NO-ISSUE: rebase 5.0 with metrics-client-ca fix by redhat-chai-bot · Pull Request #7418 · openshift/microshift

redhat-chai-bot · 2026-09-22T11:20:05Z

Summary

This is the main-targeted PR based on the rebase branch from PR #7410, with the restricted-v2 metrics CA fix included so standard presubmits can run against main.

The rebase changed the metrics CA volume in kube-state-metrics and node-exporter from the runtime-provided metrics-client-ca ConfigMap to an admin-kubeconfig-signer-ca hostPath. The follow-up commit restores the existing ConfigMap contract in the generator and generated manifests so the workloads use /etc/tls/client/client-ca.crt.

Fix commit

86fd3721331c097a24104e70d28ce7a8f3abb5cc — NO-ISSUE: restore metrics client CA ConfigMap

Validation

Targeted YAML and ConfigMap contract assertions
Generator static checks
bash -n and shellcheck
make verify-sh
git diff --check

make verify-assets was blocked before asset validation by the workspace Python 3.13 and pinned PyYAML 3.12 incompatibility (collections.Hashable).

AI-generated. Review for accuracy.

@pmtk requested via Chai Bot

Summary by CodeRabbit

New Features
- Added Kubernetes Volume Group Snapshot resources with stable v1 API support.
- Added SELinux conflict status reporting through the cluster configuration.
- Added CSI volume group snapshot support and validation.
- Added improved certificate-manager Azure DNS zone selection and resource filtering.
Bug Fixes
- Improved OVN startup recovery, job status accuracy, kubelet resource handling, and etcd member promotion reliability.
- Improved router client certificate, error-page, and access-logging configuration.
- Improved KServe deployment retries and namespace deletion verification.
Updates
- Refreshed Kubernetes, OpenShift, networking, monitoring, storage, and certificate-management component releases and images.

The docker.io/nginxinc/nginx-unprivileged:latest image is a multi-arch manifest list with 14 platform variants. When mirroring with `skopeo copy --all --preserve-digests`, Quay v3.11.7 rejects one of the platform manifests as "manifest invalid", causing the mirror step to fail and aborting CI jobs (e.g. e2e-aws-tests-arm). These test pods only run `sleep 1d` and do not use any nginx functionality, so replace the image with quay.io/microshift/busybox:1.36 which is already mirrored as a single-arch image. This eliminates the problematic multi-arch manifest list from the mirror set entirely. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The busybox image does not include /bin/bash. The Oc Exec Robot keyword hardcoded /bin/bash -c for oc exec commands, causing failures when exec'ing into busybox-based pods. Switch to /bin/sh which is available in all containers and sufficient for the POSIX commands used in tests (echo, cat, ls, grep, etc.). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…rry-pick-7199-to-release-5.0 [release-5.0] USHIFT-7451: replace nginx-unprivileged with busybox in test assets

Signed-off-by: Evgeny Slutsky <eslutsky@redhat.com>

…0.0-0.nightly-2026-08-18-203845_amd64-2026-08-18_arm64-2026-08-18 NO-ISSUE: rebase-release-5.0.0-0.nightly-2026-08-18-203845_amd64-2026-08-18-145649_arm64

…rry-pick-7224-to-release-5.0 [release-5.0] USHIFT-7465: Fix issue filtering for rebase

Signed-off-by: Evgeny Slutsky <eslutsky@redhat.com>

USHIFT-7487: bump cri-o version to 5.0 according to art new builds

…e-vm.sh

USHIFT-7488: Fix repo priority when building from sources in configur…

…2026-08-30_arm64-2026-08-30 (openshift#7279) * update last_rebase.sh * update changelog * update component images * update manifests * update buildfiles * update cbom * Update AI Model Serving for MicroShift * Update SR-IOV for MicroShift --------- Co-authored-by: microshift-rebase-script[bot] <114237296+microshift-rebase-script[bot]@users.noreply.github.com>

The cri-o package was rebranded from 1.36.x to 5.0.0 versioning, making the ec.6 RPMs on the dev-preview mirror unsatisfiable (requires cri-o >= 1.36.0, < 1.37.0 but only 5.0.0 is available). Point to the RC mirror where rc.0 RPMs have correct dependencies. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

The gitops repo advanced to 1.21, causing the manage_common_versions.sh verify step to reject the stale 1.19 value. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

Add ostree (.toml) and bootc (.containerfile) image blueprints for RHEL 9.8 with y-1 (4.22) and y-2 (4.21) MicroShift versions. These start images are prerequisites for the el98→el98 upgrade CI scenarios added in subsequent commits. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

Test RPM-based upgrade from MicroShift 4.21 (y-2) to 5.0 on RHEL 9.8 using the YMINUS2 release repo and brew RPMs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

…on RHEL 9.8 Test ostree upgrades from MicroShift 4.22 (y-1) and 4.21 (y-2) to 5.0 on RHEL 9.8 with LVMS workload validation and standard1+standard2 suites. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

…n RHEL 9.8 Test bootc upgrades from MicroShift 4.22 (y-1) and 4.21 (y-2) to 5.0 on RHEL 9.8 with LVMS workload validation and standard1+standard2 suites. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

…rry-pick-7381-to-release-5.0 [release-5.0] USHIFT-7518: Support volume group snapshots

…ession) tuned 2.28.0-1.el9fdp regressed the [bootloader] plugin so that, on traditionally-deployed rpm-ostree hosts, the microshift-baseline kernel arguments are no longer persisted to the BLS boot entry (tuned-adm returns 0 but /proc/cmdline is unchanged after reboot). This is a real, shipping defect: the low-latency profile is broken in the field for anyone on tuned 2.28.0, so there is nothing valid to gate PRs on until it is fixed. The composer image cannot be pinned to an older tuned (the edge-commit image-type package set requests tuned unversioned, so a blueprint version pin only produces a depsolve "conflicting requests" error), and downgrading tuned at runtime would only produce a false-green against a version the shipped image does not contain. So the scenario is disabled by renaming it with a .disabled suffix (the harness only runs *.sh scenarios), leaving the test intact for an easy revert. Re-enable by renaming the file back to el98-src@low-latency.sh once the fixed tuned build lands in el9fdp. Tracked by OCPBUGS-123681 (depends on tuned RHEL-261119). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…rry-pick-7376-to-release-5.0 [release-5.0] OCPBUGS-126622: Add startupProbe to ovnk pods

…rry-pick-7384-to-release-5.0 [release-5.0] OCPBUGS-126612: Disable el98 low-latency presubmit (tuned 2.28.0 regression)

openshift-merge-bot · 2026-09-22T11:20:09Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-22T11:20:10Z

@redhat-chai-bot: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

This is the main-targeted PR based on the rebase branch from PR #7410, with the restricted-v2 metrics CA fix included so standard presubmits can run against main.

The rebase changed the metrics CA volume in kube-state-metrics and node-exporter from the runtime-provided metrics-client-ca ConfigMap to an admin-kubeconfig-signer-ca hostPath. The follow-up commit restores the existing ConfigMap contract in the generator and generated manifests so the workloads use /etc/tls/client/client-ca.crt.

Fix commit

86fd3721331c097a24104e70d28ce7a8f3abb5cc — NO-ISSUE: restore metrics client CA ConfigMap

Validation

Targeted YAML and ConfigMap contract assertions

Generator static checks

bash -n and shellcheck

make verify-sh

git diff --check

make verify-assets was blocked before asset validation by the workspace Python 3.13 and pinned PyYAML 3.12 incompatibility (collections.Hashable).

AI-generated. Review for accuracy.

@pmtk requested via Chai Bot

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-22T11:20:23Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-09-22T11:20:35Z

Walkthrough

Warning

Review details and warnings were omitted to fit the comment limit.

openshift-ci · 2026-09-22T11:22:09Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign jerpeter1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-09-22T11:31:15Z

@redhat-chai-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/test-unit	`86fd372`	link	true	`/test test-unit`
ci/prow/verify	`86fd372`	link	true	`/test verify`
ci/prow/verify-deps	`86fd372`	link	true	`/test verify-deps`
ci/prow/images	`86fd372`	link	false	`/test images`
ci/prow/test-rpm	`86fd372`	link	true	`/test test-rpm`
ci/prow/test-rebase	`86fd372`	link	false	`/test test-rebase`
ci/prow/ocp-full-conformance-serial-rhel-eus	`86fd372`	link	true	`/test ocp-full-conformance-serial-rhel-eus`
ci/prow/ocp-full-conformance-rhel-eus	`86fd372`	link	true	`/test ocp-full-conformance-rhel-eus`
ci/prow/security	`86fd372`	link	false	`/test security`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

eslutsky and others added 30 commits August 18, 2026 09:31

Merge pull request openshift#7205 from openshift-cherrypick-robot/che…

df80107

…rry-pick-7199-to-release-5.0 [release-5.0] USHIFT-7451: replace nginx-unprivileged with busybox in test assets

update last_rebase.sh

b4864eb

update changelog

a2f96de

update microshift/go.mod

32650f0

update microshift/deps

0dd7183

update microshift/vendor

97511bd

update etcd/go.mod

7dac1e0

update etcd/vendor

24dfbf5

update component images

c3ac7f6

update manifests

58cc883

update buildfiles

c34d494

update cbom

f26795b

include the newly-added service-ca-controller configmap in assets

57030ee

Signed-off-by: Evgeny Slutsky <eslutsky@redhat.com>

Merge pull request openshift#7221 from eslutsky/rebase-release-5.0-5.…

00a7f8e

…0.0-0.nightly-2026-08-18-203845_amd64-2026-08-18_arm64-2026-08-18 NO-ISSUE: rebase-release-5.0.0-0.nightly-2026-08-18-203845_amd64-2026-08-18-145649_arm64

USHIFT-7465: Fix issue filtering for rebase

dc392b7

Merge pull request openshift#7225 from openshift-cherrypick-robot/che…

ab25d11

…rry-pick-7224-to-release-5.0 [release-5.0] USHIFT-7465: Fix issue filtering for rebase

bump cri-o version to 5.0 according to art new builds

a95c646

Signed-off-by: Evgeny Slutsky <eslutsky@redhat.com>

Merge pull request openshift#7247 from eslutsky/bump-crio-5.0

dba32f6

USHIFT-7487: bump cri-o version to 5.0 according to art new builds

USHIFT-7488: Fix repo priority when building from sources in configur…

b6cc0c6

…e-vm.sh

Merge pull request openshift#7264 from pacevedom/USHIFT-7488-5.0

712c9db

USHIFT-7488: Fix repo priority when building from sources in configur…

USHIFT-7491: Add "/pipeline auto" comment to auto-rebase

30dcaa7

fix: update GITOPS_VERSION from 1.19 to 1.21

0e8b46d

The gitops repo advanced to 1.21, causing the manage_common_versions.sh verify step to reject the stale 1.19 value. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

openshift-merge-bot Bot and others added 19 commits September 17, 2026 08:14

Merge pull request openshift#7385 from openshift-cherrypick-robot/che…

27c414b

…rry-pick-7381-to-release-5.0 [release-5.0] USHIFT-7518: Support volume group snapshots

OCPBUGS-122385: Add startupProbe to ovnk pods

b779f4b

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Merge pull request openshift#7401 from openshift-cherrypick-robot/che…

9b9670b

…rry-pick-7376-to-release-5.0 [release-5.0] OCPBUGS-126622: Add startupProbe to ovnk pods

Merge pull request openshift#7399 from openshift-cherrypick-robot/che…

7df60bb

…rry-pick-7384-to-release-5.0 [release-5.0] OCPBUGS-126612: Disable el98 low-latency presubmit (tuned 2.28.0 regression)

update last_rebase.sh

dad4b7b

update changelog

3c85d45

update microshift/go.mod

b9481ef

update microshift/deps

8cce169

update microshift/vendor

273f0db

update etcd/go.mod

bd0ac47

update etcd/vendor

30e3ca5

update component images

84391c2

update manifests

f3cb724

update buildfiles

5fc2aca

Update SR-IOV for MicroShift

7472afa

update cluster-monitoring-operator manifests and images

d1f4dd1

update last_rebase_cluster_monitoring_operator.sh

dc7f8ec

NO-ISSUE: restore metrics client CA ConfigMap

86fd372

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 22, 2026

openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 22, 2026

openshift-ci Bot requested review from agullon and eslutsky September 22, 2026 11:22

redhat-chai-bot closed this Sep 22, 2026

Navigation Menu

NO-ISSUE: rebase 5.0 with metrics-client-ca fix - #7418

NO-ISSUE: rebase 5.0 with metrics-client-ca fix#7418
redhat-chai-bot wants to merge 95 commits into
openshift:mainfrom
redhat-chai-bot:chai/fix-pr-7410-metrics-client-ca

redhat-chai-bot commented Sep 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-merge-bot Bot commented Sep 22, 2026

Uh oh!

openshift-ci-robot commented Sep 22, 2026

Summary

Fix commit

Validation

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

coderabbitai Bot commented Sep 22, 2026

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

redhat-chai-bot commented Sep 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix commit

Validation

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Sep 22, 2026

Uh oh!

openshift-ci-robot commented Sep 22, 2026

Summary

Fix commit

Validation

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

coderabbitai Bot commented Sep 22, 2026

Walkthrough

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

redhat-chai-bot commented Sep 22, 2026 •

edited by coderabbitai Bot

Loading