privileged: true…
No-Sensitive-Data-In-Logs		The changed script does not log passwords, tokens, API keys, PII, session IDs, hostnames, or customer data. New output contains only cert-manager versions and the action (none or rebase). Pull-sec…

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds shell functions and command output, but no Ginkgo test titles or test-title metadata. No dynamic test name condition applies.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds shell functions and a command; it adds no Ginkgo e2e tests or other tests that reference MicroShift-incompatible APIs or features.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS — The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. It adds shell functions and a detect command. It adds no Ginkgo e2e tests or other test code, so no SNO multi-node compatibility check applies.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds version lookup, rendering, and command dispatch logic. It does not add or modify deployment manifests, operator code, controllers, replica settings, affinity, topology spread constraints, node selectors, tolerations, or PDBs. Therefore, it introduces no topology-dependent scheduling constraint.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only the Bash script scripts/auto-rebase/rebase_cert_manager.sh. It does not modify an OpenShift Tests Extension binary or process-level Go suite code. Its echo output is outside this check's scope.

Full details: No-Weak-Crypto

Explanation

The pull request changes only cert-manager rendering, version lookup, and dispatch logic. The added code does not use MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB mode. It adds no custom cryptography and does not compare secrets or tokens.

Full details: Container-Privileges

Explanation

The pull request changes only scripts/auto-rebase/rebase_cert_manager.sh. The diff adds shell functions and command dispatch, not a container or Kubernetes manifest. No introduced privileged: true, host PID/network/IPC settings, SYS_ADMIN capability, allowPrivilegeEscalation: true, or root container configuration was found.

Full details: No-Sensitive-Data-In-Logs

Explanation

The changed script does not log passwords, tokens, API keys, PII, session IDs, hostnames, or customer data. New output contains only cert-manager versions and the action (none or rebase). Pull-secret use passes only file paths to commands and never prints the file contents.

Full details: Docstring Coverage

Explanation

Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 1 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eslutsky

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eslutsky]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

🔇 Additional comments: 1

scripts/auto-rebase/rebase_cert_manager.sh-98-98: 1

98-98: Major · Functional Correctness · Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Select the stable-v1 channel head, not the final entry.

A valid OLM channel can list its newest bundle first and older bundles last. In that case, .entries[-1] selects an older bundle. detect can then print action: none when a rebase is needed, and download can select the older bundle. Identify the head from the channel’s upgrade edges instead of relying on entry order. (olm.operatorframework.io)

---

Review info

Run configuration

• Source mode: Auto
• Repository: openshift/microshift
• Branch: main
• File: .coderabbit.yaml
• Commit: d0d7747
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 23ed2f96-b95a-4163-98f9-a65d053cfacf

Commits

Reviewing files that changed from the base of the PR and between d0d7747 and af3ebcb.

Files selected for processing: 1

• scripts/auto-rebase/rebase_cert_manager.sh

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[openshift-ci]

@eslutsky: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.