OCPBUGS-89360: NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images by yiraeChristineKim · Pull Request #8601 · openshift/hypershift

yiraeChristineKim · 2026-05-27T14:17:20Z

What this PR does / why we need it:

Remove the QE-only non-CGO hypershift CLI from production operator images built via Containerfile.operator and Dockerfile. The non-FIPS hypershift-no-cgo binary causes Enterprise Contract FIPS violations in Konflux builds for MCE.
The FIPS-compliant hypershift binary (CGO_ENABLED=1) remains as the shipped CLI. Also remove the hypershift-no-cgo Makefile target and update the build-ho-image skill docs to match.

multicluster-engine-hypershift-operator,/usr/bin/hcp,go binary is not CGO_ENABLED
  multicluster-engine-hypershift-operator,/usr/bin/hypershift-no-cgo,go binary does not contain required symbol(s)
  multicluster-engine-managedcluster-import-controller-container,/etc/redhat-release,operating system is not FIPS certified

Conversation
Ref: https://redhat-internal.slack.com/archives/C058TF9K37Z/p1779803011756959

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

Summary by CodeRabbit

Chores
- Optimized operator container image by streamlining build artifacts and removing unnecessary binaries from the final runtime image.

openshift-merge-bot · 2026-05-27T14:17:24Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci · 2026-05-27T14:17:33Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-05-27T14:17:41Z

📝 Walkthrough

Walkthrough

This PR modifies Containerfile.operator to remove unused binaries from the container build pipeline. The builder stage no longer invokes make hypershift-no-cgo and make product-cli; the runtime stage no longer copies hypershift-no-cgo and hcp binaries into the final image. The image continues to include and run hypershift, hypershift-operator, and karpenter-operator with the same entrypoint and labels.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Stable And Deterministic Test Names	❌ Error	Test name in test/envtest/generator.go uses fmt.Sprintf with dynamic featureSet parameter, violating deterministic test name requirement.	Replace fmt.Sprintf with static string: change It(fmt.Sprintf("should install all CRDs for feature set %q", featureSet), ...) to use a static description without the dynamic featureSet variable.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Structure And Quality	✅ Passed	PR contains no Ginkgo test code modifications; it only updates Containerfile.operator to remove hypershift-no-cgo from container builds, making this check not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only modifies Containerfile.operator build steps and binaries; no deployment manifests, operator code, controllers, or scheduling constraints are changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR modifies Containerfile.operator and adds test/e2e/assets.go (non-test asset file). No new Ginkgo e2e tests are added, so IPv6/disconnected network check is not applicable.
No-Weak-Crypto	✅ Passed	Containerfile.operator contains no cryptographic code, MD5/SHA1/DES/RC4/3DES/Blowfish/ECB usage, custom crypto, or secret comparison. PR removes non-FIPS binaries.
Container-Privileges	✅ Passed	PR `#8601` modifies only Containerfile.operator to remove non-CGO binaries; no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation configurations are added.
No-Sensitive-Data-In-Logs	✅ Passed	No logging exposing sensitive data added. PR removes build targets and binaries from Containerfile.operator with no new logging statements.
Title check	✅ Passed	The title clearly and specifically describes the main change: removing hypershift-no-cgo from operator container images. It is concise, uses standard PR conventions (NO-JIRA prefix and conventional commit format), and directly reflects the primary change in the changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-05-27T14:26:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.54%. Comparing base (2f52041) to head (5b2e110).
⚠️ Report is 180 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8601      +/-   ##
==========================================
+ Coverage   40.61%   41.54%   +0.93%     
==========================================
  Files         755      758       +3     
  Lines       93227    93838     +611     
==========================================
+ Hits        37864    38986    +1122     
+ Misses      52640    52107     -533     
- Partials     2723     2745      +22

see 66 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	`34.96% <ø> (+0.25%)`	⬆️
cpo-hostedcontrolplane	`43.59% <ø> (+1.82%)`	⬆️
cpo-other	`43.17% <ø> (+2.10%)`	⬆️
hypershift-operator	`51.62% <ø> (+0.86%)`	⬆️
other	`31.56% <ø> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

yiraeChristineKim · 2026-05-27T14:26:19Z

/pipeline required

openshift-merge-bot · 2026-05-27T14:26:23Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

yiraeChristineKim · 2026-05-27T14:39:30Z

/test all

cwbotbot · 2026-05-27T14:55:03Z

Test Results

e2e-aws

Status: ❌ FAIL
Started: 2026-05-27T14:28:00Z
View Job
View Job History

e2e-aks

Status: ❌ FAIL
Started: 2026-05-27T14:28:00Z
View Job
View Job History

yiraeChristineKim · 2026-05-27T15:32:37Z

/test all

yiraeChristineKim · 2026-05-27T15:33:43Z

/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

yiraeChristineKim · 2026-05-27T16:35:18Z

/test images

mgencur · 2026-06-04T13:23:16Z

 RUN make hypershift \
-  && make hypershift-no-cgo \
  && make hypershift-operator \
-  && make product-cli \


Why removing product-cli? Are we supposed to remove only hypershift-no-cgo ?

We build product-cli using https://github.com/openshift/hypershift/blob/main/Containerfile.cli

I'm sorry but I don't understand. Can you shed more light on this? The fact that you build product-cli using that container file doesn't explain to me why you're removing make product-cli.

I mean. This looks like completely unrelated to hypershift-no-cgo. I don't see any relation. So maybe this should be sent as a separate PR with a better description?

@mgencur Removing the product-cli seems unrelated but this PR is about removing non-FIPS compliant binaries that are not necessary to run the hypershift operator from the container image and the product-cli is another non-FIPS compliant binary. We deliver the product-cli in a separate CLI download container image and make it available from the cluster for users to download and use.

mgencur · 2026-06-04T13:23:30Z

 FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961
 COPY --from=builder /hypershift/bin/hypershift \
-  /hypershift/bin/hypershift-no-cgo \
-  /hypershift/bin/hcp \


Why remove hcp ? Are we supposed to remove only hypershift-no-cgo ?

We build product-cli using https://github.com/openshift/hypershift/blob/main/Containerfile.cli

mgencur · 2026-06-04T13:24:06Z

 RUN make hypershift \
-  && make hypershift-no-cgo \
  && make hypershift-operator \
-  && make product-cli \


Why product-cli ? Are we supposed to remove only hypershift-no-cgo ?

We build product-cli using https://github.com/openshift/hypershift/blob/main/Containerfile.cli

mgencur · 2026-06-04T13:24:18Z


 FROM registry.access.redhat.com/ubi9:latest
 COPY --from=builder /hypershift/bin/hypershift \
-                    /hypershift/bin/hcp \


Are we supposed to remove only hypershift-no-cgo ?

We build product-cli using https://github.com/openshift/hypershift/blob/main/Containerfile.cli

mgencur · 2026-06-04T13:24:24Z

 FROM registry.access.redhat.com/ubi9:latest
 COPY --from=builder /hypershift/bin/hypershift \
-                    /hypershift/bin/hypershift-no-cgo \
-                    /hypershift/bin/hcp \


Are we supposed to remove only hypershift-no-cgo ?

We build product-cli using https://github.com/openshift/hypershift/blob/main/Containerfile.cli

See my comment #8601 (comment)

csrwng · 2026-06-04T18:27:12Z

@yiraeChristineKim @rokej do we need to remove the statically compiled binary from all images? My understanding is that we'd only need to do it for the Containerfile(s) built in konflux.

yiraeChristineKim · 2026-06-04T18:31:17Z

@yiraeChristineKim @rokej do we need to remove the statically compiled binary from all images? My understanding is that we'd only need to do it for the Containerfile(s) built in konflux.

We are only using the CLI binary built from Containerfile.cli. Are you using a CLI binary built from any container file other than Containerfile.cli?

rokej · 2026-06-04T18:44:03Z

@csrwng I missed it. Yes, the binaries should be removed only from the konflux container file which is Containerfile.operator only. cc @yiraeChristineKim

Remove the hypershift-no-cgo statically compiled binary and the hcp product CLI from Containerfile.operator, as these are only required in the Konflux build pipeline and not in the operator image itself. Non-Konflux Dockerfiles (Dockerfile, Dockerfile.dev) are unchanged and continue to include hypershift-no-cgo and hcp. Signed-off-by: yiraeChristineKim <yikim@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Cursor <cursoragent@cursor.com>

yiraeChristineKim · 2026-06-10T13:20:06Z

@rokej @csrwng Can you review this again

yiraeChristineKim · 2026-06-17T14:20:46Z

/cherrypick release-4.22

yiraeChristineKim · 2026-06-17T14:20:57Z

/cherrypick release-4.21

yiraeChristineKim · 2026-06-17T14:21:10Z

/cherrypick release-4.20

yiraeChristineKim · 2026-06-17T14:21:28Z

/cherrypick release-4.19

openshift-cherrypick-robot · 2026-06-17T14:21:36Z

@yiraeChristineKim: #8601 failed to apply on top of branch "release-4.22":

Patch is empty.
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To record the empty patch as an empty commit, run "git am --allow-empty".
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

Details

In response to this:

/cherrypick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:21:54Z

@yiraeChristineKim: new pull request created: #8753

Details

In response to this:

/cherrypick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:21:58Z

@yiraeChristineKim: #8601 failed to apply on top of branch "release-4.20":

Patch is empty.
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To record the empty patch as an empty commit, run "git am --allow-empty".
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

Details

In response to this:

/cherrypick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:22:20Z

@yiraeChristineKim: #8601 failed to apply on top of branch "release-4.19":

Applying: build(operator): drop hypershift-no-cgo from operator container images
Using index info to reconstruct a base tree...
M	Containerfile.operator
Falling back to patching base and 3-way merge...
Auto-merging Containerfile.operator
CONFLICT (content): Merge conflict in Containerfile.operator
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

/cherrypick release-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

yiraeChristineKim · 2026-06-17T14:50:09Z

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

openshift-ci-robot · 2026-06-17T14:50:12Z

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

Details

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2026-06-17T14:50:59Z

@openshift-ci-robot: #8601 failed to apply on top of branch "release-4.16":

Applying: build(operator): drop hypershift-no-cgo from operator container images
Using index info to reconstruct a base tree...
M	Containerfile.operator
Falling back to patching base and 3-way merge...
Auto-merging Containerfile.operator
CONFLICT (content): Merge conflict in Containerfile.operator
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:51:43Z

@openshift-ci-robot: #8601 failed to apply on top of branch "release-4.17":

Applying: build(operator): drop hypershift-no-cgo from operator container images
Using index info to reconstruct a base tree...
M	Containerfile.operator
Falling back to patching base and 3-way merge...
Auto-merging Containerfile.operator
CONFLICT (content): Merge conflict in Containerfile.operator
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:52:28Z

@openshift-ci-robot: #8601 failed to apply on top of branch "release-4.18":

Applying: build(operator): drop hypershift-no-cgo from operator container images
Using index info to reconstruct a base tree...
M	Containerfile.operator
Falling back to patching base and 3-way merge...
Auto-merging Containerfile.operator
CONFLICT (content): Merge conflict in Containerfile.operator
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:53:12Z

@openshift-ci-robot: #8601 failed to apply on top of branch "release-4.19":

Applying: build(operator): drop hypershift-no-cgo from operator container images
Using index info to reconstruct a base tree...
M	Containerfile.operator
Falling back to patching base and 3-way merge...
Auto-merging Containerfile.operator
CONFLICT (content): Merge conflict in Containerfile.operator
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:53:57Z

@openshift-ci-robot: #8601 failed to apply on top of branch "release-4.20":

Applying: build(operator): drop hypershift-no-cgo from operator container images
Using index info to reconstruct a base tree...
M	Containerfile.operator
Falling back to patching base and 3-way merge...
Auto-merging Containerfile.operator
CONFLICT (content): Merge conflict in Containerfile.operator
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:54:43Z

@openshift-ci-robot: new pull request could not be created: failed to create pull request against openshift/hypershift#release-4.21 from head openshift-cherrypick-robot:cherry-pick-8601-to-release-4.21: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for openshift-cherrypick-robot:cherry-pick-8601-to-release-4.21."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request","status":"422"}

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-06-17T14:55:30Z

@openshift-ci-robot: new pull request created: #8755

Details

In response to this:

@yiraeChristineKim: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16

In response to this:

/jira backport release-4.22,release-4.21,release-4.20,release-4.19,release-4.18,release-4.17,release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

yiraeChristineKim · 2026-06-17T15:57:09Z

/jira cherrypick OCPBUGS-89338

openshift-ci-robot · 2026-06-17T15:58:18Z

@yiraeChristineKim: Jira Issue OCPBUGS-89338 has been cloned as Jira Issue OCPBUGS-89360. Will retitle bug to link to clone.
/retitle OCPBUGS-89360: NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images

Details

In response to this:

/jira cherrypick OCPBUGS-89338

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-06-17T15:58:43Z

@yiraeChristineKim: Jira Issue OCPBUGS-89360: All pull requests linked via external trackers have merged:

This pull request has the verified-later tag and will need to be manually moved to VERIFIED after testing. Jira Issue OCPBUGS-89360 has been moved to the MODIFIED state.

Details

In response to this:

What this PR does / why we need it:

Remove the QE-only non-CGO hypershift CLI from production operator images built via Containerfile.operator and Dockerfile. The non-FIPS hypershift-no-cgo binary causes Enterprise Contract FIPS violations in Konflux builds for MCE.
The FIPS-compliant hypershift binary (CGO_ENABLED=1) remains as the shipped CLI. Also remove the hypershift-no-cgo Makefile target and update the build-ho-image skill docs to match.
multicluster-engine-hypershift-operator,/usr/bin/hcp,go binary is not CGO_ENABLED
 multicluster-engine-hypershift-operator,/usr/bin/hypershift-no-cgo,go binary does not contain required symbol(s)
 multicluster-engine-managedcluster-import-controller-container,/etc/redhat-release,operating system is not FIPS certified
Conversation
Ref: https://redhat-internal.slack.com/archives/C058TF9K37Z/p1779803011756959

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Summary by CodeRabbit

Chores

Optimized operator container image by streamlining build artifacts and removing unnecessary binaries from the final runtime image.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 27, 2026

openshift-ci Bot added the do-not-merge/needs-area label May 27, 2026

openshift-ci Bot added area/ai Indicates the PR includes changes related to AI - Claude agents, Cursor rules, etc. and removed do-not-merge/needs-area labels May 27, 2026

yiraeChristineKim marked this pull request as ready for review May 27, 2026 14:25

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 27, 2026

openshift-ci Bot requested review from jparrill and muraee May 27, 2026 14:26

yiraeChristineKim force-pushed the mce-FIPS branch from a7008a0 to 9505671 Compare May 27, 2026 15:40

yiraeChristineKim force-pushed the mce-FIPS branch from 9505671 to c3e2327 Compare May 29, 2026 13:16

mgencur suggested changes Jun 4, 2026

View reviewed changes

openshift-ci Bot assigned mgencur Jun 4, 2026

yiraeChristineKim force-pushed the mce-FIPS branch from c3e2327 to 5b2e110 Compare June 10, 2026 13:19

yiraeChristineKim requested a review from mgencur June 10, 2026 13:21

openshift-cherrypick-robot mentioned this pull request Jun 17, 2026

[release-4.21] NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images #8753

Closed

openshift-cherrypick-robot mentioned this pull request Jun 17, 2026

[release-4.22] NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images #8755

Closed

openshift-ci Bot changed the title ~~NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images~~ OCPBUGS-89360: NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images Jun 17, 2026

hypershift-jira-solve-ci Bot mentioned this pull request Jun 21, 2026

OCPBUGS-86329: cpo: turn off cluster-api crdmigrator controller #8556

Closed

Uh oh!

Conversation

yiraeChristineKim commented May 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented May 27, 2026

Uh oh!

openshift-ci Bot commented May 27, 2026

Uh oh!

coderabbitai Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Pre-merge checks failed

❌ Failed checks (1 error)

Uh oh!

codecov Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

yiraeChristineKim commented May 27, 2026

Uh oh!

openshift-merge-bot Bot commented May 27, 2026

Uh oh!

yiraeChristineKim commented May 27, 2026

Uh oh!

cwbotbot commented May 27, 2026

Test Results

e2e-aws

e2e-aks

Uh oh!

yiraeChristineKim commented May 27, 2026

Uh oh!

yiraeChristineKim commented May 27, 2026

Uh oh!

yiraeChristineKim commented May 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

csrwng commented Jun 4, 2026

Uh oh!

yiraeChristineKim commented Jun 4, 2026

Uh oh!

rokej commented Jun 4, 2026

Uh oh!

yiraeChristineKim commented Jun 10, 2026

Uh oh!

yiraeChristineKim commented Jun 17, 2026

Uh oh!

yiraeChristineKim commented Jun 17, 2026

yiraeChristineKim commented May 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 27, 2026 •

edited

Loading

codecov Bot commented May 27, 2026 •

edited

Loading