OPRUN-4666,OPRUN-4671,OPRUN-4672,OPRUN-4673,OPRUN-4674,OPRUN-4659: Synchronize From Upstream Repositories + Remove spec.serviceAccount tests - #767
Merged
openshift-merge-bot[bot] merged 142 commits intoJul 24, 2026
Conversation
…back (#2791) - Upgrade go.opentelemetry.io/otel/exporters/otlp/otlptrace, otlptracegrpc, and otel/sdk from v1.43.0 to v1.44.0 to match otel, otel/metric, and otel/trace already at v1.44.0 - Move E2E_TIMEOUT fallback from target-specific ?= into the e2e-run-% recipe via $(or $(E2E_TIMEOUT),20m) so the 20m default is explicit and the 25m override from test-experimental-e2e is unambiguous Signed-off-by: Todd Short <tshort@redhat.com> Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.6 to 0.21.7. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.6...v0.21.7) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Convert terminal demos from standalone shell scripts recorded via asciinema to Godog BDD scenarios that generate asciicast v2 files programmatically. This makes demos into verified tests that can never silently break while producing terminal recordings. The recording infrastructure captures kubectl commands and their stdout/stderr with real execution timing during @demo-tagged scenario execution. Per-step dedup handles polling transparently so only successful results appear in the recording. Step text is emitted as comments and commands are colored for readability. Demo scenarios: - ClusterCatalog Quickstart: queries the operatorhubio catalog API - SingleNamespace Install Mode: installs mariadb-operator with a separate watch namespace, verifies rolebindings - OwnNamespace Install Mode: installs mariadb-operator with watch namespace equal to install namespace - Webhook Support: installs telegraf-operator, verifies mutating webhook injects sidecar container into test pod Not converted (no matching demo scenarios): - Synthetic User Permissions: feature gate disabled in experimental - Helm Chart Support: blocked by OCPBUGS-95281 The update-demos Makefile target now builds OLM from source using the experimental e2e infrastructure, deploys with all feature gates and operatorhubio catalog, runs demo scenarios, converts recordings to SVG via svg-term-cli, and tears down the cluster. Demo recordings are embedded in docs via the mkdocs-asciinema-player plugin and served from GitHub Pages, removing the dependency on asciinema.org for hosting recordings. Demo scenarios are excluded from regular e2e test runs via ~@demo filter. CI workflow (update-demos.yaml): - On PR: generates demos, uploads asciicast and SVG files as job artifacts - On merge to main: generates demos, deploys docs with updated recordings via make deploy-docs Old demo shell scripts, the asciinema generate-asciidemo.sh wrapper, and hack/demo/ resource files have been removed. Co-authored-by: Claude <noreply@anthropic.com>
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.38.0 to 0.55.0. - [Commits](golang/net@v0.38.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.8.5 to 1.8.6. - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.8.5...v1.8.6) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jjaruszewski <jjaruszewski@man.poznan.pl>
GitHub Actions does not support expressions in the permissions block. The dynamic expression was causing every workflow run to fail with "workflow file issue" before any job could start. Use static contents:write (matching pages.yaml convention). The deploy step is already gated by `if: github.event_name == 'push'`. Co-authored-by: Claude <noreply@anthropic.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 6.5.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6.4.0...v6.5.0) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.21.3 to 11.0. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@10.21.3...11.0) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: '11.0' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.21.1 to 3.21.2. - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.21.1...v3.21.2) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-version: 3.21.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6.2.0...v6.3.0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Track ClusterObjectSets in addedResources when applied, matching the pattern established for ClusterExtensions in #2783. This removes the special-case cleanup block in ScenarioCleanup and ensures multiple ClusterObjectSets per scenario are all cleaned up correctly. Co-authored-by: Per G. da Silva <pegoncal@redhat.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The HelmChartSupport feature gate (alpha, default off) and all code for detecting, pulling, caching, and loading native Helm chart bundles from OCI registries is removed. The path forward on the next bundle format is unclear and may not be Helm, so maintaining this code is not justified. The Helm backend that converts registry+v1 bundles into Helm chart objects for installation (RegistryV1HelmChartProvider) is unaffected. Co-authored-by: Claude <noreply@anthropic.com>
Bumps [click](https://github.com/pallets/click) from 8.4.1 to 8.4.2. - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md) - [Commits](pallets/click@8.4.1...8.4.2) --- updated-dependencies: - dependency-name: click dependency-version: 8.4.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) from 1.20.2 to 1.20.3. - [Release notes](https://github.com/cert-manager/cert-manager/releases) - [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md) - [Commits](cert-manager/cert-manager@v1.20.2...v1.20.3) --- updated-dependencies: - dependency-name: github.com/cert-manager/cert-manager dependency-version: 1.20.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.46.0 to 0.47.0. - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [regex](https://github.com/mrabarnett/mrab-regex) from 2026.5.9 to 2026.6.28. - [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt) - [Commits](mrabarnett/mrab-regex@2026.5.9...2026.6.28) --- updated-dependencies: - dependency-name: regex dependency-version: 2026.6.28 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](klauspost/compress@v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.3.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4.2.0...v4.3.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 4.0.1 to 4.0.2. - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@v4.0.1...v4.0.2) --- updated-dependencies: - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0. - [Commits](golang/sync@v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* shift to file-based cache, leveraging existing metas indexer * review comments Signed-off-by: grokspawn <jordan@nimblewidget.com> * bounds-protect type evaluation depth Signed-off-by: grokspawn <jordan@nimblewidget.com> * more review comments Signed-off-by: grokspawn <jordan@nimblewidget.com> --------- Signed-off-by: grokspawn <jordan@nimblewidget.com>
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.3.0 to 4.4.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4.3.0...v4.4.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 11.0 to 11.0.1. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@11.0...11.0.1) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 11.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(api): deprecate spec.serviceAccount and adopt cluster-admin scope Mark spec.serviceAccount as deprecated in the ClusterExtension API. Remove PreAuthorizer integration, SA-scoped RBAC templates, and restconfig action. Simplify the controller to use cluster-admin scope directly. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> * feat: add ValidatingAdmissionPolicy for serviceAccount deprecation warning Create VAP and VAPB resources that emit a warning when spec.serviceAccount is set on a ClusterExtension. Add integration test infrastructure for warning collection. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> * test: clean up e2e tests for serviceAccount deprecation Remove SA-specific e2e test scenarios, SA RBAC templates, and the extension developer test suite. Simplify test steps to use cluster-admin scope. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> * refactor: remove per-SA infrastructure and feature gates Delete authentication and authorization packages, feature gates, k8smaintainer tool, SA demo scripts, and documentation. Remove k8s.io/kubernetes dependency and unnecessary k8s staging replace directives. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> * refactor: replace contentmanager with shared TrackingCache Delete the contentmanager package and replace it with boxcutter's shared TrackingCache. Simplify revision engine factory to use the base config directly. Remove SA label constants. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> * docs: update documentation for cluster-admin scope Remove SA-related documentation, tutorials, and demo scripts. Clean up remaining ServiceAccount references from unit tests. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> * Add documentation examples for using ValidatingAdmissionPolicy to protect OLMv1 API access. Signed-off-by: Daniel Franz <dfranz@redhat.com> Co-Authored-By: Predrag Knezevic <pknezevi@redhat.com> Co-Authored-By: Daniel Franz <dfranz@redhat.com> Co-Authored-By: Claude <noreply@anthropic.com> * docs: rewrite cluster-admin scope section in design decisions doc Also updates go.mod/go.sum to fix k8s.io/client-go version. --------- Signed-off-by: Daniel Franz <dfranz@redhat.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Daniel Franz <dfranz@redhat.com> Co-authored-by: Joe Lanford <joe.lanford@gmail.com>
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 3.0.4 to 3.0.5. - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](marocchino/sticky-pull-request-comment@v3.0.4...v3.0.5) --- updated-dependencies: - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@dtfranz: This pull request references OPRUN-4659 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedToo many files! This PR contains 145 files, which is 45 over the limit of 100. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (886)
📒 Files selected for processing (215)
You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests (beta)
|
Set catalog image tags to v5.0 for the 4.23/5.0 release. Dynamically discover an installable package from the serving catalogs instead of hardcoding quay-operator v3.13.10, preferring quay-operator, cluster-logging, serverless-operator, logic-operator in that order then alling back to the first available package. Signed-off-by: Todd Short <tshort@redhat.com>
…ntal manifests HelmChartSupport was removed upstream in dbc9b4a but the downstream experimental.yaml values file and its generated manifest still referenced it, causing operator-controller to crash on startup with: invalid argument "HelmChartSupport=false" for "--feature-gates" flag: unrecognized feature gate: HelmChartSupport This made the OLM cluster operator Degraded/Unavailable and caused cluster installation to time out (exit code 6). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…cluster version Add a second ReleaseGate-eligible OTE test verifying that an operator whose olm.maxOpenShiftVersion exceeds the current cluster version does not block cluster upgrade (InstalledOLMOperatorsUpgradeable stays True). The existing test only covered the blocking path (maxOCPVersion == current version → False). This covers the complementary allow path (maxOCPVersion == next minor → True), directly exercising the normalization logic introduced for the 4.23/5.0 co-release boundary. A nextMinorVersion() helper mirrors the 4.23→5.1 special case so the bundle annotation is always set to the correct next upgrade target. Run 'make build-update' to register the new allow-case test in the extension metadata after adding it to olmv1-incompatible.go. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Todd Short <tshort@redhat.com>
Automate the ClusterExtension rollout failure coverage for OCP-88331 and OCP-88332 by building in-cluster bundle and catalog images for successful and failing bundle versions. The new QE specs verify ProgressDeadlineExceeded on an initial failed rollout and ProbeFailure while upgrading to a bad revision under the BoxCutter runtime. Signed-off-by: Daniel Franz <dfranz@redhat.com> Co-authored-by: Bruno Andrade <bruno.balint@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Todd Short <tshort@redhat.com>
dtfranz
force-pushed
the
synchronize-upstream-sa-dep
branch
from
July 24, 2026 01:13
c570992 to
029dfbd
Compare
Contributor
|
/retest |
Contributor
Author
In addition to above, I've also run an upgrade test which also included this PR, which ran successfully: |
…eAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions Signed-off-by: Daniel Franz <dfranz@redhat.com>
dtfranz
force-pushed
the
synchronize-upstream-sa-dep
branch
from
July 24, 2026 07:45
029dfbd to
4afc954
Compare
Contributor
|
/lgtm |
Contributor
Author
openshift-ci-robot
added
the
verified
|
@dtfranz: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
Author
|
/retest |
Contributor
|
/test openshift-e2e-aws-techpreview |
2 similar comments
Contributor
|
/test openshift-e2e-aws-techpreview |
Contributor
|
/test openshift-e2e-aws-techpreview |
Contributor
|
/hold cancel We'll merge this, and re-apply the lost #769 (assuming github actually merges it). |
openshift-ci
Bot
removed
the
do-not-merge/hold
Contributor
|
@dtfranz: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manual sync to remove
openshift/e2e related to deprecated ServiceAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions.Forked from #762