TRT-2586: Revert "NE-2471: Replace OLM-based Istio install with Sail Library"#1397
Closed
stbenjam wants to merge 2 commits intoopenshift:masterfrom
Closed
TRT-2586: Revert "NE-2471: Replace OLM-based Istio install with Sail Library"#1397stbenjam wants to merge 2 commits intoopenshift:masterfrom
stbenjam wants to merge 2 commits intoopenshift:masterfrom
Conversation
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@stbenjam: This pull request references NE-2471 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
@stbenjam: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Member
Author
|
/payload-job periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview |
📝 WalkthroughWalkthroughThis pull request removes Sail Library integration across the ingress operator codebase. Changes include: removing Go module dependencies related to Sail Library, deleting manifest files for the ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment Tip CodeRabbit can use Trivy to scan for security misconfigurations and secrets in Infrastructure as Code files.Add a .trivyignore file to your project to customize which findings Trivy reports. |
Contributor
|
@stbenjam: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/bcfc5f40-246c-11f1-9edf-90bb0aa8015c-0 |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
stbenjam
changed the title
Contributor
|
@stbenjam: This pull request references TRT-2586 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
manifests/00-custom-resource-definition.yaml (1)
2030-2035:⚠️ Potential issue | 🟠 MajorConflicting
minTLSVersionguidance vs enum valuesThe new note says the highest allowed value is
VersionTLS12, but this same schema still allowsVersionTLS13via enum. This contradiction will mislead API consumers and docs generation.Please align the note and enum (either remove/update the note or enforce the intended cap in schema).
Also applies to: 3327-3333
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@manifests/00-custom-resource-definition.yaml` around lines 2030 - 2035, The CRD currently has conflicting guidance for minTLSVersion: the inline NOTE states the highest allowed is VersionTLS12 while the enum for minTLSVersion still includes VersionTLS13; pick one consistent intent and update the schema and doc comment accordingly — either remove VersionTLS13 from the enum (so minTLSVersion enum only lists VersionTLS10, VersionTLS11, VersionTLS12) or change the note to allow VersionTLS13, and apply the same change to the other identical minTLSVersion block (the second occurrence) so both the NOTE and the enum values for minTLSVersion (VersionTLS10/11/12/13) are consistent.pkg/operator/controller/gatewayclass/controller.go (1)
107-135:⚠️ Potential issue | 🔴 CriticalAdd capability flags to gatewayclass controller Config and guard the OLM-only watches.
The
SubscriptionandInstallPlanwatches at lines 110 and 133 are set up unconditionally during controller creation, but these APIs only exist when the "OperatorLifecycleManager" and "marketplace" capabilities are enabled. On clusters without these capabilities, watch setup will fail duringNewUnmanaged(), causing operator startup to fail—even though the parentgatewayapicontroller gates whether dependent controllers are actually started.Pass
MarketplaceEnabledandOperatorLifecycleManagerEnabledto the gatewayclassConfigstruct and conditionally set up the OLM watches only when both capabilities are enabled. This matches the pattern already used instatusandgatewayapicontrollers.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/operator/controller/gatewayclass/controller.go` around lines 107 - 135, Add MarketplaceEnabled and OperatorLifecycleManagerEnabled boolean fields to the gatewayclass controller Config and only register the OLM-related watches when both are true: wrap the Subscription watch (predicate isServiceMeshSubscription and reconciler.enqueueRequestForSomeGatewayClass()) and the InstallPlan watch (predicates isOurInstallPlan and isInstallPlanReadyForApproval with reconciler.enqueueRequestForSomeGatewayClass()) in a conditional that checks cfg.MarketplaceEnabled && cfg.OperatorLifecycleManagerEnabled; leave all other logic and predicates unchanged so watches are only set up when those capabilities are present.
🧹 Nitpick comments (1)
pkg/operator/controller/status/controller.go (1)
483-502: Skip the cluster-wide Subscription scan until Gateway API is actually requested.
r.subscriptionCache.List(...)now runs on every status reconcile whenever OLM+marketplace are enabled, even when there are noopenshift.io/gateway-controller/v1classes. That makes this path O(total subscriptions) for clusters that are not using Gateway API.♻️ Proposed change
- state.expectedGatewayAPIOperatorVersion = r.config.GatewayAPIOperatorVersion - subscriptionList := operatorsv1alpha1.SubscriptionList{} - if err := r.subscriptionCache.List(ctx, &subscriptionList); err != nil { - return state, fmt.Errorf("failed to get subscriptions: %w", err) - } - for _, subscription := range subscriptionList.Items { - if subscription.Spec != nil && ossmSubscriptions.Has(subscription.Spec.Package) { - state.ossmSubscriptions = append(state.ossmSubscriptions, subscription) - } - } - gatewayClassList := gatewayapiv1.GatewayClassList{} if err := r.cache.List(ctx, &gatewayClassList, client.MatchingFields{ operatorcontroller.GatewayClassIndexFieldName: operatorcontroller.OpenShiftGatewayClassControllerName, }); err != nil { return state, fmt.Errorf("failed to list gateway classes: %w", err) } // If one or more gateway classes have ControllerName=operatorcontroller.OpenShiftGatewayClassControllerName, // the ingress operator should try to install OSSM. - state.shouldInstallOSSM = (len(gatewayClassList.Items) > 0) + state.shouldInstallOSSM = len(gatewayClassList.Items) > 0 + if state.shouldInstallOSSM { + state.expectedGatewayAPIOperatorVersion = r.config.GatewayAPIOperatorVersion + subscriptionList := operatorsv1alpha1.SubscriptionList{} + if err := r.subscriptionCache.List(ctx, &subscriptionList); err != nil { + return state, fmt.Errorf("failed to get subscriptions: %w", err) + } + for _, subscription := range subscriptionList.Items { + if subscription.Spec != nil && ossmSubscriptions.Has(subscription.Spec.Package) { + state.ossmSubscriptions = append(state.ossmSubscriptions, subscription) + } + } + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/operator/controller/status/controller.go` around lines 483 - 502, Currently the code always calls r.subscriptionCache.List(...) and scans all Subscriptions even when Gateway API isn't present; change the logic to first list GatewayClass (using r.cache.List with operatorcontroller.GatewayClassIndexFieldName / OpenShiftGatewayClassControllerName) and set state.shouldInstallOSSM, and only if state.shouldInstallOSSM is true then call r.subscriptionCache.List(...) to populate state.ossmSubscriptions (filtering by ossmSubscriptions.Has(subscription.Spec.Package)); keep assignment of state.expectedGatewayAPIOperatorVersion as before.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 37: Update the pinned grpc module in go.mod: replace the existing
google.golang.org/grpc v1.75.1 entry with v1.79.3 (or a later patch) to address
GHSA-p77j-4mvh-x3m3, then refresh module files so the updated version is
reflected (update dependencies and lockfile/go.sum) and verify the project
builds/tests pass; the change targets the google.golang.org/grpc version line
currently set to v1.75.1.
In `@manifests/00-custom-resource-definition.yaml`:
- Around line 2014-2017: The example under the ciphers list uses the weak legacy
cipher "DES-CBC3-SHA"; update the example to a modern, secure suite (e.g., an
ECDHE-AES-GCM or CHACHA20-based cipher) wherever the generic "ciphers" example
appears (refer to the ciphers key/example and the specific example value
"DES-CBC3-SHA"), and ensure legacy suites are only shown in explicit
compatibility sections (also apply the same replacement to the other occurrences
noted around lines 3311-3314).
---
Outside diff comments:
In `@manifests/00-custom-resource-definition.yaml`:
- Around line 2030-2035: The CRD currently has conflicting guidance for
minTLSVersion: the inline NOTE states the highest allowed is VersionTLS12 while
the enum for minTLSVersion still includes VersionTLS13; pick one consistent
intent and update the schema and doc comment accordingly — either remove
VersionTLS13 from the enum (so minTLSVersion enum only lists VersionTLS10,
VersionTLS11, VersionTLS12) or change the note to allow VersionTLS13, and apply
the same change to the other identical minTLSVersion block (the second
occurrence) so both the NOTE and the enum values for minTLSVersion
(VersionTLS10/11/12/13) are consistent.
In `@pkg/operator/controller/gatewayclass/controller.go`:
- Around line 107-135: Add MarketplaceEnabled and
OperatorLifecycleManagerEnabled boolean fields to the gatewayclass controller
Config and only register the OLM-related watches when both are true: wrap the
Subscription watch (predicate isServiceMeshSubscription and
reconciler.enqueueRequestForSomeGatewayClass()) and the InstallPlan watch
(predicates isOurInstallPlan and isInstallPlanReadyForApproval with
reconciler.enqueueRequestForSomeGatewayClass()) in a conditional that checks
cfg.MarketplaceEnabled && cfg.OperatorLifecycleManagerEnabled; leave all other
logic and predicates unchanged so watches are only set up when those
capabilities are present.
---
Nitpick comments:
In `@pkg/operator/controller/status/controller.go`:
- Around line 483-502: Currently the code always calls
r.subscriptionCache.List(...) and scans all Subscriptions even when Gateway API
isn't present; change the logic to first list GatewayClass (using r.cache.List
with operatorcontroller.GatewayClassIndexFieldName /
OpenShiftGatewayClassControllerName) and set state.shouldInstallOSSM, and only
if state.shouldInstallOSSM is true then call r.subscriptionCache.List(...) to
populate state.ossmSubscriptions (filtering by
ossmSubscriptions.Has(subscription.Spec.Package)); keep assignment of
state.expectedGatewayAPIOperatorVersion as before.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 7bda3637-d05d-4377-aae9-d20ece296358
⛔ Files ignored due to path filters (274)
go.sumis excluded by!**/*.sumvendor/cloud.google.com/go/compute/metadata/CHANGES.mdis excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/retry.gois excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/.deepsource.tomlis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/FUNDING.jsonis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/README.mdis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/doc.gois excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/map.gois excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/merge.gois excluded by!**/vendor/**,!vendor/**vendor/dario.cat/mergo/mergo.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/constants.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/csi_entry_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/csi_param_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/escape_intermediate_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/escape_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/event_handler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/ground_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/osc_string_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/parser_action_helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/parser_actions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/states.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/utilities.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/ansi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/api.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/attr_translation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/cursor_helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/erase_helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/scroll_helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/utilities.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/win_event_handler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/COPYINGis excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/decode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/deprecated.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/internal/tz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/lex.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/meta.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/parse.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/type_fields.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/BurntSushi/toml/type_toml.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/MakeNowJust/heredoc/heredoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/appveyor.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/cryptorandomstringutils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/randomstringutils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/stringutils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/goutils/wordutils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/collection.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/constraints.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/semver/v3/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/crypto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/date.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/defaults.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/dict.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/functions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/list.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/network.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/numeric.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/reflect.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/regex.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/semver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/strings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/sprig/v3/url.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/case.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/delete.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/delete_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/expr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/insert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/insert_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/part.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/placeholder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/row.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/select.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/select_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/squirrel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/squirrel_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/statement.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/stmtcacher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/stmtcacher_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/stmtcacher_noctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/update.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/update_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/Masterminds/squirrel/where.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/fs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/fs_json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/fs_os.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/fs_zip.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/gettext.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/locale.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/mo/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/mo/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/mo/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/mo/header.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/mo/message.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/mo/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/plural/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/plural/formula.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/plural/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/comment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/header.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/line_reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/message.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/re.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/po/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/tr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/chai2010/gettext-go/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cncf/xds/go/xds/data/orca/v3/orca_load_report.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/cncf/xds/go/xds/data/orca/v3/orca_load_report.pb.validate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cncf/xds/go/xds/service/orca/v3/orca.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/cncf/xds/go/xds/service/orca/v3/orca.pb.validate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cncf/xds/go/xds/service/orca/v3/orca_grpc.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/NOTICEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/archive/compression/compression.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/archive/compression/compression_fuzzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/content/adaptor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/content/content.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/content/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/errdefs/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/errdefs/grpc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/filters/adaptor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/filters/filter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/filters/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/filters/quote.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/filters/scanner.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/annotations.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/diffid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/handlers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/image.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/importexport.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/labels.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/images/mediatypes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/labels/labels.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/labels/validate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/pkg/randutil/randutil.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/remotes/handlers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/containerd/remotes/resolver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/errdefs/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/errdefs/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/errdefs/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/errdefs/resolve.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/log/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/log/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/log/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/log/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/compare.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/cpuinfo.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/cpuinfo_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/cpuinfo_other.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/database.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/defaults.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/defaults_darwin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/defaults_freebsd.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/defaults_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/defaults_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/platform_compat_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/platforms.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/platforms_other.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/containerd/platforms/platforms_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/VERSIONis excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/gocompat_errors_go120.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/gocompat_errors_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/gocompat_generics_go121.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/gocompat_generics_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/join.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/lookup_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/mkdir_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/open_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/openat2_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/openat_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/procfs_linux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cyphar/filepath-securejoin/vfs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/envoyproxy/protoc-gen-validate/validate/BUILDis excluded by!**/vendor/**,!vendor/**vendor/github.com/evanphx/json-patch/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/evanphx/json-patch/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/evanphx/json-patch/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/evanphx/json-patch/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/evanphx/json-patch/merge.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/evanphx/json-patch/patch.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/decoder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/path.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/exponent-io/jsonpath/pathaction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/LICENSE.MITis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/error_1_13.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/error_backward.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/join_unwrap_1_20.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/join_unwrap_backward.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/parse_panic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/stackframe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/column.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/db.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect_mysql.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect_oracle.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect_postgres.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect_snowflake.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect_sqlite.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/dialect_sqlserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/gorp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/hooks.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/index.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/lockerror.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/logging.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/nulltypes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/select.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-gorp/gorp/v3/table.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (26)
go.modhack/update-generated-crd.shhack/verify-generated-crd.shmanifests/00-cluster-role-sail-library.yamlmanifests/00-cluster-role.yamlmanifests/00-custom-resource-definition-internal-CustomNoUpgrade.yamlmanifests/00-custom-resource-definition-internal-DevPreviewNoUpgrade.yamlmanifests/00-custom-resource-definition-internal-OKD.yamlmanifests/00-custom-resource-definition-internal-TechPreviewNoUpgrade.yamlmanifests/00-custom-resource-definition-internal.yamlmanifests/00-custom-resource-definition.yamlmanifests/01-cluster-role-binding-sail-library.yamlpkg/operator/controller/gatewayapi/controller.gopkg/operator/controller/gatewayclass/controller.gopkg/operator/controller/gatewayclass/controller_test.gopkg/operator/controller/gatewayclass/istio.gopkg/operator/controller/gatewayclass/istio_sail_installer.gopkg/operator/controller/gatewayclass/istio_sail_installer_test.gopkg/operator/controller/gatewayclass/migration.gopkg/operator/controller/gatewayclass/status.gopkg/operator/controller/status/controller.gopkg/operator/controller/status/controller_test.gopkg/operator/controller/test/util/fake.gopkg/operator/operator.gotest/e2e/gateway_api_test.gotest/e2e/util_gatewayapi_test.go
💤 Files with no reviewable changes (12)
- manifests/01-cluster-role-binding-sail-library.yaml
- manifests/00-custom-resource-definition-internal-CustomNoUpgrade.yaml
- pkg/operator/controller/test/util/fake.go
- manifests/00-cluster-role.yaml
- manifests/00-custom-resource-definition-internal-TechPreviewNoUpgrade.yaml
- manifests/00-cluster-role-sail-library.yaml
- manifests/00-custom-resource-definition-internal-DevPreviewNoUpgrade.yaml
- pkg/operator/controller/gatewayclass/migration.go
- pkg/operator/controller/gatewayclass/istio_sail_installer_test.go
- manifests/00-custom-resource-definition-internal-OKD.yaml
- pkg/operator/controller/gatewayclass/istio_sail_installer.go
- pkg/operator/controller/gatewayclass/status.go
| golang.org/x/time v0.12.0 | ||
| google.golang.org/api v0.126.0 | ||
| google.golang.org/grpc v1.79.1 | ||
| google.golang.org/grpc v1.75.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python <<'PY'
import json
import pathlib
import re
import urllib.request
text = pathlib.Path("go.mod").read_text()
match = re.search(r'^\s*google\.golang\.org/grpc\s+v([^\s]+)', text, re.M)
if not match:
raise SystemExit("google.golang.org/grpc not found in go.mod")
version = match.group(1)
payload = json.dumps({
"package": {"ecosystem": "Go", "name": "google.golang.org/grpc"},
"version": version,
}).encode()
req = urllib.request.Request(
"https://api.osv.dev/v1/query",
data=payload,
headers={"Content-Type": "application/json"},
)
with urllib.request.urlopen(req, timeout=20) as resp:
data = json.load(resp)
print(f"google.golang.org/grpc in go.mod: {version}")
for vuln in data.get("vulns", []):
print(vuln.get("id"), vuln.get("aliases", []), vuln.get("summary"))
if not data.get("vulns"):
print("No OSV vulnerabilities returned for this version.")
PYRepository: openshift/cluster-ingress-operator
Length of output: 2660
🏁 Script executed:
cat go.mod | grep -A 2 -B 2 "google.golang.org/grpc"Repository: openshift/cluster-ingress-operator
Length of output: 222
🌐 Web query:
GHSA-p77j-4mvh-x3m3 google.golang.org/grpc vulnerability
💡 Result:
GHSA-p77j-4mvh-x3m3 (CVE-2026-33186) — google.golang.org/grpc (gRPC-Go) is a critical authorization bypass caused by improper validation of the HTTP/2 :path pseudo-header. A gRPC-Go server could accept a non-canonical path missing the required leading slash (e.g., Service/Method instead of /Service/Method), route it successfully, but have path-based authorization interceptors (including google.golang.org/grpc/authz) evaluate the raw non-canonical string—so deny rules for canonical paths may not match, enabling bypass when a fallback allow rule exists. Exploitation requires an attacker able to send raw HTTP/2 frames with malformed :path. [1][2]
- Affected:
google.golang.org/grpc< 1.79.3 [1] - Fixed in: 1.79.3 (and newer) [1][2]
- Recommended action: upgrade to v1.79.3+. If you can’t upgrade immediately, mitigate by adding an outermost interceptor that rejects methods whose
info.FullMethoddoesn’t start with/, and/or enforce strict HTTP/2 pseudo-header validation/normalization at a proxy/load balancer; consider “default deny” policies. [1][2]
Sources: GitHub Advisory Database entry for GHSA-p77j-4mvh-x3m3 [1], OSV entry (GHSA-p77j-4mvh-x3m3) [2].
Upgrade google.golang.org/grpc to v1.79.3 or later to fix GHSA-p77j-4mvh-x3m3.
Line 37 pins google.golang.org/grpc to v1.75.1, which is vulnerable to GHSA-p77j-4mvh-x3m3—a critical authorization bypass where improperly validated HTTP/2 :path pseudo-headers (missing leading slash) can bypass path-based authorization interceptors, including google.golang.org/grpc/authz. Affected versions are < 1.79.3. Upgrade before merging.
🧰 Tools
🪛 OSV Scanner (2.3.3)
[CRITICAL] 37-37: google.golang.org/grpc 1.75.1: gRPC-Go has an authorization bypass via missing leading slash in :path
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 37, Update the pinned grpc module in go.mod: replace the
existing google.golang.org/grpc v1.75.1 entry with v1.79.3 (or a later patch) to
address GHSA-p77j-4mvh-x3m3, then refresh module files so the updated version is
reflected (update dependencies and lockfile/go.sum) and verify the project
builds/tests pass; the change targets the google.golang.org/grpc version line
currently set to v1.75.1.
Comment on lines
+2014
to
+2017
| do not support. For example, to use DES-CBC3-SHA (yaml): | ||
|
|
||
| ciphers: | ||
| - ECDHE-RSA-AES128-GCM-SHA256 | ||
|
|
||
| TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable | ||
| and are always enabled when TLS 1.3 is negotiated. | ||
| - DES-CBC3-SHA |
There was a problem hiding this comment.
Security docs regression: example now highlights weak 3DES cipher
Changing the example cipher to DES-CBC3-SHA in the generic ciphers descriptions promotes a legacy weak choice. Even as an example, this can drive insecure configurations.
Use a modern example cipher (for example, ECDHE-...-AESGCM/CHACHA20) and keep legacy suites only in explicitly compatibility-focused sections.
Also applies to: 3311-3314
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@manifests/00-custom-resource-definition.yaml` around lines 2014 - 2017, The
example under the ciphers list uses the weak legacy cipher "DES-CBC3-SHA";
update the example to a modern, secure suite (e.g., an ECDHE-AES-GCM or
CHACHA20-based cipher) wherever the generic "ciphers" example appears (refer to
the ciphers key/example and the specific example value "DES-CBC3-SHA"), and
ensure legacy suites are only shown in explicit compatibility sections (also
apply the same replacement to the other occurrences noted around lines
3311-3314).
Member
Author
|
Looks like openshift/origin#39896 makes the tests work, but didn't make the cut in the nightly. Next one should have it |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This reverts #1354 and the dependent #1383.
This PR is causing blocking job failures (aws-ovn-techpreview, aws-ovn-techpreview-serial-3of3) in the nightly amd64 payload 4.22.0-0.nightly-2026-03-20-053450.
JIRA: https://issues.redhat.com/browse/TRT-2586
Failing Jobs
Why?
PR #1354 replaced the OLM-based Istio install with Sail Library. The GatewayAPIController no longer creates the servicemeshoperator3 OLM Subscription, causing all GatewayAPI TechPreview tests to fail. PR #1383 was also reverted as it depended on changes from #1354.
cc @gcs278 @rikatz
To unrevert, please revert this PR and include a fix for the issue.
/label trt-revert
Opened by Revertomatic.