OCPBUGS-23969,OCPBUGS-64886: Merge https://github.com/k8snetworkplumbingwg/sriov-network-operator:master into main#1230
Open
SchSeba wants to merge 19 commits into
Open
OCPBUGS-23969,OCPBUGS-64886: Merge https://github.com/k8snetworkplumbingwg/sriov-network-operator:master into main#1230SchSeba wants to merge 19 commits into
SchSeba wants to merge 19 commits into
Conversation
Signed-off-by: Sebastian Sch <sebassch@gmail.com>
add validation webhooks for netfilter nic selector
When a SriovNetwork has a LASTNETWORKNAMESPACE annotation pointing to a namespace where the old NetworkAttachmentDefinition no longer exists, the reconciler returned a NotFound error and blocked creation of the new NAD. Handle NotFound errors gracefully by logging and continuing, so cleanup of non-existent resources does not prevent forward progress. Also fixes swapped Namespace/Name fields in the error log message. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci
Bot
added
the
approved
Fix the rdma test, when the device plugin is restarted, the allocatable resource goes to 0 and then back to the original value that caused the test to fail. To not have a flaky test we don't use the consistency check, but an eventually check. Signed-off-by: Sebastian Sch <sebassch@gmail.com>
Fix NAD creation blocked by stale LASTNETWORKNAMESPACE annotation
SchSeba
force-pushed
the
merge-bot-master
branch
5 times, most recently
from
1975115 to
a726344
Compare
fix rdma test
A node can start with Drain_Required, which only triggers a partial drain for SR-IOV workloads. If the daemon later detects that the same change also requires a reboot, such as an RDMA subsystem mode change or firmware-related update, it could observe DrainComplete and proceed to reboot even though the node never went through a full drain. Fix this by resetting the desired drain state back to Idle whenever a reboot becomes required during or after a partial drain. This forces the operator to finish the rollback to Idle, after which the daemon re-requests Reboot_Required and gets a full drain before rebooting. Add daemon tests that cover the drain-to-reboot escalation flow and the main non-regression cases around partial and full drain handling. Signed-off-by: Sebastian Sch <sebassch@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
SchSeba
force-pushed
the
merge-bot-master
branch
7 times, most recently
from
7b8bf41 to
8e66677
Compare
Contributor
Author
|
/retitle OCPBUGS-64886: Merge https://github.com/k8snetworkplumbingwg/sriov-network-operator:master into main |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
Contributor
|
@SchSeba: This pull request references Jira Issue OCPBUGS-64886, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
Author
|
/jira refresh |
SchSeba
force-pushed
the
merge-bot-master
branch
from
793b6ee to
02e7d42
Compare
SchSeba
force-pushed
the
merge-bot-master
branch
2 times, most recently
from
a4e9c5e to
8d80384
Compare
fix(daemon): require a full drain before reboot escalation
This commit add support for Cyphers and Version in the TLS configuration. We pass the variables for the following components * operator-webhook * resource-injector * metrics exporter rbac-proxy In case of openshift cluster we add a watch to the API config CR, so if the user update the cluster level CR with custom TLS configuration our operator will follow the same configuration Signed-off-by: Sebastian Sch <sebassch@gmail.com>
SchSeba
force-pushed
the
merge-bot-master
branch
from
8d80384 to
3a520eb
Compare
Signed-off-by: Sebastian Sch <sebassch@gmail.com>
…Spec Bump openshift/api to release-5.0 which adds the Groups field to TLSProfileSpec (openshift/api#2583). This allows configuring TLS supported groups (formerly elliptic curves) for the TLS handshake, including post-quantum hybrid groups like X25519MLKEM768. Changes: - Add CurvePreferences field to consts.TLSConfig and wire it through the full TLS configuration pipeline (orchestrator, controller, templates, webhook) - Extract Groups from the OpenShift APIServer TLS profile and propagate to operand DaemonSets via --tls-curve-preferences flag - Operator converts group names to numeric CurveID values before passing to the webhook, matching the Kubernetes apiserver pattern (fs.Int32SliceVar for --tls-curve-preferences) - Webhook accepts numeric Go crypto/tls CurveID values directly (e.g. 29,23,24) without hardcoded validation; supported values depend on the Go version used - Add TLS_CURVE_PREFERENCES env var for vanilla Kubernetes (Helm values and deploy manifest) - Add CurveNamesToIDs() to convert group names to numeric IDs in the operator controller before rendering webhook manifests - Add ParseCurvePreferencesFromIDs() for the webhook to parse numeric CurveID values into []tls.CurveID - Add TODO for kube-rbac-proxy curve preferences support (blocked on kube-rbac-proxy/kube-rbac-proxy#414) - Update test CRD to CustomNoUpgrade variant with groups field - Refactor conformance tests: extract operandTLSTarget list and assertAllOperandsHaveTLSArgs helper to reduce duplication - Add unit tests for curve preferences in utils, orchestrator, and controller packages Signed-off-by: Sebastian Sch <sebassch@gmail.com>
Contributor
|
/retest |
Contributor
|
@zeeke: Only users can be targets for the DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Enable TLS cipher, version, and curve preferences control across operator components
SchSeba
force-pushed
the
merge-bot-master
branch
from
3a520eb to
c87fca2
Compare
Contributor
|
/retest |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: SchSeba, zeeke The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 tasks
openshift-merge-bot Bot
pushed a commit
that referenced
this pull request
Jul 2, 2026
The upstream merge (PR #1230) adds a watch on APIServer resources for TLS cipher/version control. Add the apiservers RBAC permission to the CSV files, deploy clusterrole, and Helm chart so the operator ServiceAccount can get/list/watch config.openshift.io apiservers. Without this, OLM-installed operators crash on startup because the informer for APIServer objects is denied by RBAC. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
New changes are detected. LGTM label has been removed. |
Contributor
|
@SchSeba: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.