Skip to content

[SANDBOX-1700] chore: upgrade to OCP 4.21 dependencies#501

Open
metlos wants to merge 3 commits intocodeready-toolchain:masterfrom
metlos:upgrade-ocp-4.21
Open

[SANDBOX-1700] chore: upgrade to OCP 4.21 dependencies#501
metlos wants to merge 3 commits intocodeready-toolchain:masterfrom
metlos:upgrade-ocp-4.21

Conversation

@metlos
Copy link
Copy Markdown
Contributor

@metlos metlos commented Mar 17, 2026

Update openshift/api to release-4.21, k8s.io deps to v0.34.1, controller-runtime to v0.22.0, and controller-tools to v0.19.0.

https://redhat.atlassian.net/browse/SANDBOX-1700

Checks

  1. Did you run make generate target? no
    This would only change controller-gen.kubebuilder.io/version annotation to from 0.18.0 to 0.19.0. No actual changes to the CRDs.

  2. Did make generate change anything in other projects (host-operator, member-operator)? no
    See above

Summary by CodeRabbit

  • Chores
    • Updated core Kubernetes/OpenShift and related tooling dependencies (including controller tooling and YAML libraries) to newer releases to improve compatibility, security, and alignment with upstream changes. Indirect dependency set was also refreshed. These dependency updates do not change public APIs or user-visible behavior.

Update openshift/api to release-4.21, k8s.io deps to v0.34.1,
controller-runtime to v0.22.0, and controller-tools to v0.19.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 17, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 35cb3abb-3844-49cf-8d64-227ef930a897

📥 Commits

Reviewing files that changed from the base of the PR and between 237e681 and b79d763.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
  • go.mod

Walkthrough

Updated Go module dependencies in go.mod: bumped Kubernetes modules (k8s.io/*) from v0.33.4→v0.34.1, advanced OpenShift API pseudo-version to release-4.21, and updated controller tooling (kube-openapi, controller-tools) plus many transitive/indirect modules. No source code or exported API changes.

Changes

Cohort / File(s) Summary
Dependency Version Updates
go.mod
Bumped direct Kubernetes modules k8s.io/api, k8s.io/apimachinery, k8s.io/code-generatorv0.34.1; updated github.com/openshift/api pseudo-version to release-4.21; upgraded k8s.io/kube-openapi and sigs.k8s.io/controller-tools. Updated many indirect/transitive dependencies (e.g., sigs.k8s.io/structured-merge-diff → v6, sigs.k8s.io/yaml → v1.6.0, github.com/emicklei/go-restful/v3, github.com/fxamacker/cbor/v2, golang.org/x/*, Prometheus libs, UUID, json-patch variants, fsnotify, etc.). No code or API surface changes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Description check ❓ Inconclusive The description is incomplete and does not follow the required template structure, missing the Description section preamble and leaving check questions 2 and 4 unanswered. Add a proper Description section with context about the changes, and fully answer check items 2 and 4 regarding other projects and PR links.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically identifies the main change: upgrading to OCP 4.21 dependencies, which matches the primary objective of updating core Kubernetes/OpenShift dependencies in go.mod.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
go.mod (1)

3-5: ⚠️ Potential issue | 🟡 Minor

Document the toolchain version intent if it diverges from CI expectations.

The go 1.24.4 declaration will be used by CI workflows (actions/setup-go reads the go directive), while the toolchain go1.24.13 suggestion only applies locally if toolchain auto-selection is enabled. This creates a potential build environment inconsistency: developers may build and test with Go 1.24.13 while CI validates with Go 1.24.4. If this is intentional for reproducibility/standardization, document it; if unintentional, align the versions.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 3 - 5, The go.mod declares "go 1.24.4" while the
toolchain line is "toolchain go1.24.13", causing CI vs local toolchain mismatch;
either make them identical (update "go 1.24.4" to "go 1.24.13" or change
"toolchain go1.24.13" to match 1.24.4) or add a short comment in the repo README
or a new TOOLCHAIN.md explaining the intentional divergence and which version CI
(go directive) and local toolchain (toolchain directive) should use; update the
go.mod and documentation consistently and mention the authoritative source (CI
uses the go directive).
🧹 Nitpick comments (1)
go.mod (1)

9-10: Update the OpenShift branch comment to match the actual upgrade target.

The inline comment says release-4.20 while this PR upgrades to OCP 4.21 and bumps github.com/openshift/api accordingly. Keeping this stale comment will mislead future dependency updates.

As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 9 - 10, Update the inline comment above the
github.com/openshift/api dependency in go.mod so it reflects the actual target
branch release-4.21 (instead of stale release-4.20) to match the bumped
dependency version; locate the comment near the github.com/openshift/api
v0.0.0-20260304172252-b0658d22beea entry and change the branch name text to
release-4.21.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@go.mod`:
- Around line 3-5: The go.mod declares "go 1.24.4" while the toolchain line is
"toolchain go1.24.13", causing CI vs local toolchain mismatch; either make them
identical (update "go 1.24.4" to "go 1.24.13" or change "toolchain go1.24.13" to
match 1.24.4) or add a short comment in the repo README or a new TOOLCHAIN.md
explaining the intentional divergence and which version CI (go directive) and
local toolchain (toolchain directive) should use; update the go.mod and
documentation consistently and mention the authoritative source (CI uses the go
directive).

---

Nitpick comments:
In `@go.mod`:
- Around line 9-10: Update the inline comment above the github.com/openshift/api
dependency in go.mod so it reflects the actual target branch release-4.21
(instead of stale release-4.20) to match the bumped dependency version; locate
the comment near the github.com/openshift/api v0.0.0-20260304172252-b0658d22beea
entry and change the branch name text to release-4.21.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d0eebf58-f13f-4c9d-95ae-d5753bc60056

📥 Commits

Reviewing files that changed from the base of the PR and between 4ff0e6b and f94bc6f.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • go.mod

go.mod Outdated
@@ -7,54 +7,56 @@ toolchain go1.24.13
require (
github.com/go-bindata/go-bindata v3.1.2+incompatible
// using latest commit from 'github.com/openshift/api branch release-4.20'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// using latest commit from 'github.com/openshift/api branch release-4.20'
// using latest commit from 'github.com/openshift/api branch release-4.21'

Comment on lines +11 to +13
k8s.io/api v0.34.1
k8s.io/apimachinery v0.34.1
k8s.io/code-generator v0.34.1
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

out of curiosity, why not using v0.34.4 version?
Also these seems to be a mismatch between this repo and the other ones. I know that it's a z-stream, so it should be just a detail, but let's try to keep it consistent

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 regarding keeping the same version in each repo

However, I have a concern. Openshift 4.21 uses k8s 1.34 but operator-sdk latest tag 1.42.1 still uses 1.33.

According to Kanika's guideline:

In the case that the Kubernetes version is not the same in the above two projects, then either use the smaller version of the two in which case the dependencies may not be the most up to date or wait for a version of the project that both support the same Kubernetes version.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep, I noticed this, too. Should be fixed now and everything should be using the exact versions as the versions in OCP 4.21. That uses k8s* v0.34.1, so I wanted to be exact to limit the possibility of surprise.

go.mod Outdated
sigs.k8s.io/controller-runtime v0.21.0
sigs.k8s.io/controller-tools v0.18.0
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
sigs.k8s.io/controller-runtime v0.22.1
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you "pick" this version? (Asking for learning purposes, I usually align with operator-sdk)

The 0.22.x causes different kinds of problems
with SSA in the fake client that are not worth upgrading to.
@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants