Skip to content

feat(pki-operator): enable configurable PKI for cert rotation #8203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sanchezl wants to merge 2 commits into from
Closed

feat(pki-operator): enable configurable PKI for cert rotation #8203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
707de8f
build(vendor): bump library-go, api, client-go for configurable PKI s…
sanchezl Apr 11, 2026
8b4cfa2
feat(pki-operator): set CertificateName for configurable PKI support
sanchezl Apr 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
62 changes: 34 additions & 28 deletions api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
module github.com/openshift/hypershift/api

go 1.25.3
go 1.25.6

require (
github.com/aws/karpenter-provider-aws v1.8.6
github.com/openshift/api v0.0.0-20260304122341-cf5d8996109f
k8s.io/api v0.34.3
k8s.io/apimachinery v0.34.3
github.com/openshift/api v0.0.0-20260408160412-464776f95207
k8s.io/api v0.35.1
k8s.io/apimachinery v0.35.1
Comment on lines +8 to +9

@coderabbitai coderabbitai Bot Apr 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Kubernetes module versions in api/go.mod:"
rg -n '^\s*k8s\.io/(api|apimachinery|apiextensions-apiserver|client-go|cloud-provider|component-base|component-helpers|csi-translation-lib)\s+v' api/go.mod

echo
python - <<'PY'
import re
mods = {}
pat = re.compile(r'^\s*(k8s\.io/(?:api|apimachinery|apiextensions-apiserver|client-go|cloud-provider|component-base|component-helpers|csi-translation-lib))\s+v(\d+\.\d+\.\d+)')
with open("api/go.mod", "r", encoding="utf-8") as f:
    for line in f:
        m = pat.match(line)
        if m:
            mods[m.group(1)] = m.group(2)

print("Resolved versions:")
for k in sorted(mods):
    print(f"  {k}: {mods[k]}")

unique = sorted(set(mods.values()))
print(f"\nUnique versions detected: {unique}")
if len(unique) > 1:
    print("RESULT: mixed patch versions detected (verification failed)")
else:
    print("RESULT: single patch version across selected k8s modules (verification passed)")
PY

Repository: openshift/hypershift

Length of output: 829

Align Kubernetes staging modules to a single patch version.

Lines 8–9 specify k8s.io/api and k8s.io/apimachinery at v0.35.1, but lines 86, 88, and 89 pin k8s.io/cloud-provider, k8s.io/component-helpers, and k8s.io/csi-translation-lib to v0.35.0. Mixing patch versions across tightly-coupled k8s.io/* staging modules risks subtle compatibility issues and dependency resolver churn. Consolidate to a single patch version across all Kubernetes modules unless there is a documented upstream constraint.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@api/go.mod` around lines 8 - 9, The Kubernetes staging modules are pinned to
mixed patch versions; update the module version pins so all k8s.io/* entries use
the same patch (e.g., set k8s.io/cloud-provider, k8s.io/component-helpers, and
k8s.io/csi-translation-lib to v0.35.1 to match k8s.io/api and
k8s.io/apimachinery) and then run dependency cleanup (go mod tidy) to ensure the
go.mod/go.sum reflect the unified version; target the single patch line items:
k8s.io/api, k8s.io/apimachinery, k8s.io/cloud-provider,
k8s.io/component-helpers, k8s.io/csi-translation-lib.

k8s.io/utils v0.0.0-20260108192941-914a6e750570
)

Expand All @@ -19,44 +19,51 @@ require (
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
github.com/aws/smithy-go v1.24.2 // indirect
github.com/awslabs/operatorpkg v0.0.0-20250909182303-e8e550b6f339 // indirect
github.com/awslabs/operatorpkg v0.0.0-20251222193911-34e9a1898737 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/jsonpointer v0.21.1 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/swag v0.23.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.22.4 // indirect
github.com/go-openapi/jsonreference v0.21.4 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/gnostic-models v0.7.1 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.9.0 // indirect
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/onsi/ginkgo/v2 v2.28.1 // indirect
github.com/onsi/gomega v1.39.1 // indirect
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/samber/lo v1.51.0 // indirect
github.com/samber/lo v1.52.0 // indirect
github.com/spf13/cobra v1.10.2 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/x448/float16 v0.8.4 // indirect
Expand All @@ -74,26 +81,25 @@ require (
golang.org/x/tools v0.42.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.34.3 // indirect
k8s.io/client-go v0.34.3 // indirect
k8s.io/cloud-provider v0.34.1 // indirect
k8s.io/component-base v0.34.3 // indirect
k8s.io/component-helpers v0.34.2 // indirect
k8s.io/csi-translation-lib v0.34.1 // indirect
k8s.io/apiextensions-apiserver v0.35.1 // indirect
k8s.io/client-go v0.35.1 // indirect
k8s.io/cloud-provider v0.35.0 // indirect
k8s.io/component-base v0.35.1 // indirect
k8s.io/component-helpers v0.35.0 // indirect
k8s.io/csi-translation-lib v0.35.0 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect
sigs.k8s.io/controller-runtime v0.22.4 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/karpenter v1.8.2 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)

// Use our openshift version of karpenter instead of upstream
replace github.com/aws/karpenter-provider-aws => github.com/openshift/aws-karpenter-provider-aws v0.0.0-20260207025257-2e871ee4d207

replace sigs.k8s.io/karpenter => github.com/openshift/kubernetes-sigs-karpenter v0.0.0-20260206012902-048debf98313
replace sigs.k8s.io/karpenter => github.com/openshift/kubernetes-sigs-karpenter v0.0.0-20260310165629-67e201b559d5
Loading
Loading